joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d809
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x485210]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41d84c
cmp word [esi], dx
jne 0x41d84c
or byte [edi + eax + 0x28], 4
jmp 0x41d851
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41d9a4
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41d984
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41d893
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41d8c9
cmp eax, edx
jae 0x41d8d5
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41d86b
jmp 0x41d9a4
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41d980
cmp dword [ebp - 0x14], 0
je 0x41d980
mov eax, dword [ebx*4 + 0x485210]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41d958
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41d921
mov word [esi], cx
jmp 0x41d954
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x485210]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x485210]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x485210]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41d9a4
pop ebx
cmp word [ebp - 4], bx
jne 0x41d969
cmp esi, dword [ebp + 0xc]
jne 0x41d969
mov word [esi], bx
jmp 0x41d9a1
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041e23d
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41d9a4
push 0xd
jmp 0x41d99d
mov ecx, dword [ebx*4 + 0x485210]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41d99b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41d9a4
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4204f0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42058d
push ebx
push esi
call fcn.004204b9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041f13e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42053a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42058c
push edi
push eax
call fcn.00419c27
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42055a
call fcn.00418a3f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42058b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041f13e
add esp, 0x20
test eax, eax
jne 0x420579
push edi
call fcn.00418a3f
jmp 0x420581
push ebx
call fcn.00418a3f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x427cf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x427d1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x427d1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x429670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
push 1
call fcn.0040b076
mov cl, byte [0x431ddc]
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
xor esi, esi
mov byte [esp + 0x20], cl
xor edi, edi
mov byte [esp + 0x21], 0
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
nop dword [eax]
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x431ee0]
movss dword [esp + 0x14], xmm0
cmp esi, edi
je 0x4296e6
movss dword [esi], xmm0
add esi, 4
mov dword [esp + 0x20], esi
jmp 0x4296fd
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.004074b0
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
inc ebx
cmp ebx, 0xa
jl 0x4296c0
mov eax, dword [esp + 0x1c]
xor ebx, ebx
sub esi, eax
xor ecx, ecx
mov edx, esi
xor ebp, ebp
sar edx, 2
mov dword [esp + 0x14], edx
test edx, edx
je 0x42978d
cmp edx, 0x3fffffff
ja 0x42989a
lea ebp, [edx*4]
cmp ebp, 0x1000
jb 0x429762
lea eax, [ebp + 0x23]
cmp eax, ebp
jbe 0x42989f
push eax
call fcn.0040b076
add esp, 4
test eax, eax
je 0x4298a4
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
mov eax, dword [esp + 0x1c]
jmp 0x429779
test ebp, ebp
je 0x429777
push ebp
call fcn.0040b076
mov ebx, eax
add esp, 4
mov eax, dword [esp + 0x1c]
jmp 0x429779
xor ebx, ebx
push esi
push eax
push ebx
add ebp, ebx
call fcn.0040c0c0
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [ebx + eax*4]
sub ecx, ebx
sar ecx, 2
test ecx, ecx
je 0x42981b
xor esi, esi
nop dword [eax]
movzx eax, byte [esi + 0x4838e0]
mov edx, str.Own_head
xor al, 0x73
sub al, 0x6c
xor al, 0x74
mov byte [esi + 0x4838e0], al
call fcn.00405030
push eax
call fcn.00405240
movzx eax, byte [esi + 0x4838e0]
add esp, 4
add al, 0x4e
mov edx, str.Earth
xor al, 0xdc
mov byte [esi + 0x4838e0], al
call fcn.00405030
push eax
call fcn.00405240
movzx eax, byte [esi + 0x4838e0]
add esp, 4
xor al, 0xac
sub al, 0x65
xor al, 0x22
sub al, 0x73
push 0x431e3c
mov byte [esi + 0x4838e0], al
call fcn.00412b61
xor byte [esi + 0x4838e0], al
add esp, 4
inc esi
cmp esi, 0x4ac
jb 0x4297a0
test ebx, ebx
je 0x429848
sub ebp, ebx
mov eax, ebx
and ebp, 0xfffffffc
cmp ebp, 0x1000
jb 0x42983e
mov ebx, dword [eax - 4]
add ebp, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298a4
push ebp
push ebx
call fcn.0040b0a6
add esp, 8
push 1
push dword [esp + 0x1c]
call fcn.0040b0a6
mov ecx, dword [esp + 0x24]
add esp, 8
test ecx, ecx
je 0x429887
sub edi, ecx
mov eax, ecx
and edi, 0xfffffffc
cmp edi, 0x1000
jb 0x42987d
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4298a4
push edi
push ecx
call fcn.0040b0a6
add esp, 8
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b063
add esp, 0x2c
ret
call fcn.004070a0
call fcn.00401370
call fcn.00412ecf
int3
Function at 0x429a10
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push str.Success_created.
push 0x431e90
mov ebx, ecx
call fcn.00401210
mov edx, str.Success_created.
call fcn.00405030
push eax
call fcn.00405240
push 8
call fcn.0040b076
push 4
mov esi, eax
call fcn.0040b076
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x407730
push 0
push 0
mov dword [eax], 0x4299e0
call fcn.0040f87c
add esp, 0x2c
mov dword [esi], eax
test eax, eax
je 0x429aa3
cmp dword [edi], 0
je 0x429ab0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
je 0x429ab7
push 0
push dword [esi + 4]
push dword [esi]
call fcn.0040a892
add esp, 0xc
test eax, eax
jne 0x429abe
mov dword [esi + 4], eax
mov dword [esi], eax
cmp dword [edi], eax
jne 0x429ac5
push 8
push esi
call fcn.0040b0a6
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push 6
mov dword [edi], 0
call fcn.00407a74
push 1
call fcn.00407a74
push 5
call fcn.00407a74
push 2
call fcn.00407a74
call fcn.004121fb
int3
Function at 0x405e8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ef2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044d8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ea4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405edc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ef9
lea eax, [ebp - 0x10]
call fcn.00404268
ret

Function at 0x40b0e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b11d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404358
jmp 0x40b126
mov eax, ebx
mov edx, esi
call fcn.004042bc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b130
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b151
mov al, byte [esp]
jmp 0x40b153
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b7e8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b650
mov eax, dword [0x489cb8]
cmp byte [eax], 0
je 0x40b864
mov eax, dword [0x489ad4]
call fcn.00402d10
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408814
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b8ac
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b89a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x489a80]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x48a660]
call fcn.004052f8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x42f2d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404728
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42f32c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x489dcc]
mov dl, 1
mov eax, dword [0x42edf8]
call fcn.0040b9a8
call fcn.00403bf4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042ef00
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430c04
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x430b50
call sub.user32.dll_EnumWindows
ret

Function at 0x430d24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x430da1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00430784
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x430d49
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00430384
cmp dword [ebp - 4], 0
je 0x430d8b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404728
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430da8
lea eax, [ebp - 4]
call fcn.00404268
ret
Function at 0x433a44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x48c4e4], 0
je 0x433b93
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x489c58]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x433b93
mov eax, dword [0x48c4e8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x48c4e4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x433b62
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x48c4e4]
call fcn.00413ec8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x433b5a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x433b5a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x433b5a
mov eax, dword [ebp - 0x14]
call fcn.0043c5a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x433b5a
push ebp
call fcn.00433a00
pop ecx
test al, al
jne 0x433b5a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x433b16
mov eax, dword [ebp - 0x14]
call fcn.0043b0d8
dec eax
jle 0x433b5a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403674
cmp byte [ebp - 1], 0
je 0x433b5a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x433b5a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x48c4e8]
call fcn.004331cc
inc edi
dec ebx
jne 0x433aa9
mov eax, dword [0x48c4e8]
cmp dword [eax + 8], 0
jle 0x433b7a
mov eax, dword [0x48c4e8]
call fcn.0043325c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x433b93
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00433868
pop ecx
test al, al
jne 0x433b93
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43712c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x437178
mov eax, esi
call fcn.0044c5dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x437178
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x437178
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4372b7
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4371b8
cmp eax, 0x108
ja 0x4371b8
mov eax, esi
call fcn.0044c5dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4372ae
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4372b7
jmp 0x4372ae
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x437297
cmp eax, 0x20a
ja 0x437297
test byte [esi + 0x50], 0x80
jne 0x4371ea
sub eax, 0x203
je 0x4371e7
sub eax, 3
je 0x4371e7
sub eax, 3
jne 0x4371ea
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4371fe
dec eax
je 0x437213
dec eax
je 0x437230
dec eax
je 0x437213
jmp 0x437237
mov ecx, ebx
mov eax, dword [0x489c58]
mov eax, dword [eax]
mov edx, esi
call fcn.00455d20
jmp 0x4372ae
cmp byte [esi + 0x5d], 1
jne 0x437229
mov eax, esi
mov si, 0xffed
call fcn.00403674
jmp 0x4372b7
or word [esi + 0x54], 1
jmp 0x4372ae
and word [esi + 0x54], 0xfffe
jmp 0x4372ae
mov eax, dword [0x48c4a0]
cmp byte [eax + 0x20], 0
je 0x4372ae
mov eax, dword [0x48c4a0]
cmp dword [eax + 0x1c], 0
je 0x4372ae
mov eax, dword [ebx]
mov edx, dword [0x48c4a0]
cmp eax, dword [edx + 0x1c]
jne 0x4372ae
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044c520
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403674
jmp 0x4372b7
cmp eax, 0xb00b
jne 0x4372ae
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00435a94
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440ca0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x489dc0]
cmp byte [eax + 0xc], 0
je 0x440e0d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x440e06
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48c4f4], 0
jne 0x440cf4
push 0x440e14
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x440e1c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c4f4], eax
cmp dword [0x45a1dc], 0
jne 0x440def
push 0x440e2c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45a1dc], eax
cmp dword [0x45a1dc], 0
je 0x440def
push 0x440e38
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c4f8], eax
push 0x440e48
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c4fc], eax
push 0x440e5c
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c500], eax
push 0x440e74
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c504], eax
push 0x440e8c
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c508], eax
push 0x440ea0
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c50c], eax
push 0x440eb8
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c510], eax
push 0x440ed0
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c514], eax
push 0x440eec
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c518], eax
push 0x440ef8
mov eax, dword [0x45a1dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48c51c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440e0d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444c98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404268
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x444ce7
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044d8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c490
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c4e0]
test si, 4
je 0x44c4a4
or bl, 1
test si, 8
je 0x44c4ae
or bl, 4
test si, 1
je 0x44c4b8
or bl, 8
test si, 2
je 0x44c4c2
or bl, 0x10
test si, 0x10
je 0x44c4cc
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c4db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44c4e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c51c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c4fd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44c50c
or bl, 4
test esi, 0x20000000
je 0x44c517
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x452be0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x452bf2
add esp, 0xfffffff0
call fcn.0040378c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419868
mov eax, dword [0x489a88]
mov dword [eax + 4], ebx
mov dword [eax], 0x452f84
mov eax, dword [0x489a94]
mov dword [eax + 4], ebx
mov dword [eax], 0x452f90
mov eax, ebx
call fcn.00452f9c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411b60]
call fcn.0040343c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411b60]
call fcn.0040343c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411b60]
call fcn.0040343c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411b60]
call fcn.0040343c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411b60]
call fcn.0040343c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44f3b4
push eax
push 0
push 0
mov eax, dword [0x489be0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x424348]
call fcn.004257b0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x424348]
call fcn.004257b0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x424348]
call fcn.004257b0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004533ec
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4532b4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4532b4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4532b4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452d2f
call fcn.004037e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret