joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4123e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp dword [0x49198c], 0
je 0x412402
cmp bx, 0x100
jb 0x412402
cmp bx, 0x7ff
jbe 0x412406
xor eax, eax
jmp 0x412408
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41248f
push 0x491990
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x412488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49198c]
call fcn.00405da0
movzx edi, bx
mov edx, edi
sub edx, 0x100
cmp eax, edx
setg byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x412470
mov eax, dword [0x49198c]
mov eax, dword [eax + edi*4 - 0x400]
mov dword [esi], eax
cmp dword [esi], 0
je 0x412467
mov eax, dword [esi]
cmp eax, dword [0x489a1c]
jne 0x41246b
xor eax, eax
jmp 0x41246d
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41248f
push 0x491990
call sub.KERNEL32.DLL_CreateThread
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41249c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412572
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x491990
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x412555
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49198c]
call fcn.00405da8
mov esi, eax
test esi, esi
jl 0x41253d
inc esi
xor edi, edi
mov eax, dword [0x49198c]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x412539
cmp ebx, dword [0x489a1c]
je 0x412539
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00403b54
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.00404dc0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00408d24
test al, al
je 0x412539
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov byte [ebp - 9], 1
jmp 0x41253d
inc edi
dec esi
jne 0x4124f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41255c
push 0x491990
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x4151e0
Capabilities:
Create thread

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x4161b8
Capabilities:
Create thread

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_CreateThread
ret
Function at 0x418cbc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x418cdf
add esp, 0xfffffff0
call fcn.00403f80
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x418e04
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x418d7c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, esi
call fcn.00404fec
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00418bb4
cmp dword [ebx + 4], 0
jge 0x418ddf
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00409958
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.KERNEL32.DLL_SetErrorMode
lea edx, [ebp - 0x1c]
call fcn.0040ca88
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x48c10c]
mov dl, 1
mov eax, dword [0x413220]
call fcn.0040d394
call fcn.004044d0
jmp 0x418ddf
movzx edx, di
mov eax, esi
call fcn.004094a8
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00418bb4
cmp dword [ebx + 4], 0
jge 0x418ddf
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.00409958
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.KERNEL32.DLL_SetErrorMode
lea edx, [ebp - 0x24]
call fcn.0040ca88
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x48bac0]
mov dl, 1
mov eax, dword [0x41327c]
call fcn.0040d394
call fcn.004044d0
lea eax, [ebx + 8]
mov edx, esi
call fcn.00404bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418e0b
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404b80
ret
Function at 0x41c83c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.KERNEL32.DLL_MoveFileA
mov edx, dword [0x48c110]
cmp eax, dword [edx]
je 0x41c87f
call sub.KERNEL32.DLL_MoveFileA
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x48bedc]
mov dl, 1
mov eax, dword [0x414498]
call fcn.0040d394
call fcn.004044d0
test ebx, ebx
jle 0x41c88c
mov eax, ebx
call fcn.0041c7fc
jmp 0x41c891
call fcn.0041c7f0
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4919cc
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x41ca01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x489adc
call sub.KERNEL32.DLL_InitializeCriticalSection
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41c9e2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x41c8dc
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41c8e0
xor eax, eax
jmp 0x41c8e2
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41c9cc
jmp 0x41c9bf
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415d8c
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415c80
push 0x4919cc
call sub.KERNEL32.DLL_CreateThread
xor eax, eax
push ebp
push 0x41c985
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41c946
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41c96d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c98c
push 0x4919cc
call sub.KERNEL32.DLL_GetFullPathNameA
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41c8f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c9e9
mov eax, dword [ebp - 0xc]
call fcn.00403c74
ret

Function at 0x41ccc8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
push 0x4919cc
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x41cd7a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x489adc], 0
je 0x41cd62
mov eax, dword [0x489adc]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x41cd62
mov edx, esi
mov eax, dword [0x489adc]
call fcn.00415d8c
mov ebx, eax
cmp dword [ebx + 8], 0
jne 0x41cd5c
test edi, edi
je 0x41cd1d
mov eax, dword [ebx]
cmp edi, dword [eax]
je 0x41cd38
cmp word [ebp + 0xa], 0
je 0x41cd5c
mov eax, dword [ebx]
mov eax, dword [eax + 8]
cmp eax, dword [ebp + 8]
jne 0x41cd5c
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x41cd5c
mov edx, esi
mov eax, dword [0x489adc]
call fcn.00415c80
mov eax, dword [ebx]
mov edx, 0x18
call fcn.00402eb8
mov edx, 0xc
mov eax, ebx
call fcn.00402eb8
dec esi
cmp esi, 0xffffffff
jne 0x41ccff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cd81
push 0x4919cc
call sub.KERNEL32.DLL_CreateThread
ret
Function at 0x41cd88
Capabilities:
Create thread
Get disk size
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_MoveFileA
mov edx, dword [0x48c110]
cmp eax, dword [edx]
jne 0x41cdb2
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x41cf1f
cmp byte [ebp - 5], 0
je 0x41cdc7
mov eax, 0xc
call fcn.00402e9c
mov dword [ebp - 0xc], eax
jmp 0x41cdcd
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
movzx ebx, byte [ebp - 5]
xor bl, 1
test bl, bl
je 0x41cded
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
jmp 0x41cdf5
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 8], edx
xor eax, eax
push ebp
push 0x41cefe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4919cc
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x41ced7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 5]
mov byte [eax + 4], dl
cmp dword [0x489adc], 0
jne 0x41ce3f
mov dl, 1
mov eax, dword [0x4136bc]
call fcn.00403c44
mov dword [0x489adc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [0x489adc]
call fcn.00415c34
call fcn.0041c818
cmp word [0x489aca], 0
je 0x41ce76
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
mov eax, dword [0x489acc]
call dword [0x489ac8]
test bl, bl
je 0x41cebf
push 0x4919cc
call sub.KERNEL32.DLL_CreateThread
xor eax, eax
push ebp
push 0x41ceb8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call sub.KERNEL32.DLL_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cebf
push 0x4919cc
call sub.KERNEL32.DLL_GetFullPathNameA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cede
push 0x4919cc
call sub.KERNEL32.DLL_CreateThread
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41cf7c
Capabilities:
Move file

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call sub.KERNEL32.DLL_MoveFileA
mov edx, dword [0x48c110]
cmp eax, dword [edx]
jne 0x41cff1
xor ebx, ebx
mov eax, dword [0x4919b4]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41cfbb
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_GetWindow
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call sub.user32.dll_GetMenuState
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041cc88
cmp ebx, 1
jne 0x41cfeb
xor eax, eax
call fcn.0041c83c
test ebx, ebx
jne 0x41cfa4
jmp 0x41cffd
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_Sleep
push esp
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041cc88
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x421554
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42155a
ret

Function at 0x4215d4
Capabilities:
Create thread

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x421e30
Capabilities:
Create thread

Disassembly:
mov edx, dword [eax + 0x14]
test edx, edx
je 0x421e3d
push edx
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x423000
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, eax
push 0x491a68
call sub.KERNEL32.DLL_GetFullPathNameA
inc dword [ebx + 0x50]
push 0x491a68
call sub.KERNEL32.DLL_CreateThread
lea eax, [ebx + 0x38]
push eax
call sub.KERNEL32.DLL_GetFullPathNameA
pop ebx
ret

Function at 0x423114
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 0x491a68
call sub.KERNEL32.DLL_GetFullPathNameA
xor eax, eax
push ebp
push 0x423160
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x50], 0
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x423148
mov eax, ebx
call fcn.00423000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423167
push 0x491a68
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x423170
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x38]
push eax
call sub.KERNEL32.DLL_CreateThread
push 0x491a68
call sub.KERNEL32.DLL_GetFullPathNameA
dec dword [ebx + 0x50]
push 0x491a68
call sub.KERNEL32.DLL_CreateThread
pop ebx
ret

Function at 0x4263b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4211e8]
call fcn.00403c44
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x426440
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov esi, eax
lea edi, [edx + 0x18]
mov ecx, 0x15
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
movzx edx, byte [ebp + 0xc]
mov byte [eax + 0x70], dl
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x426422
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x41402c]
call fcn.00403e24
mov edx, dword [ebp - 8]
mov dword [edx + 0x6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x426457
push 0x491a50
call sub.KERNEL32.DLL_GetFullPathNameA
xor edx, edx
push ebp
push 0x4264a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00424f20
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x28], eax
call fcn.00424f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4264a7
push 0x491a50
call sub.KERNEL32.DLL_CreateThread
ret

Function at 0x427a5c
Capabilities:
Create thread

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_CreateThread
ret
Function at 0x429c28
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x429ca7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.user32.dll_GetKeyboardLayout
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x429c91
cmp byte [ebx + 0x40], 0
je 0x429c91
cmp word [ebx + 0x3a], 0
je 0x429c91
push 0
push esi
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x429c91
lea edx, [ebp - 4]
mov eax, dword [0x48c0e0]
call fcn.00406b44
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x413600]
call fcn.0040d29c
call fcn.004044d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429cae
lea eax, [ebp - 4]
call fcn.00404b5c
ret
Function at 0x42eae4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov dword [ebp - 0x154], 0x154
push 0
lea eax, [ebp - 0x154]
push eax
push 0
push 0x29
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x42eb29
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xbc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x435484
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
call fcn.004358cc
mov esi, eax
mov dword [ebp - 0x14], esi
push 4
push esi
call sub.user32.dll_DispatchMessageA
mov edx, dword [0x48bee0]
mov edx, dword [edx]
cmp eax, dword [edx + 0x30]
je 0x4354df
mov eax, dword [ebp - 0x14]
call fcn.0043490c
mov esi, eax
test esi, esi
je 0x435612
jmp 0x4354ce
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4354cc
mov eax, esi
call fcn.0043fd20
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x435612
mov esi, ebx
jmp 0x4354ef
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4354ed
mov eax, esi
call fcn.0043fd20
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, dword [ebp - 0x14]
je 0x435612
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x435534
mov edx, dword [ebp + 8]
mov esi, eax
jmp 0x435521
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x43551f
mov eax, esi
call fcn.0043fd20
mov dword [ebp - 0x1c], eax
jmp 0x43555e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [0x433e78]
call fcn.00403e00
test al, al
je 0x435559
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0043fd20
mov dword [ebp - 0x1c], eax
jmp 0x43555e
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 9]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 5]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x1c]
push eax
push 0x435418
call sub.KERNEL32.DLL_MoveFileA
push eax
call fcn.004073ec
cmp byte [ebp - 8], 0
je 0x435612
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_FillRect
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
push eax
mov eax, dword [ebp + 8]
dec eax
push eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, ebx
mov si, 0xffbc
call fcn.00403e70
mov eax, dword [0x491c20]
mov edx, dword [0x43262c]
call fcn.00403e00
test al, al
je 0x4355f9
mov eax, dword [0x491c20]
mov eax, dword [eax + 0x40]
cmp dword [eax + 0x94], 0
je 0x4355f9
mov eax, dword [0x491c20]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x94]
call fcn.0043fd20
cmp eax, dword [ebp - 0x14]
je 0x435612
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetClassLongA
test eax, eax
je 0x435612
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435664
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x491c44], 0
je 0x4357ad
push 0x11
call sub.user32.dll_CheckMenuItem
test ax, 0x8000
setne al
mov edx, dword [0x48bee0]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4357ad
mov eax, dword [0x491c48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x491c44]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43577c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x491c44]
call fcn.00415d8c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x435774
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x435774
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x435774
mov eax, dword [ebp - 0x14]
call fcn.0043fd20
push eax
call sub.user32.dll_GetKeyNameTextA
test eax, eax
je 0x435774
push ebp
call fcn.00435620
pop ecx
test al, al
jne 0x435774
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403e70
test al, al
je 0x435774
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403e70
cmp byte [ebp - 1], 0
je 0x435774
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_GetScrollPos
test eax, eax
je 0x435774
mov edx, dword [ebp - 0x14]
mov eax, dword [0x491c48]
call fcn.00434d90
inc edi
dec ebx
jne 0x4356c9
mov eax, dword [0x491c48]
cmp dword [eax + 8], 0
jle 0x435794
mov eax, dword [0x491c48]
call fcn.00434e48
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4357ad
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00435484
pop ecx
test al, al
jne 0x4357ad
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43be18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43bf36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x8c
call fcn.00403594
mov eax, dword [esi + 0x64]
mov dword [ebx], eax
mov dword [ebx + 4], 0x44000000
lea edx, [ebx + 8]
mov eax, esi
call fcn.0043bdb0
test byte [esi + 0x50], 1
je 0x43be73
or dword [ebx + 4], 0x2000000
or dword [ebx + 8], 0x10000
test byte [esi + 0x1c], 0x10
jne 0x43be8b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
jne 0x43be8b
or dword [ebx + 4], 0x8000000
cmp byte [esi + 0x1d8], 0
je 0x43be9b
or dword [ebx + 4], 0x10000
mov eax, dword [esi + 0x40]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x18], eax
mov edi, dword [esi + 0x30]
test edi, edi
je 0x43bec6
mov eax, edi
call fcn.0043fd20
mov dword [ebx + 0x1c], eax
jmp 0x43becf
mov eax, dword [esi + 0x1c4]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], 0xb
mov eax, fcn.00407354
mov dword [ebx + 0x28], eax
push 0x7f00
push 0
call sub.user32.dll_GetKeyboardLayoutNameA
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x40], eax
mov eax, dword [0x48f7f4]
mov dword [ebx + 0x34], eax
lea edx, [ebp - 0x104]
mov eax, dword [esi]
call fcn.00403b54
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00404dc0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x4c]
call fcn.00409ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bf3d
lea eax, [ebp - 4]
call fcn.00404b5c
ret

Function at 0x43f8cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
mov ebx, dword [edi + 0x1b4]
test ebx, ebx
je 0x43f8f0
push ebx
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jne 0x43f8f4
xor eax, eax
jmp 0x43f8f6
mov al, 1
mov byte [esp + 8], al
cmp byte [esp + 8], 0
je 0x43f91b
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edi + 0x1b4]
push eax
call sub.user32.dll_GetWindowLongW
mov eax, edi
call fcn.0043bcf8
mov esi, eax
dec esi
test esi, esi
jl 0x43f995
inc esi
xor ebp, ebp
mov edx, ebp
mov eax, edi
call fcn.0043bcbc
mov ebx, eax
mov eax, ebx
mov edx, dword [0x433e78]
call fcn.00403e00
test al, al
je 0x43f951
cmp dword [ebx + 0x1b4], 0
jne 0x43f960
mov eax, dword [esp]
add dword [ebx + 0x40], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x44], eax
jmp 0x43f991
cmp byte [esp + 8], 0
jne 0x43f991
push 0x14
mov eax, ebx
mov edx, dword [eax + 0x4c]
push edx
mov edx, dword [eax + 0x48]
push edx
mov edx, dword [eax + 0x44]
add edx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 0x40]
add edx, dword [esp + 0x10]
push edx
push 0
mov eax, dword [eax + 0x1b4]
push eax
call sub.user32.dll_LoadBitmapA
inc ebp
dec esi
jne 0x43f92c
mov eax, edi
call fcn.0043b83c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret