joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403730
Capabilities:
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x42d4d8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x438ab4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
push edi
mov eax, dword [0x438ab4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0x3c]
test al, al
je 0x4037d7
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x1a
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push str.Protexis_Licensing_Service
mov byte [ecx + 4], 0
call fcn.004022e0
lea ecx, [esp + 0x50]
call fcn.0042b1c0
push 1
push 0
push 0
mov dword [esp + 0x6c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4037de
push eax
push 0xc0000019
lea ecx, [esp + 0x3c]
call fcn.0042b5d0
cmp dword [esp + 0x4c], 0x10
jb 0x4037d7
mov eax, dword [esp + 0x38]
push eax
call fcn.00405250
add esp, 4
xor al, al
jmp 0x403878
mov ebx, 0x10
cmp dword [esi + 0x18], ebx
jb 0x4037ed
mov esi, dword [esi + 4]
jmp 0x4037f0
add esi, 4
push 0x20000000
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x403830
push eax
push 0xc0000020
lea ecx, [esp + 0x3c]
call fcn.0042b5d0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x4c], ebx
jb 0x4037d7
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00405250
add esp, 4
xor al, al
jmp 0x403878
lea edx, [esp + 0x18]
push edx
push 1
push esi
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403856
push 0
push 0xc0000009
lea ecx, [esp + 0x3c]
call fcn.0042b5d0
xor bl, bl
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
cmp dword [esp + 0x4c], 0x10
jb 0x403876
mov eax, dword [esp + 0x38]
push eax
call fcn.00405250
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0040f653
add esp, 0x54
ret
Function at 0x4038a0
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x42d4a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x438ab4]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov eax, dword [0x438ab4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0x3c]
test al, al
je 0x403947
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x1a
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push str.Protexis_Licensing_Service
mov byte [ecx + 4], 0
call fcn.004022e0
lea ecx, [esp + 0x30]
call fcn.0042b1c0
push 1
push 0
push 0
mov dword [esp + 0x4c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40394e
push eax
push 0xc0000019
lea ecx, [esp + 0x1c]
call fcn.0042b5d0
cmp dword [esp + 0x2c], 0x10
jb 0x403947
mov eax, dword [esp + 0x18]
push eax
call fcn.00405250
add esp, 4
xor al, al
jmp 0x4039e1
mov ebx, 0x10
cmp dword [esi + 0x18], ebx
jb 0x40395d
mov esi, dword [esi + 4]
jmp 0x403960
add esi, 4
push 0xf003f
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4039a0
push eax
push 0xc0000020
lea ecx, [esp + 0x1c]
call fcn.0042b5d0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x2c], ebx
jb 0x403947
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00405250
add esp, 4
xor al, al
jmp 0x4039e1
push esi
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4039bf
push 0
push 0xc0000025
lea ecx, [esp + 0x1c]
call fcn.0042b5d0
xor bl, bl
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
cmp dword [esp + 0x2c], 0x10
jb 0x4039df
mov edx, dword [esp + 0x18]
push edx
call fcn.00405250
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0040f653
add esp, 0x34
ret
Function at 0x4041c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [0x438ab4]
xor eax, esp
mov dword [esp + 0xc0], eax
xor eax, eax
push ebp
push edi
push 0x9c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
mov dword [esi], 0xa
push eax
mov dword [ebx], 5
call fcn.004108c0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x9c
call edi
mov ebp, eax
test ebp, ebp
jne 0x404262
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x94
call edi
test eax, eax
jne 0x404262
pop edi
xor al, al
pop ebp
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0040f653
add esp, 0xc4
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x3c]
sub eax, 0
je 0x404390
sub eax, 1
je 0x40433b
sub eax, 1
jne 0x404396
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 8]
mov cl, byte [esp + 0xc6]
cmp edi, 6
jne 0x4042b0
cmp dword [esp + 0x34], eax
jne 0x4042fb
cmp cl, 1
setne al
mov dword [esi], eax
jmp 0x4042fb
cmp edi, 5
jne 0x4042f0
mov eax, dword [esp + 0x34]
cmp eax, 2
jne 0x4042d7
cmp cl, 1
jne 0x4042cf
cmp dx, 9
jne 0x4042cf
mov dword [esi], edi
mov dword [ebx], eax
jmp 0x4042fb
mov dword [esi], 2
jmp 0x4042fb
cmp eax, 1
jne 0x4042e4
mov dword [esi], 5
jmp 0x4042fb
test eax, eax
jne 0x4042fb
mov dword [esi], 3
jmp 0x4042fb
cmp edi, 4
ja 0x4042fb
mov dword [esi], 4
test ebp, ebp
je 0x404396
cmp cl, 1
jne 0x404396
cmp dx, 9
je 0x404396
cmp edi, 4
jne 0x404323
mov dword [ebx], 0
jmp 0x404396
mov ecx, dword [esp + 0xc4]
and ecx, 0x200
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [ebx], ecx
jmp 0x404396
cmp dword [esp + 0x30], 4
jne 0x404396
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x404364
mov al, byte [esp + 0x41]
mov dword [esi], 7
cmp al, 0x43
je 0x40435c
cmp al, 0x42
jne 0x404396
mov dword [ebx], 4
jmp 0x404396
cmp eax, 0xa
jne 0x404383
mov al, byte [esp + 0x41]
mov dword [esi], 6
cmp al, 0x41
je 0x40437b
cmp al, 0x42
jne 0x404396
mov dword [ebx], 3
jmp 0x404396
cmp eax, 0x5a
jne 0x404396
mov dword [esi], 8
jmp 0x404396
mov dword [esi], 9
mov ecx, dword [esp + 0xc8]
pop edi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0040f653
add esp, 0xc4
ret

Function at 0x40f653
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438ab4]
jne 0x40f65d
repz ret
jmp fcn.0041353b
Function at 0x41b890
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041b632
call 0x8dc9769d
inc ebp
test al, 0x50
call fcn.0041b642
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0041b5f7
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41b920
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041b632
mov al, 0xb3
mov edi, 0xc0458df3
push eax
call fcn.0041b642
push eax
push esi
push dword [ebp + 8]
call fcn.0041b5f7
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0041b632
retf 0x9ab3
Function at 0x41ecfd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413ea2
and dword [ebp - 4], 0
cmp dword [0x43ca8c], 0
mov ebx, eax
jne 0x41edae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ee5f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x431bd4
push edi
call esi
test eax, eax
je 0x41ee5f
push eax
call fcn.00413e30
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ca8c], eax
call esi
push eax
call fcn.00413e30
mov dword [esp], 0x431bb0
push edi
mov dword [0x43ca90], eax
call esi
push eax
call fcn.00413e30
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ca94], eax
call esi
push eax
call fcn.00413e30
pop ecx
mov dword [0x43ca9c], eax
test eax, eax
je 0x41edae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413e30
pop ecx
mov dword [0x43ca98], eax
mov eax, dword [0x43ca98]
cmp eax, ebx
je 0x41ee06
cmp dword [0x43ca9c], ebx
je 0x41ee06
push eax
call fcn.00413eab
push dword [0x43ca9c]
mov esi, eax
call fcn.00413eab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ee06
test edi, edi
je 0x41ee06
call esi
test eax, eax
je 0x41edfd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41edfd
test byte [ebp - 0xc], 1
jne 0x41ee06
or dword [ebp + 0x10], 0x200000
jmp 0x41ee3f
mov eax, dword [0x43ca90]
cmp eax, ebx
je 0x41ee3f
push eax
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee3f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ee3f
mov eax, dword [0x43ca94]
cmp eax, ebx
je 0x41ee3f
push eax
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee3f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ca8c]
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee5f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ee61
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b660
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d1c6
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x438ab4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
lea ecx, [ebp - 0x34]
call fcn.00401d00
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.004255f0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
call fcn.00401da0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42b711
mov byte [ebp - 0x35], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00401d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d70
mov al, byte [ebp - 0x35]
jmp 0x42b7e2
lea ecx, [ebp + 8]
call fcn.00401db0
push eax
lea ecx, [ebp + 8]
call fcn.00401da0
push eax
push 2
push 0
push str.EventMessageFile
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x42b768
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x36], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00401d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d70
mov al, byte [ebp - 0x36]
jmp 0x42b7e2
push 4
mov edx, dword [ebp - 0x3c]
add edx, 0x1c
push edx
push 4
push 0
push str.TypesSupported
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x42b7b6
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x37], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00401d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d70
mov al, byte [ebp - 0x37]
jmp 0x42b7e2
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00401d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401d70
mov al, byte [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f653
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4a3493]
shl eax, 2
mov dword [0x4a3497], eax
push edx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
call fcn.004969d8
pop edx
call fcn.0049693c
call fcn.00496a18
push 0
call fcn.00497c54
pop ecx
push 0x4a343c
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4a349b], eax
push 0
jmp fcn.0049ce00
Function at 0x420388
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov byte [ebp - 8], dl
test dl, dl
jle 0x42039b
call fcn.004a1b80
mov ebx, ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x4ad3c4
call fcn.00497028
mov word [ebp - 0x18], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004863cc
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov edx, dword [ebp - 4]
mov byte [edx + 0x49], 0
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x4203f9
call fcn.004a1b8d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c1c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0043bdc0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00494824
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x43c222
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b7078]
mov dl, 1
mov eax, dword [0x43bcb8]
call fcn.0048f3ec
call fcn.00493edc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43c22c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00494824
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x43c284
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4b707c]
mov dl, 1
mov eax, dword [0x43bcb8]
call fcn.0048f3ec
call fcn.00493edc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043bdf0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x441028
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004943e0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x441077
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00494610
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44740c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x447412
ret

Function at 0x4499ac
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4499fd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4499e4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4499d4
jmp 0x4499fd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4499e5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4526c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4b7574
cmp dword [edi], 0
jne 0x452740
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x4b7570]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b2d78
mov ecx, 2
call fcn.004931ec
mov edx, 0x45269c
lea eax, [esi + 5]
call fcn.004526bc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004526bc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x452715
mov dword [0x4b7570], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x45285c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4528ac]
test si, 4
je 0x452870
or bl, 1
test si, 8
je 0x45287a
or bl, 4
test si, 1
je 0x452884
or bl, 8
test si, 2
je 0x45288e
or bl, 0x10
test si, 0x10
je 0x452898
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4528a7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4528b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4528e8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4528c9
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4528d8
or bl, 4
test esi, 0x20000000
je 0x4528e3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x458e38
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x458e4a
add esp, 0xfffffff0
call fcn.00493a84
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00486574
mov eax, ebx
call fcn.00459184
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x47f764]
call fcn.00493754
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x47f764]
call fcn.00493754
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x47f764]
call fcn.00493754
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x47f764]
call fcn.00493754
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x47f764]
call fcn.00493754
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x455928
push eax
push 0
push 0
mov eax, dword [0x4b7140]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x446894]
call fcn.00447e6c
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x446894]
call fcn.00447e6c
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x446894]
call fcn.00447e6c
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.00459564
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459480
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459480
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x459480
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458f59
call fcn.00493adc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x459264
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45940f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4593f0
mov dl, 1
mov eax, dword [0x47fb68]
call fcn.00493754
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004943e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4593df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047422c
test al, al
je 0x4593d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x459420
lea eax, [ebp - 0x254]
call fcn.0048e988
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4593d2
xor eax, eax
push ebp
push 0x4593cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x459458
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4593b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00494610
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x4593b4
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00494610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593d2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4592d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.004831c0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459416
lea eax, [ebp - 0x260]
call fcn.004943e0
ret

Function at 0x459c5c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4b7564]
cmp byte [eax + 0x95], 0
jne 0x459ccd
cmp dword [0x4b7580], 0
jne 0x459c8e
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x459c18
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4b7580], eax
cmp dword [0x4b757c], 0
jne 0x459ca9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4b757c], eax
cmp dword [0x4b7584], 0
jne 0x459ccd
push esp
push 0
push 0
push 0x459bbc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4b7584], eax
pop edx
ret