joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012800
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x414
mov eax, dword [0x10048440]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x420]
push ebx
push ebp
mov ebp, dword [esp + 0x42c]
push esi
mov esi, dword [esp + 0x428]
push edi
xor ebx, ebx
push 0x3fe
lea ecx, [esp + 0x26]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x2c], bx
call fcn.10028cf0
mov eax, esi
add esp, 0xc
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10012857
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xfffffffe
jmp 0x10012870
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x10012870
push ebx
mov ecx, eax
shr ecx, 2
lea edx, [esp + 0x14]
push edx
push ebx
rep movsd dword es:[edi], dword [esi]
push 0xf003f
push ebx
push ebx
mov ecx, eax
push ebx
lea eax, [esp + 0x3c]
push eax
and ecx, 3
push SysReAllocString
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x1001297d
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100128d9
mov dword [esp + 0x14], 1
jmp 0x100128e4
cmp dword [esp + 0x14], 1
jne 0x10012965
cmp ebp, ebx
je 0x1001291a
mov eax, ebp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100128f0
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov edi, ebx
jmp 0x1001296a
push 2
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10012930
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x18]
push edx
push edi
push 1
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, ebx
jmp 0x1001296a
mov edi, 0xfffffffb
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x10012982
cmp edi, ebx
jne 0x10012982
or eax, 0xffffffff
jmp 0x10012984
mov eax, edi
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10028cdf
add esp, 0x414
ret
Function at 0x10012a00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x220
mov eax, dword [0x10048440]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
mov ebx, dword [esp + 0x22c]
push esi
mov esi, dword [esp + 0x22c]
push ebx
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x10012a50
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.10028cdf
add esp, 0x220
ret
cmp eax, 2
jne 0x10012a6e
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.10028cdf
add esp, 0x220
ret
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10012aa7
xor ecx, ecx
cmp eax, 2
sete cl
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.10028cdf
add esp, 0x220
ret
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012ab0
sub eax, edx
push ebp
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
push edi
lea edi, [ebx + eax*2]
je 0x10012ad7
mov word [edi], 0x5c
add edi, 2
mov word [edi], cx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x104
call ebp
test eax, eax
jne 0x10012b63
mov esi, edi
lea eax, [esp + 0x24]
sub esi, eax
nop
lea eax, [esp + 0x24]
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x10012b14
mov ecx, dword [esp + 0x18]
push ebx
push ecx
call fcn.10012a00
add esp, 8
test eax, eax
je 0x10012b5f
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x104
call ebp
test eax, eax
je 0x10012b10
mov esi, dword [esp + 0x18]
mov word [edi - 2], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x22c]
pop edi
pop ebp
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.10028cdf
add esp, 0x220
ret
Function at 0x10021450
Capabilities:
Read .ini file

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [edi], 0
call fcn.100210a0
mov ebx, dword [esp + 0x10]
mov eax, ebx
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10021480
sub eax, edx
sar eax, 1
je 0x100214d7
push esi
mov esi, dword [esp + 0x24]
lea edx, [esi + esi + 2]
push edx
call fcn.1002893e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
push ebx
push esi
push eax
mov dword [edi], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, esi
pop esi
jae 0x100214ca
mov ecx, dword [edi]
mov word [ecx + eax*2], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor eax, eax
pop ebx
pop ecx
ret
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x10023a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x24]
push ebp
push esi
mov ebp, dword [edi + 0x34]
sub ebp, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x10023aee
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.10029730
mov edx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x10023ac1
sub eax, ebx
jmp 0x10023ac3
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10023ab2
mov ecx, dword [edi + 0x38]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x10023ae2
sub eax, ebx
jmp 0x10023ae4
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10023ad3
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x10023b49
mov edx, dword [edi + 0x6c]
add edx, dword [edi + 0x64]
mov ecx, ebp
add edx, dword [edi + 0x30]
push edx
call fcn.10023730
add dword [edi + 0x6c], eax
mov edx, dword [edi + 0x6c]
add esp, 4
cmp edx, 3
jb 0x10023b35
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp edx, 0x106
jae 0x10023b49
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x10023a76
pop esi
pop ebp
pop ebx
ret
Function at 0x10025d80
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x10025d9c
pop edi
mov eax, 1
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x10025eac
push ebp
lea ebx, [ebx]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x10025dbf
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x10025e6b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x10025de0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x10025de0
test eax, eax
je 0x10025e7f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x10025e70
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x10025db0
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret

Function at 0x10028cdf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10048440]
jne 0x10028ce9
repz ret
jmp fcn.1002db25
Function at 0x10035068
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1002f6af
xor ebx, ebx
cmp dword [0x1004bfd8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1003513d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100350a8
xor eax, eax
jmp 0x10035201
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100423e0
push edi
call esi
cmp eax, ebx
je 0x100350a1
push eax
call fcn.1002f64c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1004bfd8], eax
call esi
push eax
call fcn.1002f64c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1004bfdc], eax
call esi
push eax
call fcn.1002f64c
mov dword [0x1004bfe0], eax
lea eax, [ebp - 8]
push eax
call fcn.1002c87d
test eax, eax
pop ecx
pop ecx
je 0x1003510b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002cd4a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1003513d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1002f64c
cmp eax, ebx
pop ecx
mov dword [0x1004bfe8], eax
je 0x1003513d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002f64c
pop ecx
mov dword [0x1004bfe4], eax
mov eax, dword [0x1004bfe4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x100351b6
cmp dword [0x1004bfe8], esi
je 0x100351b6
push eax
call fcn.1002f6b8
pop ecx
call eax
cmp eax, ebx
je 0x10035183
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1004bfe8]
call fcn.1002f6b8
pop ecx
call eax
test eax, eax
je 0x10035183
test byte [ebp - 0x18], 1
jne 0x100351b6
lea eax, [ebp - 0xc]
push eax
call fcn.1002c8b4
test eax, eax
pop ecx
je 0x1003519e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002cd4a
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x100351ad
or dword [ebp + 0x10], 0x200000
jmp 0x100351e7
or dword [ebp + 0x10], 0x40000
jmp 0x100351e7
mov eax, dword [0x1004bfdc]
cmp eax, esi
je 0x100351e7
push eax
call fcn.1002f6b8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100351e7
mov eax, dword [0x1004bfe0]
cmp eax, esi
je 0x100351e7
push dword [ebp - 4]
push eax
call fcn.1002f6b8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1004bfd8]
call fcn.1002f6b8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100550bc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
jmp loc.10063cac
Function at 0x10063757
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1007fa10
xor eax, 0xfeca978
cmp edi, ebp
jmp 0x1009777d
mov dword [esp], edx
pop edx
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x14]
add eax, dword [ebp - 4]
add eax, 0x18
jmp 0x10081883
jg 0x10097783
jmp 0x10059f1e
xchg dword [esp], ecx
ret
jmp 0x10064394
jnp 0x1008094e
jmp 0x1006078c
sub ecx, ebx
cmp eax, 0xf41b369c
or eax, ecx
pop eax
mov ecx, 0x10066add
jmp 0x10066ad4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x1005d43f
jmp 0x1007703f
jo 0x1005d83d
push edi
call fcn.10063549
add eax, dword [ebp - 0x28]
mov al, byte [eax]
and eax, 0xff
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
call fcn.1006ee6a
or byte [0x801ab9], ah
add dword [esi], edx
call fcn.100994bc
sbb ah, byte [esi - 0x4d]
sbb al, 0x80
add cl, ah
pop edx
call fcn.10075757
invalid

Function at 0x10097625
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, 0x87d78088
add eax, 0xcb624775
xor eax, 0x51e74bf1
push 0x1009a610
jmp 0x100776c3
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
call fcn.10059fd4
jmp 0x10067429
ret
push ebx
jmp 0x10071f27
Function at 0x405968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4059ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404080
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b14
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4059b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4059d5
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x40a8c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a8fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f00
jmp 0x40a906
mov eax, ebx
mov edx, esi
call fcn.00403e64
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a910
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a931
mov al, byte [esp]
jmp 0x40a933
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40afb8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ae30
mov eax, dword [0x451050]
cmp byte [eax], 0
je 0x40b034
mov eax, dword [0x450e78]
call fcn.00402980
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408138
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b07c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b06a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x450e28]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x452664]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x428f60
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x428eac
call sub.user32.dll_EnumWindows
ret

Function at 0x429080
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4290fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00428ae0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4290a5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004286e0
cmp dword [ebp - 4], 0
je 0x4290e7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004042d0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429104
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x42bf94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x452b54], 0
je 0x42c0e3
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x450ff4]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42c0e3
mov eax, dword [0x452b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x452b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42c0b2
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x452b54]
call fcn.00413534
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42c0aa
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42c0aa
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42c0aa
mov eax, dword [ebp - 0x14]
call fcn.00434be0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42c0aa
push ebp
call fcn.0042bf50
pop ecx
test al, al
jne 0x42c0aa
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42c066
mov eax, dword [ebp - 0x14]
call fcn.00433710
dec eax
jle 0x42c0aa
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004032d4
cmp byte [ebp - 1], 0
je 0x42c0aa
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42c0aa
mov edx, dword [ebp - 0x14]
mov eax, dword [0x452b58]
call fcn.0042b71c
inc edi
dec ebx
jne 0x42bff9
mov eax, dword [0x452b58]
cmp dword [eax + 8], 0
jle 0x42c0ca
mov eax, dword [0x452b58]
call fcn.0042b7ac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42c0e3
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042bdb8
pop ecx
test al, al
jne 0x42c0e3
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f6b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x42f704
mov eax, esi
call fcn.00444ce0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42f704
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x42f704
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x42f843
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x42f744
cmp eax, 0x108
ja 0x42f744
mov eax, esi
call fcn.00444ce0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42f83a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x42f843
jmp 0x42f83a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x42f823
cmp eax, 0x20a
ja 0x42f823
test byte [esi + 0x50], 0x80
jne 0x42f776
sub eax, 0x203
je 0x42f773
sub eax, 3
je 0x42f773
sub eax, 3
jne 0x42f776
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x42f78a
dec eax
je 0x42f79f
dec eax
je 0x42f7bc
dec eax
je 0x42f79f
jmp 0x42f7c3
mov ecx, ebx
mov eax, dword [0x450ff4]
mov eax, dword [eax]
mov edx, esi
call fcn.0044e48c
jmp 0x42f83a
cmp byte [esi + 0x5d], 1
jne 0x42f7b5
mov eax, esi
mov si, 0xffed
call fcn.004032d4
jmp 0x42f843
or word [esi + 0x54], 1
jmp 0x42f83a
and word [esi + 0x54], 0xfffe
jmp 0x42f83a
mov eax, dword [0x452b10]
cmp byte [eax + 0x20], 0
je 0x42f83a
mov eax, dword [0x452b10]
cmp dword [eax + 0x1c], 0
je 0x42f83a
mov eax, dword [ebx]
mov edx, dword [0x452b10]
cmp eax, dword [edx + 0x1c]
jne 0x42f83a
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00444c24
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004032d4
jmp 0x42f843
cmp eax, 0xb00b
jne 0x42f83a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042dfe4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432d70
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x432d8c
cmp dword [esi + 4], 0
je 0x432db9
test byte [ebx + 0x55], 1
jne 0x432dab
mov eax, ebx
call fcn.00431910
test eax, eax
jne 0x432dab
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x432ec9
mov edx, esi
mov eax, ebx
call fcn.00432894
jmp 0x432ec9
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x432ec2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00434be0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042f5ec
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00432d70
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00434be0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432ec9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret