joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409438
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x409459
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094a5
xor eax, eax
push ebp
push 0x409495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40949c
lea eax, [ebp - 0xc]
call fcn.00409428
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409978
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4099d2
inc esi
xor edi, edi
cmp edi, 1
jne 0x40999e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099ac
cmp edi, 1
jle 0x4099ac
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409438
test eax, eax
jne 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4099d2
inc edi
dec esi
jne 0x40998e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4099dc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409a29
xor ebx, ebx
jmp 0x409a1e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00405090
test eax, eax
jne 0x409a1d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409ad9
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099ff
mov al, byte [ebp - 1]
sub al, 1
jb 0x409a34
je 0x409a3d
jmp 0x409a46
call fcn.004074a0
mov edi, eax
jmp 0x409a48
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409a48
xor edi, edi
test di, di
je 0x409ad9
xor ebx, ebx
jmp 0x409a84
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x409a83
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409a78
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409a83
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409ad9
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409a55
xor ebx, ebx
jmp 0x409ace
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409acd
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409ac2
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409acd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409ad9
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409a93
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409f78
push ebx
push 0x409f84
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f0c
mov al, 0x6a
call fcn.00409ae8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409e60
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409f15
call fcn.00409e60
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f66
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x40c3d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov edx, 0xfc
mov dword [ebp - 0x50], edx
push ebx
mov dword [ebp - 0x50], edx
push esi
add edx, edx
mov dword [ebp - 0x50], edx
push edi
mov dword [ebp - 0x50], edx
xor edx, 0xffffffcc
mov dword [ebp - 0x50], edx
jmp 0x40c40c
rdtsc
xor edx, eax
mov ecx, edi
jmp 0x40c423
sub ecx, 0xffffffee
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], ecx
mov ebx, dword [ebp - 0x3c]
xor ebx, ecx
jmp 0x40c482
push ebx
push 0x981ba900
push 0xb48c8400
push ebx
call fcn.0040d70a
add esp, 0x10
mov ebx, 0xb1
push eax
push 0xffffffffffffffab
push 0x27be300
call fcn.0040d345
add esp, 0xc
mov dword [ebp - 0x50], ebx
add eax, esi
cmp eax, 0x6c
jne 0x40c4f0
mov ecx, 0x80
mov dword [ebp - 0x50], eax
cmp eax, 0x43ab
jne 0x40c4f0
mov eax, dword [0x43146c]
mov dword [ebp - 0x20], ecx
add ebx, 0xffffff91
push 0xc0292200
call fcn.0040d146
add esp, 4
jmp 0x40c4f0
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x64], esi
rdtsc
mov ecx, dword [0x43146c]
add edx, edx
mov dword [ebp - 0x3c], eax
jmp 0x40c556
mov edi, dword [0x43146c]
jmp 0x40c57b
mov esi, dword [ebp - 8]
mov dword [ebp - 0x50], esi
sub eax, esi
xor esi, eax
mov dword [ebp - 0x64], esi
sub esi, 0x40394800
mov ecx, eax
cmp esi, 0xffffffec
je 0x40c5b5
cmp ecx, eax
je 0x40c5b5
mov dword [ebp - 0x50], ecx
test esi, 0x97
jne 0x40c5b5
mov edx, 3
jmp 0x40c5b5
test eax, 0x9e
je 0x40c5df
cmp eax, 0xffffff8e
jne 0x40c5df
cmp eax, 0xffffff87
jne 0x40c5df
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x3c], eax
cmp edx, 0xfca6
jne 0x40c5df
test edx, 0x98
jne 0x40c5df
mov dword [ebp - 0x50], edx
pop edi
mov edx, dword [ebp - 0x64]
add edx, 0xffffffcf
cmp edx, 0x18
je 0x40c613
mov ebx, dword [ebp - 0x64]
add ebx, eax
test edi, 0x24
jne 0x40c613
cmp edi, eax
je 0x40c613
mov dword [ebp - 0x34], ebx
mov ecx, 0xca
cmp ebx, 0x7e
je 0x40c613
or edx, ecx
cmp edx, 0x38
jne 0x40c613
mov dword [ebp - 0x3c], edx
pop esi
sub ecx, 0xffffffd0
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
cmp edx, 0xffffffc5
je 0x40c65e
add edx, eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], esi
mov edx, dword [ebp - 0x50]
cmp edx, 0x9f97
je 0x40c65e
cmp edx, esi
jne 0x40c65e
xor edx, 0x63
mov dword [ebp - 0x30], edx
mov ebx, dword [ebp - 0x3c]
test ebx, 0x17
je 0x40c65e
mov dword [ebp - 0x30], ecx
jmp 0x40c65e
pop ebx
mov dword [ebp - 0x50], ebx
leave
ret
Function at 0x40cad6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0x58
mov eax, dword [ebp - 4]
add eax, 0x58
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0xd
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x40cc4e
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 0x4d
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
je 0x40cb50
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x2c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 0x2e]
cmp eax, edx
jle 0x40cb59
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
je 0x40cc39
mov edx, 1
test edx, edx
je 0x40cc39
mov eax, dword [ebp - 0x24]
mov cl, byte [eax]
mov byte [ebp - 0x25], cl
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
movzx eax, byte [ebp - 0x19]
add eax, 0x16
mov byte [ebp - 0x19], al
movzx ecx, byte [ebp - 0x19]
cmp ecx, 0x57
jl 0x40cbb8
movzx edx, byte [ebp - 0x19]
cmp edx, 0x70
jg 0x40cbb8
movzx eax, byte [ebp - 0x19]
add eax, 0x20
mov byte [ebp - 0x19], al
movzx ecx, byte [ebp - 0x19]
sub ecx, 0x16
mov byte [ebp - 0x19], cl
movzx edx, byte [ebp - 0x25]
add edx, 0x16
mov byte [ebp - 0x25], dl
movzx eax, byte [ebp - 0x25]
cmp eax, 0x57
jl 0x40cbe8
movzx ecx, byte [ebp - 0x25]
cmp ecx, 0x70
jg 0x40cbe8
movzx edx, byte [ebp - 0x25]
add edx, 0x20
mov byte [ebp - 0x25], dl
movzx eax, byte [ebp - 0x25]
sub eax, 0x16
mov byte [ebp - 0x25], al
movzx ecx, byte [ebp - 0x19]
movzx edx, byte [ebp - 0x25]
cmp ecx, edx
je 0x40cc00
jmp 0x40cc39
movzx eax, byte [ebp - 0x19]
test eax, eax
jne 0x40cc10
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x18]
jmp 0x40cc50
mov dword [ebp - 0x2c], 0x70
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
lea ecx, [eax + edx*2 - 0xde]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
lea ecx, [eax + edx - 0x6f]
mov dword [ebp - 0x20], ecx
jmp 0x40cb63
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
jne 0x40cb20
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40cc5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0xf1
cmp dword [ebp + 8], 0
je 0x40cdd5
cmp dword [ebp + 0xc], 0
je 0x40cdd5
cmp dword [ebp + 0xc], 0xffff
jbe 0x40cc93
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40cdd5
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x7c], 0
je 0x40cdd5
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x78], 0
je 0x40cdd5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x78]
cmp eax, dword [edx + 0x50]
jae 0x40cdd5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x78]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0xc], 0xffff
ja 0x40cd44
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x10]
jb 0x40cd3f
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx + 0x10]
cmp dword [ebp + 0xc], eax
jae 0x40cd3f
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x40cdd7
jmp 0x40cdd5
mov dword [ebp - 0x20], 0
jmp 0x40cd56
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
cmp edx, dword [ecx + 0x18]
jae 0x40cdd5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x24]
movsx ecx, byte [eax]
cmp edx, ecx
jne 0x40cdd0
mov edx, dword [ebp - 0x28]
movsx eax, byte [edx]
test eax, eax
jne 0x40cda7
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x40cdd7
mov dword [ebp - 0x2c], 0xe9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + eax - 0xe8]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax - 0xe8]
mov dword [ebp - 0x24], edx
jmp 0x40cd76
jmp 0x40cd4d
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x438c98
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
mov edi, dword [esp]
add esp, 4
push ecx
pop ecx
call fcn.00438cc3
inc ebx
sub ecx, ecx
push ecx
pop ebx
xor dword [eax], edi
push ecx
pop ecx
inc eax
add ebx, ebx
cmp eax, esi
jne fcn.00438c98
push ebx
pop ebx
ret
Function at 0x406ac8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406b2e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404c30
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004035f0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406b18
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b35
lea eax, [ebp - 0x10]
call fcn.004049c0
ret

Function at 0x409a58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e80
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409a71
test al, 0x10
jne 0x409a75
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409a7c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e80
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409a90
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404e80
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409ab2
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c964
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c99d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404ab0
jmp 0x40c9a6
mov eax, ebx
mov edx, esi
call fcn.00404a14
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c9b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c9d1
mov al, byte [esp]
jmp 0x40c9d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x445f34
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x49de44]
cmp byte [eax + 0xc], 0
je 0x4460a1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44609a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49eb6c], 0
jne 0x445f88
push 0x4460a8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4460b0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb6c], eax
cmp dword [0x49bd4c], 0
jne 0x446083
push 0x4460c0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x49bd4c], eax
cmp dword [0x49bd4c], 0
je 0x446083
push 0x4460cc
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb70], eax
push 0x4460dc
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb74], eax
push 0x4460f0
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb78], eax
push 0x446108
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb7c], eax
push 0x446120
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb80], eax
push 0x446134
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb84], eax
push 0x44614c
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb88], eax
push 0x446164
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb8c], eax
push 0x446180
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb90], eax
push 0x44618c
mov eax, dword [0x49bd4c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49eb94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4460a1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x449f70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004049c0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x449fbf
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00404c30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451894
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4518e4]
test si, 4
je 0x4518a8
or bl, 1
test si, 8
je 0x4518b2
or bl, 4
test si, 1
je 0x4518bc
or bl, 8
test si, 2
je 0x4518c6
or bl, 0x10
test si, 0x10
je 0x4518d0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4518df
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x458464
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45860f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4585f0
mov dl, 1
mov eax, dword [0x418be4]
call fcn.00403bbc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004049c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4585df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446294
test al, al
je 0x4585d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458620
lea eax, [ebp - 0x254]
call fcn.0040a5e4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4585d2
xor eax, eax
push ebp
push 0x4585cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458658
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4585b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404c30
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4585b4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4585d2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4584d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041d5d8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458616
lea eax, [ebp - 0x260]
call fcn.004049c0
ret

Function at 0x458f44
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49ebb8]
cmp byte [eax + 0xa5], 0
jne 0x458fb5
cmp dword [0x49ebd0], 0
jne 0x458f76
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x458f00
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49ebd0], eax
cmp dword [0x49ebcc], 0
jne 0x458f91
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49ebcc], eax
cmp dword [0x49ebd4], 0
jne 0x458fb5
push esp
push 0
push 0
push 0x458ea4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x49ebd4], eax
pop edx
ret
Function at 0x4590ac
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4590c3
add esp, 0xfffffff0
call fcn.00403f10
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421b3c
mov eax, dword [0x49dabc]
cmp word [eax + 2], 0
jne 0x4590eb
mov eax, dword [0x49dabc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a814
mov eax, dword [0x49dc10]
cmp word [eax + 2], 0
jne 0x459105
mov eax, dword [0x49dc10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045aa0c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418580]
call fcn.00403bbc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423fa8]
call fcn.0042b3f8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45928c
mov eax, dword [0x49d93c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b7c8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45afac
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49d93c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e020
test eax, eax
je 0x4591fa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409fc4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e048
test eax, eax
je 0x45920e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404c30
mov eax, dword [0x49d6e4]
cmp byte [eax], 0
jne 0x459242
mov eax, ebx
call fcn.004593b4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045b188
mov eax, ebx
call fcn.0045bb4c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x459282
call fcn.00403f68
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret