joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push 1
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x110], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e28ae
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.guid
push dword [ebp - 0x114]
call esi
test eax, eax
jne 0x4e28ae
push str._n_CPU_INFO:
call fcn.00427d77
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.00427d77
lea edx, [ebp - 0x108]
add esp, 0xc
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4e2810
sub edx, ecx
lea eax, [ebp - 0x108]
push edx
push eax
mov ecx, edi
call fcn.004df530
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.user_id
push dword [ebp - 0x114]
call esi
test eax, eax
jne 0x4e28ae
push str._n_CPU_INFO:
call fcn.00427d77
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.00427d77
lea edx, [ebp - 0x108]
add esp, 0xc
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4e2881
sub edx, esi
lea eax, [ebp - 0x108]
push edx
push eax
mov ecx, ebx
call fcn.004df530
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e36f8
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e36f8
mov esp, ebp
pop ebp
ret 8
Function at 0x4e28d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4e290c
or esi, 0xffffffff
jmp 0x4e2979
push dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmovae eax, dword [ebp + 8]
push eax
push 1
push 0
push str.guid
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4e2940
push str._self_run_success_n
call fcn.00427d77
add esp, 4
push dword [ebp + 0x30]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
push 1
push 0
push str.user_id
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4e296e
push str._self_run_success_n
call fcn.00427d77
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x4e29a9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4e299f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e29f4
push edx
push ecx
call fcn.004e3aa8
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4e29eb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4e29e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e29f4
push edx
push ecx
call fcn.004e3aa8
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x30
call fcn.005001e5
int3
Function at 0x4e2ab0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5312c8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
push eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.004e3370
cmp byte [ebp - 0x84], 0
jne 0x4e2bff
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x4e2b43
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x57a6d0
call fcn.004e3370
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.004e3370
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x4e2bb2
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call fcn.004fce20
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.004e2a00
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x4e2c3b
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4e2c31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e2c57
push edx
push ecx
call fcn.004e3aa8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e36f8
mov esp, ebp
pop ebp
ret
call fcn.005001e5
int3

Function at 0x4e6a7a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x51c2f2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051bfb5

Function at 0x51c2fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051c136

Function at 0x5204e2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005201a2
Function at 0x40141c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40142e
mov eax, dword [0x4e608b]
shl eax, 2
mov dword [0x4e608f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004c4f7c
pop edx
call fcn.004c4ee0
call fcn.004c4fbc
push 0
call fcn.004c6558
pop ecx
push 0x4e6034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4e6093], eax
push 0
jmp fcn.004cd104
Function at 0x42b630
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
call fcn.004c85f4
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x42d204
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [ebp + 0xc], 0
je 0x42d256
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp + 0xc]
xor edx, edx
push edx
push eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
call fcn.004c9b70
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jne 0x42d254
cmp eax, dword [ebp - 0x10]
jbe 0x42d239
jmp 0x42d256
jle 0x42d239
mov esp, ebp
pop ebp
ret

Function at 0x435034
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [0x50f57b]
mov dword [ebp - 4], eax
mov dl, byte [0x50f57f]
mov byte [ebp - 5], dl
xor ecx, ecx
mov cl, byte [0x50f454]
mov dword [0x51827c], ecx
mov al, byte [0x50f454]
mov byte [0x51836a], al
mov dl, byte [ebp + 8]
and dl, 1
mov byte [ebp - 6], dl
sar dword [ebp + 8], 1
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 6
push 1
lea ecx, [ebp - 4]
push ecx
push 1
lea eax, [ebp - 5]
push eax
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
xor edx, edx
mov dword [ebp - 0xc], edx
push 2
call fcn.00434ee8
pop ecx
mov byte [ebp - 0xd], al
xor ecx, ecx
mov cl, byte [ebp - 0xd]
and ecx, 2
cmp ecx, 2
jne 0x43515f
mov byte [ebp - 4], 0xd8
mov eax, dword [ebp + 8]
sar eax, 9
and al, 0xff
mov byte [ebp - 3], al
mov edx, dword [ebp + 8]
sar edx, 1
and dl, 0xff
mov byte [ebp - 2], dl
mov cl, byte [ebp + 8]
and cl, 1
shl ecx, 7
mov al, byte [ebp - 6]
shl eax, 6
or cl, al
or cl, 0
mov byte [ebp - 1], cl
push 4
lea edx, [ebp - 4]
push edx
push 1
lea ecx, [ebp - 5]
push ecx
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x14], eax
jmp 0x435150
push 2
call fcn.00434ee8
pop ecx
mov byte [ebp - 0xd], al
xor eax, eax
mov al, byte [ebp - 0xd]
and eax, 1
dec eax
jne 0x435149
push 1
call sub.KERNEL32.DLL_Sleep
mov dword [ebp - 0xc], 1
jmp 0x435150
xor edx, edx
mov dword [ebp - 0xc], edx
jmp 0x43515f
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0x14]
cmp eax, 0x2710
jb 0x435123
cmp dword [ebp - 0xc], 1
jne 0x435169
xor eax, eax
jmp 0x43516e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x435174
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push esi
push edi
mov esi, 0x50f580
lea edi, [ebp - 0x854]
mov ecx, 0x210
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [0x50fdc3]
mov byte [ebp - 1], al
xor edx, edx
mov dl, byte [0x50f454]
mov dword [0x51827c], edx
mov cl, byte [0x50f454]
mov byte [0x51836a], cl
mov al, byte [ebp + 8]
and al, 1
mov byte [ebp - 2], al
sar dword [ebp + 8], 1
mov byte [ebp - 1], 0x10
mov byte [ebp - 0x854], 6
push 1
lea edx, [ebp - 0x854]
push edx
push 1
lea ecx, [ebp - 1]
push ecx
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
xor eax, eax
mov dword [ebp - 8], eax
push 2
call fcn.00434ee8
pop ecx
mov byte [ebp - 9], al
xor edx, edx
mov dl, byte [ebp - 9]
and edx, 2
cmp edx, 2
jne 0x43532c
mov byte [ebp - 0x854], 2
mov cl, byte [ebp - 2]
shl ecx, 4
mov byte [ebp - 0x853], cl
mov byte [ebp - 0x852], 0
push 0x840
push dword [ebp + 0x14]
lea eax, [ebp - 0x851]
push eax
call fcn.004c53bc
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
lea ecx, [ebp - 0x854]
push ecx
push 1
lea eax, [ebp - 1]
push eax
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
mov byte [ebp - 0x854], 0x10
mov edx, dword [ebp + 8]
sar edx, 9
and dl, 0xff
mov byte [ebp - 0x853], dl
mov ecx, dword [ebp + 8]
sar ecx, 1
and cl, 0xff
mov byte [ebp - 0x852], cl
mov al, byte [ebp + 8]
and al, 1
shl eax, 7
mov dl, byte [ebp - 2]
shl edx, 6
or al, dl
mov cl, byte [ebp + 0xc]
and cl, 0x3f
or al, cl
mov byte [ebp - 0x851], al
push 4
lea eax, [ebp - 0x854]
push eax
push 1
lea edx, [ebp - 1]
push edx
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x10], eax
jmp 0x43531d
push 2
call fcn.00434ee8
pop ecx
mov byte [ebp - 9], al
xor ecx, ecx
mov cl, byte [ebp - 9]
and ecx, 1
dec ecx
jne 0x435316
push 1
call sub.KERNEL32.DLL_Sleep
mov dword [ebp - 8], 1
jmp 0x43531d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43532c
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0x10]
cmp eax, 0x3e8
jb 0x4352f0
cmp dword [ebp - 8], 1
jne 0x435336
xor eax, eax
jmp 0x43533b
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435344
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push esi
push edi
mov eax, dword [0x50fdc4]
mov dword [ebp - 4], eax
mov esi, 0x50fdc8
lea edi, [ebp - 0x1010]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x510dc8]
mov byte [ebp - 5], al
mov dl, byte [ebp + 8]
and dl, 1
mov byte [ebp - 6], dl
sar dword [ebp + 8], 1
xor ecx, ecx
mov cl, byte [0x50f454]
mov dword [0x51827c], ecx
mov al, byte [0x50f454]
mov byte [0x51836a], al
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 0x13
mov edx, dword [ebp + 8]
sar edx, 9
and dl, 0xff
mov byte [ebp - 3], dl
mov ecx, dword [ebp + 8]
sar ecx, 1
and cl, 0xff
mov byte [ebp - 2], cl
mov al, byte [ebp + 8]
and al, 1
shl eax, 7
mov dl, byte [ebp - 6]
shl edx, 6
or al, dl
mov cl, byte [ebp + 0xc]
and cl, 0x3f
or al, cl
mov byte [ebp - 1], al
push 4
lea eax, [ebp - 4]
push eax
push 1
lea edx, [ebp - 5]
push edx
push 0x518354
call fcn.0042e6e0
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
mov byte [ebp - 7], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x43543b
push 2
call fcn.00434ee8
pop ecx
mov byte [ebp - 7], al
xor eax, eax
mov al, byte [ebp - 7]
and eax, 1
dec eax
jne 0x435434
push 1
call sub.KERNEL32.DLL_Sleep
mov dword [ebp - 0x10], 1
jmp 0x43543b
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x43544a
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, 0x3e8
jb 0x43540e
cmp dword [ebp - 0x10], 1
jne 0x435454
xor eax, eax
jmp 0x4354cc
mov byte [ebp - 4], 3
mov dl, byte [ebp - 6]
shl edx, 4
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea ecx, [ebp - 4]
push ecx
push 1
lea eax, [ebp - 5]
push eax
push 0x518354
call fcn.0042e6e0
add esp, 0x14
mov byte [ebp - 5], 0x11
push dword [ebp + 0x10]
lea edx, [ebp - 0x1010]
push edx
push 1
lea ecx, [ebp - 5]
push ecx
push 0x518354
call fcn.0042e4dc
add esp, 0x14
push 0x12
push 0x518354
call fcn.0042e93c
add esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 0x1010]
push eax
push dword [ebp + 0x14]
call fcn.004c53bc
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4394b4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x439400
call sub.USER32.DLL_EnumWindows
ret
Function at 0x4395d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x439655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00439024
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4395fd
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00438c7c
cmp dword [ebp - 4], 0
je 0x43963f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004c2880
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43965c
lea eax, [ebp - 4]
call fcn.004c23d0
ret

Function at 0x44b0f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004c23d0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44b13f
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004c2638
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4531b4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4531ba
ret

Function at 0x45577c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4557cd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4557b4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4557a4
jmp 0x4557cd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4557b5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e6c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45e710]
test si, 4
je 0x45e6d4
or bl, 1
test si, 8
je 0x45e6de
or bl, 4
test si, 1
je 0x45e6e8
or bl, 8
test si, 2
je 0x45e6f2
or bl, 0x10
test si, 0x10
je 0x45e6fc
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45e70b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45e714
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45e74c]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45e72d
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x45e73c
or bl, 4
test esi, 0x20000000
je 0x45e747
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4650a8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4650ba
add esp, 0xfffffff0
call fcn.004c1be8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004ad134
mov eax, dword [0x517f4c]
mov dword [eax + 4], ebx
mov dword [eax], 0x46544c
mov eax, dword [0x517f50]
mov dword [eax + 4], ebx
mov dword [eax], 0x465458
mov eax, ebx
call fcn.00465464
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4a293c]
call fcn.004c1854
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x46192c
push eax
push 0
push 0
mov eax, dword [0x517f38]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4525e8]
call fcn.00453cfc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4525e8]
call fcn.00453cfc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4525e8]
call fcn.00453cfc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004658cc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4657a8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4657a8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4657a8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4651f7
call fcn.004c1c40
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46558c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x465737
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x465718
mov dl, 1
mov eax, dword [0x4a2f28]
call fcn.004c1854
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004c23d0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x465707
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00480238
test al, al
je 0x4656fa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x465748
lea eax, [ebp - 0x254]
call fcn.004b1924
push eax
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4656fa
xor eax, eax
push ebp
push 0x4656f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x465780
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4656dc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004c2638
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4656dc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004c2638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4656fa
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4655fd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004a7734
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46573e
lea eax, [ebp - 0x260]
call fcn.004c23d0
ret

Function at 0x46606c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x60e888]
cmp byte [eax + 0xa5], 0
jne 0x4660dd
cmp dword [0x60e8a0], 0
jne 0x46609e
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x466028
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x60e8a0], eax
cmp dword [0x60e89c], 0
jne 0x4660b9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x60e89c], eax
cmp dword [0x60e8a4], 0
jne 0x4660dd
push esp
push 0
push 0
push 0x465fcc
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x60e8a4], eax
pop edx
ret