joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f894
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x1003f8ab
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x1003f8e5
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.1003d676
pop ecx
push esi
call fcn.1003d75a
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.1003d676
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.1003d75a
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.1003d676
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.1003d6df

Function at 0x1003f96a
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1003f98f
push 0xffffffffffffff99
pop edi
jmp 0x1003f9d1
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1003f9a5
push 0xffffffffffffff98
jmp 0x1003f98c
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.1003a9fe
push 0x100
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.1003f9d6
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x1003f9ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x1003faaf
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x1003fbff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.1003f9ff
dec edi
jne 0x1003fcb5
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x1003fcc6
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x1003fce0
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003fd08
mov edx, esi
call fcn.1003fb77
leave
ret
Function at 0x1003fd0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x1003fd94
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.1003f9ff
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x1003fd29
cmp dword [ebp + 0xc], 0
je 0x1003fe13
lea eax, [esi + 0x44]
call fcn.1003f9ff
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x1003fe13
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x1003fe01
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043376
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005ae00]
jne 0x10043380
repz ret
jmp fcn.100435be
Function at 0x40150c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x144
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401540
mov eax, 0
jmp 0x4015e1
lea edx, [ebp - 0x138]
mov eax, 0
mov ecx, 0x4a
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4015c8
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x138]
add eax, 0x24
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4015ad
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x130]
jmp 0x4015e1
lea eax, [ebp - 0x138]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40157b
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 0
mov edi, dword [ebp - 4]
leave
ret

Function at 0x40163f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], str.Launching_Pixel_Gun_3D_via_Steam...
mov dword [esp], 0xb
call sym._out
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.steam:__rungameid_2524890
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
nop
leave
ret
Function at 0x4019ba
Capabilities:
Set console window title

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x344
call sym.___main
mov dword [esp], str.PG3D_Simple_DLL_Injector
call sym._SetConsoleTitleA_4
sub esp, 4
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._strncpy
mov byte [ebp - 0x119], 0
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401a4f
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov dword [esp + 0x10], str.AsteroidPC.dll
lea eax, [ebp - 0x21c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x320]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [ebp - 0x320]
mov dword [esp], eax
call sym._fileExists
xor eax, 1
test al, al
je 0x401ae6
mov dword [esp + 4], str.DLL_file_not_found.
mov dword [esp], 0xc
call sym._out
mov dword [esp + 4], str.AsteroidPC.dll
mov dword [esp], str._s__n
call sym._printf
mov dword [esp + 4], str.Ensure_that_the_DLL_is_in_the_same_folder_as_the_injector.
mov dword [esp], 0xb
call sym._out
mov dword [esp], 0xa
call sym._countdown
mov eax, 1
jmp 0x401c49
mov dword [esp + 4], str.Checking_if_Pixel_Gun_3D_is_already_running...
mov dword [esp], 0xb
call sym._out
mov dword [esp], str.Pixel_Gun_3D.exe
call sym._GetProcessID
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401b60
mov dword [esp + 4], str.Pixel_Gun_3D_not_found._Launching_the_game...
mov dword [esp], 0xe
call sym._out
call sym._launchGame
mov dword [esp + 4], str.Waiting_for_Pixel_Gun_3D_to_start...
mov dword [esp], 0xe
call sym._out
mov dword [esp], 0x7d0
call sym._Sleep_4
sub esp, 4
mov dword [esp], str.Pixel_Gun_3D.exe
call sym._GetProcessID
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401b28
mov dword [esp + 4], str.Pixel_Gun_3D_process_found_
mov dword [esp], 0xb
call sym._out
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x43a
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401bc5
mov dword [esp + 4], str.Error_opening_Pixel_Gun_3D_process.
mov dword [esp], 0xc
call sym._out
mov dword [esp], 0xa
call sym._countdown
mov eax, 1
jmp 0x401c49
lea eax, [ebp - 0x320]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._injectDLL
xor eax, 1
test al, al
je 0x401c16
mov dword [esp + 4], str.DLL_injection_failed.
mov dword [esp], 0xc
call sym._out
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], 0xa
call sym._countdown
mov eax, 1
jmp 0x401c49
mov dword [esp + 4], str.DLL_injected_successfully.
mov dword [esp], 0xb
call sym._out
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], 0xa
call sym._countdown
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402350
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x40239b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402394
test esi, esi
je 0x402394
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402370
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402580
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4025d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4026a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40260e
cmp eax, 4
jne 0x402630
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40261e
cmp edx, 4
je 0x40261e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402580
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor bl, bl
call esi
mov ecx, 0x8000
test cx, ax
je 0x40116a
mov bl, 2
push 0x10
call esi
mov edx, 0x8000
test dx, ax
je 0x40117b
or bl, 4
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x40118c
or bl, 1
push 0x5b
call esi
mov edx, 0x8000
test dx, ax
jne 0x4011a8
push 0x5c
call esi
mov ecx, 0x8000
test cx, ax
je 0x4011ab
or bl, 8
pop esi
mov al, bl
pop ebx
ret

Function at 0x401890
Capabilities:
Delete file

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00403590
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0049e9f0
mov eax, dword [esi + 4]
xor ecx, ecx
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x4019cb
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4018f8
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov word [esp + 0x18], dx
test ecx, ecx
jl 0x4019e3
cmp ecx, eax
jge 0x4019e3
mov eax, dword [esi]
mov esi, dword [eax + ecx*4]
cmp dword [esi + 4], 3
je 0x40199e
push ebx
push str.Key_d
lea ecx, [esp + 0x20]
push 0x20
push ecx
call fcn.004011e0
mov edx, dword [esi + 4]
push edx
lea eax, [esp + 0x6c]
push 0x4b996c
push eax
inc ebx
call ebp
add esp, 0x1c
push edi
lea ecx, [esp + 0x5c]
push ecx
push str.Type
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x5c]
push 0x4b996c
push ecx
call ebp
add esp, 0xc
push edi
lea edx, [esp + 0x5c]
push edx
push 0x4b9990
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push edi
add ecx, ecx
push ecx
push edx
push str.KeyData
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push str.Action
lea eax, [esp + 0x1c]
push eax
push edi
mov ecx, esi
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
inc ecx
cmp ecx, eax
mov dword [esp + 0x10], ecx
jl 0x4018f0
pop ebp
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x8c
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x402740
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x94
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x90], eax
push ebp
mov dword [esp + 8], ecx
call fcn.00403590
mov ebp, eax
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0049e9f0
push 0
push str.Key_d
lea edx, [esp + 0x28]
push 0x20
push edx
mov dword [esp + 0x20], 0
call fcn.004011e0
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x7a]
push ecx
mov word [esp + 0x7c], ax
call fcn.0049e9f0
add esp, 0x28
push ebp
push 0x1f
lea edx, [esp + 0x5c]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x54], 0
je 0x40292d
push ebx
push esi
push edi
lea esp, [esp]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebp
push 0xbc614e
push str.Type
lea ecx, [esp + 0x2c]
push ecx
call esi
mov edi, eax
cmp edi, 0xbc614e
je 0x4028d5
test edi, edi
je 0x4028d5
push ebp
push 0xbc614e
push 0x4b9990
lea edx, [esp + 0x2c]
push edx
call esi
mov esi, eax
cmp esi, 0xbc614e
je 0x4028d5
test esi, esi
je 0x4028d5
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049f212
add esp, 4
mov ebx, eax
push ebp
lea eax, [esi + esi]
push eax
push ebx
push str.KeyData
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
test eax, eax
jne 0x40286a
push ebx
call fcn.0049f207
add esp, 4
jmp 0x4028d5
mov ecx, dword [esp + 0x14]
push edi
call fcn.00402410
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [ebx + 4], edi
test esi, esi
jle 0x402896
mov edi, dword [esp + 0x18]
push edi
lea ecx, [ebx + 8]
call fcn.00401dd0
add edi, 2
sub esi, 1
jne 0x402885
mov edx, dword [esp + 0x18]
push edx
call fcn.0049f207
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
add esp, 4
push str.Action
lea ecx, [esp + 0x24]
push ecx
push ebp
mov ecx, ebx
call edx
test al, al
jne 0x4028c7
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
jmp 0x4028d5
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.00442c80
mov eax, dword [esp + 0x10]
inc eax
push eax
push str.Key_d
lea ecx, [esp + 0x28]
push 0x20
push ecx
mov dword [esp + 0x20], eax
call fcn.004011e0
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x7a]
push eax
mov word [esp + 0x7c], dx
call fcn.0049e9f0
add esp, 0x1c
push ebp
push 0x1f
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x60], 0
jne 0x4027d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
pop ebp
xor ecx, esp
call fcn.0049e9d2
add esp, 0x94
ret