joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da25b
Capabilities:
Get file system object information

Disassembly:
push 0x270
mov eax, 0x559477
call fcn.00539379
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00405790
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x560370
call fcn.0041a95b
cmp eax, 0xffffffff
jne 0x4da340
push 0
push 0x55ff44
lea ecx, [ebp - 0x278]
call fcn.0041a95b
cmp eax, 0xffffffff
jne 0x4da340
push 0
push 0x560864
lea ecx, [ebp - 0x278]
call fcn.0041a95b
cmp eax, 0xffffffff
jne 0x4da340
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00405790
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x27c], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x114]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4da31c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00407430
jmp 0x4da36f
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.0040ab60
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00407430
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4da366
mov ebx, dword [ebp - 0x274]
jmp 0x4da36f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00407430
mov eax, ebx
call fcn.00539328
ret
Function at 0x4fde71
Capabilities:
Get common file path

Disassembly:
push 0x120
mov eax, 0x55b054
call fcn.00539379
mov ebx, ecx
mov dword [ebp - 0x12c], ebx
call fcn.0051b43e
push 0x1c4
call fcn.0040ffbb
pop ecx
mov dword [ebp - 0x128], eax
and dword [ebp - 4], 0
test eax, eax
je 0x4fdeb4
push 0
push dword [ebx + 0x60]
mov ecx, eax
call fcn.0051ba6b
jmp 0x4fdeb6
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.0051a8b9
call fcn.00420c5f
mov esi, 0x104
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x8c]
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x114]
push eax
call fcn.00537130
mov edi, eax
pop ecx
mov byte [ebp + edi - 0x114], 0x5c
inc edi
cmp edi, esi
jae 0x4fe0d3
xor eax, eax
mov byte [ebp + edi - 0x114], 0
mov dword [ebp - 0x128], eax
test ebx, ebx
je 0x4fe0cd
xor esi, esi
mov dword [ebp - 0x120], esi
cmp dword [ebx + 4], eax
jle 0x4fe0cd
call fcn.00411269
push eax
lea ecx, [ebp - 0x118]
call fcn.00404bf0
mov eax, dword [ebx]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x114]
push edi
push ecx
push esi
lea ecx, [ebp - 0x118]
push ecx
mov ecx, ebx
call dword [eax + 0xc]
test eax, eax
je 0x4fe0ab
push 0x571964
mov esi, 0x571968
lea ecx, [ebp - 0x118]
push esi
call fcn.0044d5eb
push esi
push 0x568c0c
lea ecx, [ebp - 0x118]
call fcn.0044d5eb
push esi
push 0x571964
lea ecx, [ebp - 0x118]
call fcn.0044d5eb
call fcn.00411269
push eax
lea ecx, [ebp - 0x124]
call fcn.00404bf0
mov eax, dword [ebp - 0x128]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4fdfd7
push dword [ebp - 0x118]
lea eax, [ebp - 0x124]
push str.10__s
push eax
call fcn.0040a4d0
add esp, 0xc
jmp 0x4fe009
jge 0x4fdff7
push dword [ebp - 0x118]
inc eax
push eax
lea eax, [ebp - 0x124]
push str._d__s
push eax
call fcn.0040a4d0
add esp, 0x10
jmp 0x4fe009
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x124]
call fcn.00409ce0
push 0x1c4
call fcn.0040ffbb
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4fe033
mov ecx, eax
call fcn.004a8855
mov ecx, eax
mov dword [ebp - 0x11c], eax
jmp 0x4fe03b
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov eax, dword [ecx]
mov esi, dword [ebp - 0x124]
push esi
mov byte [ebp - 4], 2
call dword [eax + 0xb4]
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x120]
add eax, 0xe110
push eax
mov edx, dword [ecx]
call dword [edx + 0xb0]
push dword [ebp - 0x120]
mov ecx, ebx
call fcn.0041be1b
mov ecx, dword [ebp - 0x11c]
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc8]
mov ecx, dword [ebp - 0x11c]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.0051a8b9
inc dword [ebp - 0x128]
lea ecx, [esi - 0x10]
call fcn.00407430
mov esi, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00407430
inc esi
mov dword [ebp - 0x120], esi
cmp esi, dword [ebx + 4]
jl 0x4fdf2c
call fcn.00539328
ret
call fcn.00535506
int3
Function at 0x549943
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5afec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0053cb1b
mov dword [ebp - 0x14], eax
cmp dword [0x5bbe3c], esi
jne 0x549a36
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5499c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x549b16
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x549b16
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x549b16
push eax
call ebx
push 0x58e0d8
push edi
mov dword [0x5bbe3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x58e0e8
push edi
mov dword [0x5bbe40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5bbe44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bbe4c], eax
test eax, eax
je 0x549a33
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bbe48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x549a5b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x549a4e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x549a70
push 4
pop eax
jmp 0x549b18
cmp dword [ebp - 0x14], esi
je 0x549a70
push dword [0x5bbe3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x549a55
mov eax, dword [0x5bbe48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x549ace
cmp dword [0x5bbe4c], edi
je 0x549ace
push eax
call ebx
push dword [0x5bbe4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x549ace
test eax, eax
je 0x549ace
call ecx
test eax, eax
je 0x549ac3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x549ac3
test byte [ebp - 8], 1
jne 0x549ace
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x549afe
mov eax, dword [0x5bbe40]
cmp eax, edi
je 0x549afb
push eax
call ebx
test eax, eax
je 0x549afb
call eax
mov esi, eax
test esi, esi
je 0x549afb
mov eax, dword [0x5bbe44]
cmp eax, edi
je 0x549afb
push eax
call ebx
test eax, eax
je 0x549afb
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5bbe3c]
call ebx
test eax, eax
je 0x549b16
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x549b18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00535234
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x233e37bc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x29423cf7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x474020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403898
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403878
xor eax, eax
push ebp
push 0x403871
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403878
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x474020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x474020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4046d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x476048], 0
je 0x404735
cmp word [0x47621c], 0xd7b2
jne 0x4046fd
cmp dword [0x476224], 0
jbe 0x4046fd
mov eax, 0x476218
call dword [0x476234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40475c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47402c], 0
jne 0x404751
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408388
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4083da
test eax, edx
je 0x4083dd
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40839d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4083c3
add ecx, 4
js 0x4083b3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4083c0
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4083e9
test edx, edx
jne 0x408390
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b728
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b761
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404944
jmp 0x40b76a
mov eax, ebx
mov edx, esi
call fcn.004048a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b774
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b796
movzx eax, byte [esp]
jmp 0x40b798
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40be28
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bca0
mov eax, dword [0x475a9c]
cmp byte [eax], 0
je 0x40bea4
mov eax, dword [0x4758c0]
call fcn.004031c8
call fcn.00402fac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408ea8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40beec
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40beda
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x475868]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4787f4]
call fcn.004059ac
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c750
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c826
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004048ec
lea eax, [ebp - 4]
call fcn.00404d3c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ce4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c810
mov eax, ebx
call fcn.00402e50
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c809
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ce4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c7f3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c838
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c7f3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c810
mov eax, dword [ebp - 0x10]
call fcn.00402e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c82d
lea eax, [ebp - 4]
call fcn.00404854
ret

Function at 0x41b3ac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x47a9e8
cmp dword [edi], 0
jne 0x41b428
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x47a9e4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x474ad4
mov ecx, 2
call fcn.00403040
mov edx, 0x41b384
lea eax, [esi + 5]
call fcn.0041b3a4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b3a4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b3fd
mov dword [0x47a9e4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d978
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404ce4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41d9d0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x475bac]
mov dl, 1
mov eax, dword [0x41d484]
call fcn.0040bfe8
call fcn.0040429c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d58c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41e82c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e832
ret
Function at 0x43199c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404854
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4319ea
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404ac4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435a6c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435b9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41d4e4]
call fcn.0041d5b4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x435b75
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041d654
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404ac4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x435bb4
call fcn.00404b6c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041d6b8
lea ecx, [ebp - 4]
mov edx, 0x435bf0
mov eax, dword [ebp - 0xc]
call fcn.0041d900
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d970
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x435b58
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x435bfc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x47551c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435b5f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x435c4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x435c93
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435c76
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435c87
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x435c93
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x43ac5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x47ac4c], 0
je 0x43ada5
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x475a38]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x43ada5
mov eax, dword [0x47ac50]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x47ac4c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43ad74
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x47ac4c]
call fcn.00414440
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43ad6c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x43ad6c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43ad6c
mov eax, dword [ebp - 0x14]
call fcn.0044544c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43ad6c
push ebp
call fcn.0043ac18
pop ecx
test al, al
jne 0x43ad6c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403bfc
test al, al
je 0x43ad6c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403bfc
cmp byte [ebp - 1], 0
je 0x43ad6c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43ad6c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47ac50]
call fcn.0043a388
inc edi
dec ebx
jne 0x43acc1
mov eax, dword [0x47ac50]
cmp dword [eax + 8], 0
jle 0x43ad8c
mov eax, dword [0x47ac50]
call fcn.0043a440
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43ada5
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043aa7c
pop ecx
test al, al
jne 0x43ada5
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442348
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406674
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0043cfe4
test ebx, ebx
jne 0x44239b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00442284
mov ebx, eax
test ebx, ebx
je 0x442486
cmp esi, ebx
je 0x4423c4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4423d9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x442411
add eax, 0xffffff5f
sub eax, 2
jb 0x442429
dec eax
sub eax, 2
jb 0x44243d
dec eax
sub eax, 2
jb 0x442433
jmp 0x442447
add eax, 0xfffffdff
sub eax, 2
jb 0x442429
dec eax
sub eax, 2
jb 0x44243d
dec eax
sub eax, 2
jb 0x442433
jmp 0x442447
mov byte [esp + 0x120], 0
jmp 0x44244f
mov byte [esp + 0x120], 2
jmp 0x44244f
mov byte [esp + 0x120], 1
jmp 0x44244f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004502f0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0043e7a4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x442488
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x44a7dc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x475ba0]
cmp byte [eax + 0xc], 0
je 0x44a949
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a942
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47ac5c], 0
jne 0x44a830
push 0x44a950
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44a958
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac5c], eax
cmp dword [0x475660], 0
jne 0x44a92b
push 0x44a968
call sub.kernel32.dll_LoadLibraryA
mov dword [0x475660], eax
cmp dword [0x475660], 0
je 0x44a92b
push 0x44a974
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac60], eax
push 0x44a984
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac64], eax
push 0x44a998
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac68], eax
push 0x44a9b0
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac6c], eax
push 0x44a9c8
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac70], eax
push 0x44a9dc
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac74], eax
push 0x44a9f4
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac78], eax
push 0x44aa0c
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac7c], eax
push 0x44aa28
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac80], eax
push 0x44aa34
mov eax, dword [0x475660]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x47ac84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a949
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret