joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f3f8
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
mov eax, dword [esp + 0x14]
mov dword [0x46e33c], eax
push dword [0x46cbe0]
mov edx, 0x4590ae
pop ecx
call fcn.00401010
jne 0x47f438
mov edx, dword [0x46cbe0]
push dword [0x46e33c]
push edx
call fcn.00417220
pop eax
add eax, dword [0x46bd3c]
jmp 0x47f67d
push dword [0x46e33c]
push dword [0x46e33c]
call fcn.00415125
lea eax, [0x46cbe0]
push eax
call fcn.004171c0
lea eax, [esp]
push eax
push 0x1a
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov ebx, eax
and ebx, ebx
jne 0x47f4c2
push dword [0x46e33c]
push dword [0x46e33c]
push 0x104
call fcn.00414220
lea eax, [0x46cbe0]
push eax
call fcn.004171c0
mov eax, dword [0x46cbe0]
push eax
push dword [esp + 4]
call sub.SHELL32.dll_SHGetPathFromIDListW
mov ebx, eax
and ebx, ebx
jne 0x47f4c2
push dword [0x46e33c]
push dword [0x46e33c]
call fcn.00415125
lea eax, [0x46cbe0]
push eax
call fcn.004171c0
push dword [0x46e33c]
push dword [0x46e33c]
push 1
push dword [0x46cbe0]
call fcn.004141a0
add dword [0x46e33c], 2
mov edx, 0x45a27c
pop ecx
mov dword [0x46e33c], ecx
add ecx, dword [0x46bd3c]
call fcn.00401010
jne 0x47f529
mov edx, dword [0x46cbe0]
push dword [0x46e33c]
push edx
call fcn.00417220
mov edx, 0x459d7c
push edx
call fcn.00417220
lea eax, [0x46cbe0]
push eax
call fcn.004171c0
jmp 0x47f552
mov edx, dword [0x46cbe0]
push dword [0x46e33c]
push edx
call fcn.00417220
mov edx, str.PureBasic_
push edx
call fcn.00417220
lea eax, [0x46cbe0]
push eax
call fcn.004171c0
push dword [0x46cbe0]
call fcn.00414ed7
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x47f56f
cmp edi, 0xffffffff
jne 0x47f56f
xor eax, eax
jmp 0x47f574
mov eax, 1
or eax, eax
je 0x47f652
mov dword [esp + 4], 3
mov ebx, dword [esp + 4]
inc ebx
push ebx
mov eax, 0x45a27c
push eax
push dword [0x46cbe0]
call fcn.004138a0
mov ebx, eax
and ebx, ebx
jle 0x47f652
mov ebx, dword [esp + 4]
inc ebx
push ebx
mov eax, 0x45a27c
push eax
push dword [0x46cbe0]
call fcn.004138a0
mov dword [esp + 4], eax
push dword [0x46e33c]
push dword [0x46e33c]
push dword [0x46e33c]
push dword [esp + 0x10]
push dword [0x46cbe0]
call fcn.00413a30
mov edx, dword [0x46bd3c]
add dword [esp], edx
call fcn.00414ed7
pop dword [0x46e33c]
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x47f607
cmp edi, 0xffffffff
jne 0x47f607
xor eax, eax
jmp 0x47f60c
mov eax, 1
or eax, eax
je 0x47f64d
push dword [0x46e33c]
push dword [0x46e33c]
push dword [0x46e33c]
push dword [esp + 0x10]
push dword [0x46cbe0]
call fcn.00413a30
mov edx, dword [0x46bd3c]
add dword [esp], edx
call fcn.004148cb
pop dword [0x46e33c]
mov ebx, eax
and ebx, ebx
jne 0x47f64d
jmp 0x47f652
jmp 0x47f584
mov edx, dword [0x46cbe0]
push dword [0x46e33c]
push edx
call fcn.00417220
pop eax
add eax, dword [0x46bd3c]
jmp 0x47f67d
add esp, 8
pop edi
pop ebx
ret
Function at 0x4073fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436bc0]
jne 0x407408
repz ret
jmp fcn.0040937c

Function at 0x407d0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x436bc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404d53
and dword [ebp - 0x14], 0
cmp dword [0x43c2bc], 0
mov dword [ebp - 0x18], eax
jne 0x407dbe
push 0x402944
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407e66
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402938
push ebx
call edi
test eax, eax
je 0x407e66
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402928
push ebx
mov dword [0x43c2bc], eax
call edi
push eax
call esi
push 0x402914
push ebx
mov dword [0x43c2c0], eax
call edi
push eax
call esi
push 0x4028f8
push ebx
mov dword [0x43c2c4], eax
call edi
push eax
call esi
mov dword [0x43c2cc], eax
test eax, eax
je 0x407dbe
push 0x4028e0
push ebx
call edi
push eax
call esi
mov dword [0x43c2c8], eax
mov eax, dword [0x43c2c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407e17
cmp dword [0x43c2cc], ecx
je 0x407e17
push eax
call esi
push dword [0x43c2cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407e17
test ebx, ebx
je 0x407e17
call edi
test eax, eax
je 0x407e0e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407e0e
test byte [ebp - 8], 1
jne 0x407e17
or dword [ebp + 0x10], 0x200000
jmp 0x407e4a
mov eax, dword [0x43c2c0]
cmp eax, dword [ebp - 0x18]
je 0x407e4a
push eax
call esi
test eax, eax
je 0x407e4a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407e4a
mov eax, dword [0x43c2c4]
cmp eax, dword [ebp - 0x18]
je 0x407e4a
push eax
call esi
test eax, eax
je 0x407e4a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c2bc]
call esi
test eax, eax
je 0x407e66
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407e68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073fe
leave
ret

Function at 0x438c94
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub eax, 0xdbc6fdd7
or ecx, ecx
call fcn.00438cc2
or eax, ecx
xor dword [edx], esi
inc eax
or eax, eax
sub eax, 0x771bde7d
inc edx
or ecx, eax
cmp edx, ebx
jne fcn.00438c94
mov eax, ecx
ret
Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408180
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408180
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x408133
test edx, 3
jne 0x408122
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40812d
jmp 0x408133
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x408133
cmp dword [ecx - 8], 1
je 0x40813d
mov edx, ebx
or edx, 3
call fcn.00404dd0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40814f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404684

Function at 0x40818c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x40821c
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x40821c
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4081cf
test edx, 3
jne 0x4081be
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4081c9
jmp 0x4081cf
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4081cf
cmp dword [ecx - 8], 1
je 0x4081d9
mov edx, ebx
or edx, 3
call fcn.00404dd0
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4081eb
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404684

Function at 0x40b4b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b4f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404774
jmp 0x40b4fa
mov eax, ebx
mov edx, esi
call fcn.004046d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b504
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b526
movzx eax, byte [esp]
jmp 0x40b528
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40bbb8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40ba30
mov eax, dword [0x45bba4]
cmp byte [eax], 0
je 0x40bc34
mov eax, dword [0x45b9ac]
call fcn.00403028
call fcn.00402de8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408c50
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bc7c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bc6a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x45b950]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x45e7f4]
call fcn.00405850
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c4c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c59e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040471c
lea eax, [ebp - 4]
call fcn.00404b98
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b48
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c588
mov eax, ebx
call fcn.00402c8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c581
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b48
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c56b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c5b0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c56b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c588
mov eax, dword [ebp - 0x10]
call fcn.00402ca8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5a5
lea eax, [ebp - 4]
call fcn.00404684
ret
Function at 0x41b330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45f300
cmp dword [edi], 0
jne 0x41b3ac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45f2fc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45aad4
mov ecx, 2
call fcn.00402e7c
mov edx, 0x41b308
lea eax, [esi + 5]
call fcn.0041b328
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b328
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b381
mov dword [0x45f2fc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404b48
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41d958
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45bcc0]
mov dl, 1
mov eax, dword [0x41d424]
call fcn.0040bd78
call fcn.004040cc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d52c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41eae8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41eaee
ret
Function at 0x42b914
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b38
xor eax, eax
push ebp
push 0x42ba49
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42ba1c
xor edx, edx
push ebp
push 0x42ba15
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x42b961
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42b9ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x42b9d9
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x42b9a0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00404b48
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00402e7c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b9e0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x45b8f4]
mov dl, 1
mov eax, dword [0x40745c]
call fcn.0040bd3c
call fcn.004040cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ba50
lea eax, [ebp - 4]
call fcn.00404684
ret
Function at 0x42ba58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42bc13
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404e34
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x42bc2c
call fcn.00404994
mov eax, ebx
call fcn.0041a8b0
mov edi, eax
dec edi
test edi, edi
jl 0x42bb10
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041a884
mov edx, dword [0x428044]
call fcn.004039e4
test al, al
je 0x42bb0c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0041a884
lea edx, [ebp - 0x14]
call fcn.00439c70
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404e34
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a08
inc esi
dec edi
jne 0x42babe
movzx eax, byte [0x42bc30]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42bc3c
mov eax, dword [ebp - 8]
call fcn.0040cf8c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040471c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00439c70
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42bc2c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00439c70
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42bc2c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42bc2c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42bc48
call fcn.00409354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bc1a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004046a8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004046a8
lea eax, [ebp - 0x14]
call fcn.00404684
lea eax, [ebp - 0x10]
call fcn.00404684
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046a8
ret
Function at 0x42e48c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404684
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42e4da
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004048f4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43255c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43268f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41d484]
call fcn.0041d554
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x432665
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041d5f4
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004048f4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4326a4
call fcn.00404994
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041d658
lea ecx, [ebp - 4]
mov edx, 0x4326e0
mov eax, dword [ebp - 0xc]
call fcn.0041d888
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d978
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x432648
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4326ec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x45b494]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43264f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x43273c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x432783
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x432766
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x432777
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x432783
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x437428
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x45f560], 0
je 0x437571
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45bb40]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x437571
mov eax, dword [0x45f564]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x45f560]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x437540
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x45f560]
call fcn.00414418
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x437538
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x437538
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x437538
mov eax, dword [ebp - 0x14]
call fcn.00441764
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x437538
push ebp
call fcn.004373e4
pop ecx
test al, al
jne 0x437538
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403a54
test al, al
je 0x437538
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403a54
cmp byte [ebp - 1], 0
je 0x437538
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x437538
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45f564]
call fcn.00436b54
inc edi
dec ebx
jne 0x43748d
mov eax, dword [0x45f564]
cmp dword [eax + 8], 0
jle 0x437558
mov eax, dword [0x45f564]
call fcn.00436c0c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x437571
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00437248
pop ecx
test al, al
jne 0x437571
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406518
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004397b0
test ebx, ebx
jne 0x43e9b3
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0043e89c
mov ebx, eax
test ebx, ebx
je 0x43ea9e
cmp esi, ebx
je 0x43e9dc
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x43e9f1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x43ea29
add eax, 0xffffff5f
sub eax, 2
jb 0x43ea41
dec eax
sub eax, 2
jb 0x43ea55
dec eax
sub eax, 2
jb 0x43ea4b
jmp 0x43ea5f
add eax, 0xfffffdff
sub eax, 2
jb 0x43ea41
dec eax
sub eax, 2
jb 0x43ea55
dec eax
sub eax, 2
jb 0x43ea4b
jmp 0x43ea5f
mov byte [esp + 0x120], 0
jmp 0x43ea67
mov byte [esp + 0x120], 2
jmp 0x43ea67
mov byte [esp + 0x120], 1
jmp 0x43ea67
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0044c254
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0043af1c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x43eaa0
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret