joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408234
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x408286
test eax, edx
je 0x408289
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x408249
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40826f
add ecx, 4
js 0x40825f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40826c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x408295
test edx, edx
jne 0x40823c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40b45c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b495
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404904
jmp 0x40b49e
mov eax, ebx
mov edx, esi
call fcn.00404868
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b4a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4ca
movzx eax, byte [esp]
jmp 0x40b4cc
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bb5c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b9d4
mov eax, dword [0x461c78]
cmp byte [eax], 0
je 0x40bbd8
mov eax, dword [0x461aa8]
call fcn.004031c8
call fcn.00402fac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408bdc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc20
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bc0e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x461a50]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4647f0]
call fcn.004059ec
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c498
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c56e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004048ac
lea eax, [ebp - 4]
call fcn.00404cfc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ca4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c558
mov eax, ebx
call fcn.00402e50
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c551
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ca4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c53b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c580
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c53b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c558
mov eax, dword [ebp - 0x10]
call fcn.00402e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c575
lea eax, [ebp - 4]
call fcn.00404814
ret
Function at 0x40dbcc
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x40dc66
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x40dbeb
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x40dc7c
dec edx
je 0x40dcb1
jmp 0x40dd02
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x40dd02
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_W]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40dd74
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x40dd93
add edx, 3
sar edx, 2
test edx, edx
jle 0x40dea1
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x40ddc8
je 0x40de0b
sub ecx, 0x2b
je 0x40de01
sub ecx, 4
je 0x40de06
dec ecx
sub ecx, 0xa
jb 0x40ddf3
jmp 0x40de0e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x40ddda
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x40dde5
jmp 0x40de0e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x40de0e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x40de0e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x40de0e
mov byte [eax], 0x3e
jmp 0x40de0e
mov byte [eax], 0x3f
jmp 0x40de0e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x40ddab
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x40de5f
cmp byte [esp + 7], 0xff
jne 0x40de5f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x40de96
cmp dl, 0xff
je 0x40de96
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x40dda2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x41b3e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4669e4
cmp dword [edi], 0
jne 0x41b460
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4669e0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x460b10
mov ecx, 2
call fcn.00403040
mov edx, 0x41b3bc
lea eax, [esi + 5]
call fcn.0041b3dc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b3dc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b435
mov dword [0x4669e0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c290
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x41c2ab
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x41c2a0
pop edi
pop esi
ret
Function at 0x41fddc
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x41fe6d
movzx ebx, byte [ebx + 0x460c64]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x460b64]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x460b64]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x460c64]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jb 0x41fec7
movzx ebx, byte [ebx + 0x460c64]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x460c64]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x460b64]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x460b64]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x460b64]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x460b64]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x4669ec]
movzx ecx, byte [ecx + 0x460c64]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x460b64]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x466dec]
movzx eax, byte [eax + 0x460b64]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x460c64]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x4671ec]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x460c64]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x460c64]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x4675ec]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x41ff84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
movzx ecx, cl
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jb 0x41ff91
pop esi
pop ebx
ret
Function at 0x420d40
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], pe_nt_image_headers32
mov esi, 0x460b64
mov ebx, 0x4669ec
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.0041fcc4
mov dword [esp + 8], eax
mov eax, edi
call fcn.0041fcd4
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.0041fcc4
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.0041fcd4
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x420d59
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x423220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404ca4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x423278
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x461d94]
mov dl, 1
mov eax, dword [0x422d2c]
call fcn.0040bd1c
call fcn.0040425c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00422e34
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4240d4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4240da
ret
Function at 0x42e39c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404814
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42e3ea
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4334cc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4335ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x422d8c]
call fcn.00422e5c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4335d5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00422efc
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404a84
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x433614
call fcn.00404b2c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00422f60
lea ecx, [ebp - 4]
mov edx, 0x433650
mov eax, dword [ebp - 0xc]
call fcn.004231a8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d6b8
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4335b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x43365c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x461690]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4335bf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4336ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4336f3
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4336d6
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4336e7
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4336f3
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4381e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x467c44], 0
je 0x43832d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x461c18]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x43832d
mov eax, dword [0x467c48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x467c44]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4382fc
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x467c44]
call fcn.00414478
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4382f4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x4382f4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4382f4
mov eax, dword [ebp - 0x14]
call fcn.004428a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4382f4
push ebp
call fcn.004381a0
pop ecx
test al, al
jne 0x4382f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403bfc
test al, al
je 0x4382f4
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403bfc
cmp byte [ebp - 1], 0
je 0x4382f4
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4382f4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x467c48]
call fcn.00437910
inc edi
dec ebx
jne 0x438249
mov eax, dword [0x467c48]
cmp dword [eax + 8], 0
jle 0x438314
mov eax, dword [0x467c48]
call fcn.004379c8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43832d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00438004
pop ecx
test al, al
jne 0x43832d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f774
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004066b4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0043a56c
test ebx, ebx
jne 0x43f7c7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0043f6b0
mov ebx, eax
test ebx, ebx
je 0x43f8b2
cmp esi, ebx
je 0x43f7f0
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x43f805
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x43f83d
add eax, 0xffffff5f
sub eax, 2
jb 0x43f855
dec eax
sub eax, 2
jb 0x43f869
dec eax
sub eax, 2
jb 0x43f85f
jmp 0x43f873
add eax, 0xfffffdff
sub eax, 2
jb 0x43f855
dec eax
sub eax, 2
jb 0x43f869
dec eax
sub eax, 2
jb 0x43f85f
jmp 0x43f873
mov byte [esp + 0x120], 0
jmp 0x43f87b
mov byte [esp + 0x120], 2
jmp 0x43f87b
mov byte [esp + 0x120], 1
jmp 0x43f87b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0044e07c
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0043bcdc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x43f8b4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x447a08
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x461d88]
cmp byte [eax + 0xc], 0
je 0x447b75
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x447b6e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x467c54], 0
jne 0x447a5c
push 0x447b7c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x447b84
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c54], eax
cmp dword [0x4617d8], 0
jne 0x447b57
push 0x447b94
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4617d8], eax
cmp dword [0x4617d8], 0
je 0x447b57
push 0x447ba0
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c58], eax
push 0x447bb0
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c5c], eax
push 0x447bc4
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c60], eax
push 0x447bdc
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c64], eax
push 0x447bf4
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c68], eax
push 0x447c08
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c6c], eax
push 0x447c20
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c70], eax
push 0x447c38
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c74], eax
push 0x447c54
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c78], eax
push 0x447c60
mov eax, dword [0x4617d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467c7c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447b75
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44dbc0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x44dbe1
test edi, 0x40000
je 0x44dbfb
test bl, bl
jne 0x44dc7c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x44dc7c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x44dc2e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x44dc43
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x44dc52
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x44dc63
cmp byte [esp + 2], 0
je 0x44dc7c
cmp byte [esp + 2], 0
je 0x44dc74
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x44dc7c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret