joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b004
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x40b00d
mov eax, dword [ebp - 4]
add esp, 0xfffffb54
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0x52cde0
call fcn.0049b3b8
mov word [ebp - 0x18], 8
xor edx, edx
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
mov word [ebp - 0x18], 0x20
push 1
mov ecx, dword [ebp + 0x10]
push ecx
push 0x10
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.00403068
add esp, 0x14
push esi
call fcn.00403310
pop ecx
mov byte [ebp - 0x2d], 0
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
mov ebx, 1
mov eax, 1
lea ecx, [ebp - 0x80b0]
sub eax, ebx
mov ebx, eax
lea eax, [ebp - 0x84b0]
mov edx, ebx
add edx, edx
mov byte [ebp - 0x84b0], 0x45
push 1
lea edx, [edx + edx*4]
push 0
push edx
push 1
push ecx
push 1
push eax
push esi
call fcn.004036f8
add esp, 0x20
dec eax
jne 0x40b0c3
cmp byte [ebp - 0x80b0], 0x43
jne 0x40b0c3
mov byte [ebp - 0x2d], 1
jmp 0x40b0df
cmp byte [edi + 0x39], 0
jne 0x40b0df
call fcn.004a2ec0
sub eax, dword [ebp - 0x2c]
cmp eax, 0x320
jl 0x40b07a
mov ebx, 1
jmp 0x40b12b
cmp byte [ebp - 0x2d], 0
je 0x40b0e9
xor ebx, ebx
jmp 0x40b0fb
cmp byte [edi + 0x39], 0
je 0x40b0f6
mov ebx, 0x64
jmp 0x40b0fb
mov ebx, 0xc8
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x40b149
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b3ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x11
add esp, 0xfffff004
push eax
dec eax
jne 0x40b3f5
mov eax, dword [ebp - 4]
add esp, 0xfffffb50
push ebx
push esi
push edi
mov eax, 0x52ceb8
call fcn.0049b3b8
mov word [ebp - 0x18], 8
xor edx, edx
lea edi, [ebp - 0x12c]
mov dword [ebp - 4], edx
mov esi, 0x50269d
inc dword [ebp - 0xc]
mov ecx, 0x40
mov word [ebp - 0x18], 0x14
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x18], 0x20
push 0x52b516
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403510
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004036e0
mov eax, dword [ebp + 0xc]
pop ecx
lea edx, [ebp - 0x114b4]
xor ebx, ebx
mov byte [eax + 0x39], 0
push 0x10000
push 0
push edx
call fcn.0049af44
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x14b4]
mov byte [edx], 0x55
inc eax
inc edx
cmp eax, 0x1388
jl 0x40b487
push 1
lea ecx, [ebp - 0x14b4]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov esi, eax
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
jne 0x40b553
cmp edi, 0xe000
jle 0x40b4d0
xor edi, edi
push 1
push edi
lea eax, [ebp - 0x114b4]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov edi, eax
test edi, edi
jle 0x40b517
xor eax, eax
lea edx, [ebp - 0x114b4]
cmp edi, eax
jle 0x40b503
cmp byte [edx], 0xa0
je 0x40b503
inc eax
inc edx
cmp edi, eax
jg 0x40b4f8
cmp edi, eax
je 0x40b50b
mov bl, 1
jmp 0x40b553
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.004036e0
pop ecx
call fcn.004a2ec0
sub eax, dword [ebp - 0x2c]
cmp eax, 0xf
jle 0x40b541
push 1
lea edx, [ebp - 0x14b4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
call fcn.004a2ec0
sub eax, esi
cmp eax, 0x320
jle 0x40b4b9
test bl, bl
je 0x40b5f7
mov byte [ebp - 0x14b4], 0xff
lea eax, [ebp - 0x14b4]
push 1
push eax
xor ebx, ebx
mov edx, dword [ebp + 8]
push edx
call fcn.004035d4
add esp, 0xc
lea ecx, [ebp - 0x12c]
push 0x100
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
xor edi, edi
call fcn.004a2ec0
mov esi, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
jne 0x40b5f7
cmp edi, 0xe000
jle 0x40b5ad
xor edi, edi
push 0x64
push edi
lea eax, [ebp - 0x114b4]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov edi, eax
cmp edi, 1
jl 0x40b5e9
xor eax, eax
lea edx, [ebp - 0x114b4]
cmp edi, eax
jle 0x40b5e1
cmp byte [edx], 0xa5
je 0x40b5e1
inc eax
inc edx
cmp edi, eax
jg 0x40b5d6
cmp edi, eax
je 0x40b5e9
mov bl, 1
jmp 0x40b5f7
call fcn.004a2ec0
sub eax, esi
cmp eax, 0x320
jle 0x40b59a
test bl, bl
je 0x40b5ff
xor ebx, ebx
jmp 0x40b614
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
je 0x40b60f
mov ebx, 0xc8
jmp 0x40b614
mov ebx, 0x64
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x40b662
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b8f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x11
add esp, 0xfffff004
push eax
dec eax
jne 0x40b8f9
mov eax, dword [ebp - 4]
add esp, 0xfffffc48
push ebx
push esi
push edi
mov eax, 0x52cf90
call fcn.0049b3b8
mov word [ebp - 0x18], 8
xor edx, edx
mov cx, word [0x5028a0]
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
mov word [ebp - 0x34], cx
mov cl, byte [0x5028a2]
mov byte [ebp - 0x32], cl
mov word [ebp - 0x18], 0x20
push 0x52b530
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403510
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004036e0
pop ecx
lea edx, [ebp - 0x113bc]
mov byte [ebp - 0x31], 0
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x39], 0
push 0x10000
push 0
push edx
call fcn.0049af44
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x13bc]
mov byte [edx], 0x55
inc eax
inc edx
cmp eax, 0x1388
jl 0x40b98f
push 1
lea ecx, [ebp - 0x13bc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
call fcn.004a2ec0
mov dword [ebp - 0x30], eax
xor ebx, ebx
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
jne 0x40ba6b
cmp ebx, 0xe000
jle 0x40b9e5
xor ebx, ebx
push 1
push ebx
lea eax, [ebp - 0x113bc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov ebx, eax
test ebx, ebx
jle 0x40ba2e
xor edx, edx
xor eax, eax
lea esi, [ebp - 0x113bc]
jmp 0x40ba1c
mov edi, edx
inc edx
mov cl, byte [esi]
cmp cl, byte [ebp + edi - 0x34]
je 0x40ba1a
xor edx, edx
inc eax
inc esi
cmp ebx, eax
jle 0x40ba25
cmp edx, 1
jl 0x40ba0d
dec edx
jne 0x40ba2e
mov byte [ebp - 0x31], 1
jmp 0x40ba6b
call fcn.004a2ec0
sub eax, dword [ebp - 0x30]
cmp eax, 5
jle 0x40ba58
push 1
lea eax, [ebp - 0x13bc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x30], eax
call fcn.004a2ec0
sub eax, dword [ebp - 0x2c]
cmp eax, 0x3e8
jle 0x40b9c2
cmp byte [ebp - 0x31], 0
je 0x40ba75
xor ebx, ebx
jmp 0x40ba8a
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
je 0x40ba85
mov ebx, 0xc8
jmp 0x40ba8a
mov ebx, 0x64
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x40bad8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x11
add esp, 0xfffff004
push eax
dec eax
jne 0x40bae9
mov eax, dword [ebp - 4]
add esp, 0xfffffc48
push ebx
push esi
push edi
mov eax, 0x52cffc
call fcn.0049b3b8
mov word [ebp - 0x18], 8
xor edx, edx
mov cx, word [0x5028a3]
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
mov word [ebp - 0x34], cx
mov cl, byte [0x5028a5]
mov byte [ebp - 0x32], cl
mov word [ebp - 0x18], 0x20
push 0x52b53d
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403510
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004036e0
pop ecx
lea edx, [ebp - 0x113bc]
mov byte [ebp - 0x31], 0
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x39], 0
push 0x10000
push 0
push edx
call fcn.0049af44
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x13bc]
mov byte [edx], 0x55
inc eax
inc edx
cmp eax, 0x1388
jl 0x40bb7f
push 1
lea ecx, [ebp - 0x13bc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x2c], eax
call fcn.004a2ec0
mov dword [ebp - 0x30], eax
xor ebx, ebx
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.00403fd0
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
jne 0x40bc5b
cmp ebx, 0xe000
jle 0x40bbd5
xor ebx, ebx
push 1
push ebx
lea eax, [ebp - 0x113bc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403618
add esp, 0x10
mov ebx, eax
test ebx, ebx
jle 0x40bc1e
xor edx, edx
xor eax, eax
lea esi, [ebp - 0x113bc]
jmp 0x40bc0c
mov edi, edx
inc edx
mov cl, byte [esi]
cmp cl, byte [ebp + edi - 0x34]
je 0x40bc0a
xor edx, edx
inc eax
inc esi
cmp ebx, eax
jle 0x40bc15
cmp edx, 1
jl 0x40bbfd
dec edx
jne 0x40bc1e
mov byte [ebp - 0x31], 1
jmp 0x40bc5b
call fcn.004a2ec0
sub eax, dword [ebp - 0x30]
cmp eax, 5
jle 0x40bc48
push 1
lea eax, [ebp - 0x13bc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035d4
add esp, 0xc
call fcn.004a2ec0
mov dword [ebp - 0x30], eax
call fcn.004a2ec0
sub eax, dword [ebp - 0x2c]
cmp eax, 0x3e8
jle 0x40bbb2
cmp byte [ebp - 0x31], 0
je 0x40bc65
xor ebx, ebx
jmp 0x40bc7a
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x39], 0
je 0x40bc75
mov ebx, 0xc8
jmp 0x40bc7a
mov ebx, 0x64
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.004a6e54
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x40bcc8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dfac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x52deb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
call fcn.0049b3b8
test edi, edi
jg 0x41dfdd
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x41e0e4
push 0x84
call fcn.0049a138
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41e00a
mov word [ebp - 0x24], 0x14
mov edx, dword [ebp - 0x10]
push edx
call fcn.00402970
pop ecx
mov word [ebp - 0x24], 8
mov eax, dword [ebp - 0x10]
jmp 0x41e00d
mov eax, dword [ebp - 0x10]
mov word [ebp - 0x24], 0x20
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.00403024
inc dword [ebp - 0x18]
add esp, 8
mov word [ebp - 0x24], 0x2c
mov al, byte [ebp + 0x14]
xor ecx, ecx
mov dword [0x53a330], ecx
and al, 0xfc
mov byte [0x53a2f0], al
push 0x53a2f4
call sym.TJDevice.dll__InitCommpara
pop ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
mov dword [0x53a340], edx
and ecx, 3
lea eax, [ebp - 0x38]
mov dword [0x53a31c], eax
mov dword [ebp - 0x38], ecx
cmp esi, 2
jne 0x41e078
mov byte [0x53a310], 1
push 0
call fcn.0040755c
pop ecx
push esi
push ebx
push edi
push 0x53a2f4
lea edx, [ebp - 0xc]
push edx
call sym.TJDevice.dll__PowerOnOff
add esp, 0x14
cmp esi, 2
jne 0x41e0c8
push 1
call fcn.0040755c
pop ecx
call fcn.004a2ec0
mov esi, eax
mov eax, dword [0x539ee4]
mov eax, dword [eax]
call fcn.0044f854
push 1
call sub.KERNEL32.DLL_Sleep
call fcn.004a2ec0
sub eax, esi
cmp ebx, eax
jge 0x41e0a0
mov edx, dword [ebp - 8]
push edx
call fcn.00402b2c
pop ecx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402b2c
pop ecx
mov word [ebp - 0x24], 0x2c
mov eax, dword [ebp - 0x34]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4292e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
test ebx, ebx
je 0x42932a
xor eax, eax
mov dword [esp], eax
call fcn.004a2ec0
mov esi, eax
mov eax, dword [0x539ee4]
mov eax, dword [eax]
call fcn.0044f854
push 1
call sub.KERNEL32.DLL_Sleep
push esp
push ebx
call sub.KERNEL32.DLL_GetExitCodeThread
cmp dword [esp], 0x103
jne 0x42932a
call fcn.004a2ec0
sub eax, esi
cmp edi, eax
jg 0x4292fc
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x429558
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
mov eax, 0x534bd4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0049b3b8
push 0x94
push 0
lea edx, [ebp - 0xd4]
push edx
call fcn.0049af44
mov dword [ebp - 0xd4], 0x94
mov word [ebp - 0x30], 8
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 4], ecx
lea eax, [ebp - 0xd4]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x42979b
mov edx, dword [ebp - 0xc4]
dec edx
je 0x4296b9
dec edx
jne 0x42979b
mov esi, str.WINNT
mov edi, ebx
mov eax, edi
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [ebp - 0xd0], 5
jne 0x429621
cmp dword [ebp - 0xcc], 0
jne 0x429621
mov word [ebp - 0x30], 0x20
mov edx, str.Windows_2000
lea eax, [ebp - 8]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a6e54
jmp 0x42979b
cmp dword [ebp - 0xd0], 5
jne 0x429669
cmp dword [ebp - 0xcc], 1
jne 0x429669
mov word [ebp - 0x30], 0x2c
mov edx, str.Windows_XP
lea eax, [ebp - 0xc]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a6e54
jmp 0x42979b
cmp dword [ebp - 0xd0], 4
jne 0x42979b
cmp dword [ebp - 0xcc], 0
jne 0x42979b
mov word [ebp - 0x30], 0x38
mov edx, str.Windows_NT
lea eax, [ebp - 0x10]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a6e54
jmp 0x42979b
cmp dword [ebp - 0xd0], 4
jne 0x42970d
cmp dword [ebp - 0xcc], 0xa
jne 0x42970d
mov edi, ebx
mov esi, str.WIN98
mov eax, edi
mov edx, str.Windows_98
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebp - 0x30], 0x44
lea eax, [ebp - 0x14]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a6e54
jmp 0x42979b
cmp dword [ebp - 0xd0], 4
jne 0x42975e
cmp dword [ebp - 0xcc], 0x5a
jne 0x42975e
mov edi, ebx
mov esi, str.WINME
mov eax, edi
mov edx, str.Windows_ME
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebp - 0x30], 0x50
lea eax, [ebp - 0x18]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004a6e54
jmp 0x42979b
mov edi, ebx
mov esi, str.WIN95
mov eax, edi
mov edx, str.Windows_95
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebp - 0x30], 0x5c
lea eax, [ebp - 0x1c]
call fcn.004a6cf4
inc dword [ebp - 0x24]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004a6e84
dec dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004a6e54
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a6e54
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c668
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42c5b4
call sub.USER32.DLL_EnumWindows
ret

Function at 0x42c78c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42c809
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042c1d8
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42c7b1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042be30
cmp dword [ebp - 4], 0
je 0x42c7f3
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0049824c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c810
lea eax, [ebp - 4]
call fcn.00497d9c
ret

Function at 0x4351e4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00497d9c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x435233
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00498004
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43cfd8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x43cfde
ret

Function at 0x43f520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x43f571
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x43f558
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x43f548
jmp 0x43f571
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x43f559
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446990
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4469e0]
test si, 4
je 0x4469a4
or bl, 1
test si, 8
je 0x4469ae
or bl, 4
test si, 1
je 0x4469b8
or bl, 8
test si, 2
je 0x4469c2
or bl, 0x10
test si, 0x10
je 0x4469cc
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4469db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4469e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446a1c]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4469fd
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x446a0c
or bl, 4
test esi, 0x20000000
je 0x446a17
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44d358
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44d36a
add esp, 0xfffffff0
call fcn.004975b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004810b0
mov eax, dword [0x539fd8]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d6fc
mov eax, dword [0x539fdc]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d708
mov eax, ebx
call fcn.0044d714
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x476b68]
call fcn.00497238
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x476b68]
call fcn.00497238
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x476b68]
call fcn.00497238
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x476b68]
call fcn.00497238
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x476b68]
call fcn.00497238
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x449bdc
push eax
push 0
push 0
mov eax, dword [0x539fc4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x43c6dc]
call fcn.0043db20
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x43c6dc]
call fcn.0043db20
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x43c6dc]
call fcn.0043db20
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044db7c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44da58
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44da58
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44da58
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d4a7
call fcn.0049760c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44d83c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d9e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44d9c8
mov dl, 1
mov eax, dword [0x477154]
call fcn.00497238
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00497d9c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44d9b7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00461fa0
test al, al
je 0x44d9aa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44d9f8
lea eax, [ebp - 0x254]
call fcn.00486100
push eax
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x44d9aa
xor eax, eax
push ebp
push 0x44d9a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44da30
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x44d98c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00498004
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44d98c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00498004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d9aa
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44d8ad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0047b694
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d9ee
lea eax, [ebp - 0x260]
call fcn.00497d9c
ret

Function at 0x44e31c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x53d138]
cmp byte [eax + 0xa5], 0
jne 0x44e38d
cmp dword [0x53d150], 0
jne 0x44e34e
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x44e2d8
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x53d150], eax
cmp dword [0x53d14c], 0
jne 0x44e369
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x53d14c], eax
cmp dword [0x53d154], 0
jne 0x44e38d
push esp
push 0
push 0
push 0x44e27c
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x53d154], eax
pop edx
ret