joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c2430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1013f620
mov eax, dword fs:[0]
push eax
push ebx
push ebp
mov eax, dword [0x101aeb60]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea ebx, [ebx]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
cmp ebp, dword [esp + 0x54]
jne 0x100c2481
cmp ecx, eax
je 0x100c24fc
cmp ebx, dword [esp + 0x94]
jne 0x100c2490
cmp dword [esp + 0x78], edx
je 0x100c24fc
cmp dword [esp + 0x70], 8
push dword [esp + 0x6c]
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
push eax
push dword [esp + 0x34]
lea ecx, [esp + 0x28]
push 0
call fcn.1000d9de
test eax, eax
js 0x100c254b
cmp dword [esp + 0x30], 8
push dword [esp + 0x2c]
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push dword [esp + 0x74]
lea ecx, [esp + 0x68]
push 0
call fcn.1000d9de
test eax, eax
js 0x100c2544
lea eax, [esp + 0x1c]
push eax
call fcn.100c26f0
lea eax, [esp + 0x60]
push eax
call fcn.100c26f0
add esp, 8
jmp 0x100c2460
cmp ebp, dword [esp + 0x54]
jne 0x100c2532
cmp ecx, eax
jne 0x100c2532
cmp ebx, dword [esp + 0x94]
jne 0x100c2519
cmp dword [esp + 0x78], edx
jne 0x100c2519
xor ebx, ebx
jmp 0x100c254e
cmp ecx, eax
jne 0x100c2532
xor ebx, ebx
mov eax, 1
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x100c254e
xor ebx, ebx
xor eax, eax
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x100c254e
mov ebx, 1
jmp 0x100c254e
or ebx, 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x100c2561
push dword [esp + 0x1c]
call fcn.1008bed8
add esp, 4
xor eax, eax
cmp dword [esp + 0x50], 8
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
jb 0x100c258b
push dword [esp + 0x3c]
call fcn.1008bed8
add esp, 4
xor eax, eax
cmp dword [esp + 0x70], 8
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x100c25b5
push dword [esp + 0x5c]
call fcn.1008bed8
add esp, 4
xor eax, eax
cmp dword [esp + 0x90], 8
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x100c25e2
push dword [esp + 0x7c]
call fcn.1008bed8
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x100ca610
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x100f7807
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.100b2120
mov eax, dword [0x101aeb60]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x100f796a
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.100dc540
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.100dc5c0
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.100dac40
push ebp
call fcn.100dc540
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.100dc5c0
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.100dac40
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x100f7823
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.100a3ae5
add esp, 0xa0
ret
Function at 0x1011be40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x1011be59
mov esi, edi
mov edi, eax
jmp 0x1011be5b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1011be6b
mov eax, ebx
jmp 0x1011be75
push eax
push ebx
call fcn.100d2eb0
add esp, 8
test eax, eax
jne 0x1011be7d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x1011be99
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x1011be84
cmp eax, dword [esi + 4]
jge 0x1011beb0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x1011bea0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x1011bed1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1011bece
dec eax
test eax, eax
jg 0x1011bec0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40611c
pop dword [ebp - 0x40]
mov eax, 0x40611c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xbb6522cf
sub dword [ebp - 0x50], 0x6d12dd84
mov dword [ebp - 0x4c], 0x43634fd6
sub dword [ebp - 0x4c], 0x11300391
mov dword [ebp - 0x48], 0xed4a8482
add dword [ebp - 0x48], 0x5f01bfac
mov dword [ebp - 0x44], 0xd6e2c522
sub dword [ebp - 0x44], 0xd6e2c522
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x78a931bd
sub dword [ebp - 0x50], 0x436c867
mov dword [ebp - 0x4c], 0x7e9a0fb
sub dword [ebp - 0x4c], 0xc67d3f86
mov dword [ebp - 0x48], 0x62634ae
add dword [ebp - 0x48], 0x5d4937be
mov dword [ebp - 0x44], 0xce84150c
sub dword [ebp - 0x44], 0xce84150c
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x32757
push 0
call eax
mov ecx, 0xd67e0b2b
sub ecx, 0xd67dd3c4
xor esi, esi
add esi, eax
mov edi, 0xda027215
add edi, 0x263e8deb
add edi, dword [ebp - 0x40]
mov ebx, 0xe4e601f7
sub ebx, 0xafa6cc8c
xor dword [ebp - 0x3c], edx
mov edx, dword [edi]
xor dword [ebp - 0x14], edx
sub edx, ebx
sub dword [ebp - 0x1c], 0x645c5d20
mov dword [esi], edx
add dword [ebp - 0x14], 0x7ff9707c
add esi, 0x2a6fb70c
add esi, 0xd59048f8
add edi, 0x730183a7
sub edi, 0x730183a3
loop 0x406231
add eax, 0x470187ce
add eax, 0xb8ff48a1
mov ebx, eax
add eax, 5
mov ecx, 0x25698ef7
sub ecx, 0x25298ef7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4027cc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402809
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402829
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00403bac
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402914
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402943
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a64
jmp 0x402961
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040289c
mov edi, eax
test ebx, ebx
je 0x402961
cmp dword [esi], 0
je 0x402961
dec ebx
jmp 0x40294a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402cdc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402cbc
xor eax, eax
push ebp
push 0x402cb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402cf8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402cbc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404d28
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404ee0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404d89
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404efc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404df6
xor eax, eax
push ebp
push 0x404def
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404dd8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404f1c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404df6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404ed7
cmp byte [ebp - 0xd], 0
jne 0x404e38
cmp byte [ebp - 0x12], 0
je 0x404ed7
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404e51
dec ebx
cmp byte [ebx], 0x2e
je 0x404e60
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404e50
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404ed7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404e8d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ed7
cmp byte [ebp - 0xd], 0
je 0x404ed7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404ed7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4089b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4089e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403a64
jmp 0x4089f2
mov eax, ebx
mov edx, esi
call fcn.00403a18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4089fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408a1d
mov al, byte [esp]
jmp 0x408a1f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x414100
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x414106
ret

Function at 0x416964
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4169b5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41699c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41698c
jmp 0x4169b5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41699d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425b78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x46b760], 0
sete dl
or al, dl
jne 0x425cbc
mov eax, dword [0x46b764]
mov bx, 0xffff
call fcn.00402fa8
mov eax, dword [0x46b760]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x425c8b
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x46b760]
call fcn.0040d5d0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x425c83
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x425c83
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x425c83
mov eax, dword [ebp - 0x10]
call fcn.0042da64
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x425c83
push ebp
call fcn.00425b34
pop ecx
test al, al
jne 0x425c83
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x425c3f
mov eax, dword [ebp - 0x10]
call fcn.0042c3a8
dec eax
jle 0x425c83
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402fa8
cmp byte [ebp - 0x15], 0
je 0x425c83
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x425c83
mov edx, dword [ebp - 0x10]
mov eax, dword [0x46b764]
call fcn.004253e4
inc edi
dec esi
jne 0x425bd2
mov eax, dword [0x46b764]
cmp dword [eax + 8], 0
jle 0x425ca3
mov eax, dword [0x46b764]
call fcn.00425474
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x425cbc
push ebp
mov eax, dword [ebp - 0x14]
call fcn.004259ec
pop ecx
test al, al
jne 0x425cbc
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b534
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42b565
je 0x42b5bf
sub eax, 7
je 0x42b586
dec eax
je 0x42b5b0
sub eax, 0x17
je 0x42b640
jmp 0x42b67e
add eax, 0xffffff00
sub eax, 9
jb 0x42b62c
add eax, 0xffffff09
sub eax, 0xb
jb 0x42b616
jmp 0x42b67e
mov eax, ebx
call fcn.0043bcb4
mov edi, eax
test edi, edi
je 0x42b6de
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x42b6e7
jmp 0x42b6de
test byte [ebx + 0x44], 0x20
jne 0x42b6e7
jmp 0x42b6de
mov edx, esi
mov eax, ebx
call fcn.00428dc8
cmp dword [esi + 0xc], 0xffffffff
jne 0x42b6e7
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406854
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00427870
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042b3e4
test eax, eax
je 0x42b6e7
mov dword [esi + 0xc], 1
jmp 0x42b6e7
mov edx, esi
mov eax, ebx
call fcn.0042b4a8
test al, al
jne 0x42b6e7
jmp 0x42b6de
mov eax, ebx
call fcn.00428440
test al, al
jne 0x42b6e7
jmp 0x42b6de
mov eax, ebx
call fcn.0042da64
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42b6de
cmp dword [0x469734], 0
je 0x42b6de
mov eax, dword [0x469734]
cmp ebx, dword [eax + 0x24]
jne 0x42b6de
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x469734]
call fcn.00428ce4
jmp 0x42b6de
mov eax, dword [0x46b728]
cmp byte [eax + 0x20], 0
je 0x42b6de
mov eax, dword [0x46b728]
cmp dword [eax + 0x1c], 0
je 0x42b6de
mov eax, dword [esi]
mov edx, dword [0x46b728]
cmp eax, dword [edx + 0x1c]
jne 0x42b6de
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043bbc8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00402fa8
jmp 0x42b6e7
mov edx, esi
mov eax, ebx
call fcn.00428dc8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bb78
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x42bb94
cmp dword [esi + 4], 0
je 0x42bbc1
test byte [ebx + 0x45], 1
jne 0x42bbb3
mov eax, ebx
call fcn.0042ab90
test eax, eax
jne 0x42bbb3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x42bcd1
mov edx, esi
mov eax, ebx
call fcn.0042b7f0
jmp 0x42bcd1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42bcca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042da64
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00428ce4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0042bb78
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042da64
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bcd1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4355fc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403980
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43565d
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x43565d
cmp byte [ebp - 0x102], 0
je 0x43565d
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403bac
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b998
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x46b7dc
cmp dword [edi], 0
jne 0x43ba14
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x46b7d8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4698c0
mov ecx, 2
call fcn.0040285c
mov edx, 0x43b970
lea eax, [esi + 5]
call fcn.0043b990
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0043b990
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43b9e9
mov dword [0x46b7d8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43bb38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43bb88]
test si, 4
je 0x43bb4c
or bl, 1
test si, 8
je 0x43bb56
or bl, 4
test si, 1
je 0x43bb60
or bl, 8
test si, 2
je 0x43bb6a
or bl, 0x10
test si, 0x10
je 0x43bb74
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43bb83
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43bb8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x43bbc4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43bba5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x43bbb4
or bl, 4
test esi, 0x20000000
je 0x43bbbf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret