joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46620c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x468118
sub eax, eax
test esi, esi
je 0x4662e4
sub eax, 1
test ecx, ecx
je 0x4662e2
test esi, 3
je 0x46624a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x46622f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x4662c9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x466254
mov ecx, edx
test ecx, ecx
je 0x4662e2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4662cf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4662ec
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0046636f
jae 0x4662fa
xor ecx, ecx
call fcn.0046636f
jae 0x466329
xor eax, eax
call fcn.0046636f
jae 0x466339
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0046636f
adc al, al
jae 0x46631b
jne 0x466365
stosb byte es:[edi], al
jmp 0x4662fd
call fcn.0046637b
sub ecx, ebx
jne 0x466342
call fcn.00466379
jmp 0x466361
lodsb al, byte [esi]
shr eax, 1
je 0x46638b
adc ecx, ecx
jmp 0x46635e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00466379
cmp eax, 0x7d00
jae 0x46635e
cmp ah, 5
jae 0x46635f
cmp eax, 0x7f
ja 0x466360
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4662fd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x466c7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x469000]
jne 0x466c86
repz ret
jmp fcn.00466f2d
Function at 0x402940
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40296f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403d20
jmp 0x40298d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004028c8
mov edi, eax
test ebx, ebx
je 0x40298d
cmp dword [esi], 0
je 0x40298d
dec ebx
jmp 0x402976
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c30
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x4ba040], 0x8088405
inc edx
mov dword [0x4ba040], edx
mul edx
mov eax, edx
ret

Function at 0x402c48
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x4ba040], 0x8088405
inc edx
mov dword [0x4ba040], edx
fld qword [0x4b602c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
ret

Function at 0x402e28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ec0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ea0
xor eax, eax
push ebp
push 0x402e99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402edc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ea0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x405688
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405844
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4056e9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x405860
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40575b
xor eax, eax
push ebp
push 0x405754
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004054e0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40573d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405880
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40575b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40583c
cmp byte [ebp - 0xd], 0
jne 0x40579d
cmp byte [ebp - 0x12], 0
je 0x40583c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4057b6
dec ebx
cmp byte [ebx], 0x2e
je 0x4057c5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4057b5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40583c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4057f2
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40583c
cmp byte [ebp - 0xd], 0
je 0x40583c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40583c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405dc4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x405e20
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_ReadFile
dec eax
pop eax
pop ecx
jne 0x405e12
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x405e07
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x405e02
mov eax, 0x64
jmp 0x405e17
call sub.kernel32.dll_GetLastError
call fcn.004027f4
xor eax, eax
jmp 0x405e02
mov eax, 0x67
jmp 0x405e17

Function at 0x405e28
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x405e83
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x405e75
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x405e6a
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x405e65
mov eax, 0x65
jmp 0x405e7a
call sub.kernel32.dll_GetLastError
call fcn.004027f4
xor eax, eax
jmp 0x405e65
mov eax, 0x67
jmp 0x405e7a

Function at 0x40b060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b099
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403d20
jmp 0x40b0a2
mov eax, ebx
mov edx, esi
call fcn.00403c8c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b0ac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0cd
mov al, byte [esp]
jmp 0x40b0cf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x417838
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41783e
ret

Function at 0x419c28
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x419c79
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419c60
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x419c50
jmp 0x419c79
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419c61
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425e34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x4ba780], 0
sete dl
or al, dl
jne 0x425f74
mov eax, dword [0x4ba784]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4ba780]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x425f43
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4ba780]
call fcn.00410e30
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x425f3b
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x425f3b
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x425f3b
mov eax, dword [ebp - 0x14]
call fcn.0042e13c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x425f3b
push ebp
call fcn.00425df0
pop ecx
test al, al
jne 0x425f3b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x425ef7
mov eax, dword [ebp - 0x14]
call fcn.0042cac8
dec eax
jle 0x425f3b
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.0040318c
cmp byte [ebp - 1], 0
je 0x425f3b
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x425f3b
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4ba784]
call fcn.0042563c
inc edi
dec esi
jne 0x425e8a
mov eax, dword [0x4ba784]
cmp dword [eax + 8], 0
jle 0x425f5b
mov eax, dword [0x4ba784]
call fcn.004256cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x425f74
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00425c58
pop ecx
test al, al
jne 0x425f74
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bad4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42bb05
je 0x42bb5f
sub eax, 7
je 0x42bb26
dec eax
je 0x42bb50
sub eax, 0x17
je 0x42bc04
jmp 0x42bc42
add eax, 0xffffff00
sub eax, 9
jb 0x42bbf0
add eax, 0xffffff09
sub eax, 0xb
jb 0x42bbb8
jmp 0x42bc42
mov eax, ebx
call fcn.0043d73c
mov edi, eax
test edi, edi
je 0x42bca2
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x42bcab
jmp 0x42bca2
test byte [ebx + 0x44], 0x20
jne 0x42bcab
jmp 0x42bca2
mov edx, esi
mov eax, ebx
call fcn.004290d4
cmp dword [esi + 0xc], 0xffffffff
jne 0x42bcab
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407408
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00427c10
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042b9ac
test eax, eax
je 0x42bcab
mov dword [esi + 0xc], 1
jmp 0x42bcab
mov edx, esi
mov eax, ebx
call fcn.0042ba40
test al, al
je 0x42bca2
cmp dword [esi + 0xc], 0
jne 0x42bcab
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042e13c
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x42bcab
mov eax, ebx
call fcn.00428770
test al, al
jne 0x42bcab
jmp 0x42bca2
mov eax, ebx
call fcn.0042e13c
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42bca2
cmp dword [0x4b6734], 0
je 0x42bca2
mov eax, dword [0x4b6734]
cmp ebx, dword [eax + 0x24]
jne 0x42bca2
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4b6734]
call fcn.00429008
jmp 0x42bca2
mov eax, dword [0x4ba748]
cmp byte [eax + 0x20], 0
je 0x42bca2
mov eax, dword [0x4ba748]
cmp dword [eax + 0x1c], 0
je 0x42bca2
mov eax, dword [esi]
mov edx, dword [0x4ba748]
cmp eax, dword [edx + 0x1c]
jne 0x42bca2
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043d680
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.0040318c
jmp 0x42bcab
mov edx, esi
mov eax, ebx
call fcn.004290d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c16c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x42c188
cmp dword [esi + 4], 0
je 0x42c1b5
test byte [ebx + 0x45], 1
jne 0x42c1a7
mov eax, ebx
call fcn.0042b0a4
test eax, eax
jne 0x42c1a7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x42c2c5
mov edx, esi
mov eax, ebx
call fcn.0042bde4
jmp 0x42c2c5
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42c2be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042e13c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00429008
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0042c16c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042e13c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c2c5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435a60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403c38
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x435aaf
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403e68
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d458
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4ba7e0
cmp dword [edi], 0
jne 0x43d4d4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4ba7dc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4b68c8
mov ecx, 2
call fcn.00402888
mov edx, 0x43d430
lea eax, [esi + 5]
call fcn.0043d450
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043d450
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43d4a9
mov dword [0x4ba7dc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43d5f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43d640]
test si, 4
je 0x43d604
or bl, 1
test si, 8
je 0x43d60e
or bl, 4
test si, 1
je 0x43d618
or bl, 8
test si, 2
je 0x43d622
or bl, 0x10
test si, 0x10
je 0x43d62c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43d63b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43d644
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43d67c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43d65d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43d66c
or bl, 4
test esi, 0x20000000
je 0x43d677
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x443824
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x443836
add esp, 0xfffffff0
call fcn.004032b0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00415858
mov eax, ebx
call fcn.00443b70
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40f76c]
call fcn.00402f80
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40f76c]
call fcn.00402f80
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40f76c]
call fcn.00402f80
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40f76c]
call fcn.00402f80
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40f76c]
call fcn.00402f80
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x4437f4
push eax
push 0
push 0
mov eax, dword [0x4b9a80]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x416d60]
call fcn.00418298
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x416d60]
call fcn.00418298
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x416d60]
call fcn.00418298
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.00443f50
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x443e6c
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x443e6c
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x443e6c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x443945
call fcn.00403308
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x443c50
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x443dfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x443ddc
mov dl, 1
mov eax, dword [0x40fa6c]
call fcn.00402f80
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403c38
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x443dcb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00432680
test al, al
je 0x443dbe
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x443e0c
lea eax, [ebp - 0x254]
call fcn.0040941c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x443dbe
xor eax, eax
push ebp
push 0x443db7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x443e44
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x443da0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403e68
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x443da0
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443dbe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x443cc1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00412860
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443e02
lea eax, [ebp - 0x260]
call fcn.00403c38
ret

Function at 0x444648
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4ba7d0]
cmp byte [eax + 0x95], 0
jne 0x4446b9
cmp dword [0x4ba7ec], 0
jne 0x44467a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x444604
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4ba7ec], eax
cmp dword [0x4ba7e8], 0
jne 0x444695
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4ba7e8], eax
cmp dword [0x4ba7f0], 0
jne 0x4446b9
push esp
push 0
push 0
push 0x4445a8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4ba7f0], eax
pop edx
ret