joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406811
pop dword [ebp - 0xc]
mov eax, 0x406811
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xdf22f355
add dword [ebp - 0x1c], 0x6f2f51f6
mov dword [ebp - 0x18], 0x89814140
add dword [ebp - 0x18], 0xa8b20b05
mov dword [ebp - 0x14], 0xe82682c
sub dword [ebp - 0x14], 0xc23623fe
mov dword [ebp - 0x10], 0xaffc6918
sub dword [ebp - 0x10], 0xaffc6918
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd392e96b
add dword [ebp - 0x1c], 0xa0df7feb
mov dword [ebp - 0x18], 0x93292d02
sub dword [ebp - 0x18], 0x51bccb8d
mov dword [ebp - 0x14], 0xc02a0fb9
sub dword [ebp - 0x14], 0x5cbaa34d
mov dword [ebp - 0x10], 0x84b9f02c
add dword [ebp - 0x10], 0x7b460fd4
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3efca
push 0
call eax
mov ecx, 0x6523
mov edx, eax
mov ebx, 0x41f000
add ebx, dword [ebp - 0xc]
mov edi, 0x6f66dfe8
xor dword [ebp - 4], 0xe68b0264
mov esi, dword [ebx]
xor dword [ebp - 4], 0xb379e01d
xor esi, edi
sub dword [ebp - 8], edi
mov dword [edx], esi
xor dword [ebp - 4], esi
add edx, 0xaae3914c
sub edx, 0xaae39148
add ebx, 4
loop 0x406912
add eax, 0x86d41f59
sub eax, 0x86d297fa
mov ebx, eax
add eax, 0x45f32ac9
add eax, 0xba0cd53c
mov ecx, 0x37df0f8d
sub ecx, 0x379f0f8d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret
Function at 0x401a84
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b3a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4695cc
call sub.KERNEL32.DLL_LocalAlloc
cmp byte [0x46904d], 0
je 0x401ab2
push 0x4695cc
call sub.KERNEL32.DLL_TlsGetValue
mov eax, 0x4695ec
call fcn.00401448
mov eax, 0x4695fc
call fcn.00401448
mov eax, 0x469628
call fcn.00401448
push 0xff8
push 0
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [0x469624], eax
cmp dword [0x469624], 0
je 0x401b19
mov eax, 3
mov edx, dword [0x469624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401aef
mov eax, 0x46960c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x469618], eax
mov byte [0x4695c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b41
cmp byte [0x46904d], 0
je 0x401b39
push 0x4695cc
call sub.KERNEL32.DLL_TlsSetValue
ret

Function at 0x401b48
Capabilities:
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4695c4], 0
je 0x401c25
xor edx, edx
push ebp
push 0x401c1e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x46904d], 0
je 0x401b7a
push 0x4695cc
call sub.KERNEL32.DLL_TlsGetValue
mov byte [0x4695c4], 0
mov eax, dword [0x469624]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [0x469624], eax
mov ebx, dword [0x4695ec]
jmp 0x401bad
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, dword [ebx]
cmp ebx, 0x4695ec
jne 0x401b9b
mov eax, 0x4695ec
call fcn.00401448
mov eax, 0x4695fc
call fcn.00401448
mov eax, 0x469628
call fcn.00401448
mov eax, dword [0x4695e4]
test eax, eax
je 0x401bf3
mov edx, dword [eax]
mov dword [0x4695e4], edx
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x4695e4]
test eax, eax
jne 0x401bdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c25
cmp byte [0x46904d], 0
je 0x401c13
push 0x4695cc
call sub.KERNEL32.DLL_TlsSetValue
push 0x4695cc
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4695c4], 0
jne 0x40218d
call fcn.00401a84
test al, al
je 0x402195
cmp ebx, 0x7ffffff8
jle 0x40219f
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022f3
xor ecx, ecx
push ebp
push 0x4022ec
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46904d], 0
je 0x4021c0
push 0x4695cc
call sub.KERNEL32.DLL_TlsGetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021d0
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x40226f
mov eax, ebx
test eax, eax
jns 0x4021e5
add eax, 3
sar eax, 2
mov edx, dword [0x469624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x40226f
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402220
mov eax, ebx
test eax, eax
jns 0x40220f
add eax, 3
sar eax, 2
mov ecx, dword [0x469624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x402246
mov ecx, ebx
test ecx, ecx
jns 0x402229
add ecx, 3
sar ecx, 2
mov edi, dword [0x469624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4695b4]
sub ebx, 4
add dword [0x4695b8], ebx
call fcn.004039d0
jmp 0x4022f3
cmp ebx, dword [0x46961c]
jg 0x4022c1
sub dword [0x46961c], ebx
cmp dword [0x46961c], 0xc
jge 0x402293
add ebx, dword [0x46961c]
xor eax, eax
mov dword [0x46961c], eax
mov eax, dword [0x469620]
add dword [0x469620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4695b4]
sub ebx, 4
add dword [0x4695b8], ebx
call fcn.004039d0
jmp 0x4022f3
mov eax, ebx
call fcn.0040207c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022f3
cmp byte [0x46904d], 0
je 0x4022eb
push 0x4695cc
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4695c8], eax
cmp byte [0x4695c4], 0
jne 0x402338
call fcn.00401a84
test al, al
jne 0x402338
mov dword [0x4695c8], 8
mov dword [ebp - 4], 8
jmp 0x402499
xor ecx, ecx
push ebp
push 0x402492
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x46904d], 0
je 0x402359
push 0x4695cc
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402374
mov dword [0x4695c8], 9
jmp 0x402469
dec dword [0x4695b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4695b8], eax
test bl, 1
je 0x4023d4
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4023a4
test edx, 0x80000003
je 0x4023b3
mov dword [0x4695c8], 0xa
jmp 0x402469
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023cb
mov dword [0x4695c8], 0xa
jmp 0x402469
add ebx, edx
mov esi, eax
call fcn.00401c28
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x469620]
jne 0x402414
sub dword [0x469620], ebx
add dword [0x46961c], ebx
cmp dword [0x46961c], 0x3c00
jle 0x402405
call fcn.00401f18
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004039d0
jmp 0x402499
mov edx, dword [eax]
test dl, 2
je 0x402437
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402432
mov dword [0x4695c8], 0xb
jmp 0x402469
or dword [eax], 1
jmp 0x402460
mov eax, edi
cmp dword [eax + 4], 0
je 0x40244a
cmp dword [eax], 0
je 0x40244a
cmp dword [eax + 8], 0xc
jge 0x402456
mov dword [0x4695c8], 0xb
jmp 0x402469
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c28
mov edx, ebx
mov eax, esi
call fcn.00401e90
mov eax, dword [0x4695c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402499
cmp byte [0x46904d], 0
je 0x402491
push 0x4695cc
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4045a0
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x4045b4
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404598
ret

Function at 0x405270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
cmp dword [ebx + 0x10], 0
jne 0x4052ab
push 0x105
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov eax, esp
mov dl, 1
call fcn.004054ac
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x4052ab
mov eax, dword [ebx + 4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x4052f4
Capabilities:
Clear file content
Extract resource via kernel32 functions
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405488
call sub.KERNEL32.DLL_LockResource
mov esi, eax
test esi, esi
je 0x40535c
push 0x405498
push esi
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
test ebx, ebx
je 0x40535c
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x40535c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x40547e
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x40539c
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x40547e
mov eax, dword [ebp - 4]
add eax, 2
call fcn.004052e0
mov esi, eax
cmp byte [esi], 0
je 0x40547e
lea eax, [esi + 1]
call fcn.004052e0
mov esi, eax
cmp byte [esi], 0
je 0x40547e
jmp 0x4053a2
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_ResetEvent
jmp 0x405461
lea eax, [esi + 1]
call fcn.004052e0
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x40547e
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_ResetEvent
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov esi, eax
cmp esi, 0xffffffff
je 0x40547e
push esi
call sub.KERNEL32.DLL_GlobalSize
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x40547e
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_ResetEvent
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x4053c0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4054ac
Capabilities:
Clear file content
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056dc
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x40552f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056dc
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x40552f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056f8
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x4055b8
xor eax, eax
push ebp
push 0x4055b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004052f4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405596
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405718
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405596
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4055b8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_MultiByteToWideChar
push eax
call sub.KERNEL32.DLL_LoadLibraryA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4056d2
cmp byte [ebp - 0xd], 0
jne 0x4055ff
cmp byte [ebp - 0x12], 0
je 0x4056d2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405618
dec ebx
cmp byte [ebx], 0x2e
je 0x405627
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405617
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4056d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405664
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
test esi, esi
jne 0x4056d2
cmp byte [ebp - 0xd], 0
je 0x4056d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
test esi, esi
jne 0x4056d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_ResetEvent
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c160
Capabilities:
Log keystrokes

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x40c1c7
mov eax, dword [esp + 0x10]
mov dword [0x4670c4], eax
mov eax, dword [esp + 4]
mov dword [0x4670c8], eax
mov eax, dword [esp + 8]
mov dword [0x4670cc], eax
cmp dword [0x4670c4], 1
jne 0x40c1ab
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x4670d0], eax
jmp 0x40c1b4
mov eax, dword [esp + 0xc]
mov dword [0x4670d0], eax
mov eax, 0x4670d4
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00404158
add esp, 0x94
ret

Function at 0x40c1f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c2c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403f80
lea eax, [ebp - 8]
call fcn.004043f8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c2b0
mov eax, ebx
call fcn.00402744
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c2a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c293
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c2d8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c293
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c2b0
mov eax, dword [ebp - 0x10]
call fcn.00402764
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c2cd
lea eax, [ebp - 8]
call fcn.00403ee8
ret

Function at 0x40c7d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c834
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.user32.dll_IsRectEmpty
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404158
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, eax
pop eax
call fcn.004083bc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c83b
lea eax, [ebp - 0xc]
call fcn.00403ee8
ret

Function at 0x420194
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42019a
ret
Function at 0x421974
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x421a11
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x421a11
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x421a1c]
mov eax, ebx
call fcn.00421ddc
mov eax, dword [ebx + 0x14]
call fcn.00421674
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyState
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
add ecx, edi
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00416bec
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x421a5c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x421a90]
mov eax, ebx
call fcn.00421ddc
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnumWindows
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
ret

Function at 0x421e78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.00420ec4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyState
pop ebx
ret

Function at 0x421ed4
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.004216b0
push eax
call sub.user32.dll_GetMenu
mov eax, dword [ebx + 0x14]
call fcn.004216b0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0x14]
call fcn.00421790
test al, al
jne 0x421f27
mov eax, dword [ebx + 0x14]
call fcn.00421674
call fcn.004209f0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.00421674
call fcn.004209f0
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursor
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
pop ebx
ret
Function at 0x422fb0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, ebx
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00422e60
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.user32.dll_GetKeyboardType
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42304d
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x423004
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetActiveWindow
push 0
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyCursor
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423054
cmp dword [ebp - 8], 0
je 0x423043
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetClipboardData
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CallWindowProcA
ret
Function at 0x42496c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, esi
call fcn.00424808
lea edx, [ebp - 0x22]
mov ecx, 0x16
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x22], 0x9ac6cdd7
jne 0x4249ae
lea eax, [ebp - 0x22]
call fcn.00422e48
cmp ax, word [ebp - 0xe]
je 0x4249b3
call fcn.00421ff8
sub dword [ebp - 8], 0x16
mov eax, dword [ebp - 8]
call fcn.00402744
mov dword [ebp - 0xc], eax
mov ebx, dword [esi + 0x28]
xor eax, eax
push ebp
push 0x424adb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esi + 0x28]
mov dx, word [ebp - 0x14]
mov word [eax + 0x18], dx
cmp word [ebp - 0x14], 0
jne 0x4249f9
mov word [ebp - 0x14], 0x60
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x18]
movsx edx, word [ebp - 0x1c]
sub eax, edx
push eax
call sub.user32.dll_ScreenToClient
mov dword [ebx + 0xc], eax
movzx eax, word [ebp - 0x14]
push eax
push 0x9ec
movsx eax, word [ebp - 0x16]
movsx edx, word [ebp - 0x1a]
sub eax, edx
push eax
call sub.user32.dll_ScreenToClient
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x32], 8
xor eax, eax
mov dword [ebp - 0x2e], eax
xor eax, eax
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x424a6a
call fcn.00421ff8
lea eax, [ebp - 0x96]
push eax
push 0x64
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_DispatchMessageA
mov dword [ebp - 0x32], 8
mov eax, dword [ebp - 0x76]
mov dword [ebp - 0x2e], eax
mov eax, dword [ebp - 0x72]
mov dword [ebp - 0x2a], eax
xor eax, eax
mov dword [ebp - 0x26], eax
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_CheckMenuItem
lea eax, [ebp - 0x32]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x424abe
call fcn.00421ff8
mov byte [esi + 0x2c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424ae2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402764
ret