joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ee5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ee5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ee5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ee5
cmp dword [ecx + 0x74], 0xe
jbe 0x401ee5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407da6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415628
push 0x415620
push str.FlsAlloc
push 0x1f
call fcn.00407c65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407dda
push dword [ebp + 8]
mov ecx, esi
call dword [0x414150]
call esi
jmp 0x407de0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407e24
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415638
push 0x415630
push str.FlsGetValue
push 0x21
call fcn.00407c65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407e5b
push dword [ebp + 8]
mov ecx, esi
call dword [0x414150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407e63
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415640
push 0x415638
push str.FlsSetValue
push 0x22
call fcn.00407c65
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407e9d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b3e8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b485
push ebx
push esi
call fcn.0040b3b1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b345
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b432
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b484
push edi
push eax
call fcn.00408555
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b452
call fcn.00407af8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b483
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b345
add esp, 0x20
test eax, eax
jne 0x40b471
push edi
call fcn.00407af8
jmp 0x40b479
push ebx
call fcn.00407af8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413540
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41356d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41356d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b004]
jne 0x40100a
repz ret
jmp fcn.004013a0

Function at 0x40485b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403be3
and dword [ebp - 0x14], 0
cmp dword [0x80d930], 0
mov dword [ebp - 0x18], eax
jne 0x40490e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4049b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4049b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x80d930], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x80d934], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x80d938], eax
call edi
push eax
call esi
mov dword [0x80d940], eax
test eax, eax
je 0x40490e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x80d93c], eax
mov eax, dword [0x80d93c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404967
cmp dword [0x80d940], ecx
je 0x404967
push eax
call esi
push dword [0x80d940]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404967
test ebx, ebx
je 0x404967
call edi
test eax, eax
je 0x40495e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40495e
test byte [ebp - 8], 1
jne 0x404967
or dword [ebp + 0x10], 0x200000
jmp 0x40499a
mov eax, dword [0x80d934]
cmp eax, dword [ebp - 0x18]
je 0x40499a
push eax
call esi
test eax, eax
je 0x40499a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40499a
mov eax, dword [0x80d938]
cmp eax, dword [ebp - 0x18]
je 0x40499a
push eax
call esi
test eax, eax
je 0x40499a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80d930]
call esi
test eax, eax
je 0x4049b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4049b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x403080
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4030bc
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4030dc
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404ce4
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x403314
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404a74
test esi, esi
jne 0x40334a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404b64
jmp 0x403368
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403218
mov edi, eax
test esi, esi
je 0x403368
cmp dword [ebx], 0
je 0x403368
dec esi
jmp 0x403351
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ad8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ab8
xor eax, eax
push ebp
push 0x403ab1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403af4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ab8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46a020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4048f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46c04c], 0
je 0x404955
cmp word [0x46c220], 0xd7b2
jne 0x40491d
cmp dword [0x46c228], 0
jbe 0x40491d
mov eax, 0x46c21c
call dword [0x46c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40497c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46a02c], 0
jne 0x404971
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x408a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408ae2
test eax, edx
je 0x408ae5
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408aa5
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x408acb
add ecx, 4
js 0x408abb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x408ac8
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408af1
test edx, edx
jne 0x408a98
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x409498
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404f04
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4094b1
test al, 0x10
je 0x4094b5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40bfa4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40bfdd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404b64
jmp 0x40bfe6
mov eax, ebx
mov edx, esi
call fcn.00404ac8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40bff0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c012
movzx eax, byte [esp]
jmp 0x40c014
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c6a4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c51c
mov eax, dword [0x46bbd0]
cmp byte [eax], 0
je 0x40c720
mov eax, dword [0x46b9a8]
call fcn.00403408
call fcn.0040300c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004096ec
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c768
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c756
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46b94c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x46e7f8]
call fcn.00405e54
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40d020
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d0f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404b0c
lea eax, [ebp - 4]
call fcn.00404f5c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f04
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d0e0
mov eax, ebx
call fcn.00402eb0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d0d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f04
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0c3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d108
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d0c3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0e0
mov eax, dword [ebp - 0x10]
call fcn.00402ecc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d0fd
lea eax, [ebp - 4]
call fcn.00404a74
ret

Function at 0x41f0c8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4709ec
cmp dword [edi], 0
jne 0x41f144
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4709e8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x46aae8
mov ecx, 2
call fcn.00403118
mov edx, 0x41f0a0
lea eax, [esi + 5]
call fcn.0041f0c0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f0c0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f119
mov dword [0x4709e8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4217f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404f04
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42184c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46bd08]
mov dl, 1
mov eax, dword [0x421300]
call fcn.0040c870
call fcn.004044bc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00421408
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4229a4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4229aa
ret
Function at 0x43420c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404a74
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43425a
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404ce4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4382e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x438413
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x421360]
call fcn.00421430
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4383e9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004214d0
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404ce4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x438428
call fcn.00404d8c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00421534
lea ecx, [ebp - 4]
mov edx, 0x438464
mov eax, dword [ebp - 0xc]
call fcn.0042177c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040e330
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4383cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x438470
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x46b488]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4383d3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4384c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x438507
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4384ea
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4384fb
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x438507
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x43d3e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x470c4c], 0
je 0x43d531
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x46bb5c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x43d531
mov eax, dword [0x470c50]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x470c4c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43d500
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x470c4c]
call fcn.0041815c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43d4f8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x43d4f8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43d4f8
mov eax, dword [ebp - 0x14]
call fcn.00447cfc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43d4f8
push ebp
call fcn.0043d3a4
pop ecx
test al, al
jne 0x43d4f8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403e44
test al, al
je 0x43d4f8
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403e44
cmp byte [ebp - 1], 0
je 0x43d4f8
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43d4f8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x470c50]
call fcn.0043cb14
inc edi
dec ebx
jne 0x43d44d
mov eax, dword [0x470c50]
cmp dword [eax + 8], 0
jle 0x43d518
mov eax, dword [0x470c50]
call fcn.0043cbcc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43d531
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043d208
pop ecx
test al, al
jne 0x43d531
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444bc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406b1c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0043f770
test ebx, ebx
jne 0x444c17
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00444b00
mov ebx, eax
test ebx, ebx
je 0x444d02
cmp esi, ebx
je 0x444c40
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x444c55
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x444c8d
add eax, 0xffffff5f
sub eax, 2
jb 0x444ca5
dec eax
sub eax, 2
jb 0x444cb9
dec eax
sub eax, 2
jb 0x444caf
jmp 0x444cc3
add eax, 0xfffffdff
sub eax, 2
jb 0x444ca5
dec eax
sub eax, 2
jb 0x444cb9
dec eax
sub eax, 2
jb 0x444caf
jmp 0x444cc3
mov byte [esp + 0x120], 0
jmp 0x444ccb
mov byte [esp + 0x120], 2
jmp 0x444ccb
mov byte [esp + 0x120], 1
jmp 0x444ccb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004536f8
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00440f30
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x444d04
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x44d05c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x46bcf8]
cmp byte [eax + 0xc], 0
je 0x44d1c9
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d1c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x470c5c], 0
jne 0x44d0b0
push 0x44d1d0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44d1d8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c5c], eax
cmp dword [0x46b5d0], 0
jne 0x44d1ab
push 0x44d1e8
call sub.kernel32.dll_LoadLibraryA
mov dword [0x46b5d0], eax
cmp dword [0x46b5d0], 0
je 0x44d1ab
push 0x44d1f4
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c60], eax
push 0x44d204
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c64], eax
push 0x44d218
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c68], eax
push 0x44d230
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c6c], eax
push 0x44d248
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c70], eax
push 0x44d25c
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c74], eax
push 0x44d274
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c78], eax
push 0x44d28c
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c7c], eax
push 0x44d2a8
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c80], eax
push 0x44d2b4
mov eax, dword [0x46b5d0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x470c84], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1c9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45323c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x45325d
test edi, 0x40000
je 0x453277
test bl, bl
jne 0x4532f8
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4532f8
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4532aa
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4532bf
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x4532ce
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4532df
cmp byte [esp + 2], 0
je 0x4532f8
cmp byte [esp + 2], 0
je 0x4532f0
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4532f8
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret