joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465ee0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x465f0f
push 0x54c9c0
push edx
call fcn.0044c980
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x465f26
push ecx
push 0x54c9dc
push edx
call fcn.0044ca50
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x465f3d
push edi
call fcn.00465c40
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x465f51
push edi
call fcn.00464cc0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x465f65
push edi
call fcn.00465c20
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x465f75
push edi
call fcn.00465dc0
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x477a80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x477aad
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x477af4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x477afa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x477b5b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x477b20
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x477b87
mov eax, dword [esi + 4]
push 1
push 0x54fb3e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x54fb3f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x477b60
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53f002
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call 0x1535626
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x6a000400
push ecx
call dword [0x7d5461fc]
test dword [esi*2 - 0x143fccfc], eax
xor eax, eax
jmp 0x53f06c
xor byte [ebx], bh
jne 0x53f03b
je 0x53f069
cmp dword [ebp + 0xc], 0
je 0x53f069
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x53f04d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call 0xff54eb56
pop ecx
cmp eax, esi
je 0x53f038
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408a80
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xff41002f
imul edx, dword [esi - 0x18], 0xfff4fc14
add esp, 0x10
mov eax, esi
mov dword [0xae5d5b5e], eax
nop
nop
nop
nop
nop
nop
nop
sbb edx, dword [eax - 0x1374aa70]
push ebp
mov ebp, esp
mov ebx, dword [0x15fffd08]
adc al, 0xc1
inc eax
add byte [ebx - 0x3f7afb3c], al
je 0x408aa7
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040876d
add esp, 0xc
pop ebp
ret
mov edx, dword [edx]
fmul qword [ebx + 0x54680c4d]
stc
jl 0x408ab2
push eax
push ecx
out 0xc7, al
cld
test bh, bh
add esp, 0xc
pop ebp
push edi
cdq
nop
push ebp
sbb al, 0xec
inc esi
lodsd eax, dword [esi]
or al, 0x8b
dec ebp
aad 0x56
mov esi, dword [edx]
adc byte [ecx + 0x4d46f84d], cl
or byte [edx], ch
mov eax, dword [esi]
push 0
push 0x55
cld
fdiv qword [esi - 0xc]
push 0
push ebx
mov ebp, dword [eax + edx*4 + 0x6af43b8d]
add dword [eax + 0x52], edx
loopne 0x408b33
cld
add byte [eax], al
add bl, ah
call dword [sym.imp.WS2_32.dll_WSASend]
cmp dword [0x571775ff], 0xffffff8b
cmp eax, 0xa440e9d8
call edi
sub al, 0xd5
fisttp qword [edx]
mov dword [edx + 0x5f], ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
in eax, 0x5d
ret 0xc

Function at 0x40abf0
Capabilities:
Encode data using xor

Disassembly:
ret
inc byte [ecx - 0xffff3a]
inc dword [ebx + 0x188903d1]
mov edi, dword [ebp - 0x35]
stosb byte es:[edi], al
sbb cl, byte [edx]
add byte [eax], al
add byte [esp + eax*8 + 0x66d6000c], cl
or al, cl
mov edi, dword [edi + 0x10]
or ch, 0xd8
push cs
out 0xff, al
add byte [eax], 0
mov word [eax], cx
add eax, 2
jge 0x40ab7c
add ah, bl
add byte [eax], al
enter 0xffffffffffffe189, 0xffffffffffffffee
rol byte [edx], 0x8a
inc ebp
push 0x65
jge 0x40abca
mov eax, dword [edi]
call [edi + 0x5e]
jl 0x40ab7d
in al, dx
mov bl, 0xec
or byte [ebx + 0x56530c55], cl
inc ecx
mov edx, edi
test dword [ebx - 0x77], eax
jge 0x40abff
inc ebx
mov dword [ebp - 4], edi
jne 0x40ac13
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x6d10
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x40ac79
mov esi, dword [ebp + 8]
xor eax, ecx
mov bl, 0x8b
push cs
push eax
mov byte [edx], 0x81
stc
add byte [eax], 0
add byte [ecx + 0x3f7d0875], cl
dec edi
mov dword [edx], edi
mov ecx, dword [edx - 0x74b0762b]
inc ebp
adc byte [eax + 0x45894008], cl
and ebx, dword [eax + 0x40]
add dword [eax], eax
add cl, al
shl dword [0xfc00], 0x49
add ah, bl
add byte [eax], al
je 0x1840ad75
cmp eax, 0x35d800
jne 0x40aca6
sub edi, 2
xlatb
cmp dh, 0
sti
mov edi, 0x8b068b66
arpl word [ecx + 0xfc00e2], ax
mov byte [ecx + 0xdc00fa], al
xchg ecx, eax
inc esp
test ebp, esi
add byte [eax], al
add byte [ecx + 0x3a5e1], al
add byte [0xf6ff], ah
rol dword [edi - 0x7c3ef4e8], 0xc6
add bl, byte [ecx - 0x5742775]
add ebx, 0xb7ceb600
mov dword [ebp + 0x56], esi
cmc
xor eax, dword [eax]
dec edx
cmp ecx, dword [ebx - 0x48c4663f]
mov edi, edx
mov ebp, dword [ebx + ecx*4]
xlatb
mov eax, ecx
cdq
cmp esi, dword [edi + 0x2c8bfa8b]
mov edx, edi
or eax, dword fs:[eax]
add byte [eax], al
call fcn.0040b810
loop 0x40ac85
mov esi, 0x3401
mov eax, 0xb9d374ca
add eax, 0xe8000000
enter 0x9e, 0
mov ecx, dword [esi + eax*2 + 0xb]
retf 0xef75
Function at 0x4010c0
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x521619
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x56e19c]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push edi
mov eax, dword [0x56e19c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x14], ebp
push ebp
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebp
push 0x55005a
mov ecx, esi
mov dword [esp + 0x20], esi
mov byte [esi + 4], 0
call fcn.00401430
mov dword [esp + 0x50], ebp
push 0x288
mov dword [esp + 0x18], 1
call fcn.00404a89
mov ebx, eax
add esp, 4
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x288
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401169
cmp ebx, ebp
je 0x40115a
push ebx
call fcn.00404a94
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00404a89
add esp, 4
mov ebx, eax
push 0x27
lea edx, [esp + 0x21]
push ebp
push edx
mov byte [esp + 0x28], 0
call fcn.004f8510
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebp
jne 0x40122f
mov edi, ebx
cmp ebx, ebp
je 0x40123c
jmp 0x4011a0
movzx ecx, byte [edi + 0x199]
movzx edx, byte [edi + 0x198]
movzx eax, byte [edi + 0x197]
push ecx
movzx ecx, byte [edi + 0x196]
push edx
movzx edx, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push ecx
push edx
push eax
push str._02x_02x_02x_02x_02x_02x
lea edx, [esp + 0x38]
call fcn.00401770
lea eax, [esp + 0x38]
add esp, 0x1c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4011e8
sub eax, edx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00401430
cmp dword [esi + 0x18], 0x10
mov ebp, dword [esi + 0x14]
jb 0x40120c
mov edx, dword [esi + 4]
jmp 0x40120f
lea edx, [esi + 4]
xor eax, eax
call fcn.00401040
test eax, eax
jne 0x40122d
test ebp, ebp
setne al
test eax, eax
jne 0x40122d
mov edi, dword [edi]
test edi, edi
jne 0x4011a0
xor ebp, ebp
cmp ebx, ebp
je 0x40123c
push ebx
call fcn.00404a94
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004f6f4f
add esp, 0x44
ret
Function at 0x402330
Capabilities:
Write file on windows

Disassembly:
push esi
push 1
mov ecx, edi
call fcn.0040d930
push 0x550310
push str.defdata.dat
call fcn.004f7a9f
mov esi, eax
add esp, 8
test esi, esi
je 0x40243f
push esi
push 1
lea eax, [edi + 0x78]
push 4
push eax
call fcn.004f7c18
push esi
push 1
lea ecx, [edi + 0x7c]
push 4
push ecx
call fcn.004f7c18
push esi
push 1
lea edx, [edi + 0x80]
push 4
push edx
call fcn.004f7c18
push esi
push 1
lea eax, [edi + 0x84]
push 4
push eax
call fcn.004f7c18
add esp, 0x40
push esi
push 1
lea ecx, [edi + 0x88]
push 4
push ecx
call fcn.004f7c18
push esi
push 1
lea edx, [edi + 0x8c]
push 4
push edx
call fcn.004f7c18
push esi
push 1
lea eax, [edi + 0x90]
push 4
push eax
call fcn.004f7c18
push esi
push 1
lea ecx, [edi + 0x94]
push 4
push ecx
call fcn.004f7c18
add esp, 0x40
push esi
push 1
lea edx, [edi + 0xa4]
push 4
push edx
call fcn.004f7c18
push esi
push 1
lea eax, [edi + 0xa8]
push 4
push eax
call fcn.004f7c18
push esi
push 1
lea ecx, [edi + 0xb4]
push 4
push ecx
call fcn.004f7c18
push esi
push 1
lea edx, [edi + 0xb8]
push 4
push edx
call fcn.004f7c18
add esp, 0x40
push esi
push 1
lea eax, [edi + 0xac]
push 4
push eax
call fcn.004f7c18
push esi
call fcn.004f7d11
add esp, 0x14
push 0
mov ecx, edi
call fcn.0040d930
pop esi
ret
Function at 0x402bb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x521658
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x56e19c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x56e19c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 1
mov edi, ecx
call fcn.0040d930
lea esi, [esp + 0x24]
mov byte [edi + 0xb0], 1
call fcn.004010c0
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x14], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
xor esi, esi
cmp dword [esp + 0x3c], 0x10
mov eax, dword [esp + 0x28]
jae 0x402c2d
lea eax, [esp + 0x28]
movsx eax, byte [eax + esi]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x402ca1
cmp dword [esp + 0x14], 7
jge 0x402ca1
fld qword [0x5506a8]
fild dword [esp + 0x14]
call fcn.004f8270
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov eax, dword [edi + 0x9c]
fimul dword [esp + 0x1c]
fild dword [edi + 0x9c]
test eax, eax
jge 0x402c71
fadd qword [0x5506a0]
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
faddp st(1)
or eax, 0xc00
inc dword [esp + 0x14]
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0x9c], ecx
fldcw word [esp + 0x18]
jmp 0x402cc3
mov edx, dword [edi + 0x9c]
push edx
call fcn.004f79a7
add esp, 4
call fcn.004f79b9
cdq
mov ecx, 0x7fff
idiv ecx
add dword [edi + 0x9c], edx
inc esi
cmp esi, 0x11
jl 0x402c1e
mov edx, dword [edi + 0x9c]
push edx
call fcn.004f79a7
add esp, 4
mov eax, 0x5f5e100
call fcn.00402230
mov dword [edi + 0x94], eax
mov eax, 0x5f5e100
call fcn.00402230
mov dword [edi + 0x98], eax
mov eax, dword [edi + 0x9c]
push eax
call fcn.004f79a7
mov eax, dword [esp + 0x2c]
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [edi + 0xa0], ebx
jae 0x402d20
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402d23
sub eax, edx
cmp eax, ebx
mov dword [esp + 0x1c], eax
jle 0x402d6d
cmp dword [esp + 0x3c], 0x10
mov ecx, dword [esp + 0x28]
jae 0x402d43
lea ecx, [esp + 0x28]
movsx esi, byte [ecx + ebx]
add dword [edi + 0xa0], esi
test esi, esi
jle 0x402d66
call fcn.004f79b9
imul esi, esi, 0x64
cdq
idiv esi
mov eax, dword [esp + 0x1c]
add dword [edi + 0xa0], edx
inc ebx
cmp ebx, eax
jl 0x402d34
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.0040d930
cmp dword [esp + 0x3c], 0x10
jb 0x402d89
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00404a94
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004f6f4f
mov esp, ebp
pop ebp
ret
Function at 0x403e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403e89
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403ec4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403ec0
lea ebx, [ebx]
cmp esi, eax
jae 0x403ec4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403eb0
cmp esi, eax
jb 0x403eca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407b13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0040ade7
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407b4c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040775f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x407baa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x407bce
cmp dword [edi + 0x54], 0
jne 0x407bce
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040ade7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00407b6b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41146b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4114b2
call fcn.0040ade7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4114b2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4114ce
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410fe3
mov esi, eax
test edi, edi
je 0x4114cc
test ebx, ebx
je 0x4114cc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412f53
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x515fee
call fcn.004f8b17
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x412f78
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x412fbe
lea ecx, [ebp - 0x10]
call fcn.00403df0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043b29a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401960
mov eax, esi
call fcn.004f8bef
ret 8
Function at 0x4177f4
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x56e19c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x41782d
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x417854
cmp dword [0x571bb0], 0
jne 0x417854
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x417847
push 0x12
call esi
test bx, ax
je 0x41784b
mov eax, edi
jmp 0x4178c3
push edi
call fcn.004fb9bb
pop ecx
jmp 0x4178c3
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004f8510
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x41787d
call fcn.00409dd4
call fcn.0040833f
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f6f4f
leave
ret 4
Function at 0x4279f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x427a13
call fcn.00409dd4
call fcn.0040ade7
mov esi, dword [eax + 0xc]
push 0xf1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x427a33
xor eax, eax
jmp 0x427b4e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x427a2c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x427a2c
movzx eax, word [esi + 6]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404a5a
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x427a0e
cmp dword [ebp + 0x10], 0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 6]
lea edx, [eax + 6]
push ebx
push edx
je 0x427a90
mov ecx, edi
call fcn.00420489
jmp 0x427a95
call fcn.00420373
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
cmp dword [eax + 4], 0
jne 0x427aa7
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
cmp dword [edi + 0xbe0], 0
jne 0x427ac2
push dword [ebp + 0x10]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x310]
test eax, eax
je 0x427b3a
mov eax, dword [edi + 0xad0]
mov dword [ebp + 0xc], eax
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 6]
jae 0x427b11
lea eax, [esi + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx + ebx*4], eax
jne 0x427b04
test eax, eax
jbe 0x427b04
push eax
mov ecx, 0x56afdc
call fcn.0046b749
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov dword [eax], ecx
movzx eax, word [esi + 6]
add dword [ebp - 4], 2
inc ebx
cmp ebx, eax
jl 0x427adb
mov eax, dword [ebp + 8]
mov dword [edi + 0xbe0], eax
movzx ecx, word [esi + 6]
mov eax, dword [edi]
push 1
push ecx
push dword [ebp - 8]
mov ecx, edi
call dword [eax + 0x318]
mov ebx, eax
test ebx, ebx
jne 0x427b3a
and dword [edi + 0xbe0], eax
push dword [ebp - 8]
call fcn.00404a94
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42d547
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x42d688
push esi
push edi
push 0x52a5a0
call fcn.00413041
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x42d5d7
mov esi, dword [ebx + 0x168]
jmp 0x42d5c3
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42d5c3
push edi
call fcn.0040e0c7
push eax
push 0x56b910
call fcn.0041305f
pop ecx
pop ecx
test eax, eax
je 0x42d5c3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x42d5c3
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x42d583
lea ecx, [ebx + 0x164]
call fcn.004869c3
jmp 0x42d686
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x42d686
jmp 0x42d5ed
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.004868f1
mov esi, dword [eax]
test esi, esi
jne 0x42d606
xor ebx, ebx
jmp 0x42d609
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42d67c
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42d67c
test edi, edi
je 0x42d64e
push esi
push 0x56b910
call fcn.0041305f
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x5354fc
call fcn.0041305f
pop ecx
pop ecx
test eax, eax
je 0x42d67c
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.0042cafe
test eax, eax
jne 0x42d67c
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0042ca2d
cmp dword [ebp - 8], 0
jne 0x42d5ea
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x431d09
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x56e19c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.004317b7
mov ebx, eax
cmp ebx, esi
je 0x431d76
lea ecx, [ebp - 0x20c]
call fcn.00407114
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f6f4f
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x431d94
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00431d09
cmp eax, esi
jne 0x431ddb
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x431d7e
lea ecx, [ebp - 0x20c]
call fcn.00407114
push dword [ebp - 0x214]
mov ecx, edi
call fcn.004316fc
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.00407114
mov eax, esi
jmp 0x431d65