joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebx + 0x18]
test eax, eax
mov dword [esp + 0x18], 0x420a60
mov dword [esp + 0x28], 0x420ac0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0x420900
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x14], 0
je 0x420e80
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x420e80
push 0
lea edx, [esp + 0x18]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
add dword [edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
adc dword [edi + 4], 0
mov edi, dword [ebx + 0x14]
mov eax, edi
mov dword [edi + 0x1d0], ecx
mov dword [edi + 0x3bd10], 1
mov dword [edi + 0x3bcd4], edx
call fcn.00426710
test eax, eax
jne 0x420ec5
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.004267a0
add esp, 4
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x420eda
fld qword [0x486818]
fld st(0)
jmp 0x420f48
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x20], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x24], eax
fild qword [esp + 0x20]
and ecx, 0x80000000
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x20], esi
fild qword [esp + 0x20]
mov eax, edi
mov ecx, edi
and eax, 0x7fffffff
fchs
mov dword [esp + 0x20], edx
faddp st(1)
mov dword [esp + 0x24], eax
fld qword [0x486818]
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], esi
fild qword [esp + 0x20]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x423650
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x423660
pop edi
pop ebx
ret

Function at 0x423690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x4236a0
pop esi
pop ebp
pop ebx
ret
Function at 0x423810
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
lea edx, [eax + 1]
je 0x423852
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x423821
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x4239a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
push edi
mov dword [esp + 0x10], ecx
xor edx, edx
lea ebx, [ebx]
cmp edx, dword [esp + 0x20]
jae 0x423b17
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x423a30
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x423a06
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x4239f0
cmp edx, 0x10
jae 0x423ab2
lea eax, [edx - 8]
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x20]
jae 0x423b17
or eax, 8
xor edi, edi
cmp eax, 1
je 0x423a92
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x423a65
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 0x18], eax
jb 0x423a51
cmp edx, dword [esp + 0x20]
jae 0x423b17
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
nop
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x423af6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x423ad0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jb 0x423ac0
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4256b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x4256d0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x4256e0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x4256d0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x425740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.00423810
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x425754
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x4257d4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x425831
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x425823
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x4257f0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x4257e0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x425858
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x425840
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x425880
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x425880
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x4257d0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x429b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
add edx, 1
add esi, 4
cmp edx, 0x100
jb 0x429b57
pop esi
ret
Function at 0x42d910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
not eax
je 0x42d942
jmp 0x42d920
test cl, 3
je 0x42d942
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x47dc58]
add ecx, 1
sub esi, 1
jne 0x42d920
cmp esi, 0x20
push ebx
push edi
jb 0x42db2c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x47e058]
xor edx, dword [ebx*4 + 0x47e458]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x47dc58]
add ecx, 4
xor edx, dword [eax*4 + 0x47e858]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x47e058]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x47e458]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x47dc58]
add ecx, 4
xor eax, dword [edx*4 + 0x47e858]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x47e058]
xor edx, dword [ebx*4 + 0x47e458]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x47dc58]
xor edx, dword [eax*4 + 0x47e858]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x47e058]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x47e458]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x47dc58]
xor eax, dword [edx*4 + 0x47e858]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x47e058]
xor edx, dword [ebx*4 + 0x47e458]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x47dc58]
xor edx, dword [eax*4 + 0x47e858]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x47e058]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x47e458]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x47dc58]
and edx, 0xff
xor eax, dword [edx*4 + 0x47e858]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x47e058]
xor edx, dword [ebx*4 + 0x47e458]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x47dc58]
add ecx, 4
xor edx, dword [eax*4 + 0x47e858]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x47e058]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x47e458]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x47dc58]
and edx, 0xff
xor eax, dword [edx*4 + 0x47e858]
sub edi, 1
jne 0x42d952
cmp esi, 4
jb 0x42db79
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x47e058]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x47e458]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x47dc58]
and eax, 0xff
xor edi, dword [eax*4 + 0x47e858]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x42db36
test esi, esi
pop edi
pop ebx
je 0x42db9d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x47dc58]
add ecx, 1
sub esi, 1
jne 0x42db80
not eax
pop esi
ret
Function at 0x42e550
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.00462fc9
mov ecx, dword [esp + 0x20]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x42e573
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42e582
mov eax, 1
pop ecx
ret

Function at 0x42e680
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x42e698
mov esi, 8
push 2
call edi
test ax, ax
jge 0x42e6a4
or esi, 1
push 1
call edi
test ax, ax
jge 0x42e6b0
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x42e6bc
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x42e6c8
or esi, 0x20
pop edi
mov ax, si
pop esi
ret

Function at 0x42ecd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0x13c]
cmp eax, ecx
je 0x42ecf9
cmp esi, dword [edi + 0x94]
je 0x42ecf9
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x94]
cmp esi, eax
je 0x42eded
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x42ed65
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x94]
mov dword [esp + 0x14], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
lea edx, [esp + 8]
push edx
call eax
mov dword [edi + 0x94], 0
test esi, esi
je 0x42eded
mov edx, dword [esi]
mov eax, dword [edx + 0x128]
mov ecx, esi
call eax
cmp eax, edi
jne 0x42eded
mov edx, dword [esi]
mov eax, dword [edx + 0xd8]
mov ecx, esi
call eax
test al, al
je 0x42eded
mov edx, dword [esi]
mov eax, dword [edx + 0x120]
mov ecx, esi
call eax
test al, al
je 0x42eded
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0x94], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x94]
mov dword [esp + 0x14], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x50]
lea eax, [esp + 8]
push eax
call edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f380
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x477f08
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4921bc]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x90]
xor ebx, ebx
mov eax, 7
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], bx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x34], eax
mov eax, edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
lea edx, [eax + 2]
jmp 0x42f3f0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42f3f0
sub eax, edx
sar eax, 1
push eax
push edi
lea esi, [esp + 0x24]
call fcn.00401890
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea esi, [ebp + 0x15c]
push esi
mov byte [esp + 0x94], 1
call fcn.00417890
mov byte [esp + 0x88], bl
cmp dword [esp + 0x34], 8
jb 0x42f443
mov edx, dword [esp + 0x20]
push edx
call fcn.0046207a
add esp, 4
mov eax, dword [esi + 4]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x42f456
cmp eax, esi
je 0x42f45b
call fcn.004625df
mov ecx, dword [esp + 0x58]
cmp dword [esp + 0x18], ecx
je 0x42f46d
push ebp
mov edx, edi
call fcn.0042f640
cmp dword [esp + 0x74], ebx
jne 0x42f4e5
mov edx, dword [esp + 0x94]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edx
call fcn.00435090
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x58]
push eax
push esi
mov byte [esp + 0x94], 2
call fcn.00418210
mov esi, 8
cmp dword [esp + 0x50], esi
jb 0x42f4c1
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0046207a
add esp, 4
cmp dword [esp + 0x34], esi
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
jb 0x42f4e5
mov edx, dword [esp + 0x20]
push edx
call fcn.0046207a
add esp, 4
cmp dword [esp + 0x78], 8
jb 0x42f4f9
mov eax, dword [esp + 0x64]
push eax
call fcn.0046207a
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.00461f6b
add esp, 0x7c
ret 8
Function at 0x42fff0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
sub eax, 0x100
je 0x430076
sub eax, 4
jne 0x430070
cmp dword [esi + 0x94], eax
je 0x430070
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x9c]
mov word [esp + 0x18], cx
mov ecx, dword [esi + 0xa0]
mov dword [esp], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call fcn.0042e680
mov word [esp + 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x94]
mov dword [esp + 0xc], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x50]
lea eax, [esp]
push eax
call edx
xor al, al
add esp, 0x2c
ret
cmp ecx, 9
jne 0x430070
cmp dword [esi + 0x94], 0
je 0x4300cd
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd8]
call edx
test al, al
je 0x4300cd
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx]
mov edx, dword [eax + 0x120]
call edx
test al, al
je 0x4300cd
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx]
mov edx, dword [eax + 0x44]
call edx
cmp eax, 0xa
jne 0x4300cd
mov eax, dword [esi + 0x94]
cmp byte [eax + 0x49d], 0
jne 0x430070
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
mov eax, esi
push ecx
call fcn.0042ebe0
mov al, 1
add esp, 0x2c
ret
Function at 0x4327d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4775c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebp
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432812
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x24]
call fcn.00401890
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
add esi, 0x30
push esi
mov dword [esp + 0x50], 0
call fcn.00433070
cmp dword [esp + 0x34], 8
jb 0x43285f
mov edx, dword [esp + 0x20]
push edx
call fcn.0046207a
add esp, 4
mov edi, dword [esp + 0x14]
test edi, edi
mov ebp, dword [esi + 4]
je 0x43286e
cmp edi, esi
je 0x432873
call fcn.004625df
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x4328a6
test edi, edi
jne 0x432884
call fcn.004625df
cmp esi, dword [edi + 4]
jne 0x43288e
call fcn.004625df
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret 4
Function at 0x437890
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [edi + 4]
push ebx
push esi
push 4
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov ecx, dword [edi + 4]
push 1
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push esi
call ebx
mov edx, dword [edi + 4]
xor eax, eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43795d
lea esp, [esp]
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43795d
cmp dword [esp + 0x10], 0x10
jne 0x437921
mov ecx, dword [esp + 0xc]
cmp ecx, dword [edi + 4]
jne 0x437921
push 1
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [esp + 0xc]
push edx
call fcn.0042feb0
add esp, 4
test al, al
jne 0x437948
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x10], 0x12
je 0x43795d
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4378f0
push 1
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [esp + 0x10], 0x12
jne 0x43797b
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477e19
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4921bc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], 3
call fcn.00438cd0
mov eax, edi
call fcn.00438a30
mov eax, edi
call fcn.00438af0
lea eax, [edi + 0x3c]
mov byte [esp + 0x14], 2
call fcn.00433490
lea eax, [edi + 0x30]
mov byte [esp + 0x14], 1
call fcn.00433b20
cmp dword [edi + 0x2c], 8
jb 0x437bdd
mov eax, dword [edi + 0x18]
push eax
call fcn.0046207a
add esp, 4
xor esi, esi
mov dword [edi + 0x2c], 7
mov dword [edi + 0x28], esi
mov word [edi + 0x18], si
mov eax, dword [edi + 4]
cmp eax, esi
je 0x437bfd
push eax
call fcn.0046207a
add esp, 4
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4