joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4823f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405a5c
xor eax, eax
push ebp
push 0x482757
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKBCodePage
mov dl, 1
mov eax, dword [0x422e30]
call fcn.00403bcc
mov dword [ebp - 8], eax
call sub.user32.dll_DestroyCaret
push ebx
and ebx, 0x12c
xor ebx, 0xf4
or ebx, 0x11f
and ebx, 0x5f
add ebx, 0x25
add ebx, 0x124
sub ebx, 0xfa
sub ebx, 0xc4
dec ebx
nop
nop
nop
nop
push ebx
pop ebx
pop ebx
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
call sub.user32.dll_GetKBCodePage
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00427c98
call sub.user32.dll_GetKBCodePage
push 0
push 0
mov eax, dword [ebx]
call fcn.00427c98
push edi
push edx
xchg edx, edi
xchg edi, edx
nop
nop
nop
nop
sub edi, 0xa2
xchg edx, edi
mov edi, 0x10e
and edi, 0x106
or edx, 0xcf
dec edx
or edi, 0x11a
xchg edi, edx
sub edx, 0x146
or edi, 0x170
or edx, 0x19c
sub edi, 0x15c
pop edx
pop edi
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
mov ecx, dword [ebx]
mov dl, 1
mov eax, dword [0x479af0]
call fcn.00479e94
mov dword [ebp - 0xc], eax
call sub.user32.dll_DestroyCaret
push ebx
and ebx, 0x12c
xor ebx, 0xf4
or ebx, 0x11f
and ebx, 0x5f
add ebx, 0x25
add ebx, 0x124
sub ebx, 0xfa
sub ebx, 0xc4
dec ebx
nop
nop
nop
nop
push ebx
pop ebx
pop ebx
xor eax, eax
push ebp
push 0x48265f
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentProcessId
push esi
or esi, 0x1c
and esi, 0xf2
dec esi
add esi, 0x132
xor esi, 0x16c
and esi, 0x66
push esi
pop esi
and esi, 0x48
mov esi, 0x16b
pop esi
lea edx, [ebp - 0x40c]
mov ecx, 0x400
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
push edx
or edx, 0xcf
xor edx, 0x15
nop
nop
nop
nop
dec edx
dec edx
add edx, 0x173
pop edx
test ebx, ebx
jle 0x482605
call sub.user32.dll_GetKBCodePage
lea edx, [ebp - 0x40c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00427f04
call sub.kernel32.dll_GetCurrentProcessId
push esi
or esi, 0x1c
and esi, 0xf2
dec esi
add esi, 0x132
xor esi, 0x16c
and esi, 0x66
push esi
pop esi
and esi, 0x48
mov esi, 0x16b
pop esi
lea edx, [ebp - 0x40c]
mov ecx, 0x400
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
push edx
or edx, 0xcf
xor edx, 0x15
nop
nop
nop
nop
dec edx
dec edx
add edx, 0x173
pop edx
push 1
call sub.kernel32.dll_SetLastError
call sub.user32.dll_GetKBCodePage
test ebx, ebx
jg 0x48258a
call sub.user32.dll_DestroyCaret
push ebx
and ebx, 0x12c
xor ebx, 0xf4
or ebx, 0x11f
and ebx, 0x5f
add ebx, 0x25
add ebx, 0x124
sub ebx, 0xfa
sub ebx, 0xc4
dec ebx
nop
nop
nop
nop
push ebx
pop ebx
pop ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482666
push 1
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0xc]
call fcn.00403bfc
call sub.user32.dll_GetKBCodePage
ret
Function at 0x4a7b98
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x4a7bbd
cmp dword [esp + 4], 5
jb 0x4a7bbd
mov al, 1
jmp 0x4a7bbf
xor eax, eax
add esp, 0x114
ret
Function at 0x4c0643
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4c069b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4c0691
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4c069f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4065f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406615
xor eax, eax
test eax, eax
je 0x406627
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406627
xor ecx, ecx
jmp 0x40662a
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406716
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422eb4], 0
push esi
jne 0x40674d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406727
mov dword [ecx*4 + 0x422eb0], eax
inc ecx
cmp ecx, 0x100
jl 0x406722
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40677e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422eb0]
xor eax, esi
inc ecx
dec edx
jne 0x406760
pop edi
not eax
pop esi
ret 0xc

Function at 0x4022e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4041a8], esi
push edi
dec ecx
jne 0x40230f
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4041a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
push eax
push dword [0x4041a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4041b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4023c3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4023aa
pop ebp
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x50e049
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [0x50105c]
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x67
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], bl
mov byte [ebp - 0x30], 0x54
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x6d
mov byte [ebp - 0x2d], 0x70
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x79
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x49
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x74
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x46
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], bl
mov dword [ebp - 4], ebx
mov esi, 0x184
push esi
lea eax, [ebp - 0x1b4]
push ebx
push eax
call 0x5105b4
add esp, 0xc
cmp dword [ebp - 4], ebx
lea eax, [ebp - 0x1b4]
push esi
push eax
jne 0x50e129
call dword [0x501080]
jmp 0x50e134
push 0x50187c
call dword [0x501034]
cmp byte [ebp - 0x1b4], bl
je 0x50e1a2
lea eax, [ebp - 0x1b4]
push eax
call dword [0x501078]
lea ecx, [ebp - 0x1b4]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x50e164
lea eax, [ebp - 0x1b4]
push 0x501190
push eax
call edi
cmp dword [ebp - 4], 1
jne 0x50e185
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b4]
push eax
call edi
lea eax, [ebp - 0x1b4]
push 0x501190
push eax
call edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1b4]
push eax
call edi
lea eax, [ebp - 0x1b4]
push 5
push eax
call fcn.0050dead
pop ecx
pop ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x50e103
pop edi
pop esi
pop ebx
leave
ret

Function at 0x50e2d5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x50e2e9
call fcn.0050e28c
mov ecx, eax
test ecx, ecx
jne 0x50e2ed
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
not eax
jle 0x50e312
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [ecx + edx*4]
xor eax, edx
inc esi
dec edi
jne 0x50e2fc
pop edi
pop esi
not eax
ret
Function at 0x402898
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4028d5
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4028f5
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00403de8
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402a00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a2f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ca0
jmp 0x402a4d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402988
mov edi, eax
test ebx, ebx
je 0x402a4d
cmp dword [esi], 0
je 0x402a4d
dec ebx
jmp 0x402a36
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402db8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d98
xor eax, eax
push ebp
push 0x402d91
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402dd4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d98
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b6c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040278c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46c049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403b34
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x405434
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4055f0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405495
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40560c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405507
xor eax, eax
push ebp
push 0x405500
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0040528c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4054e9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40562c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405507
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4055e8
cmp byte [ebp - 0xd], 0
jne 0x405549
cmp byte [ebp - 0x12], 0
je 0x4055e8
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405562
dec ebx
cmp byte [ebx], 0x2e
je 0x405571
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405561
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4055e8
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40559e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055e8
cmp byte [ebp - 0xd], 0
je 0x4055e8
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4055e8
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40907c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4090b5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403ca0
jmp 0x4090be
mov eax, ebx
mov edx, esi
call fcn.00403c0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4090c8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4090e9
mov al, byte [esp]
jmp 0x4090eb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x413108
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x413118
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x41312d
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4151dc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4151e2
ret

Function at 0x4176e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x417731
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x417718
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x417708
jmp 0x417731
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x417719
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422a04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x46c780], 0
sete dl
or al, dl
jne 0x422b44
mov eax, dword [0x46c784]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x46c780]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x422b13
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x46c780]
call fcn.0040e28c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x422b0b
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x422b0b
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x422b0b
mov eax, dword [ebp - 0x14]
call fcn.0042ad44
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x422b0b
push ebp
call fcn.004229c0
pop ecx
test al, al
jne 0x422b0b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x422ac7
mov eax, dword [ebp - 0x14]
call fcn.00429698
dec eax
jle 0x422b0b
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00403088
cmp byte [ebp - 1], 0
je 0x422b0b
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x422b0b
mov edx, dword [ebp - 0x14]
mov eax, dword [0x46c784]
call fcn.0042220c
inc edi
dec esi
jne 0x422a5a
mov eax, dword [0x46c784]
cmp dword [eax + 8], 0
jle 0x422b2b
mov eax, dword [0x46c784]
call fcn.0042229c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x422b44
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00422828
pop ecx
test al, al
jne 0x422b44
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4286a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4286d5
je 0x42872f
sub eax, 7
je 0x4286f6
dec eax
je 0x428720
sub eax, 0x17
je 0x4287d4
jmp 0x428812
add eax, 0xffffff00
sub eax, 9
jb 0x4287c0
add eax, 0xffffff09
sub eax, 0xb
jb 0x428788
jmp 0x428812
mov eax, ebx
call fcn.0043a6f8
mov edi, eax
test edi, edi
je 0x428872
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x42887b
jmp 0x428872
test byte [ebx + 0x44], 0x20
jne 0x42887b
jmp 0x428872
mov edx, esi
mov eax, ebx
call fcn.00425ca4
cmp dword [esi + 0xc], 0xffffffff
jne 0x42887b
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407020
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.004247e0
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0042857c
test eax, eax
je 0x42887b
mov dword [esi + 0xc], 1
jmp 0x42887b
mov edx, esi
mov eax, ebx
call fcn.00428610
test al, al
je 0x428872
cmp dword [esi + 0xc], 0
jne 0x42887b
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042ad44
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x42887b
mov eax, ebx
call fcn.00425340
test al, al
jne 0x42887b
jmp 0x428872
mov eax, ebx
call fcn.0042ad44
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x428872
cmp dword [0x46973c], 0
je 0x428872
mov eax, dword [0x46973c]
cmp ebx, dword [eax + 0x24]
jne 0x428872
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x46973c]
call fcn.00425bd8
jmp 0x428872
mov eax, dword [0x46c748]
cmp byte [eax + 0x20], 0
je 0x428872
mov eax, dword [0x46c748]
cmp dword [eax + 0x1c], 0
je 0x428872
mov eax, dword [esi]
mov edx, dword [0x46c748]
cmp eax, dword [edx + 0x1c]
jne 0x428872
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043a63c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00403088
jmp 0x42887b
mov edx, esi
mov eax, ebx
call fcn.00425ca4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret