joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fc20
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059b13
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10079214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x1002fcc5
cmp word [esi], di
je 0x1002fcc5
test eax, eax
je 0x1002fc81
cmp word [eax], di
je 0x1002fc81
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x1002fcc5
jmp 0x1002fcc0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10031950
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x1002fcc5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1002fd3c
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x1002fd27
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x1002fcf5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x1002fd16
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1002fd5c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x1002fd27
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x1002fd3c
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002deb9
mov esp, ebp
pop ebp
ret 0x30
call fcn.1001fe21
int3

Function at 0x1004e287
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004df47

Function at 0x40123a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push edi
and dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
call sub.iphlpapi.DLL_GetAdaptersInfo
mov dword [ebp - 8], eax
push 0
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebp - 4], 0
jne 0x4013f1
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 8]
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push edi
lea eax, [ebp - 0x21c]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp + 8]
call fcn.004013f9
call fcn.0040e280
test eax, eax
je 0x4010d6
push 0x10
push 0x46af86
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012b0
cmp dword [0x48a8e0], 0
push ebx
push esi
mov ebx, 0x48a8f4
jne 0x401106
push 0xffffffffffffffff
push dword [0x48a8e8]
mov esi, 0x48c990
push 1
call fcn.00406519
mov al, byte [0x4786bc]
mov byte [0x48c992], al
jmp 0x401154
lea eax, [ebp - 2]
push eax
push 0x48a8e0
mov esi, ebx
mov eax, 0x48c990
call fcn.00406b73
test al, al
jne 0x40112e
mov dword [0x4786d4], 1
jmp 0x4012a1
mov al, byte [0x48c990]
mov byte [0x48a8e4], al
mov al, byte [0x48c991]
push 0x48a8dc
mov byte [ebp - 1], al
lea eax, [ebp - 0x428]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [0x48a8e0]
push ebx
call fcn.0041923f
test eax, eax
je 0x40118a
mov edi, 0x48c990
call fcn.004066e5
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4786d4], 1
jmp 0x4012ae
cmp byte [ebp - 1], 1
jne 0x40123c
cmp byte [0x48a8b5], 1
jne 0x40123c
call fcn.0040d96a
test al, al
jne 0x40123c
push edi
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebp - 2], 0
je 0x401215
mov edi, 0x46aff0
push edi
lea esi, [ebp - 0x10]
call fcn.0040e2d5
push ebx
mov eax, esi
call fcn.0040e4d0
push edi
mov eax, esi
call fcn.0040e4d0
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x428]
push eax
push 0x46aff4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x10]
call fcn.0044de9c
pop ecx
jmp 0x401297
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x428]
push eax
push 0x46aff4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401297
call fcn.004012b5
call fcn.00401388
cmp byte [0x48a8e4], 0
jne 0x401259
mov edi, 0x48b338
call fcn.00409f45
push 1
mov eax, 0x48ab00
call fcn.004193a1
cmp byte [0x48a8e4], 0
jne 0x401297
mov edi, 0x48c15c
mov esi, dword [edi]
test esi, esi
je 0x40128c
push dword [esi + 8]
call fcn.0044de9c
push esi
call fcn.0044de9c
and dword [edi], 0
pop ecx
pop ecx
add edi, 4
cmp edi, 0x48c978
jl 0x401273
mov edi, 0x48c990
call fcn.004066e5
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x401e7a
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
push 1
push dword [esi]
call fcn.00403726
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebp, ebp
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401eca
push 0x25
push pe_nt_image_headers32
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401eec
push 0x27
push pe_nt_image_headers32
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
push dword [esi]
call fcn.00403726
pop edi
pop ebp
mov al, 1
pop ebx
ret 4

Function at 0x40234a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xb0
push dword [ebx]
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x402377
xor al, al
jmp 0x40238b
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x402391
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 0x101]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044de32
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x4023ee
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x4023cd
mov ecx, dword [ebp - 4]
and word [ecx + eax*2], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp + 8]
call fcn.0040e438
mov bl, 1
push dword [ebp - 4]
call fcn.0044de9c
pop ecx
mov al, bl
jmp 0x40238a
xor bl, bl
jmp 0x4023e1
Function at 0x40348b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x4034c3
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x4034bc
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x4035d4
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
push ebx
mov ebx, pe_nt_image_headers32
je 0x403502
push ebx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044e371
test eax, eax
pop ecx
pop ecx
jne 0x4034ff
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x40356d
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044e3ca
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
call fcn.0044e476
add esp, 0x10
test eax, eax
jne 0x403568
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x80c]
push eax
push str._s_u
push eax
call fcn.0044e3e0
push dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044e371
add esp, 0x18
test eax, eax
je 0x4035c9
inc dword [ebp - 4]
jmp 0x403570
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x4035a2
push 0x400
lea eax, [ebp - 0x80c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044e371
test eax, eax
pop ecx
pop ecx
je 0x4035c9
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x4035c1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x4035be
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x4035be
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jne 0x4035d0
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x4035d3
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x403726
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x403751
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x40376c
push 1
jmp 0x403753
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x403824
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x46b160
call fcn.0040e438
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xe
push dword [ebp]
call ebx
mov esi, eax
test esi, esi
jne 0x403856
mov esi, 0x7fff
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044de32
pop ecx
mov edi, eax
push edi
lea eax, [esi + 1]
push eax
push 0xd
push dword [ebp]
call ebx
and word [edi + esi*2], 0
test eax, eax
jle 0x4038a1
mov eax, dword [esp + 0x18]
push edi
call fcn.0040e438
mov bl, 1
push edi
call fcn.0044de9c
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 8
xor bl, bl
jmp 0x403891
Function at 0x403f81
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp byte [ebx + 0xb], 0
je 0x403fa1
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp byte [ebx + 9], 0
push esi
mov esi, 0x400
je 0x403fda
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [ebx + 0x58]
lea ecx, [ebp - 0x818]
push ecx
push eax
call fcn.0044e371
test eax, eax
pop ecx
pop ecx
jne 0x403fd7
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 6], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
je 0x404070
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call edi
cmp byte [ebx + 0xc], 0
jne 0x404019
lea eax, [ebp - 0x818]
push eax
call fcn.0044e3ca
pop ecx
push eax
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebx + 0x10]
dec eax
je 0x40404f
dec eax
je 0x404038
dec eax
jne 0x40406d
push dword [ebx + 0x14]
lea eax, [ebp - 0x818]
push eax
call fcn.0044e371
pop ecx
pop ecx
jmp 0x404066
push dword [ebx + 0x14]
lea eax, [ebp - 0x818]
push eax
call fcn.0044e642
test eax, eax
pop ecx
pop ecx
je 0x40406d
jmp 0x40406a
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push eax
lea eax, [ebp - 0x818]
push eax
push ecx
call fcn.0044e476
add esp, 0xc
test eax, eax
jne 0x40406d
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 7], 0
je 0x4040dd
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x818]
push eax
lea esi, [ebp - 0x14]
call fcn.0040e2d5
lea esi, [ebx + 0x2c]
lea edi, [ebp - 0x14]
call fcn.00405b50
push dword [ebp - 0x14]
call fcn.0044de9c
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
pop ecx
je 0x4040da
mov ecx, dword [esi]
cmp ecx, edi
je 0x4040da
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0x28]
push edi
push dword [esi + 0xc]
push ecx
push edi
push eax
call fcn.0044ce2e
add esp, 0x20
cmp eax, edi
mov dword [esi + 0x18], eax
jle 0x4040da
inc dword [ebp - 4]
mov dword [esi + 0x18], edi
inc dword [ebp - 8]
cmp byte [ebx + 8], 0
pop edi
je 0x404100
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x4040fd
push dword [ebp + 8]
mov esi, ebx
call fcn.00404148
test al, al
je 0x4040fd
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 0xa], 0
je 0x40411f
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x40411c
inc dword [ebx + 0x68]
mov eax, dword [ebx + 0x68]
cmp eax, dword [ebx + 0x64]
jne 0x40411c
inc dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x404140
lea eax, [ebp + 8]
push eax
lea esi, [ebx + 0x78]
call fcn.004281d6
inc dword [ebx + 0x6c]
xor eax, eax
cmp byte [ebx + 4], al
sete al
jmp 0x404143
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x4041a4
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4041c2
mov eax, dword [esp + 0xc]
cmp byte [eax + 5], 1
jne 0x404257
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push 0
push 0
push 0xe
push dword [esp + 0x24]
call ebx
mov esi, eax
test esi, esi
jne 0x4041e1
mov esi, 0x7fff
xor ecx, ecx
push 2
lea ebp, [esi + 1]
pop edx
mov eax, ebp
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044de32
pop ecx
mov edi, eax
push edi
push ebp
push 0xd
push dword [esp + 0x24]
call ebx
and word [edi + esi*2], 0
test eax, eax
pop ebp
pop ebx
jg 0x404220
xor esi, esi
inc esi
push edi
call fcn.0044de9c
pop ecx
mov eax, esi
jmp 0x40425a
mov esi, dword [esp + 0xc]
cmp byte [esi + 0xc], 0
jne 0x404239
push edi
call fcn.0044e3ca
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [esi + 0x20]
push edi
call fcn.0044e642
test eax, eax
pop ecx
pop ecx
je 0x404250
mov byte [esi + 0x70], 1
xor esi, esi
jmp 0x404215
push edi
call fcn.0044de9c
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
ret 8
Function at 0x40602f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20630
call fcn.00453310
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov byte [0x48c990], bl
mov byte [0x48c991], bl
mov byte [0x48c992], bl
mov dword [0x48c994], ebx
mov dword [0x48c998], ebx
mov dword [0x48c99c], ebx
mov dword [0x48c9a0], ebx
mov dword [0x48c9a4], 0x46b380
mov dword [0x48c9a8], ebx
mov dword [0x48c9ac], ebx
mov dword [0x48c9b0], ebx
mov dword [0x48c9b4], 0x46b380
mov dword [0x48c9b8], ebx
mov dword [0x48c9bc], ebx
mov dword [0x48c9c0], ebx
mov dword [0x48c9c8], ebx
mov dword [0x48c9d0], ebx
call fcn.0044de32
pop ecx
mov dword [0x48c9c4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004507f8
push esi
lea eax, [ebp - 0x424]
push str.Include
push eax
call fcn.00450842
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045087f
mov edi, 0x20a
push edi
call fcn.0044de32
mov ecx, dword [0x48c9c4]
mov edx, dword [0x48c9c8]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48c9c8]
mov eax, dword [0x48c9c4]
mov eax, dword [eax + ecx*4]
inc dword [0x48c9c8]
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0044ddb8
add esp, 0x40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406296
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20630]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x1fffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40628d
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
add eax, eax
mov word [ebp + eax - 0x20630], bx
mov word [ebp + eax - 0x2062e], bx
lea eax, [ebp - 0x20630]
mov word [ebp - 0x21c], bx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, bx
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], bx
je 0x4061ff
cmp ax, 0x3b
je 0x4061ff
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0044dd8e
pop ecx
pop ecx
jmp 0x406284
lea eax, [ebp - 0x21c]
push eax
call fcn.0044e3ca
test eax, eax
pop ecx
je 0x40623b
lea eax, [ebp - 0x21c]
push eax
call fcn.0044e3ca
cmp word [ebp + eax*2 - 0x21e], 0x5c
pop ecx
je 0x40623b
lea eax, [ebp - 0x21c]
push 0x46b574
push eax
call fcn.0044dd8e
pop ecx
pop ecx
push edi
call fcn.0044de32
mov ecx, dword [0x48c9c4]
mov edx, dword [0x48c9c8]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x48c9c8]
mov eax, dword [0x48c9c4]
mov eax, dword [eax + ecx*4]
inc dword [0x48c9c8]
push esi
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0045089d
mov eax, dword [ebp - 8]
add esp, 0x10
cmp word [eax], bx
mov word [ebp - 0x21c], bx
je 0x40628d
add dword [ebp - 8], 2
jmp 0x4061cf
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x48c990
pop ebx
leave
ret
Function at 0x4070d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, eax
push ebx
push edi
mov edi, dword [ecx]
add eax, 4
mov dword [esi], eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044de32
mov ecx, dword [esi]
add ecx, dword [ebp + 8]
lea ebx, [edi + edi]
push ebx
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.00450190
mov eax, dword [ebp - 4]
add dword [esi], ebx
xor ecx, ecx
add esp, 0x10
cmp edi, ecx
mov word [ebx + eax], cx
jle 0x407132
xor word [eax + ecx*2], di
inc ecx
cmp ecx, edi
jl 0x407129
pop edi
pop ebx
leave
ret 4

Function at 0x407e3f
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
push 5
pop eax
mov dword [0x48ab00], eax
mov dword [0x48ab04], eax
mov al, byte [0x48ad1d]
xor ebx, ebx
neg al
push ebx
push 0x5b
mov dword [0x48ad48], ebx
mov byte [0x48ab08], 1
mov byte [0x48ab09], bl
mov dword [0x48ab0c], ebx
sbb eax, eax
and eax, 0xffffff70
add eax, 0xa0
mov dword [0x48ad58], eax
call esi
push ebx
push 0x10
mov byte [0x48ad55], al
call esi
push ebx
push dword [0x48ad58]
mov byte [0x48ad52], al
call esi
push ebx
push 0xa1
mov byte [0x48ad53], al
call esi
push ebx
push 0x11
mov byte [0x48ad54], al
call esi
push ebx
push 0x12
mov byte [0x48ad50], al
call esi
mov byte [0x48ad51], al
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
xor edi, edi
inc edi
lea esi, [edi + 0x477818]
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
jne 0x407ef7
mov byte [esi], 0x20
inc edi
cmp edi, 7
jle 0x407ede
lea eax, [ebp - 8]
push str.0409
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
pop ebx
jne 0x407f3f
push 4
lea eax, [ebp - 0xc]
push str.0002
push eax
call fcn.00450b38
add esp, 0xc
test eax, eax
mov byte [0x47781a], 0x20
mov byte [0x47781d], 0x20
je 0x407fd1
jmp 0x407fbc
lea eax, [ebp - 8]
push str.0809
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
jne 0x407f5c
mov byte [0x47781a], 0x20
jmp 0x407fb5
lea eax, [ebp - 6]
push 0x46bcf4
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
jne 0x407f79
mov byte [0x47781d], 0x20
jmp 0x407fca
lea eax, [ebp - 6]
push 0x46bcf8
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
je 0x407f53
lea eax, [ebp - 6]
push 0x46bcfc
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
je 0x407fca
lea eax, [ebp - 6]
push 0x46bd00
push eax
call fcn.00450ab0
test eax, eax
pop ecx
pop ecx
jne 0x407fd1
mov byte [0x47781d], 0x20
mov byte [0x47781e], 0x20
mov byte [0x47781b], 0x20
mov byte [0x47781c], 0x20
leave
ret
Function at 0x4081db
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp ebx, edi
jne 0x4081f5
mov eax, dword [ebp + 8]
cmp byte [eax + 9], 0
je 0x4082cb
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x408296
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 4]
mov dword [0x48ce48], eax
call esi
test ebx, ebx
mov dword [ebp + 0xc], eax
je 0x408268
lea eax, [ebp - 0xc]
push eax
push ebx
call edi
mov ecx, dword [0x48ce48]
cmp ecx, eax
mov dword [0x48ce44], eax
je 0x40825d
push 1
push eax
push ecx
call esi
mov dword [ebp - 8], eax
mov eax, dword [0x48ce44]
push 1
push eax
push dword [ebp - 4]
call esi
mov dword [ebp - 0xc], eax
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jne 0x4082ca
cmp dword [ebp - 8], ecx
jne 0x4082ca
cmp dword [ebp - 0xc], ecx
jne 0x4082ca
mov eax, dword [0x48ce48]
cmp dword [ebp - 4], eax
jne 0x4082ca
cmp eax, dword [0x48ce44]
jne 0x4082ca
mov eax, dword [ebp + 8]
mov dword [eax + 0x24c], ecx
jmp 0x4082ca
cmp ebx, edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4082be
push edi
push dword [0x48ce44]
push eax
call esi
mov ecx, dword [0x48ce48]
mov eax, dword [0x48ce44]
cmp ecx, eax
je 0x4082be
push edi
push eax
push ecx
call esi
push edi
push dword [0x48ce48]
push dword [ebp - 4]
call esi
pop esi
pop edi
leave
ret 8

Function at 0x408341
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp byte [ebp + 0xc], al
mov byte [ebp - 1], al
je 0x40839f
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov eax, esi
call fcn.004082d0
mov edi, dword [esi + 4]
push esi
call fcn.004094b7
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push dword [ebp + 8]
mov eax, esi
push 2
pop ebx
call fcn.004082d0
mov edi, dword [esi]
push esi
call fcn.004094b7
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 8