joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x412150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406d66
and dword [ebp - 0x14], 0
cmp dword [0x413e1c], 0
mov dword [ebp - 0x18], eax
jne 0x40ae48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40aef0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40aef0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413e1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413e20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413e24], eax
call edi
push eax
call esi
mov dword [0x413e2c], eax
test eax, eax
je 0x40ae48
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413e28], eax
mov eax, dword [0x413e28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40aea1
cmp dword [0x413e2c], ecx
je 0x40aea1
push eax
call esi
push dword [0x413e2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40aea1
test ebx, ebx
je 0x40aea1
call edi
test eax, eax
je 0x40ae98
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ae98
test byte [ebp - 8], 1
jne 0x40aea1
or dword [ebp + 0x10], 0x200000
jmp 0x40aed4
mov eax, dword [0x413e20]
cmp eax, dword [ebp - 0x18]
je 0x40aed4
push eax
call esi
test eax, eax
je 0x40aed4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40aed4
mov eax, dword [0x413e24]
cmp eax, dword [ebp - 0x18]
je 0x40aed4
push eax
call esi
test eax, eax
je 0x40aed4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413e1c]
call esi
test eax, eax
je 0x40aef0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40aef2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e26
leave
ret
Function at 0x4012cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
imul ecx, ecx, 0x106
cmp byte [ecx + 0x4032e0], 0
push ebx
lea ebx, [ecx + 0x4032e0]
push esi
push edi
mov dword [ebp - 4], edx
jne 0x40138a
mov esi, 0x4031c0
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x40131f
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x401341
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__mbsncpy]
lea eax, [ebp + edi - 0x11c]
add esp, 0xc
sub eax, esi
and byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x11c]
push 0x403014
push eax
call esi
mov ecx, dword [ebp - 4]
call fcn.004012a6
push eax
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [ebp - 0x11c]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
test eax, eax
pop ecx
jne 0x40138a
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x74e827cf
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..pdata_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57ae5d44
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40156b
cmp byte [esi + ebx - 1], 0xa
je 0x40153f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401fd0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x402023
mov edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x104a3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104a31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104a307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a306a
add dl, dl
jne 0x104a3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a30dc
xor eax, eax
add dl, dl
jne 0x104a3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104a317d
add dl, dl
jne 0x104a30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104a30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104a3075
mov eax, 1
add dl, dl
jne 0x104a30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104a30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a30e1
sub eax, ebx
mov ebx, 1
jne 0x104a3128
mov ecx, 1
add dl, dl
jne 0x104a310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104a3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104a313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104a314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104a3136
cmp eax, 0x7d00
jae 0x104a316d
cmp eax, 0x500
jb 0x104a3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a3075
cmp eax, 0x7f
ja 0x104a3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104a3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104a319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104a3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405ab4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405b1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004041cc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c60
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405b04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b21
lea eax, [ebp - 0x10]
call fcn.00403f5c
ret

Function at 0x40aaf4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab2d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040404c
jmp 0x40ab36
mov eax, ebx
mov edx, esi
call fcn.00403fb0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ab40
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ab61
mov al, byte [esp]
jmp 0x40ab63
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b1e8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b060
mov eax, dword [0x44f014]
cmp byte [eax], 0
je 0x40b264
mov eax, dword [0x44ee3c]
call fcn.00402acc
call fcn.00402824
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408368
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b2ac
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b29a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x44edec]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x450664]
call fcn.00404fc8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40bb00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40bbd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ff4
lea eax, [ebp - 8]
call fcn.0040446c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040441c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40bbc0
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40bbb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040441c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40bba3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40bbe8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40bba3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbc0
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbdd
lea eax, [ebp - 8]
call fcn.00403f5c
ret

Function at 0x40c054
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c0b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004041cc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407e34
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c0bf
lea eax, [ebp - 0xc]
call fcn.00403f5c
ret

Function at 0x41a194
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x450884
cmp dword [edi], 0
jne 0x41a210
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x450880]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44e3ec
mov ecx, 2
call fcn.004028b8
mov edx, 0x41a16c
lea eax, [esi + 5]
call fcn.0041a18c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041a18c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41a1e5
mov dword [0x450880], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b424
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b42a
ret
Function at 0x41d86c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41d8bd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41d8a4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41d894
jmp 0x41d8bd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41d8a5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426e40
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x426d8c
call sub.user32.dll_EnumWindows
ret

Function at 0x426f60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x426fdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004269c0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x426f85
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004265c0
cmp dword [ebp - 4], 0
je 0x426fc7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0040441c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426fe4
lea eax, [ebp - 4]
call fcn.00403f5c
ret

Function at 0x429c80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x450b54], 0
je 0x429dcf
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x44efb8]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x429dcf
mov eax, dword [0x450b58]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x450b54]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x429d9e
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x450b54]
call fcn.00413764
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x429d96
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x429d96
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x429d96
mov eax, dword [ebp - 0x14]
call fcn.004327e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x429d96
push ebp
call fcn.00429c3c
pop ecx
test al, al
jne 0x429d96
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x429d52
mov eax, dword [ebp - 0x14]
call fcn.00431314
dec eax
jle 0x429d96
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403420
cmp byte [ebp - 1], 0
je 0x429d96
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x429d96
mov edx, dword [ebp - 0x14]
mov eax, dword [0x450b58]
call fcn.00429408
inc edi
dec ebx
jne 0x429ce5
mov eax, dword [0x450b58]
cmp dword [eax + 8], 0
jle 0x429db6
mov eax, dword [0x450b58]
call fcn.00429498
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x429dcf
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00429aa4
pop ecx
test al, al
jne 0x429dcf
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d368
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x42d3b4
mov eax, esi
call fcn.00442784
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42d3b4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x42d3b4
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x42d4f3
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x42d3f4
cmp eax, 0x108
ja 0x42d3f4
mov eax, esi
call fcn.00442784
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42d4ea
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x42d4f3
jmp 0x42d4ea
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x42d4d3
cmp eax, 0x20a
ja 0x42d4d3
test byte [esi + 0x50], 0x80
jne 0x42d426
sub eax, 0x203
je 0x42d423
sub eax, 3
je 0x42d423
sub eax, 3
jne 0x42d426
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x42d43a
dec eax
je 0x42d44f
dec eax
je 0x42d46c
dec eax
je 0x42d44f
jmp 0x42d473
mov ecx, ebx
mov eax, dword [0x44efb8]
mov eax, dword [eax]
mov edx, esi
call fcn.0044bf58
jmp 0x42d4ea
cmp byte [esi + 0x5d], 1
jne 0x42d465
mov eax, esi
mov si, 0xffed
call fcn.00403420
jmp 0x42d4f3
or word [esi + 0x54], 1
jmp 0x42d4ea
and word [esi + 0x54], 0xfffe
jmp 0x42d4ea
mov eax, dword [0x450b10]
cmp byte [eax + 0x20], 0
je 0x42d4ea
mov eax, dword [0x450b10]
cmp dword [eax + 0x1c], 0
je 0x42d4ea
mov eax, dword [ebx]
mov edx, dword [0x450b10]
cmp eax, dword [edx + 0x1c]
jne 0x42d4ea
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.004426c8
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403420
jmp 0x42d4f3
cmp eax, 0xb00b
jne 0x42d4ea
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0042bcd0
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430974
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x430990
cmp dword [esi + 4], 0
je 0x4309bd
test byte [ebx + 0x55], 1
jne 0x4309af
mov eax, ebx
call fcn.0042f580
test eax, eax
jne 0x4309af
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x430acd
mov edx, esi
mov eax, ebx
call fcn.00430498
jmp 0x430acd
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x430ac6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004327e4
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0042d29c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00430974
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004327e4
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430acd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret