joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4045a8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4045d4
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004028f4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404613
cmp cl, 0xb
je 0x404624
cmp cl, 0xc
je 0x404635
cmp cl, 0xd
je 0x404646
cmp cl, 0xe
je 0x404666
cmp cl, 0xf
je 0x40467f
cmp cl, 0x11
je 0x404690
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403ba0
mov eax, 4
jmp 0x4046a1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004041b0
mov eax, 4
jmp 0x4046a1
lea edx, [esi + eax]
add eax, ebx
call fcn.00404974
mov eax, 0x10
jmp 0x4046a1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004046c4
pop eax
jmp 0x4046a1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004045a8
pop eax
jmp 0x4046a1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406054
mov eax, 4
jmp 0x4046a1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405c0c
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4045c2
pop ecx
sub ecx, eax
jle 0x4046bd
lea edx, [ebx + eax]
add eax, esi
call fcn.004028f4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4046c4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x40470a
cmp cl, 0xb
je 0x404721
cmp cl, 0xc
je 0x404735
cmp cl, 0xd
je 0x404749
cmp cl, 0xe
je 0x40476a
cmp cl, 0xf
je 0x404787
cmp cl, 0x11
je 0x40479b
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402824
mov eax, ebx
mov edx, dword [esi]
call fcn.00403ba0
add ebx, 4
add esi, 4
dec ebp
jne 0x40470a
jmp 0x4047af
mov eax, ebx
mov edx, dword [esi]
call fcn.004041b0
add ebx, 4
add esi, 4
dec ebp
jne 0x404721
jmp 0x4047af
mov eax, ebx
mov edx, esi
call fcn.00404974
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404735
jmp 0x4047af
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004046c4
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404752
jmp 0x4047af
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004045a8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x40476a
jmp 0x4047af
mov eax, ebx
mov edx, dword [esi]
call fcn.00406054
add ebx, 4
add esi, 4
dec ebp
jne 0x404787
jmp 0x4047af
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405c0c
add ebx, 4
add esi, 4
dec ebp
jne 0x40479b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404974
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402824
cmp eax, edx
je 0x404a0b
cmp word [eax], 8
jb 0x4049ac
push eax
push edx
cmp word [eax], 0x100
je 0x4049a2
cmp word [eax], 0x101
je 0x40499a
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4049aa
call dword [0x4973e8]
jmp 0x4049aa
add eax, 8
call fcn.00403b4c
pop edx
pop eax
cmp word [edx], 8
jae 0x4049c3
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4049de
cmp word [edx], 0x101
jne 0x4049f7
push eax
call 0x4049b2
pop eax
jmp dword [0x4973f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x4049ee
mov ecx, dword [edx - 8]
inc ecx
jle 0x4049ee
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404928
ret

Function at 0x404e0c
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404e1a
mov edx, dword [edx + 8]
jmp fcn.004041b0
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404b84
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.00404164
add esp, 0x10
pop ebx
ret

Function at 0x404eb4
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.0040603c
cmp word [edx], 0xd
je 0x404eff
cmp word [edx], 9
je 0x404eff
cmp word [edx], 0x400d
je 0x404ef5
cmp word [edx], 0x4009
je 0x404ef5
cmp word [edx], 0x101
jne fcn.00404920
jmp fcn.00404e44
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406054
mov edx, dword [edx + 8]
jmp fcn.00406054

Function at 0x4050a8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405328
xor eax, eax
push ebp
push 0x40509a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x4973ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.004050a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050a1
lea eax, [ebp - 0x10]
call fcn.00405320
ret
cmp word [edx], 0x101
je 0x405044
cmp word [edx], 0x100
jne fcn.00404974
cmp word [eax], 8
jb 0x4050cd
push eax
push edx
call fcn.00404930
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.004042b8
Function at 0x405210
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x405236
cmp eax, 0x100
jne 0x405265
mov eax, 8
cmp edx, 0x11
jbe 0x405248
cmp edx, 0x100
jne case.default.0x40525c
mov edx, 8
mov al, byte [eax + 0x494064]
mov dl, byte [edx + 0x494064]
movzx ecx, byte [edx + eax*8 + 0x494078]
jmp dword [ecx*4 + 0x405277]
mov eax, edx
cmp eax, 0x101
jne case.0x40525c.0
pop edi
pop esi
call fcn.0040517c
push eax
popf
ret
pop edi
pop esi
jmp 0x404928
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404c78
xchg edi, eax
call fcn.00404c78
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404d18
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404d18
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404d74
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404d74
fld xword [esp]
add esp, 0xc
jmp 0x4052cf
mov eax, edi
mov edx, esi
call fcn.00405114
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404ce4
xchg edi, eax
call fcn.00404ce4
mov edx, edi
cmp al, dl
pop edi
pop esi
ret
Function at 0x405c90
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405e48
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405cf1
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405e64
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405d5e
xor eax, eax
push ebp
push 0x405d57
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405d40
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405e84
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d5e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e3f
cmp byte [ebp - 0xd], 0
jne 0x405da0
cmp byte [ebp - 0x12], 0
je 0x405e3f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405db9
dec ebx
cmp byte [ebx], 0x2e
je 0x405dc8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405db8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e3f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405df5
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e3f
cmp byte [ebp - 0xd], 0
je 0x405e3f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405e3f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406070
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.0040603c
push eax
push ecx
push edx
mov ecx, dword [eax]
test ecx, ecx
je 0x40608a
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp]
mov eax, dword [edx]
call dword [eax]
test eax, eax
je 0x406099
mov al, 0x17
jmp fcn.00402824
ret

Function at 0x40611c
Capabilities:
Terminate process

Disassembly:
test eax, eax
jns 0x406136
mov ecx, dword [0x497014]
test ecx, ecx
je 0x40612f
mov edx, dword [esp]
call ecx
mov al, 0x18
jmp fcn.00402824
ret
Function at 0x40b52c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b565
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403c30
jmp 0x40b56e
mov eax, ebx
mov edx, esi
call fcn.00403be4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b578
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b599
mov al, byte [esp]
jmp 0x40b59b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x419950
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419956
ret

Function at 0x41be80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41bed1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41beb8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41bea8
jmp 0x41bed1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41beb9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x49775c], 0
sete dl
or al, dl
jne 0x42c5b4
mov eax, dword [0x497760]
mov bx, 0xffff
call fcn.00403134
mov eax, dword [0x49775c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x42c583
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x49775c]
call fcn.00410edc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x42c57b
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x42c57b
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42c57b
mov eax, dword [ebp - 0x10]
call fcn.0043433c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42c57b
push ebp
call fcn.0042c42c
pop ecx
test al, al
jne 0x42c57b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x42c537
mov eax, dword [ebp - 0x10]
call fcn.00432c48
dec eax
jle 0x42c57b
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00403134
cmp byte [ebp - 0x15], 0
je 0x42c57b
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42c57b
mov edx, dword [ebp - 0x10]
mov eax, dword [0x497760]
call fcn.0042bcdc
inc edi
dec esi
jne 0x42c4ca
mov eax, dword [0x497760]
cmp dword [eax + 8], 0
jle 0x42c59b
mov eax, dword [0x497760]
call fcn.0042bd6c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42c5b4
push ebp
mov eax, dword [ebp - 0x14]
call fcn.0042c2e4
pop ecx
test al, al
jne 0x42c5b4
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
inc dword [esi + eax*8 - 0x7b]
mov ebp, 0x55fffffc
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0042c8dc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
adc al, 0xf7
invalid
Function at 0x42d19c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0042c8dc
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042c891
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
movsd dword es:[edi], dword [esi]
adc eax, 0xfffffc
Function at 0x431dd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x431e05
je 0x431e5f
sub eax, 7
je 0x431e26
dec eax
je 0x431e50
sub eax, 0x17
je 0x431ee0
jmp 0x431f1e
add eax, 0xffffff00
sub eax, 9
jb 0x431ecc
add eax, 0xffffff09
sub eax, 0xb
jb 0x431eb6
jmp 0x431f1e
mov eax, ebx
call fcn.00442134
mov edi, eax
test edi, edi
je 0x431f7e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x431f87
jmp 0x431f7e
test byte [ebx + 0x44], 0x20
jne 0x431f87
jmp 0x431f7e
mov edx, esi
mov eax, ebx
call fcn.0042f6c0
cmp dword [esi + 0xc], 0xffffffff
jne 0x431f87
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407864
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0042e168
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00431c84
test eax, eax
je 0x431f87
mov dword [esi + 0xc], 1
jmp 0x431f87
mov edx, esi
mov eax, ebx
call fcn.00431d48
test al, al
jne 0x431f87
jmp 0x431f7e
mov eax, ebx
call fcn.0042ed38
test al, al
jne 0x431f87
jmp 0x431f7e
mov eax, ebx
call fcn.0043433c
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x431f7e
cmp dword [0x4947ec], 0
je 0x431f7e
mov eax, dword [0x4947ec]
cmp ebx, dword [eax + 0x24]
jne 0x431f7e
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4947ec]
call fcn.0042f5dc
jmp 0x431f7e
mov eax, dword [0x497724]
cmp byte [eax + 0x20], 0
je 0x431f7e
mov eax, dword [0x497724]
cmp dword [eax + 0x1c], 0
je 0x431f7e
mov eax, dword [esi]
mov edx, dword [0x497724]
cmp eax, dword [edx + 0x1c]
jne 0x431f7e
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00442048
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00403134
jmp 0x431f87
mov edx, esi
mov eax, ebx
call fcn.0042f6c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432418
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x432434
cmp dword [esi + 4], 0
je 0x432461
test byte [ebx + 0x45], 1
jne 0x432453
mov eax, ebx
call fcn.00431488
test eax, eax
jne 0x432453
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x432571
mov edx, esi
mov eax, ebx
call fcn.00432090
jmp 0x432571
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43256a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043433c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042f5dc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00432418
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043433c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432571
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ba28
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403b4c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ba89
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x43ba89
cmp byte [ebp - 0x102], 0
je 0x43ba89
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403d78
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441e18
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4977d8
cmp dword [edi], 0
jne 0x441e94
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4977d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x494978
mov ecx, 2
call fcn.004028f4
mov edx, 0x441df0
lea eax, [esi + 5]
call fcn.00441e10
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00441e10
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x441e69
mov dword [0x4977d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x441fb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x442008]
test si, 4
je 0x441fcc
or bl, 1
test si, 8
je 0x441fd6
or bl, 4
test si, 1
je 0x441fe0
or bl, 8
test si, 2
je 0x441fea
or bl, 0x10
test si, 0x10
je 0x441ff4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x442003
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44200c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x442044]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x442025
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x442034
or bl, 4
test esi, 0x20000000
je 0x44203f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret