joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4132da
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor ecx, ecx
mov eax, dword [ecx*8 + 0x469430]
test eax, eax
je 0x4132f6
cmp eax, ebx
je 0x413313
inc ecx
cmp ecx, 0xa
jl 0x4132e1
cmp ecx, 0xa
jl 0x4132fe
push 9
pop ecx
mov eax, dword [esp + 0xc]
test eax, eax
push esi
lea esi, [ecx*8 + 0x469430]
je 0x413332
mov dword [esi + 4], eax
jmp 0x413368
mov edx, dword [esp + 0xc]
test edx, edx
je 0x413329
lea eax, [ecx*8 + 0x469434]
cmp dword [eax], 0
jne 0x413329
mov dword [eax], edx
mov eax, dword [ecx*8 + 0x469434]
pop ebx
ret
and dword [esi + 4], 0
push edi
push 0x20
pop edi
push ebx
push edi
call dword [sym.imp.USER32.dll_VkKeyScanExA]
cmp ax, 0xffff
je 0x413352
and ax, 0x600
cmp ax, 0x600
je 0x41335d
inc edi
cmp edi, 0x100
jl 0x41333a
jmp 0x413364
mov dword [esi + 4], 3
mov eax, dword [esi + 4]
pop edi
mov dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x413851
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov ebx, 0x80000000
cmp ecx, ebx
je 0x4139be
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, ebx
je 0x4139bd
mov edx, dword [0x469480]
cmp edx, 2
jne 0x4138b5
push eax
mov al, byte [ebp + 0x18]
neg al
push ecx
push 0
sbb eax, eax
and eax, ebx
or eax, 1
push eax
call fcn.00411eab
add esp, 0x10
call fcn.00412422
cmp byte [ebp + 0x18], 0
je 0x4139bd
mov dword [esi], ebx
mov dword [edi], ebx
jmp 0x4139bd
mov eax, dword [ebp + 0x10]
or word [eax], 0x8001
cmp byte [ebp + 0x18], 0
je 0x4138ff
cmp edx, 1
jne 0x4138eb
cmp dword [0x469400], ebx
jne 0x4138db
push 0x469400
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x469400]
add dword [esi], eax
mov eax, dword [0x469404]
add dword [edi], eax
jmp 0x413916
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
add dword [esi], eax
mov eax, dword [ebp - 8]
jmp 0x4138e7
mov eax, dword [0x465108]
test byte [eax + 0xc8], 2
jne 0x413916
push edi
push esi
call fcn.00439c0e
pop ecx
pop ecx
cmp dword [0x469480], 1
jne 0x41392d
mov eax, dword [esi]
mov dword [0x469400], eax
mov eax, dword [edi]
mov dword [0x469404], eax
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 8], eax
mov eax, dword [esi]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
inc eax
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
inc eax
test ebx, ebx
mov dword [edi], eax
jl 0x4139a6
cmp ebx, 0x64
jle 0x413968
push 0x64
pop ebx
test ebx, ebx
je 0x4139a6
cmp dword [0x469480], 1
je 0x4139a6
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
push ebx
push dword [edi]
push dword [esi]
inc eax
push eax
mov eax, dword [ebp - 0xc]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
inc eax
push eax
call fcn.0042b54c
add esp, 0x14
jmp 0x4139bd
push eax
push dword [esi]
push 0
push 0x8001
call fcn.0041380d
add esp, 0x10
call fcn.00412422
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413e9c
Capabilities:
Log keystrokes

Disassembly:
push esi
movzx esi, byte [esp + 8]
mov ecx, esi
mov eax, 0x90
cmp ecx, eax
jg 0x413f22
je 0x413f18
sub ecx, 0x5b
cmp ecx, 0x14
ja case.0x413ebb.93
jmp dword [ecx*4 + 0x413fc8]
mov eax, 0x15b
jmp 0x413fb4
mov eax, 0x15c
jmp 0x413fb4
push 0x52
jmp 0x413f58
push 0x4f
jmp 0x413f58
push 0x50
jmp 0x413f58
push 0x51
jmp 0x413f58
push 0x4b
jmp 0x413f58
push 0x4c
jmp 0x413f58
push 0x4d
jmp 0x413f58
push 0x47
jmp 0x413f58
push 0x48
jmp 0x413f58
push 0x49
jmp 0x413f58
push 0x53
jmp 0x413f58
mov eax, 0x135
jmp 0x413fb4
push 0x37
jmp 0x413f58
push 0x4a
jmp 0x413f58
push 0x4e
jmp 0x413f58
mov eax, 0x145
jmp 0x413fb4
sub ecx, 0xa0
je 0x413f56
dec ecx
je 0x413f4f
dec ecx
je 0x413f4b
dec ecx
je 0x413f44
dec ecx
je 0x413f40
dec ecx
jne case.0x413ebb.93
mov eax, 0x138
jmp 0x413fb4
push 0x38
jmp 0x413f58
mov eax, 0x11d
jmp 0x413fb4
push 0x1d
jmp 0x413f58
mov eax, 0x136
jmp 0x413fb4
push 0x2a
pop eax
jmp 0x413fb4
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ax, ax
jne 0x413f6b
pop esi
ret
cmp esi, 0x2e
jg 0x413fa0
cmp esi, 0x2d
jge 0x413f90
cmp esi, 3
je 0x413faf
cmp esi, 0xd
je 0x413f90
cmp esi, 0x20
jle 0x413fb4
cmp esi, 0x28
jle 0x413f90
cmp esi, 0x2c
je 0x413faf
jmp 0x413fb4
cmp byte [esp + 0xc], 0
movzx eax, ax
je 0x413fc6
or ax, 0x100
pop esi
ret
sub esi, 0x5d
je 0x413faf
sub esi, 0x12
je 0x413faf
sub esi, 0x21
jne 0x413fb4
or eax, 0x100
mov cl, byte [esp + 0xc]
neg cl
movzx eax, ax
sbb ecx, ecx
not ecx
and ecx, eax
mov ax, cx
pop esi
ret
Function at 0x414070
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebp
xor ebp, ebp
cmp dword [0x469480], ebp
push esi
push edi
je 0x414088
mov al, byte [0x469408]
jmp 0x4141f4
cmp dword [0x467388], ebp
je 0x41409a
mov al, byte [0x467270]
jmp 0x4141f4
push ebx
xor bl, bl
cmp byte [0x468399], bl
jne 0x414138
cmp byte [0x46839a], bl
jne 0x414138
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x4140cf
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x4140de
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x4140ed
or bl, 1
push 0xa3
call edi
test si, ax
je 0x4140fc
or bl, 2
push 0xa4
call edi
test si, ax
je 0x41410b
or bl, 4
push 0xa5
call edi
test si, ax
je 0x41411a
or bl, 8
push 0x5b
call edi
test si, ax
je 0x414126
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x4141b3
or bl, 0x80
jmp 0x4141b3
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x41415b
push 0x10
call ebp
test si, ax
je 0x41415d
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x41416f
push 0x11
call ebp
test si, ax
je 0x414172
or bl, 1
push 0x12
call edi
test si, ax
jne 0x414184
push 0x12
call ebp
test si, ax
je 0x414187
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x414199
push 0x5b
call ebp
test si, ax
je 0x41419c
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x4141ae
push 0x5c
call ebp
test si, ax
je 0x4141b1
or bl, 0x80
xor ebp, ebp
cmp dword [0x467388], ebp
je 0x4141ef
mov al, bl
not al
and al, byte [0x467270]
je 0x4141ef
not al
and byte [0x467272], al
and byte [0x467270], al
and byte [0x467271], al
xor eax, eax
mov al, byte [0x467272]
push eax
push 0x467278
call fcn.00412040
pop ecx
pop ecx
xor eax, eax
mov al, bl
pop ebx
push 0xffc3d44f
push 1
push ebp
mov byte [esp + 0x18], al
push ebp
push dword [esp + 0x1c]
and eax, 0xffffffc4
or eax, 4
push eax
call fcn.004126cc
mov eax, dword [esp + 0x2c]
mov esi, eax
movsx eax, byte [eax]
add esp, 0x18
mov edi, 0xffc3d44d
jmp 0x41423c
cmp al, 0x39
jg 0x414240
push edi
push ebp
add al, 0x30
push ebp
push ebp
push eax
push 2
call fcn.00412cfd
add esp, 0x18
inc esi
mov al, byte [esi]
cmp al, 0x30
jge 0x414224
push edi
push ebp
push ebp
push ebp
push 0x12
push 1
call fcn.00412cfd
add esp, 0x18
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x415646
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x10]
jge 0x41565e
mov byte [ebp - 0x10], 0x30
lea eax, [ebp - 0xf]
push 0xa
push eax
movzx eax, byte [ebp + 8]
push eax
call fcn.0040125c
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jle 0x415702
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 8], eax
cmp dword [0x469480], ebx
jne 0x4156d5
call esi
sub eax, dword [0x4681ac]
mov ecx, dword [0x465108]
cmp eax, dword [ecx + 0xb0]
jbe 0x4156d5
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4156ce
push 1
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], 1
call esi
mov dword [0x4681ac], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00414070
cmp dword [0x469480], 2
mov eax, dword [0x465108]
pop ecx
jne 0x4156f2
mov eax, dword [eax + 0x60]
jmp 0x4156f5
mov eax, dword [eax + 0x5c]
push eax
call fcn.004123cc
dec dword [ebp + 8]
pop ecx
jne 0x415683
pop esi
pop ebx
leave
ret

Function at 0x415c53
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ecx
movzx eax, byte [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push eax
call ebp
mov ecx, dword [esp + 0x18]
and al, 1
neg al
sbb eax, eax
xor edi, edi
inc eax
inc eax
inc edi
cmp ecx, edi
mov dword [esp + 0xc], eax
je 0x415c85
cmp ecx, 2
jne 0x415d50
cmp eax, ecx
je 0x415d50
push ebx
xor ebx, ebx
cmp byte [esp + 0x18], 0x90
push esi
mov esi, 0xffc3d44d
jne 0x415cc1
cmp byte [0x468399], bl
je 0x415caf
call fcn.00415d55
jmp 0x415d4a
push esi
push ebx
push ebx
push ebx
push 0x90
push edi
call fcn.00412cfd
add esp, 0x18
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
push 2
call fcn.00412cfd
add esp, 0x18
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x467c9c]
sete byte [esp + 0x13]
cmp byte [esp + 0x13], bl
je 0x415d08
push edi
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], edi
cmp byte [esp + 0x1c], 0x14
jne 0x415d4a
cmp dword [esp + 0x20], 2
jne 0x415d4a
push 0x14
call ebp
test al, 1
je 0x415d4a
push esi
push ebx
push ebx
push ebx
push 0x10
push 2
call fcn.00412cfd
add esp, 0x18
cmp byte [esp + 0x13], bl
je 0x415d4a
push edi
push 0xffffffffffffffff
mov dword [0x46506c], ebx
call fcn.0040de6e
pop ecx
pop ecx
mov dword [0x46506c], edi
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
pop ecx
ret
Function at 0x415d7e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x467c8c]
test eax, eax
je 0x415e8c
mov ecx, dword [0x467c90]
mov dl, byte [ebp + 8]
imul ecx, ecx, 0x70
mov byte [ecx + eax + 5], dl
mov eax, dword [0x467c90]
mov ecx, dword [0x467c8c]
imul eax, eax, 0x70
mov dl, byte [ebp + 0xc]
mov byte [eax + ecx], dl
mov eax, dword [0x467c90]
mov ecx, dword [0x467c8c]
imul eax, eax, 0x70
mov dx, word [ebp + 0x10]
mov word [eax + ecx + 2], dx
mov eax, dword [0x467c90]
mov ecx, dword [0x467c8c]
imul eax, eax, 0x70
push esi
mov byte [eax + ecx + 4], 0x69
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x467c94], eax
sub eax, dword [0x4683b4]
test eax, eax
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jge 0x415dff
fadd dword [0x45babc]
mov eax, dword [0x467c90]
fmul dword [0x45bab8]
mov ecx, dword [0x467c8c]
imul eax, eax, 0x70
fstp dword [eax + ecx + 8]
mov eax, dword [0x467c94]
mov dword [0x4683b4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x467c8c]
mov esi, eax
mov eax, dword [0x467c90]
imul eax, eax, 0x70
test esi, esi
je 0x415e5a
cmp esi, dword [0x467c98]
je 0x415e53
push 0x64
lea eax, [eax + ecx + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x415e6b
mov byte [eax + ecx + 0xc], 0
jmp 0x415e6b
lea eax, [eax + ecx + 0xc]
push 0x45bab4
push eax
call fcn.00457a80
pop ecx
pop ecx
inc dword [0x467c90]
mov eax, dword [0x467c90]
cmp eax, dword [0x465070]
mov dword [0x467c98], esi
pop esi
jl 0x415e8c
and dword [0x467c90], 0
leave
ret

Function at 0x415edb
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x466208]
jne 0x415ee8
call fcn.00450529
mov eax, dword [0x469498]
mov ecx, dword [eax]
add dword [0x469498], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x415f1f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x466208]
jne 0x415f2c
call fcn.00450529
mov eax, dword [0x469498]
mov ecx, dword [eax]
add dword [0x469498], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x415f61
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x466208]
jne 0x415f6f
call fcn.00450529
mov eax, dword [0x469498]
mov eax, dword [eax]
add dword [0x469498], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x415fb5
fadd qword [0x45c0c0]
fmul qword [0x45c0b8]
pop ecx
ret
Function at 0x415fbd
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
inc esi
mov dword [0x4694a0], eax
push edi
mov edx, esi
mov eax, 0x4694a0
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x469e5c
jl 0x415fd2
pop edi
mov dword [0x466208], esi
mov dword [0x469e60], esi
pop esi
ret

Function at 0x417d3e
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.00444014
mov eax, dword [0x467390]
test eax, eax
pop ecx
pop ecx
je 0x417d63
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x466200]
push esi
xor esi, esi
cmp word [eax], si
jbe 0x417d8f
mov ecx, dword [esi*4 + 0x468428]
test ecx, ecx
je 0x417d82
push 1
call fcn.0040ff39
mov eax, dword [0x466200]
movzx eax, word [eax]
inc esi
cmp esi, eax
jl 0x417d70
push dword [esp + 8]
call fcn.0043e0fc
pop esi

Function at 0x41890e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 0x2af8
jae 0x41898a
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx*4 + 0x467980]
test ecx, ecx
je 0x41898a
cmp eax, dword [ecx + 0xc]
jae 0x41898a
cmp dword [ebp + 0x10], 0
mov ecx, dword [ecx + 0x14]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
mov ecx, dword [eax + 8]
je 0x418969
test ecx, ecx
je 0x41895a
push dword [ecx + 0x18]
push dword [ebp + 0x10]
call fcn.00457a80
push eax
call fcn.00457cb0
add esp, 0xc
pop ebp
ret
push 0x40
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop ebp
ret
test ecx, ecx
je 0x418978
push dword [ecx + 0x18]
call fcn.00457cb0
pop ecx
pop ebp
ret
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, 0x3f
jbe 0x418996
push 0x3f
pop eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x418994
mov byte [eax], 0
xor eax, eax
pop ebp
ret
Function at 0x41a511
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x467b78]
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45bf4c
call fcn.0040184e
cmp dword [ebp + 8], ebx
je 0x41a599
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov esi, dword [ebp + 0x10]
je 0x41a542
cmp byte [edi], bl
jne 0x41a54a
cmp esi, ebx
je 0x41a599
cmp byte [esi], bl
je 0x41a599
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a599
cmp esi, ebx
je 0x41a5a3
cmp byte [esi], bl
je 0x41a5a3
push str.ahk_default
push esi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x41a580
mov esi, 0x45a5d8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41a5cb
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 4]
call fcn.0041a887
pop ecx
push dword [ebp - 4]
mov byte [ebp + 0xf], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0xf], bl
je 0x41a599
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41a599
mov ecx, dword [0x467b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
jmp 0x41a59c
Function at 0x41a887
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
mov edi, 0x103
jmp 0x41a92c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a934
push dword [ebp - 0xc]
call fcn.0041a887
pop ecx
push dword [ebp - 0xc]
mov byte [ebp - 1], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x41a934
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41a934
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0xff
call esi
cmp eax, edi
jne 0x41a8c1
mov al, 1
jmp 0x41a936
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f2fa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test bl, bl
jne 0x41f307
xor al, al
pop ebx
ret
mov eax, dword [esp + 0xc]
dec eax
je 0x41f365
dec eax
je 0x41f356
cmp byte [0x468399], 0
jne 0x41f332
cmp byte [0x46839a], 0
jne 0x41f332
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x41f3b7
push esi
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x41f350
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
js 0x41f350
xor eax, eax
jmp 0x41f353
xor eax, eax
inc eax
pop esi
pop ebx
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebx
and eax, 1
ret
push ebx
call fcn.00445190
test al, al
pop ecx
je 0x41f387
cmp dword [0x46738c], 0
movzx eax, bl
je 0x41f3b0
mov al, byte [eax + 0x467278]
shr al, 7
pop ebx
ret
xor eax, eax
cmp dword [0x467388], eax
je 0x41f3ad
push eax
push eax
push ebx
call fcn.00413201
add esp, 0xc
test al, al
je 0x41f3a8
push 1
call fcn.00412558
pop ecx
movzx eax, bl
jmp 0x41f37c
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
Function at 0x422077
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x467b78]
push 0x45bf4c
call fcn.0040184e
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043b175
mov esi, eax
test esi, esi
je 0x422169
push dword [ebp + 8]
push esi
call fcn.0043b25e
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x422169
push ebx
push edi
push 0
push esi
mov byte [ebp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
test ebx, ebx
je 0x422105
cmp ebx, dword [0x467c9c]
je 0x422105
push esi
call fcn.0043c146
test al, al
pop ecx
jne 0x422105
push 1
push ebx
push dword [0x467c9c]
call edi
test eax, eax
setne byte [ebp + 0x1b]
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x422156
mov ecx, dword [0x467b78]
push 1
push 0
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
mov eax, dword [0x465108]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x422156
cmp eax, 0x19
jge 0x42214c
cmp byte [0x468399], 0
je 0x42214c
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x422156
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
cmp byte [ebp + 0x1b], 0
je 0x422167
push 0
push ebx
push dword [0x467c9c]
call edi
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x14
Function at 0x422171
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x467b78]
push 0x45bf4c
call fcn.0040184e
mov ecx, dword [0x46a4f8]
push 1
push ebx
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x14], ecx
call fcn.0040184e
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043b175
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x42225c
push edi
push ebx
push eax
mov byte [ebp + 0x17], bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
cmp edi, ebx
je 0x422205
cmp edi, dword [0x467c9c]
je 0x422205
push dword [ebp + 0x10]
call fcn.0043c146
test al, al
pop ecx
jne 0x422205
push 1
push edi
push dword [0x467c9c]
call esi
test eax, eax
setne byte [ebp + 0x17]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0x17], bl
mov dword [ebp - 4], eax
je 0x42221d
push ebx
push edi
push dword [0x467c9c]
call esi
cmp dword [ebp - 4], ebx
pop edi
je 0x42225c
lea eax, [ebp - 0x118]
push 0xfc
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x42225c
lea eax, [ebp - 0x10]
push eax
push 0x43b4aa
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov byte [ebp - 0xc], bl
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [ebp - 0xc], bl
jne 0x422261
xor eax, eax
inc eax
jmp 0x4222a6
push dword [ebp - 8]
lea eax, [ebp - 0x118]
push 0x45a764
push 0x101
push eax
call fcn.0040a76e
mov ecx, dword [0x467b78]
add esp, 0x10
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
mov ecx, dword [ebp - 0x14]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
call fcn.0040184e
pop esi
pop ebx
leave
ret 0x10
Function at 0x4235ef
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [0x467b78]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45bf4c
call fcn.0040184e
mov ecx, dword [0x46a4f8]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040184e
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x423750
cmp byte [eax], bl
je 0x423750
mov esi, 0x105
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00439851
lea eax, [ebp - 0x120]
push eax
call fcn.00457cb0
add esp, 0x10
cmp byte [ebp + eax - 0x121], 0x5c
je 0x42367d
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x423750
mov byte [ebp + eax - 0x120], 0x5c
mov byte [ebp + eax - 0x11f], bl
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x46b3bc], 1
jne 0x4236af
or dword [0x46b3bc], edi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b3b8], eax
mov eax, dword [0x46b3b8]
cmp eax, ebx
je 0x4236f1
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x423750
cmp byte [ebp + 0xc], bl
je 0x4236de
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x4236e4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x42372c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x423750
cmp byte [ebp + 0xc], bl
mov eax, dword [ebp + 8]
jne 0x42371d
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x467b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
mov ecx, dword [0x46a4f8]
push edi
push esi
call fcn.00401d5e
jmp 0x423752
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8