joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405822
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x456268
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x456268], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40585d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a14
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405a31
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405a34
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405a63
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4088ec]
mov dword [ebp - 8], eax
mov eax, dword [0x4088f0]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ab3
test edi, edi
jne 0x405a70
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405aad

Function at 0x405ab7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI_RegOpenKeyExW]
test eax, eax
jne 0x405b30
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI_RegQueryValueExW]
test eax, eax
jne 0x405b19
cmp dword [ebp + 0x14], 1
je 0x405b1e
cmp dword [ebp + 0x14], 2
je 0x405b1e
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x5adc24
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
les eax, [eax + 0x4ba2ae64]
xor eax, 0xed93f14a
pop edx
fimul dword [edi - 0x71]
fisttp dword [ebx - 0x1c]
mov bl, 0x93
dec eax
in al, dx
push ss
pop es
mov bh, byte [ecx - 0x41be5617]
clc
nop
xchg edx, eax
salc
push 0x19339c97
fild dword [edi + 0x2b]
cmp eax, 0x202cddaa
invalid
Function at 0x7702c4
Capabilities:
Encode data using xor

Disassembly:
lds esp, [ecx + 0x49e95bcb]
stosb byte es:[edi], al
sub al, 0x74
out dx, al
push cs
cli
out dx, eax
xchg edx, eax
xor eax, 0x562d0bb1
add edx, dword [esi + 0x7afd71c5]
in eax, dx
adc eax, 0xb13d517a
mov al, 0x89
pop ebp
popal
lea esp, [ecx + 0x1d]
stc
test ebp, ecx
adc dword [edi + edx - 0x1bbbfec2], edi
hlt
loopne 0x7701d2
test al, 0x7d
dec ecx
imul eax, dword [esi], 0xbdadb8d5
pushfd
mov ebx, ebp
aam 0x99
push es
aad 0xb8
lodsd eax, dword [esi]
mov ebp, 0xd4dd8b9c
cdq
aam 0x38
ja 0x770168
arpl word [ebx], dx
pop ebp
jae 0x770176
cdq
mov eax, 0x31425d6d
dec ebp
stosd dword es:[edi], eax
mov word [esi], ds
insd dword es:[edi], dx
pop ds
cmp eax, 0xf8ecf346
sbb dword [ecx - 0x6f28be23], eax
jno 0x7701cc
wait
pop es
mov esp, dword [ecx]
cmpsb byte [esi], byte es:[edi]
aaa
adc eax, ebp
lea ebx, [ebp + 0x71]
sub eax, 0xc7f877e1
pushfd
add dword [eax + 0x5d33f111], eax
xchg ecx, eax
adc al, 0x64
mov ebp, 0xe075ed6d
and dword [ecx], esi
aas
cmp byte [ecx + 0x61ea5309], ah
inc edx
adc ecx, dword [esi - 0x1c]
dec ebx
xchg ebp, eax
jns 0x7701f7
clc
jo 0x7701f7
pop es
loopne 0x7702ab
popfd
inc esp
cld
push eax
lcall 0x2da2, 0x8d260a24
movsd dword es:[edi], dword [esi]
fdiv qword [ebx + 0x3008b62d]
inc ebx
mov byte [0xb3dca52d], al
sub eax, 0x433008b6
sahf
dec esi
mov edi, 0xe20538f3
invalid
loop 0x770218
sbb dword [ebp + 0x79ec688f], edx
insd dword es:[edi], dx
or eax, 0x708c08a1
mov bl, 0xc2
pop ds
pop ecx
dec ecx
add al, 4
mov es, word [edi - 0x29aea281]
cmpsb byte [esi], byte es:[edi]
mov cl, 0xdc
fst qword [eax + 0x55]
adc dword [eax + 8], ebx
pushfd
and cl, al
xor dword [0x97b7cd21], 0x1d
pop eax
mov eax, 0xa1191381
cdq
rcl byte [ebp - 0x4a], 0xdf
sub ebx, esp
jl 0x770240
insd dword es:[edi], dx
and byte [ebp - 0xed972ef], bh
xor dl, ch
pop ebp
push ds
pop ecx
lodsd eax, dword [esi]
rol dword [ecx + 0x6d8c1d11], 1
insd dword es:[edi], dx
xchg ecx, eax
sbb byte [ecx - 0x45], dl
inc ecx
sbb eax, 0x4d2221bd
dec ebp
jecxz 0x770250
lea edi, [edx]
or edx, dword [edi - 0x42fe9038]
shr dword [ebp + 0x2d9d9f45], 0x6c
mov dword [0xdea54f01], eax
add dword [0x9f31d47], 0xffffffd3
inc edi
sbb eax, 0x1cd309f3
ror dword [esi], 1
inc edi
sbb eax, 0x1cd309f3
ror dword [esi], 1
salc
popfd
loope 0x7702a1
test eax, 0x25287699
and dword [ecx], 0xd86544a7
cdq
jns 0x77030b
pop eax
mov ebp, 0xf6a5e18b
cmp dword [edi - 0x66], eax
push ebp
add dword [ecx + 0x76], ebx
fcom st(6)
adc eax, 0x3d4ee781
pop ds
stosd dword es:[edi], eax
mov edx, 0xf23a45dd
add esi, dword [ecx - 0x38]
jmp 0x1f3ca77c
sub esp, dword [edi]
sahf
cmp dword [edi + 0x714c813c], esp
arpl bp, di
xor byte [ecx + 0x23c91c85], dh
shl byte [ecx], 0x70
and edi, dword [ebx - 0x44]
aad 0xcd
mov ebp, 0x11fd701e
and dword [ecx - 0x73ffe39d], esi
add edi, dword [edi + ebx*8]
adc dword [ebp - 0x520201c7], ecx
add bh, byte [esi]
call 0x5cf1dbc3
inc ecx
setns byte [ebp + 0x4e]
invalid
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x2526249
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x21b54478
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403078
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047c0
test esi, esi
jne 0x4030ae
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004048b0
jmp 0x4030cc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402f7c
mov edi, eax
test esi, esi
je 0x4030cc
cmp dword [ebx], 0
je 0x4030cc
dec esi
jmp 0x4030b5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x459008], 0x8088405
inc edx
mov dword [ebx + 0x459008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4037b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x459024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40384c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40382c
xor eax, eax
push ebp
push 0x403825
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403868
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40382c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x459024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x459024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404640
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45b048], 0
je 0x4046a1
cmp word [0x45b21c], 0xd7b2
jne 0x404669
cmp dword [0x45b224], 0
jbe 0x404669
mov eax, 0x45b218
call dword [0x45b234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4046c8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x459030], 0
jne 0x4046bd
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40822c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4082bc
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4082bc
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40826f
test edx, 3
jne 0x40825e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408269
jmp 0x40826f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40826f
cmp dword [ecx - 8], 1
je 0x408279
mov edx, ebx
or edx, 3
call fcn.00404f0c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40828b
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004047c0

Function at 0x4082c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408358
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408358
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40830b
test edx, 3
jne 0x4082fa
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408305
jmp 0x40830b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40830b
cmp dword [ecx - 8], 1
je 0x408315
mov edx, ebx
or edx, 3
call fcn.00404f0c
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408327
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004047c0

Function at 0x408b64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404c84
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408b7d
test al, 0x10
je 0x408b81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40b560
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b599
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004048b0
jmp 0x40b5a2
mov eax, ebx
mov edx, esi
call fcn.00404814
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b5ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5ce
movzx eax, byte [esp]
jmp 0x40b5d0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40bc60
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bad8
mov eax, dword [0x45ab2c]
cmp byte [eax], 0
je 0x40bcdc
mov eax, dword [0x45a930]
call fcn.0040317c
call fcn.00402de8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408cf8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd24
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bd12
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45a8d4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45d7f4]
call fcn.00405a2c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c570
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c646
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404858
lea eax, [ebp - 4]
call fcn.00404cd4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c84
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c630
mov eax, ebx
call fcn.00402c8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c629
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c84
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c613
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c658
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c613
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c630
mov eax, dword [ebp - 0x10]
call fcn.00402ca8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c64d
lea eax, [ebp - 4]
call fcn.004047c0
ret
Function at 0x41b194
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45e300
cmp dword [edi], 0
jne 0x41b210
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45e2fc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x459ad8
mov ecx, 2
call fcn.00402e7c
mov edx, 0x41b16c
lea eax, [esi + 5]
call fcn.0041b18c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b18c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b1e5
mov dword [0x45e2fc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d734
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404c84
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41d78c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45ac50]
mov dl, 1
mov eax, dword [0x41d258]
call fcn.0040be20
call fcn.00404208
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d360
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41e5e8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e5ee
ret
Function at 0x428e5c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004047c0
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x428eaa
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404a30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cf2c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d05f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41d2b8]
call fcn.0041d388
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x42d035
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041d428
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404a30
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x42d074
call fcn.00404ad0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041d48c
lea ecx, [ebp - 4]
mov edx, 0x42d0b0
mov eax, dword [ebp - 0xc]
call fcn.0041d6bc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d828
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x42d018
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x42d0bc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x45a430]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d01f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x42d10c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x42d153
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42d136
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42d147
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x42d153
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x431c44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x45e534], 0
je 0x431d8d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45aac8]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x431d8d
mov eax, dword [0x45e538]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x45e534]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x431d5c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x45e534]
call fcn.0041427c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x431d54
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x431d54
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x431d54
mov eax, dword [ebp - 0x14]
call fcn.0043be68
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x431d54
push ebp
call fcn.00431c00
pop ecx
test al, al
jne 0x431d54
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403ba8
test al, al
je 0x431d54
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403ba8
cmp byte [ebp - 1], 0
je 0x431d54
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x431d54
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45e538]
call fcn.00431370
inc edi
dec ebx
jne 0x431ca9
mov eax, dword [0x45e538]
cmp dword [eax + 8], 0
jle 0x431d74
mov eax, dword [0x45e538]
call fcn.00431428
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x431d8d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00431a64
pop ecx
test al, al
jne 0x431d8d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret