joyce8/EMBER2024-capa huggingface dataset:
Function at 0x275a14c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275ace7b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
xor esi, esi
push 0x110
lea ecx, [ebp - 0x120]
push esi
push ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
call fcn.2757fdd0
add esp, 0xc
mov dword [ebp - 0x134], esi
cmp edi, esi
mov ebx, dword [ebp + 0x10]
lea edx, [ebx + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x130], edx
mov byte [ebp - 0x13c], 8
mov byte [ebp - 0x13b], 2
mov word [ebp - 0x13a], si
je 0x275a154d
mov dword [edi], esi
cmp dword [ebp + 8], esi
je 0x275a165f
cmp dword [ebp - 0x12c], esi
je 0x275a165f
cmp ebx, esi
je 0x275a165f
cmp edi, esi
je 0x275a165f
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x275a15bd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x275a15a6
call esi
mov dword [ebp - 0x128], eax
jmp 0x275a1669
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x128], eax
jmp 0x275a1669
mov eax, dword [ebp - 0x120]
cmp eax, 5
ja 0x275a15f1
jne 0x275a15d3
cmp dword [ebp - 0x11c], 1
jae 0x275a15f1
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp + 8]
push edi
push ecx
push ebx
push edx
push eax
call fcn.275a13e0
mov dword [ebp - 0x128], eax
jmp 0x275a1669
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.2757e5f7
mov esi, eax
add esp, 4
test esi, esi
jne 0x275a1612
mov dword [ebp - 0x128], 0x8007000e
jmp 0x275a1669
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp + 0x14]
mov dword [esi], edx
push ebx
push ecx
lea edx, [esi + 0xc]
mov dword [esi + 4], eax
push edx
mov dword [ebp - 0x134], esi
mov dword [esi + 8], ebx
call fcn.2757fff0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + 8]
add esp, 0xc
push edi
push eax
push 0
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x275a1669
jmp 0x275a158d
mov dword [ebp - 0x128], 0x80070057
mov eax, dword [ebp - 0x134]
push eax
call fcn.2757e8ec
mov eax, dword [ebp - 0x128]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2757f388
mov esp, ebp
pop ebp
ret 0x18
Function at 0x275a2040
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275acf68
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
je 0x275a2210
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x275a20c5
mov dword [ebp - 0x6c], 0x2751b66c
mov dword [ebp - 0x68], 0x27535ef4
mov dword [ebp - 0x64], 0x33
mov dword [ebp - 0x60], 0x80070057
push 0x275b2b28
lea eax, [ebp - 0x6c]
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], bl
mov dword [ebp - 0x14], 1
push eax
call fcn.2757e9b1
cmp dword [0x275bca8c], ebx
jne 0x275a21b0
push 0x275bca90
lea ecx, [ebp - 0x10]
call fcn.275797b0
cmp dword [0x275bca8c], ebx
mov dword [ebp - 4], ebx
jne 0x275a2141
push 0xf0000000
push 1
push 0x27535ec8
push ebx
push 0x275bca8c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x275a2141
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x275a2115
call esi
jmp 0x275a2121
call esi
and eax, 0xffff
or eax, 0x80070000
push 1
push eax
push 0x49
push 0x27535ef4
lea ecx, [ebp - 0x6c]
call fcn.275a2000
push 0x275b2b28
lea ecx, [ebp - 0x6c]
push ecx
call fcn.2757e9b1
mov edi, dword [ebp - 0x10]
lea esi, [edi + 4]
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
add edi, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x275bca8c], ebx
jne 0x275a21aa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x275a2181
call esi
jmp 0x275a218d
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x6c], 0x2751b66c
mov dword [ebp - 0x68], 0x27535ef4
mov dword [ebp - 0x64], 0x52
mov dword [ebp - 0x60], eax
jmp 0x275a209b
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
push ebx
push esi
call fcn.2757fdd0
mov ecx, dword [0x275bca8c]
add esp, 0xc
push esi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x275a2210
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x275a21de
call esi
jmp 0x275a21ea
call esi
and eax, 0xffff
or eax, 0x80070000
push 1
push eax
push 0x58
push 0x27535ef4
lea ecx, [ebp - 0xc8]
call fcn.275a2000
push 0x275b2b28
lea edx, [ebp - 0xc8]
push edx
jmp 0x275a20c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x275a35df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x275a360c
call fcn.27583c80
mov dword [eax], esi
call fcn.27583c6d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.27583c0e
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x275a35e8
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x275a363b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.27583c93
pop ecx
call fcn.27583c6d
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x275a3662
test al, 1
je 0x275a3662
test byte [esp + 0xc], 2
je 0x275a3662
call fcn.27583c80
mov dword [eax], 5
call fcn.27583c6d
mov dword [eax], 0xd
jmp 0x275a3632
xor eax, eax
pop esi
ret
Function at 0x4017f6
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x4298cf
call fcn.00428700
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00402658
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040184f
lea ecx, [esi + 0x30]
call fcn.00402658
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4018aa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x429937
call fcn.00428700
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x42c808
mov dword [esi + 0xc], 0x42c7f8
mov dword [esi + 0x10], 0x42c7e8
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x24]
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], 1
mov byte [esi + 0x1e], bl
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
call fcn.00402658
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
call fcn.00402658
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 1
call fcn.00402658
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 2
mov dword [esi + 0x50], ebx
call fcn.00402658
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.00402658
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 4
call fcn.00402658
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 5
call fcn.00402658
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 6
call fcn.00402658
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 7
call fcn.00402658
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42c7c4
mov dword [esi + 4], 0x42c7b0
mov dword [esi + 8], 0x42c79c
mov dword [esi + 0xc], 0x42c78c
mov dword [esi + 0x10], 0x42c77c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4039b0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
and dword [ebp - 4], 0
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
mov edi, edx
lea ecx, [ebp - 4]
push 0x2002
call fcn.004055a5
test al, al
jne 0x4039d7
xor bl, bl
jmp 0x403a0d
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4039d3
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4039d3
and dword [ebp - 4], 0
mov bl, 1
lea ecx, [ebp - 4]
call fcn.004055c6
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403bbf
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x403d4b
Capabilities:
Create directory

Disassembly:
mov eax, 0x429ae8
call fcn.00428700
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403d6e
mov al, 1
jmp 0x403db4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403d7f
xor al, al
jmp 0x403db4
lea ecx, [ebp - 0x44]
call fcn.00403f78
lea ecx, [ebp - 0x1c]
call fcn.00402658
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040422f
test al, al
je 0x403da9
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00402132
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40422e
or eax, eax
ret

Function at 0x4048ed
Capabilities:
Get disk information

Disassembly:
mov eax, 0x429bc0
call fcn.00428700
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00401ee6
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
je 0x4049c3
mov eax, SysReAllocString
cmp ebx, eax
ja 0x404929
mov eax, ebx
add eax, eax
push eax
call fcn.004020fe
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x14], ebx
je 0x4049bc
cmp ebx, dword [ebp - 0x18]
ja 0x4049bc
lea ecx, [ebp - 0x2c]
call fcn.00402658
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
jbe 0x4049a4
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x404999
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402797
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
call fcn.0040f1c6
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401c9a
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x14]
jb 0x404967
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x2c]
call fcn.00402132
push esi
call fcn.00402132
cmp dword [ebp - 0x18], ebx
pop ecx
pop ecx
sete al
jmp 0x4049c5
push esi
call fcn.00402132
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404a4a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404a74
xor al, al
jmp 0x404a94
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004289e0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x40c17d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42a2b6
call fcn.00428700
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00402658
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c1cc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40c229
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42a301
call fcn.00428700
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040e682
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c274
push dword [esi + 0x24]
call fcn.00402132
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.0041d00a
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040c802
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40ecba
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x42a70d
call fcn.00428700
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.00402658
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00402658
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00402658
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.0040c1cc
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.0040c1cc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40eefd
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x42a78e
call fcn.00428700
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x42d024
mov dword [esi + 4], 0x42d010
mov dword [esi + 8], 0x42d000
mov dword [esi + 0xc], 0x42c7e8
mov dword [esi + 0x10], 0x42cfec
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.00402658
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402658
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00403f78
lea ecx, [edi + 0x28]
call fcn.00402658
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.0040ac82
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42cfd8
mov dword [esi + 4], 0x42cfc4
mov dword [esi + 8], 0x42cfb4
mov dword [esi + 0xc], 0x42cfa4
mov dword [esi + 0x10], 0x42cf90
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f28e
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x42a84d
call fcn.00428700
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x40f2b2
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x40f2c6
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x40f2da
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x40f2ee
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.0040272b
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.0040272b
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.0040272b
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.0040f3ed
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.0040f3ed
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40faca
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 8]
shr eax, 0xf
movzx ecx, word [ecx + 0xc]
and al, 1
cmp ecx, 8
je 0x40fb0b
cmp ecx, 0x52
je 0x40fafe
cmp ecx, 0x76
je 0x40faf5
xor al, al
jmp 0x40fb14
mov ecx, esi
call fcn.00410453
jmp 0x40fb12
test al, al
je 0x40faf1
mov ecx, esi
call fcn.004102a1
jmp 0x40fb12
mov ecx, esi
call fcn.00410343
mov al, 1
pop esi
ret 4
Function at 0x410870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x42aa22
call fcn.00428700
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42d0f0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.00402658
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402658
or dword [esi + 0x64], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.00402658
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.00402658
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42d0bc
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41087c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x42aa22
call fcn.00428700
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x42d0f0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.00402658
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402658
or dword [esi + 0x64], 0xffffffff
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.00402658
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.00402658
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42d0bc
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410d23
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x42ab02
call fcn.00428700
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x42d0f0
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00402658
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402658
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402658
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x42d158
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret