joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40904a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, eax
xor eax, eax
push edi
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov byte [0xff4788fe], al
mov byte [ebp + edi*8 + 8], al
inc ebp
cld
call fcn.00450bb0
pop ecx
inc eax
adc al, ch
jbe 0x4090ce
add al, 0
pop ecx
mov ebx, eax
pop esi
mov dword [ebp - 0x18], ebx
call fcn.00450bb0
pop ecx
lea eax, [eax + eax + 1]
push eax
clc
pop edi
pop ecx
add al, 0
mov ebx, eax
pop ecx
test dword [ebp - 0xc], edx
mov al, 0x20
mov dword [ebp - 0x10], edi
inc edi
inc ebp
clc
add dword [eax], eax
add byte [eax], al
call fcn.0040949e
test eax, eax
jne 0x4090dd
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
cmp al, 0x20
jbe 0x4090b7
cmp al, 9
jne 0x4090bc
inc dword [ebp - 0xc]
sti
in eax, dx
mov esi, dword [ebp - 0xc]
mov ebx, edi
xor al, al
call fcn.0040949a
push 0x46c120
push edi
call 0x863b25
test eax, eax
pop eax
pop ecx
ja 0x40912c
mov byte [ebp - 2], 1
xor edi, edi
mov bl, byte [ebp - 0x18]
mov esi, dword [ebp - 0x14]
push ebx
push dword [esi*4 + 0x78390]
test al, 0x33
stosb byte es:[edi], al
add eax, 0x5bc08500
pop ecx
je 0x409101
inc esi
cmp esi, 0x62
test eax, 0xde3cec75
cmp esi, 0x66
jne 0x40409175
cmp byte [ebp - 1], 0x10
movzx eax, byte [ebx]
je 0x4091c5
push edi
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
and eax, 0xff
mov ebx, dword [ebp + 8]
jmp 0x4093e0
push 0x46eb24
push edi
call 0x483b25
test eax, eax
pop ecx
dec ecx
jne 0x409143
into
inc ebp
inc dword [ecx]
retf
push 0x46cb2c
push edi
call fcn.00463b25
test eax, eax
pop ecx
pop ecx
jne 0x40915a
mov byte [ebp - 3], 1
jmp 0x4090dd
push 0x46cb30
push edi
call fcn.00463b25
test eax, eax
pop ecx
pop ecx
jne 0x409174
mov byte [ebp - 4], 1
jmp 0xc04090dd
cmp byte [edi], 0x30
jne 0x4091a5
mov al, byte [ebx + 1]
cmp al, 0x78
je 0x40918c
cmp al, 0x5c
push ebp
and dword [ebx + 0x758d02c7], eax
cld
jmp 0x4092b8
add dword [eax], eax
add dh, bh
xor eax, 0xcb3448f9
inc esi
add byte [ebx - 0x38], dl
cmp dword [esi - 0x3b7c7ffc], eax
or al, 0xe9
sub bh, bh
invalid
push edi
call 0x1451842
xor edi, edi
cmp eax, edi
pop ecx
mov dword [ebp - 8], eax
jg 0x3090df
mov dword [ebp - 8], 1
jmp 0x3890df
cmp byte [ebp - 2], 0
je 0x4091e4
xlatb
push eax
call dword [0xc67584]
movzx edi, ax
sub ebx, 0x800800ff
mov eax, dword [ebp + 8]
jmp 0x40944a
mov edi, 0x4d8bf875
or byte [eax - 0x18], dl
push es
cli
invalid
mov byte [ebp - 2], bh
add byte [ebx + ecx - 0x75], dh
inc ebp
or byte [edi + 0x6a], dl
or eax, 0x81a0e9
add byte [edx + 1], ch
push 0xd
push dword [ebp + 8]
call fcn.00408e10
jmp 0x40944f
call 0x306e35
jmp 0x409451
call fcn.00408f3f
invalid
push dword [ecx - 0x18]
call fcn.0044e722
pop eax
push dword [ebp - 0x10]
call 0x493603e
add byte [eax - 1], bl
jne 0x40944b
call 0x8044e722
pop ecx
pop edi
pop esi
dec edx
dec ecx
ret 4
Function at 0x40b4a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
test al, 3
je 0x40b528
push ebx
xor ebx, ebx
inc ebx
test bl, al
je 0x40b4d1
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call fcn.00451df8
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
pop ecx
pop ecx
jne 0x40b527
mov eax, dword [esi]
test al, 0x20
je 0x40b4ec
push dword [esi + 4]
push 2
push ebx
push 0x46cc1c
call fcn.00451fc2
mov dword [esi + 0xc], ebx
jmp 0x40b524
test al, 0x40
je 0x40b509
push dword [esi + 4]
push 2
push ebx
push 0x46cc20
call fcn.00451fc2
mov dword [esi + 0xc], 2
jmp 0x40b524
test al, al
jns 0x40b527
push dword [esi + 4]
push 3
push ebx
push str.rb
call fcn.00451fc2
mov dword [esi + 0xc], 4
add esp, 0x10
pop ebx
leave
ret

Function at 0x40b55c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and dword [esi + 0xc], 0
push edi
push 0x46cc28
push dword [ebp + 8]
mov byte [esi + 8], 0
call fcn.00451cd9
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x40b5e7
push ebx
push edi
push 3
lea eax, [ebp + 8]
push 1
push eax
call fcn.004523ce
push edi
mov ebx, eax
call fcn.004520b6
add esp, 0x14
push 2
pop eax
cmp ebx, eax
jb 0x40b5c4
cmp byte [ebp + 8], 0xff
jne 0x40b5b3
cmp byte [ebp + 9], 0xfe
jne 0x40b5c4
mov dword [esi + 0xc], 1
jmp 0x40b5e2
cmp byte [ebp + 8], 0xfe
jne 0x40b5c4
cmp byte [ebp + 9], 0xff
jne 0x40b5c4
mov dword [esi + 0xc], eax
jmp 0x40b5e2
cmp ebx, 3
jb 0x40b5e6
cmp byte [ebp + 8], 0xef
jne 0x40b5e6
cmp byte [ebp + 9], 0xbb
jne 0x40b5e6
cmp byte [ebp + 0xa], 0xbf
jne 0x40b5e6
mov dword [esi + 0xc], 4
mov byte [esi + 8], 1
pop ebx
pop edi
pop ebp
ret 4

Function at 0x40ba18
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esi + 0x58]
cmp dword [esi + 0x5c], edi
jne 0x40ba97
cmp edi, 4
jle 0x40ba29
push 4
pop edi
push 4
pop eax
sub eax, edi
push eax
lea eax, [edi + esi + 0x10]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00451850
mov eax, dword [esi + 0x58]
sub eax, edi
lea eax, [eax + esi + 0x14]
push edi
push eax
mov eax, esi
sub eax, edi
add eax, 0x14
push eax
call fcn.00450dd0
push dword [esi + 4]
lea eax, [esi + 0x14]
push 0x40
push 1
push eax
mov dword [esi + 0x54], edi
call fcn.004523ce
and dword [esi + 0x5c], 0
add esp, 0x28
test eax, eax
mov dword [esi + 0x58], eax
jne 0x40ba97
push dword [esi + 4]
call fcn.00451bb5
test eax, eax
pop ecx
jne 0x40ba92
push dword [esi + 4]
call fcn.00451be4
test eax, eax
pop ecx
jne 0x40ba92
pop edi
ret
or eax, 0xffffffff
pop edi
ret
mov ecx, dword [esi + 0x5c]
movzx eax, byte [ecx + esi + 0x14]
inc ecx
mov dword [esi + 0x5c], ecx
pop edi
ret
Function at 0x40bbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push edi
add eax, eax
mov dword [ebp + 0x14], eax
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov word [esi], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bbfd
lea eax, [ebp + 0x14]
push eax
push esi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], edi
je 0x40bbf4
shr dword [ebp + 0x14], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
leave
ret

Function at 0x40bc00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostmessageW]
lea eax, [ebp - 8]
push eax
push 0x1f4
push 2
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMe3rageTimeoutW]
test eax, eax
jne 0x40bc60
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GeuWindoThreedProcessHd]
push dword [ebp - 4]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x40c077
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov edi, eax
xor esi, esi
cmp edi, ebx
mov byte [0x4795c3], bl
je 0x40c0bd
mov byte [0x489618], 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x40c0fe
push ebx
push ebx
mov dword [ebp - 8], edi
call fcn.004526cd
add esp, 0x18
mov esi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_MesqaweBoxU]
cmp esi, ebx
mov edi, eax
je 0x40c0e9
push 0xffffffffffffffff
push esi
mov byte [0x489618], bl
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x4795c3], 1
jne 0x40c0f7
or eax, 0xffffffff
jmp 0x40c0f9
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c49d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40c4d7
lea eax, [esp]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40c4cd
or eax, eax
jmp 0x40c4d7
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp]
mov esp, ebp
pop ebp
ret
Function at 0x40cbf6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.0044f00e
dec eax
lea eax, [esi + eax*2]
cmp word [eax], 0x5c
pop ecx
jne 0x40cc12
and word [eax], 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40cc89
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jne 0x40cc3c
push 0
push esi
call ebp
test eax, eax
je 0x40cc41
mov al, 1
jmp 0x40cc8f
cmp eax, 3
jne 0x40cc8d
push esi
call fcn.0040d6da
mov edi, eax
push 0x5c
push edi
call fcn.00452dc0
add esp, 0xc
test eax, eax
jne 0x40cc61
push edi
call fcn.0044e722
pop ecx
jmp 0x40cc8d
and word [eax], 0
push ebx
push edi
call fcn.0040cbf6
push edi
mov bl, al
call fcn.0044e722
test bl, bl
pop ecx
pop ecx
je 0x40cc84
push 0
push esi
call ebp
test eax, eax
setne bl
mov al, bl
pop ebx
jmp 0x40cc8f
test al, 0x10
jne 0x40cc38
xor al, al
pop edi
pop esi
pop ebp
ret

Function at 0x40cc93
Capabilities:
Check if file exists
Copy file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push dword [ebp + 8]
lea eax, [ebp - 0x438]
call fcn.0040c4db
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
call fcn.0040c4db
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x40cd0c
cmp byte [ebp + 0x10], al
je 0x40cd08
lea eax, [ebp - 0x22c]
push eax
invalid
Function at 0x40d288
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x48b7b4], 0
push ebx
push esi
mov ebx, eax
je 0x40d2f3
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
add byte [eax - 1], dl
adc eax, sym.imp.ADVAPI32.dll_OpenProcessToken
xor esi, esi

Function at 0x40d649
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
test edi, edi
push esi
jl 0x40d6d5
jne 0x40d65d
push 0
jmp 0x40d6cf
mov al, byte [0x48b7b5]
neg al
sbb eax, eax
and eax, 0x28
add eax, 0xf
cmp edi, eax
jae 0x40d6ce
mov esi, dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
test eax, eax
je 0x40d6ce
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 8]
push eax
call esi
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sbb ecx, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
fild qword [esp + 0x18]
fild qword [esp + 0x20]
fdivp st(1)
fmul qword [0x4723a0]
call fcn.00465e16
cmp eax, edi
jb 0x40d68c
jmp 0x40d6d5
push edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d921
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [0x4795bc]
push edi
push 0x8000
push esi
call fcn.00452a09
pop ecx
push eax
call fcn.00452912
push dword [ebp + 8]
mov dword [ebp - 4], eax
or eax, 0xffffffff
call int.0040df43
mov edi, eax
push edi
push 0x46ced4
push esi
call fcn.00452a36
push edi
call fcn.0044e722
push esi
call fcn.00452d03
add esp, 0x20
cmp dword [ebp - 4], 0xffffffff
jne 0x40d977
push 0x4000
jmp 0x40d97a
push dword [ebp - 4]
push esi
call fcn.00452a09
pop ecx
push eax
call fcn.00452912
pop ecx
pop ecx
pop edi
test bl, bl
pop ebx
je 0x40d998
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
leave
ret
Function at 0x411d21
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x464]
test eax, eax
mov ecx, 0x10000
je 0x411d34
cmp eax, ecx
jne 0x411d4f
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x45c]
call fcn.004523ce
add esp, 0x10
and dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
ret

Function at 0x411d66
Capabilities:
Write file on windows

Disassembly:
cmp dword [esi + 0x18], 1
mov eax, dword [esi + 0x444]
push edi
je 0x411e1d
cmp eax, dword [esi + 0x43c]
jae 0x411de9
mov edi, 0x10000
push ebx
mov eax, dword [esi + 0x444]
mov ecx, dword [esi + 0x438]
mov ebx, dword [esi + 0x460]
mov edx, dword [esi + 0x458]
and eax, 0x1ffff
mov al, byte [eax + ecx]
mov byte [edx + ebx], al
inc dword [esi + 0x460]
cmp dword [esi + 0x460], edi
jne 0x411dd1
push dword [esi + 0x20]
push edi
push 1
push dword [esi + 0x458]
call fcn.00451fc2
add esp, 0x10
and dword [esi + 0x460], 0
inc dword [esi + 0x444]
inc dword [esi + 8]
mov eax, dword [esi + 0x444]
cmp eax, dword [esi + 0x43c]
jb 0x411d85
pop ebx
and dword [esi + 0x440], 0
pop edi
ret
mov eax, dword [esi + 0x444]
mov ecx, dword [esi + 0x438]
mov edi, dword [esi + 8]
mov edx, dword [esi]
and eax, 0x1ffff
mov al, byte [eax + ecx]
mov byte [edx + edi], al
inc dword [esi + 8]
inc dword [esi + 0x444]
mov eax, dword [esi + 0x444]
cmp eax, dword [esi + 0x43c]
jb 0x411df2
jmp 0x411de9

Function at 0x412c26
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
push edi
lea eax, [ebp - 0xdc]
call fcn.0041288d
push dword [ebp + 0x10]
lea esi, [ebp - 0xdc]
call fcn.004129cd
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x412c6b
mov eax, dword [ebp + 8]
lea esi, [edi + eax]
lea eax, [ebp - 0xdc]
push eax
call fcn.0041299f
xor byte [esi], al
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x412c51
pop edi
pop esi
leave
ret 0xc
invalid
Function at 0x430e75
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push str.open_
lea esi, [ebp - 0x14]
call fcn.0040e30a
xor ebx, ebx
push 0x3c
xor esi, esi
lea eax, [ebp - 0x5c]
push ebx
inc esi
push eax
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esi
call fcn.00451260
add esp, 0xc
cmp dword [ebp + 0x14], 2
jb 0x430ede
mov ecx, dword [ebp + 0x10]
mov eax, esi
call fcn.00405aa7
mov esi, eax
call fcn.0040fc41
cmp word [eax], bx
je 0x430ede
mov ecx, dword [ebp + 0x10]
xor eax, eax
inc eax
call fcn.00405aa7
mov esi, eax
call fcn.0040fc41
push eax
call fcn.0040d6da
pop ecx
mov edi, eax
cmp dword [ebp + 0x14], 3
jb 0x430f00
mov ecx, dword [ebp + 0x10]
push 2
pop eax
call fcn.00405aa7
mov esi, eax
call fcn.0040fc41
push eax
call fcn.0040d6da
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 4
jb 0x430f3b
mov ecx, dword [ebp + 0x10]
push 3
pop eax
call fcn.00405aa7
mov esi, eax
call fcn.0040fc41
cmp word [eax], bx
je 0x430f3b
mov ecx, dword [ebp + 0x10]
push 3
pop eax
call fcn.00405aa7
mov esi, eax
call fcn.0040fc63
mov ebx, eax
lea eax, [ebp - 0x14]
call fcn.0040e441
xor ebx, ebx
cmp dword [ebp + 0x14], 5
jb 0x430f57
mov ecx, dword [ebp + 0x10]
push 4
pop eax
call fcn.00405aa7
call fcn.0040fd19
movzx eax, ax
mov dword [ebp - 8], eax
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00451260
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x54], ebx
call fcn.00405aa7
mov esi, eax
call fcn.0040fc41
mov esi, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp edi, ebx
mov dword [ebp + 0x10], eax
je 0x430fb6
push edi
call fcn.0044e722
pop ecx
cmp esi, ebx
je 0x430fc1
push esi
call fcn.0044e722
pop ecx
cmp dword [ebp + 0x10], ebx
jne 0x43101f
mov esi, dword [ebp + 8]
cmp byte [esi + 0x290], 1
jne 0x431009
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call fcn.00418b7f
push dword [eax]
mov ebx, esi
push 0x87
call fcn.004189b9
push dword [ebp - 0x20]
call fcn.0044e722
xor ebx, ebx
pop ecx
inc ebx
push dword [ebp - 0x14]
call fcn.0044e722
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14
xor ecx, ecx
push ebx
inc ecx
mov eax, esi
call fcn.0041a11e
mov esi, dword [ebp + 0x18]
push ebx
call fcn.004101fc
jmp 0x430ff7
cmp byte [ebp + 0xc], bl
je 0x431032
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x7e8], eax
jmp 0x430ff7
mov esi, dword [ebp + 0x18]
push 1
call fcn.004101fc
cmp dword [ebp - 0x24], ebx
je 0x430ff7
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x430ff7
Function at 0x43b00d
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
push ebx
mov edi, 0x48dd20
push edi
call fcn.00451260
push 0x10
push ebx
mov esi, 0x48dd10
push esi
call fcn.00451260
add esp, 0x18
push esi
push edi
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [esp + 0x30]
xor eax, eax
inc eax
push ebx
mov dword [0x48dd20], 0x44
mov dword [0x48dd4c], eax
mov word [0x48dd50], ax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
pop edi
pop esi
pop ebx
je 0x43b070
push dword [0x48dd10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
ret 4

Function at 0x43b613
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x4134], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x4138], eax
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_Scre5.ToClient]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
lea eax, [edi + 0x413c]
cmp ecx, dword [eax]
jne 0x43b65f
cmp edx, dword [edi + 0x4140]
je 0x43b679
cmp dword [ebp + 0xc], 1
mov dword [eax], ecx
mov dword [edi + 0x4140], edx
jl 0x43b679
push edx
push ecx
push 0xfffffffffffffff5
push dword [ebp + 8]
call fcn.0043af0c
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
mov ebx, 0x8000
test bx, ax
jne 0x43b6a0
push 1
call dword [sym.imp.USER32.dll_GetKeyWtcte]
test bx, ax
jne 0x43b6a0
and dword [ebp - 4], 0
jmp 0x43b6a7
mov dword [ebp - 4], 1
push 2
call esi
test bx, ax
jne 0x43b6c1
push 2
call dword [sym.imp.USER32.dll_GetKeyWtcte]
test bx, ax
jne 0x43b6c1
xor ebx, ebx
jmp 0x43b6c4
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 4]
cmp esi, dword [edi + 0x4144]
je 0x43b72b
cmp dword [ebp + 0xc], 1
jl 0x43b72b
cmp byte [edi + 0x4170], 0
je 0x43b72b
test esi, esi
push dword [ebp - 8]
push dword [ebp - 0xc]
je 0x43b6ec
push 0xfffffffffffffff9
jmp 0x43b71c
push 0xfffffffffffffff8
push dword [ebp + 8]
call fcn.0043af0c
cmp byte [edi + 0x414c], 0
je 0x43b724
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetVindmwLongU]
test eax, 0x1000000
push dword [ebp - 8]
push dword [ebp - 0xc]
je 0x43b71a
push 0xfffffffffffffffa
jmp 0x43b71c
push 0xfffffffffffffff4
push dword [ebp + 8]
call fcn.0043af0c
mov byte [edi + 0x414c], 0
cmp dword [ebp + 0xc], 0
je 0x43b737
mov dword [edi + 0x4144], esi
cmp ebx, dword [edi + 0x4148]
je 0x43b75d
cmp dword [ebp + 0xc], 1
jl 0x43b75d
test ebx, ebx
push dword [ebp - 8]
push dword [ebp - 0xc]
je 0x43b753
push 0xfffffffffffffff7
jmp 0x43b755
push 0xfffffffffffffff6
push dword [ebp + 8]
call fcn.0043af0c
cmp dword [ebp + 0xc], 0
je 0x43b769
mov dword [edi + 0x4148], ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43c28d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x43c2ad
push dword [ebp + 0xc]
mov ecx, 0x48a010
call fcn.0043aa10
mov dword [0x48a02c], eax
jmp 0x43c2b2
mov eax, dword [0x48a02c]
cmp eax, 0xffffffff
jne 0x43c2be
xor eax, eax
jmp 0x43c464
push ebx
push esi
mov esi, dword [eax*4 + 0x48a060]
cmp byte [esi + 0x3a], 0
mov ebx, dword [esi]
push edi
mov dword [ebp + 0xc], ebx
je 0x43c33a
cmp dword [esi + 0x4154], 0
mov byte [esi + 0x3a], 0
jl 0x43c2f9
lea edi, [esi + 0x4160]
cmp byte [edi], 0
je 0x43c2f9
push dword [esi + 0x415c]
call fcn.00440df3
mov byte [edi], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
sub edi, dword [ebp - 0x10]
sub ebx, dword [ebp - 0xc]
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetVindmwLongU]
test edi, edi
je 0x43c374
test ebx, ebx
jne 0x43c32b
test eax, 0x400000
jne 0x43c374
mov dword [esi + 0x50], ebx
mov dword [esi + 0x48], ebx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
mov edi, dword [ebp + 8]
cmp edi, 8
jg 0x43c3e0
je 0x43c3ae
test edi, edi
je 0x43c39c
cmp edi, 1
je 0x43c3ae
cmp edi, 2
je 0x43c380
cmp edi, 3
je 0x43c43c
jle 0x43c45a
cmp edi, 5
jle 0x43c3ae
cmp edi, 6
je 0x43c384
jmp 0x43c45a
mov byte [esi + 0x3a], 1
or eax, 0xffffffff
jmp 0x43c461
mov byte [esi + 0x38], 1
cmp byte [esi + 0x38], 0
je 0x43c45f
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43c45a
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x38], 0
jmp 0x43c45a
cmp byte [esi + 0x38], 0
jne 0x43c45f
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 8
je 0x43c3da
cmp edi, 4
je 0x43c3da
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, eax
je 0x43c3da
push ebx
call fcn.00409786
mov byte [esi + 0x38], 1
jmp 0x43c45a
mov eax, edi
sub eax, 9
je 0x43c43c
sub eax, 0x37
je 0x43c42c
dec eax
je 0x43c41a
dec eax
je 0x43c40d
dec eax
jne 0x43c45a
push eax
mov byte [esi + 0x39], al
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push 1
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_KnvalidadeRect]
jmp 0x43c45a
push ebx
mov byte [esi + 0x39], 1
call dword [sym.imp.USER32.dll_LockWindowUpdate]
jmp 0x43c45a
push 0
push ebx
call dword [sym.imp.USER32.dll_Ena_leWindoW]
mov eax, esi
call fcn.00443c05
jmp 0x43c45a
push 1
push ebx
call dword [sym.imp.USER32.dll_Ena_leWindoW]
call fcn.00443b08
jmp 0x43c45a
cmp byte [esi + 0x38], 0
je 0x43c45f
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp ebx, eax
je 0x43c45a
push ebx
call fcn.00409786
xor eax, eax
inc eax
jmp 0x43c461
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8