joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf380
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x569090]
cmp byte [eax], 0
jne 0x4bf3ae
mov ecx, 0xaf
mov edx, 0x4bf3fc
mov eax, 0x4bf434
call fcn.004048d0
mov eax, ebx
call fcn.004050b0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4bf3ed
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040526c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf448
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x569090]
cmp byte [eax], 0
jne 0x4bf46b
mov ecx, 0xbd
mov edx, 0x4bf4ac
mov eax, 0x4bf4e4
call fcn.004048d0
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4bf49e
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4bf49e
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4bf49e
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4c5108
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c5167
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW
lea edx, [ebp - 8]
call fcn.004c4fb4
mov dword [ebp - 4], eax
xor ebx, ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c4fb4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040542c
je 0x4c5151
inc ebx
jmp 0x4c5134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c516e
lea eax, [ebp - 8]
call fcn.004050b0
ret

Function at 0x4c5b34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4c5b98
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404bf4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040b084
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5b9f
lea eax, [ebp - 0xc]
call fcn.00404974
ret
Function at 0x4c61dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov ebx, ecx
mov edi, edx
mov esi, eax
test ebx, ebx
je 0x4c61f5
cmp dword [ebx], 0
jne 0x4c62ef
mov dword [esp], esi
lea eax, [esp + 8]
push eax
push 0x40
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c6214
call fcn.0043c060
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xc]
cmp word [eax], 0x25ff
jne 0x4c6276
add dword [esp + 0xc], 2
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c6253
call fcn.0043c060
mov eax, dword [esp + 0xc]
mov dword [esp], eax
lea eax, [esp + 8]
push eax
push 0x40
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c6276
call fcn.0043c060
test ebx, ebx
je 0x4c628f
lea edx, [ebx + 4]
mov eax, dword [esp]
mov ecx, 6
call fcn.00402c78
mov eax, dword [esp]
mov dword [ebx], eax
mov eax, dword [esp]
mov byte [eax], 0xe9
mov eax, edi
sub eax, dword [esp + 0xc]
sub eax, 5
mov edx, eax
and dl, 0xff
mov ecx, dword [esp]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov ecx, dword [esp]
mov byte [ecx + 2], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov ecx, dword [esp]
mov byte [ecx + 3], dl
shr eax, 0x18
and al, 0xff
mov edx, dword [esp]
mov byte [edx + 4], al
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
push 6
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c62ef
call fcn.0043c060
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4c62f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4c6354
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c6323
call fcn.0043c060
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402c78
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4c6354
call fcn.0043c060
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4ca728
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ca892
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x569090]
cmp byte [eax], 0
jne 0x4ca783
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404c28
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.0043856c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405288
jmp 0x4ca86a
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405304
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ca7b5
mov eax, esi
call fcn.004050b0
jmp 0x4ca86a
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4ca7ec
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x569204]
call fcn.00406e84
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x437cb0]
call fcn.00410610
call fcn.004042f0
cmp dword [ebp - 8], 1
jne 0x4ca7f9
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405678
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00405304
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405304
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ca85a
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x569618]
call fcn.00406e84
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x437cb0]
call fcn.00410610
call fcn.004042f0
mov eax, dword [esi]
call fcn.00405304
mov edx, eax
mov eax, esi
call fcn.00405218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca899
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404998
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404998
ret
Function at 0x4ca8a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4ca9c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
dec eax
sub eax, 2
jb 0x4ca8ea
mov ecx, 0x7d
mov edx, 0x4ca9e0
mov eax, 0x4caa1c
call fcn.004048d0
mov eax, dword [0x569090]
cmp byte [eax], 0
jne 0x4ca948
cmp esi, 1
jne 0x4ca922
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404c28
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404c28
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.00438514
jmp 0x4ca9a5
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404c28
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404c28
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00438540
jmp 0x4ca9a5
mov eax, edi
call fcn.00405314
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00405304
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00405304
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4ca9a5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x56931c]
call fcn.00406e84
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x437cb0]
call fcn.00410610
call fcn.004042f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca9cf
lea eax, [ebp - 0x20]
call fcn.00404974
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404998
ret

Function at 0x4d06bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4d07e0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, dl
cmp eax, 5
jg 0x4d0702
je 0x4d0735
cmp eax, 4
ja case.default.0x4d06e7
jmp dword [eax*4 + 0x4d06ee]
cmp eax, 8
jg 0x4d0713
je 0x4d0741
sub eax, 6
je 0x4d0739
dec eax
je 0x4d073d
jmp case.default.0x4d06e7
sub eax, 9
je 0x4d0745
sub eax, 0xf6
je 0x4d0749
jmp case.default.0x4d06e7
mov bl, 2
jmp 0x4d074f
mov bl, 2
jmp 0x4d074f
mov bl, 1
jmp 0x4d074f
mov bl, 3
jmp 0x4d074f
mov bl, 3
jmp 0x4d074f
mov bl, 4
jmp 0x4d074f
xor ebx, ebx
jmp 0x4d074f
mov bl, 1
jmp 0x4d074f
mov bl, 6
jmp 0x4d074f
mov bl, 1
jmp 0x4d074f
mov bl, 1
jmp 0x4d074f
xor ebx, ebx
lea eax, [ebp - 0xc]
mov dl, byte [ebp - 1]
add dl, 0x41
dec edx
call fcn.00404b5c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x4d07f8
call fcn.00404cac
cmp byte [ebp - 1], 0
jbe case.0x4d078c.1
cmp bl, 4
jne case.0x4d078c.1
mov eax, dword [ebp - 8]
call fcn.00404e60
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4d078c.1
jmp dword [eax*4 + 0x4d0793]
xor ebx, ebx
jmp case.0x4d078c.1
mov bl, 7
jmp case.0x4d078c.1
mov bl, 4
jmp case.0x4d078c.1
xor ebx, ebx
jmp case.0x4d078c.1
mov bl, 6
jmp case.0x4d078c.1
mov bl, 5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d07e7
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404998
ret
Function at 0x4d1930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor edx, edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d1ace
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x56f58c
call fcn.00404974
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.00402da4
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
call fcn.00405288
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.004419a8
lea eax, [ebp - 0x110]
mov edx, 0x4d1ae0
call fcn.00405320
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404c28
mov eax, dword [ebx]
call fcn.0040b458
test al, al
jne 0x4d1a33
lea eax, [ebp - 0x11c]
mov edx, dword [ebx]
call fcn.00405288
mov eax, dword [ebp - 0x11c]
call fcn.00441b1c
test al, al
jne 0x4d1a33
lea eax, [ebp - 0x109]
push eax
push 0
push 0x4d1af8
lea eax, [ebp - 0x120]
call fcn.004422f8
mov eax, dword [ebp - 0x120]
call fcn.00404e60
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, 0x56f58c
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404bf4
mov eax, ebx
mov edx, dword [0x56f58c]
call fcn.004049c8
mov eax, dword [ebx]
call fcn.0040b458
test al, al
jne 0x4d1a8f
push 0x4d1b04
push 0xa
mov ecx, dword [0x56a668]
mov dl, 1
mov eax, dword [0x41bc88]
call fcn.00421084
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d1a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00420d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1a8f
mov eax, dword [ebp - 4]
call fcn.00403b24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1ad5
lea eax, [ebp - 0x120]
call fcn.00404974
lea eax, [ebp - 0x11c]
call fcn.004050b0
lea eax, [ebp - 0x118]
call fcn.00404974
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.004050c8
ret
Function at 0x4dc880
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4dc9ce
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
test edi, edi
je 0x4dc9b3
call fcn.0041258c
call fcn.00412570
mov esi, eax
dec esi
test esi, esi
jl 0x4dc9b3
inc esi
xor ebx, ebx
push 7
lea eax, [ebp - 0xb]
push eax
push 0x1004
call fcn.0041258c
mov edx, ebx
call fcn.00412580
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404bf4
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.0040b084
cmp edi, eax
jne 0x4dc918
call fcn.0041258c
mov edx, ebx
call fcn.00412580
mov dword [ebp - 4], eax
jmp 0x4dc9ab
push 7
lea eax, [ebp - 0xb]
push eax
push 0xb
call fcn.0041258c
mov edx, ebx
call fcn.00412580
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404bf4
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0040b084
cmp edi, eax
jne 0x4dc961
call fcn.0041258c
mov edx, ebx
call fcn.00412580
mov dword [ebp - 4], eax
jmp 0x4dc9ab
push 7
lea eax, [ebp - 0xb]
push eax
push 0x1011
call fcn.0041258c
mov edx, ebx
call fcn.00412580
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x18]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404bf4
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040b084
cmp edi, eax
jne 0x4dc9ab
call fcn.0041258c
mov edx, ebx
call fcn.00412580
mov dword [ebp - 4], eax
inc ebx
dec esi
jne 0x4dc8c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc9d5
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404998
ret
Function at 0x4dd704
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x4dd72b
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4dd8b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4dd8ad
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4dd77a
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x4dd770
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x4dd892
mov edx, dword [ebp - 4]
test al, 8
je 0x4dd7f6
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4dd7db
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00470fd0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4dd818
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00470fd0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00470fd0
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x4dd870
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x4dd640
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x4dd892
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x4dd640
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd8b4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ddca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x4ddd57
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4ddd68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ddd41
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4ddd80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x4ddd41
test esi, esi
jne 0x4ddd18
cmp dword [ebp - 8], 1
je 0x4ddd1c
xor ebx, ebx
jmp 0x4ddd41
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.00404bf4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.0040310c
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x4ddd41
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd5e
lea eax, [ebp - 0x34]
call fcn.00404974
ret

Function at 0x4de960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4dea1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5691ac]
cmp dword [eax], 5
jl 0x4de991
mov eax, dword [0x569600]
cmp dword [eax], 2
je 0x4de995
mov bl, 1
jmp 0x4dea09
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4dea38
push esi
push 0x4dea64
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404d20
mov eax, dword [ebp - 0x14]
call fcn.00404e60
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4dea09
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4de9f7
cmp word [ebp - 0xc], 0
jne 0x4de9fe
cmp eax, 0xea
jne 0x4dea00
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dea26
lea eax, [ebp - 0x14]
call fcn.00404974
ret
Function at 0x4deaf0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4deb78
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4deb60
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00404bf4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00405dfc
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x4deb5c
push ebx
call sub.kernel32.dll_IsValidCodePage
test eax, eax
jne 0x4deb62
xor ebx, ebx
jmp 0x4deb62
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4deb7f
lea eax, [ebp - 0x18]
call fcn.00404974
ret

Function at 0x4df310
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x4df350
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jle 0x4df350
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00404bf4
jmp 0x4df35c
mov eax, esi
mov edx, 0x4df370
call fcn.004049c8
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4f5384
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00479694
test al, al
je 0x4f54d9
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00479390
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x4f53f0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_EqualRect
test eax, eax
je 0x4f53f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f2608
jmp 0x4f54d9
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f54c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x14]
push edi
mov esi, dword [ebp - 0x18]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f54ce
cmp dword [ebp - 0xc], 0
je 0x4f54aa
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x4f54b9
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50ffd4
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ecx
mov eax, dword [0x569600]
cmp dword [eax], 2
jne 0x51001d
xor edx, edx
mov eax, 5
call fcn.00410e54
test al, al
je 0x51001d
push esp
push 4
push 0
push 0x50ffc0
push 0x10
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x51001d
push 0xfffffffffffffffe
push ebx
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_ResumeThread
push ebx
call sub.kernel32.dll_CloseHandle
pop edx
pop ebx
ret