joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x130]
call sym.__errno
mov dword [eax], 0
test ebx, ebx
je 0x40e457
cmp byte [ebx], 0
je 0x40e423
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x40e448
test al, 0x10
je 0x40e423
mov dword [esp + 4], ebx
mov eax, 0x104
lea esi, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x40e2c0
and edx, 0x8080
jne 0x40e2e6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
lea edx, [ecx + 0x233]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x40e439
mov dword [esp + 4], esi
lea esi, [eax + 0x22c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x40e3c0
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x40e330
and edx, 0x8080
jne 0x40e356
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp byte [ebx + ecx + 0x22b], 0x2f
je 0x40e3c0
mov ecx, esi
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x40e370
and edx, 0x8080
jne 0x40e396
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
cmp byte [ebx + ecx + 0x22b], 0x5c
je 0x40e3c0
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov word [eax + esi], 0x5c
lea esi, [esi]
lea edi, [edi]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov word [eax + esi], 0x2a
mov eax, 0xffffffff
xor edx, edx
mov dword [ebx + 0x224], eax
xor ecx, ecx
xor esi, esi
mov dword [ebx + 0x228], edx
xor eax, eax
mov edx, 0x104
mov dword [ebx + 0x118], ecx
xor ecx, ecx
mov word [ebx + 0x11c], si
lea esi, [ebx + 0x120]
mov word [ebx + 0x11e], ax
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sym._memset
add esp, 0x124
mov eax, ebx
pop ebx
pop esi
ret
call sym.__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret
call sym.__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x40e430
call sym.__errno
mov dword [eax], 2
xor eax, eax
jmp 0x40e430
call sym.__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x40e430
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3d737e52
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x63e71411
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x182f6252
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x44c130a7
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x478206e3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
mov ecx, 0x1ae539a6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call fcn.10001520
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call fcn.10001598
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call fcn.10001598
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call fcn.100015d4
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402dec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043f0
test esi, esi
jne 0x402e23
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044e0
jmp 0x402e44
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c88
mov dword [esp], eax
test esi, esi
je 0x402e44
cmp dword [ebx], 0
je 0x402e44
dec esi
jmp 0x402e2b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4034f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x451020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403588
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403568
xor eax, eax
push ebp
push 0x403561
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403568
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x451020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x451020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40426c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x453044], 0
je 0x4042cd
cmp word [0x453218], 0xd7b2
jne 0x404295
cmp dword [0x453220], 0
jbe 0x404295
mov eax, 0x453214
call dword [0x453230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45106c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4042f4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x451030], 0
jne 0x4042e9
push 0
push 0x451064
push 0x45106c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x406014
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40607a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404660
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004030b4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406064
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406081
lea eax, [ebp - 0x10]
call fcn.004043f0
ret

Function at 0x40b014
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b04d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044e0
jmp 0x40b056
mov eax, ebx
mov edx, esi
call fcn.00404444
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b060
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b081
mov al, byte [esp]
jmp 0x40b083
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b718
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b580
mov eax, dword [0x4527f8]
cmp byte [eax], 0
je 0x40b794
mov eax, dword [0x45258c]
call fcn.00402ee4
call fcn.00402bb4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408804
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b7dc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b7ca
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x452524]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x453660]
call fcn.00405480
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c038
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c10e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404488
lea eax, [ebp - 8]
call fcn.00404900
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048b0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c0f8
mov eax, ebx
call fcn.00402a28
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c0f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004048b0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c0db
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c120
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c0db
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0f8
mov eax, dword [ebp - 0x10]
call fcn.00402a58
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c115
lea eax, [ebp - 8]
call fcn.004043f0
ret

Function at 0x40c5e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c64c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404660
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040834c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c653
lea eax, [ebp - 0xc]
call fcn.004043f0
ret

Function at 0x41a820
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x453884
cmp dword [edi], 0
jne 0x41a89c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x453880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4513e8
mov ecx, 2
call fcn.00402c48
mov edx, 0x41a7f8
lea eax, [esi + 5]
call fcn.0041a818
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a818
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a871
mov dword [0x453880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c238
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c23e
ret
Function at 0x41e6b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41e701
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41e6e8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41e6d8
jmp 0x41e701
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41e6e9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4274e8
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x427434
call sub.user32.dll_EnumWindows
ret

Function at 0x427608
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x427685
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00427068
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42762d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00426c68
cmp dword [ebp - 4], 0
je 0x42766f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004048b0
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42768c
lea eax, [ebp - 4]
call fcn.004043f0
ret

Function at 0x42ab78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x42abc8]
test si, 4
je 0x42ab8c
or bl, 1
test si, 8
je 0x42ab96
or bl, 4
test si, 1
je 0x42aba0
or bl, 8
test si, 2
je 0x42abaa
or bl, 0x10
test si, 0x10
je 0x42abb4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42abc3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x42abcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x42ac04]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42abe5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42abf4
or bl, 4
test esi, 0x20000000
je 0x42abff
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4312c8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4312da
add esp, 0xfffffff0
call fcn.0040399c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419790
mov eax, dword [0x452530]
mov dword [eax + 4], ebx
mov dword [eax], 0x43166c
mov eax, dword [0x452540]
mov dword [eax + 4], ebx
mov dword [eax], 0x431678
mov eax, ebx
call fcn.00431684
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.0040364c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.0040364c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.0040364c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.0040364c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411a88]
call fcn.0040364c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x42da9c
push eax
push 0
push 0
mov eax, dword [0x4526e0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b93c]
call fcn.0041cda4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b93c]
call fcn.0041cda4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b93c]
call fcn.0041cda4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00431ad4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43199c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43199c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43199c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x431417
call fcn.004039f4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x431780
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43192b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x43190c
mov dl, 1
mov eax, dword [0x411ea4]
call fcn.0040364c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043f0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4318fb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044ccc8
test al, al
je 0x4318ee
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43193c
lea eax, [ebp - 0x254]
call fcn.00408e78
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4318ee
xor eax, eax
push ebp
push 0x4318e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x431974
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4318d0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404660
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4318d0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404660
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4318ee
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4317f1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415980
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431932
lea eax, [ebp - 0x260]
call fcn.004043f0
ret

Function at 0x432274
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x453b10]
cmp byte [eax + 0xa5], 0
jne 0x4322e5
cmp dword [0x453b28], 0
jne 0x4322a6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x432230
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x453b28], eax
cmp dword [0x453b24], 0
jne 0x4322c1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x453b24], eax
cmp dword [0x453b2c], 0
jne 0x4322e5
push esp
push 0
push 0
push 0x4321d4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x453b2c], eax
pop edx
ret