joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453db7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57bf70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x453dec
xor eax, eax
jmp 0x453e3f
lea eax, [ebp - 0x210]
push eax
call fcn.00503246
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x453e1d
push 0x559098
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00507975
add esp, 0xc
test eax, eax
jne 0x453de8
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00507975
add esp, 0xc
test eax, eax
jne 0x453de8
lea eax, [ebp - 0x210]
push eax
call fcn.00412da9
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040863f
leave
ret

Function at 0x455c07
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0xf0000000
push ebx
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
push edi
call esi
test eax, eax
je 0x455c2f
cmp dword [edi], 0
jne 0x455c41
push ebx
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push 0
push edi
call esi
cmp dword [edi], 0
je 0x455c65
push dword [ebp + 0xc]
lea esi, [ebp - 8]
push dword [ebp + 8]
call fcn.0045e992
lea eax, [edi + 4]
push eax
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x455c93
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
xor eax, eax
inc eax
push 0
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 3
push ecx
call esi
push 0
lea eax, [ebp + 8]
push eax
push 4
push dword [edi + 4]
call esi
pop esi
pop ebx
leave
ret 8
Function at 0x456a05
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x456b46
push esi
push edi
push 0x53acf8
call fcn.004d66a1
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x456a95
mov esi, dword [ebx + 0x168]
jmp 0x456a81
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456a81
push edi
call fcn.004a7774
push eax
push 0x579550
call fcn.00472f30
pop ecx
pop ecx
test eax, eax
je 0x456a81
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x456a81
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x456a41
lea ecx, [ebx + 0x164]
call fcn.004562c6
jmp 0x456b44
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x456b44
jmp 0x456aab
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.004b6302
mov esi, dword [eax]
test esi, esi
jne 0x456ac4
xor ebx, ebx
jmp 0x456ac7
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456b3a
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x456b3a
test edi, edi
je 0x456b0c
push esi
push 0x579550
call fcn.00472f30
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x539a6c
call fcn.00472f30
pop ecx
pop ecx
test eax, eax
je 0x456b3a
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.004d834f
test eax, eax
jne 0x456b3a
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004e8e58
cmp dword [ebp - 8], 0
jne 0x456aa8
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x458c41
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x458c65
cmp dword [edi + 0x54], 0
jne 0x458c65
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004f9139
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004f97f2
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45f9a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x45f9bc
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0045f6ce
cmpsd dword [esi], dword es:[edi]
and cl, ch
int3
Function at 0x45fd77
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x45fd82
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x45fd7d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x45fd67
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x45fd6f
invalid
cmp edx, ebx
jne 0x45febd
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
enter 0x4d39, 8
enter 0x4d39, 8
jb 0x45fd3e
add eax, dword [eax + 4]
jmp 0x45fd2b
mov dword [ebp + 0xc], ebx
jmp 0x45fd8d
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x45fda5
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x45fdc3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x45fe21
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x45fe08
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x45fe11
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x45fe1b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x45fdfd
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x45fd87
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x45fe6e
dec eax
je 0x45fe65
sub eax, 3
je 0x45fe5c
mov dword [ebp - 4], 0x40
jmp 0x45fe8b
mov dword [ebp - 4], 4
jmp 0x45fe71
mov dword [ebp - 4], 0x20
jmp 0x45fe71
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x45febd
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x45fe3d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0045f6ce
mov edx, eax
mov eax, dword [0x1475ff5a]
push 1
push esi
call edi
mov eax, esi
jmp 0x45fec9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4616c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x461718
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
invalid
mov ch, 0xb8
clc
Function at 0x4628f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x462966
ja 0x462909
cmp esi, dword [esp + 0x20]
jae 0x46296a
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x462925
jb 0x462921
cmp ecx, 0x10000
jae 0x462925
mov edi, ecx
jmp 0x46292a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x462966
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x462966
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x462909
ja 0x462966
cmp esi, dword [esp + 0x20]
jb 0x462909
cmp esi, dword [esp + 0x20]
jne 0x462987
cmp ebp, ebx
jne 0x462987
or esi, ebp
je 0x46297f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x4645e0
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x52a898
call fcn.00505841
lea eax, [ebp - 0x10]
push eax
call fcn.00459854
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
lea eax, [ebp - 0x14]
push str._shm
push eax
lea esi, [ebp - 0x10]
call fcn.004c3234
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [eax]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047510a
lea eax, [ebp - 0x14]
push str._wal
push eax
call fcn.004c3234
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0047510a
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0047510a
call fcn.00505919
ret

Function at 0x468006
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 4
mov eax, 0x5283b2
call fcn.00505841
mov edi, ecx
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov esi, ebx
call fcn.0043c54e
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
mov dword [ebp - 0x10], 1
je 0x4680c3
mov esi, dword [ebx]
call fcn.0044b025
test al, al
je 0x4680c3
mov eax, dword [ebx]
push edi
push dword [ebp + 0x10]
push dword [eax]
call fcn.00503970
mov eax, dword [ebx]
add esp, 0xc
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp + 0x10], edi
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x468080
mov edi, dword [ebp + 0x10]
jmp 0x4680bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4680ba
mov edi, dword [ebp + 0x10]
mov esi, dword [ebx]
call fcn.0044b025
test al, al
je 0x4680ba
mov eax, dword [ebx]
mov eax, dword [eax]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4680c3
xor edi, edi
mov esi, dword [ebx]
call fcn.0044b025
mov eax, ebx
call fcn.00505919
ret 0xc
Function at 0x46ac12
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x57bf70]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x52a0ac
call fcn.00505841
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x1c], esi
call fcn.005038f0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
xor eax, eax
cmp byte [ebp + 0x214], bl
push str.InstallDir
setne al
push str.SoftwareAdvancedSystemRepairPro
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x104
add eax, 0x80000001
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2], cx
push esi
lea ecx, [ebp]
call fcn.004ed4a8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040863f
add ebp, 0x20c
leave
ret
Function at 0x46b4da
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, ecx
mov ecx, 0x104
cmp eax, ecx
ja 0x46b634
je 0x46b65a
cmp eax, 0xa1
jb 0x46b686
cmp eax, 0xa2
jbe 0x46b65a
cmp eax, 0xa3
jbe 0x46b686
cmp eax, 0xa5
jbe 0x46b65a
cmp eax, 0xa6
jbe 0x46b686
cmp eax, 0xa8
jbe 0x46b65a
cmp eax, 0x100
jne 0x46b686
cmp dword [esi + 0x80], 0xffffffff
je 0x46b65a
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x46b65a
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x46b600
dec eax
jne 0x46b65a
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [eax + 1]
add ecx, eax
cmp edi, ecx
jge 0x46b5f8
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x46b5b9
mov eax, dword [esi + 0x7c]
add eax, dword [esi + 0x80]
inc edi
cmp edi, eax
jl 0x46b591
jmp 0x46b5f8
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x1e4], 1
call dword [eax + 0x1ec]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1e8]
mov ecx, eax
call fcn.0043d5ab
push dword [esi + 0x80]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x248]
and dword [esi + 0x1e4], 0
xor eax, eax
inc eax
jmp 0x46b68e
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [ecx + eax - 1]
cmp edi, eax
jle 0x46b5f8
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x46b5b9
dec edi
cmp edi, dword [esi + 0x80]
jg 0x46b611
jmp 0x46b5f8
cmp eax, 0x200
jb 0x46b686
cmp eax, 0x202
jbe 0x46b65a
cmp eax, 0x203
jbe 0x46b686
cmp eax, 0x205
jbe 0x46b65a
add eax, 0xfffffdf9
cmp eax, 1
ja 0x46b686
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x46b670
cmp dword [ecx + 0x20], 0
je 0x46b670
push edi
call fcn.004ccf4e
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x46b686
cmp dword [ecx + 0x20], 0
je 0x46b686
push edi
call fcn.004ccf4e
push edi
mov ecx, esi
call fcn.004222da
pop edi
pop esi
pop ebp
ret 4
Function at 0x47121e
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0xf01ff
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp esi, edi
jne 0x471252
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4712fd
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x47126f
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
jmp 0x47124b
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call edi
test eax, eax
je 0x47124b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
call esi
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x4712e1
mov eax, dword [ebp - 0x18]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x4712b4
mov ecx, 0x2710
cmp eax, ecx
jbe 0x4712b6
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 8]
call edi
test eax, eax
je 0x4712e7
cmp dword [ebp - 0x1c], ebx
ja 0x47128e
call esi
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
ja 0x4712e7
cmp dword [ebp - 0x2c], 2
je 0x471298
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
mov eax, 0x3e8
pop ebx
pop edi
xor edx, edx
pop esi
leave
ret
Function at 0x472bbf
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x57bf70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x472bf8
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x472c1f
cmp dword [0x57fd78], 0
jne 0x472c1f
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x472c12
push 0x12
call esi
test bx, ax
je 0x472c16
mov eax, edi
jmp 0x472c8e
push edi
call fcn.005087bf
pop ecx
jmp 0x472c8e
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005038f0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x472c48
call fcn.004fa6c5
call fcn.004f6d7c
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040863f
leave
ret 4
Function at 0x4734f5
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push 0x30
mov eax, 0x52887c
call fcn.00505841
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf003f
push esi
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x4735fd
push 0x2c
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x4735fd
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push ebx
call esi
test eax, eax
je 0x4735e8
cmp dword [ebp - 0x38], 1
je 0x4735fd
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x473599
push dword [ebp - 0x24]
call edi
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
call esi
test eax, eax
je 0x4735e8
cmp dword [ebp - 0x38], 1
je 0x4735e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2bf20
ja 0x4735e8
cmp dword [ebp - 0x38], 3
je 0x47356b
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4735e8
jmp 0x4735e2
push 0x3e8
call edi
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
call esi
test eax, eax
je 0x4735e8
cmp dword [ebp - 0x38], 1
je 0x4735e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2bf20
ja 0x4735e8
cmp dword [ebp - 0x38], 1
jne 0x4735b2
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x18]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0047510a
call fcn.00505919
ret

Function at 0x475054
Capabilities:
Enumerate processes

Disassembly:
push 0x234
mov eax, 0x52884c
call fcn.005058aa
and dword [ebp - 0x23c], 0
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.005038f0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x240], esi
and dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x4750d9
lea eax, [ebp - 0x23c]
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4750d5
mov eax, dword [ebx]
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.005045e5
pop ecx
pop ecx
test eax, eax
je 0x4750f0
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4750b3
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4750e8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
call fcn.0050592d
ret
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4750ff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4750ea
Function at 0x4763a3
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x581a30], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x4763d2
or dword [0x581a30], 1
mov ecx, 0x581a2c
call fcn.004cbfe8
push 0x52cbd5
call fcn.0050429f
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4763de
call fcn.004fa6c5
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x476457
cmp dword [eax + 0x20], 0
je 0x476457
test eax, eax
je 0x4763f5
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x476457
mov eax, dword [edi + 4]
dec eax
je 0x476436
dec eax
je 0x47640c
dec eax
jne 0x476457
mov esi, 0x428e
jmp 0x47643b
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x47643b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x47643b
add esi, 3
jmp 0x47643b
mov esi, 0x3ea0
push esi
mov ecx, 0x581a2c
call fcn.00405c95
test eax, eax
je 0x4763d9
mov eax, dword [0x581a2c]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x476459
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x47a5da
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x57bf70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.004c2a1c
mov ebx, eax
cmp ebx, esi
je 0x47a647
lea ecx, [ebp - 0x20c]
call fcn.0047e8d3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040863f
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x47a665
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0047a5da
cmp eax, esi
jne 0x47a6ac
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], pe_nt_image_headers32
call ebx
test eax, eax
je 0x47a64f
lea ecx, [ebp - 0x20c]
call fcn.0047e8d3
push dword [ebp - 0x214]
mov ecx, edi
call fcn.004b9605
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0047e8d3
mov eax, esi
jmp 0x47a636