joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fa6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420f36
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00420fc0
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x45fac9
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fac0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46003a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x4600dd
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4601c2
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x460082
cmp byte [ebp - 0xf0], al
jne 0x46008b
cmp byte [edi + 0x1a], 0
jne 0x46008b
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x46009a
cmp byte [edi + 0x1b], 0
jne 0x46009a
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x4600ac
cmp byte [edi + 0x1c], 0
jne 0x4600ac
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x4600be
cmp byte [edi + 0x1d], 0
jne 0x4600be
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x4601c2
cmp byte [edi + 0x1e], 0
jne 0x4601c2
mov byte [esi + 4], 1
jmp 0x4601c2
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46010a
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x460113
cmp byte [edi + 0x1a], 0
jne 0x460113
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460139
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x460143
cmp byte [edi + 0x1b], 0
jne 0x460143
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460163
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46016d
cmp byte [edi + 0x1c], 0
jne 0x46016d
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46018d
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x460197
cmp byte [edi + 0x1d], 0
jne 0x460197
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4601b7
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x4601c1
cmp byte [edi + 0x1e], 0
jne 0x4601c1
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46034d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x460365
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x46036f
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x460379
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x460388
cmp byte [esi + 0x1a], al
je 0x460388
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x460395
cmp byte [esi + 0x1b], al
je 0x460395
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x4603a2
cmp byte [esi + 0x1c], al
je 0x4603a2
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x4603af
cmp byte [esi + 0x1d], al
je 0x4603af
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x4603bc
cmp byte [esi + 0x1e], al
je 0x4603bc
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x46043e
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x460576
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x460401
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x460576
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.0045ffb6
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460476
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x460494
cmp byte [esi + 0x1a], 0
jne 0x460494
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.004616c0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00460f42
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4604b6
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x4604d4
cmp byte [esi + 0x1b], 0
jne 0x4604d4
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.004616c0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00460f42
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4604f0
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x46050b
cmp byte [esi + 0x1c], 0
jne 0x46050b
push 0x11
lea ecx, [ebp - 0xc]
call fcn.004616c0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00460f42
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x460527
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x460542
cmp byte [esi + 0x1d], 0
jne 0x460542
push 0x12
lea ecx, [ebp - 0xc]
call fcn.004616c0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00460f42
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x460559
push 0x5b
call edi
test bx, ax
je 0x460574
cmp byte [esi + 0x1e], 0
jne 0x460574
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.004616c0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00460f42
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x460d9c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x460dfd
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004615f8
mov ecx, dword [ebp - 4]
call fcn.0046001f
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004615f8
mov ecx, dword [ebp - 4]
call fcn.00460006
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x460e07
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x460ee2
cmp bl, 0x14
je 0x460ee2
cmp bl, 0x90
je 0x460ee2
cmp bl, 0x91
je 0x460ee2
cmp bl, 0xff
je 0x460ecf
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x460e7a
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx edx, bh
mov ecx, edi
shl edx, 0x10
or edx, 1
call fcn.0046024f
cmp al, 1
jne 0x460e94
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x460ea5
cmp byte [esi + 0x1d], 0
jne 0x460ea5
cmp bl, 0x12
jne 0x460ec3
cmp byte [esi + 0x16], 0
jne 0x460ec3
cmp byte [esi + 0x1c], 0
jne 0x460ec3
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x460ed7
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x460ed7
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x460f32
cmp bl, 0xff
je 0x460f08
mov ecx, edi
call fcn.0046024f
push ecx
mov ecx, esi
cmp al, 1
jne 0x460ef9
push 1
jmp 0x460efb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004615f8
jmp 0x460f32
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0046001f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x460f42
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46101a
cmp bl, 0x14
je 0x46101a
cmp bl, 0x90
je 0x46101a
cmp bl, 0x91
je 0x46101a
cmp bl, 0xff
je 0x46106a
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x460fb9
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx edx, bh
mov ecx, edi
shl edx, 0x10
or edx, 0xc0000001
call fcn.0046024f
cmp al, 1
jne 0x460fd6
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x460fe7
cmp byte [esi + 0x1d], 0
jne 0x460fe7
cmp bl, 0x12
jne 0x461005
cmp byte [esi + 0x16], 0
jne 0x461005
cmp byte [esi + 0x1c], 0
jne 0x461005
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x46100f
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46106a
cmp bl, 0xff
je 0x461040
mov ecx, edi
call fcn.0046024f
push ecx
mov ecx, esi
cmp al, 1
jne 0x461031
push 3
jmp 0x461033
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004615f8
jmp 0x46106a
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00460006
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x461097
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x4610c8
cmp byte [esi + 1], 0
jne 0x4610c8
cmp byte [esi + 2], 0
jne 0x4610c8
cmp byte [esi + 3], 0
jne 0x4610c8
cmp byte [esi + 4], 0
je 0x461276
cmp dword [edi + 0x20], 0
push ebx
je 0x4611fe
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4611fe
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x461152
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x461110
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x461121
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46112d
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x461139
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x461145
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x461163
cmp byte [esi + 1], 0
je 0x46117a
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x461197
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4611db
cmp byte [esi + 2], 0
jne 0x4611c0
cmp byte [edi + 0x1c], 0
jne 0x4611c0
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x4611d6
test al, al
je 0x4611db
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46126e
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x46126e
xor ebx, ebx
cmp byte [esi], bl
je 0x461217
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 1], bl
je 0x46122f
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 2], bl
je 0x461244
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 3], bl
je 0x461259
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 4], bl
je 0x46126e
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004615f8
mov ecx, edi
call fcn.0046001f
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46127e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x4612af
cmp byte [esi + 1], 0
jne 0x4612af
cmp byte [esi + 2], 0
jne 0x4612af
cmp byte [esi + 3], 0
jne 0x4612af
cmp byte [esi + 4], 0
je 0x46146b
cmp dword [edi + 0x20], 0
push ebx
je 0x4613ed
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4613ed
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x461339
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x4612f7
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x461308
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x461314
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x461320
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46132c
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46134a
cmp byte [esi + 1], 0
je 0x461363
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x461382
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4613c8
cmp byte [esi + 2], 0
jne 0x4613ab
cmp byte [edi + 0x1c], 0
jne 0x4613ab
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x4613c3
test al, al
je 0x4613c8
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x461463
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x461463
cmp byte [esi], 0
push 2
pop ebx
je 0x461408
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 1], 0
je 0x461421
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 2], 0
je 0x461437
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 3], 0
je 0x46144d
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004615f8
cmp byte [esi + 4], 0
je 0x461463
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004615f8
mov ecx, edi
call fcn.00460006
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x461473
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x4614f8
jne 0x461487
push 0
jmp 0x4614f2
cmp esi, 0xf
jae 0x4614f1
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4614f1
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x4614aa
fadd qword [0x4b9e48]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.00420732
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x4614b3
jmp 0x4614f8
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x461652
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x461676
xor al, al
jmp 0x4616bb
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x461672
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x4616a6
mov byte [esi + 1], 1
test bl, 2
je 0x4616af
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x4616b9
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x46349e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.0046339d
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4636b5
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20030
call fcn.00431ac0
push ebx
push esi
lea eax, [esp + 0x10038]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.004646af
lea eax, [esp + 0x3c]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.004646af
pop ecx
pop ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x463743
cmp byte [ebp + 8], al
je 0x46373c
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call fcn.004236cc
pop ecx
pop ecx
test eax, eax
je 0x463735
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1003c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x4637ef
xor al, al
jmp 0x4637ef
lea ecx, [esp + 0x10038]
call fcn.00464ad8
test al, al
je 0x46373c
lea ecx, [esp + 0x38]
call fcn.00464ad8
test al, al
je 0x4637f5
cmp byte [ebp + 8], 0
je 0x46373c
lea eax, [esp + 0x10038]
push str..
push eax
call fcn.00422f0d
lea eax, [esp + 0x10040]
push eax
call fcn.00422d7c
xor ecx, ecx
mov word [esp + eax*2 + 0x10046], cx
lea eax, [esp + 0x44]
push eax
call fcn.00422d7c
xor ecx, ecx
mov dword [esp + 0x1c], 2
add esp, 0x10
mov word [esp + eax*2 + 0x3a], cx
lea eax, [esp + 0x10038]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x18], ax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
call fcn.00407f41
lea ecx, [esp + 0x28]
call fcn.00463a6e
mov bl, al
lea ecx, [esp + 0x28]
neg bl
sbb bl, bl
call fcn.00405a64
inc bl
jne 0x46373c
lea ecx, [esp + 0x38]
call fcn.00464ad8
test al, al
jmp 0x463768
Function at 0x463833
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 1], bl
mov edi, edx
call fcn.004077c7
lea ecx, [ebp - 0x44]
call fcn.004077c7
lea ecx, [ebp - 0x24]
call fcn.004077c7
lea ecx, [ebp - 0x14]
call fcn.004077c7
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.004048ae
lea edx, [ebp - 0x44]
mov ecx, edi
call fcn.004048ae
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x34]
call fcn.00464a6e
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 3], al
call fcn.00464ad8
mov esi, str..
test al, al
je 0x4638a4
push esi
lea ecx, [ebp - 0x34]
call fcn.00407e0b
mov ecx, dword [ebp - 0x44]
call fcn.00464ad8
test al, al
je 0x4638b9
push esi
lea ecx, [ebp - 0x44]
call fcn.00407e0b
lea ecx, [ebp - 0x54]
call fcn.004077c7
lea ecx, [ebp - 0x64]
call fcn.004077c7
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x34]
call fcn.004046f9
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [ebp - 2], al
cmp esi, 0xffffffff
je 0x463a05
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
jne 0x463a05
test byte [ebp - 0x2c8], 0x10
jne 0x4639d9
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407f41
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x74]
call fcn.004640b2
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00405a64
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x14]
call fcn.004081a7
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407c8e
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407e0b
lea ecx, [ebp - 0x24]
call fcn.00463c7b
test al, al
je 0x463991
cmp byte [ebp + 8], bl
je 0x4639fc
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407a68
push dword [ebp - 0x24]
test eax, eax
je 0x46399f
call edi
cmp byte [ebp + 0xc], 1
jne 0x4639c3
cmp byte [ebp - 3], bl
jne 0x4639aa
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4639d1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a48
movzx eax, al
test eax, eax
je 0x4639fc
push dword [ebp - 0x14]
call edi
jmp 0x4639d1
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.00463a48
movzx eax, al
test eax, eax
je 0x4639fc
mov byte [ebp - 1], 1
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [ebp - 2]
jne 0x463903
mov al, bl
mov byte [ebp - 2], al
jmp 0x463903
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x463a0f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [ebp - 1]
lea ecx, [ebp - 0x64]
call fcn.00405a64
lea ecx, [ebp - 0x54]
call fcn.00405a64
lea ecx, [ebp - 0x14]
call fcn.00405a64
lea ecx, [ebp - 0x24]
call fcn.00405a64
lea ecx, [ebp - 0x44]
call fcn.00405a64
lea ecx, [ebp - 0x34]
call fcn.00405a64
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463a6e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x48fac0
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.00407886
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x463b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x463ad2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x463ad7
jmp 0x463b3f
cmp eax, 3
jne 0x463b43
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x48fac0
inc dword [eax]
call fcn.00407e2f
cmp eax, 0xffffffff
je 0x463b30
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.00407e8c
lea ecx, [esp + 0x18]
call fcn.00463a6e
test al, al
je 0x463b2e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.00405a64
jmp 0x463b45
test al, 0x10
je 0x463b43
mov bl, 1
jmp 0x463b45
xor bl, bl
lea ecx, [esp + 8]
call fcn.00405a64
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret