joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e647
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a402c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0045563b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0045563b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x45e6be
cmp word [ecx], dx
je 0x45e6be
mov eax, dword [0x48f05c]
push edi
dec eax
push eax
push 0x48ef48
call fcn.0045e5e6
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x45e731
cmp word [eax], dx
je 0x45e731
mov eax, dword [edi]
test eax, eax
je 0x45e6e2
cmp word [eax], dx
je 0x45e6e2
lea eax, [ebp - 0x10]
push eax
call fcn.0045dfc9
jmp 0x45e6eb
lea eax, [ebp - 0x10]
push eax
call fcn.0045e064
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x45e75b
mov eax, dword [0x48ef44]
push dword [ebp - 0x14]
dec eax
push eax
push 0x48ec38
call fcn.0045e5e6
add esp, 0xc
test al, al
je 0x45e75b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x45e726
cmp word [eax], di
je 0x45e726
lea eax, [ebp - 0x10]
push eax
call fcn.0045dfc9
pop ecx
jmp 0x45e75d
lea eax, [ebp - 0x10]
push eax
call fcn.0045e064
jmp 0x45e723
mov eax, dword [edi]
test eax, eax
je 0x45e748
cmp word [eax], dx
je 0x45e748
lea eax, [ebp - 0x10]
push eax
call fcn.0045df7e
pop ecx
jmp 0x45e75b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x45e826
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0045e46b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45e826
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x45e826
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x45e826
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45e7b3
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00456d0f
test ebx, ebx
je 0x45e821
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00456d0f
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45e826
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45e826
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00462d11
add esp, 0x10
xor eax, eax
inc eax
jmp 0x45e828
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441873
leave
ret
Function at 0x462f45
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00462ec1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4630b4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4630b4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x463069
jg 0x462fa1
test eax, eax
je 0x46305f
push 1
push 0x1000
call fcn.00456698
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x462fc4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x463056
push 0x8000
push ebx
call fcn.00451e09
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x462fed
jg 0x462fe8
cmp ecx, 0x1000
jb 0x462fed
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004589b6
add esp, 0x10
cmp eax, 0xffffffff
je 0x463032
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x462fe8
jl 0x463019
test ecx, ecx
jne 0x462fda
push dword [ebp - 0xc]
push ebx
call fcn.00451e09
push esi
call fcn.00454ef2
add esp, 0xc
xor ebx, ebx
jmp 0x4630c2
cmp byte [edi + 0x24], 0
je 0x463049
cmp dword [edi + 0x20], 5
jne 0x463049
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x463054
mov ebx, dword [edi + 0x18]
jmp 0x463056
xor ebx, ebx
push esi
call fcn.00454ef2
pop ecx
jmp 0x4630c2
test ecx, ecx
jg 0x46302b
jl 0x463069
test eax, eax
jae 0x46302b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045a535
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x463089
cmp byte [edi + 0x1c], 0
je 0x46302b
jmp 0x4630ba
push ebx
call fcn.0045c441
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46302b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4630c2
cmp byte [edi + 0x1c], 0
je 0x4630bf
mov ebx, dword [edi + 0x18]
jmp 0x4630c2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045a535
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46492d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46492d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402ab8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b50
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b30
xor eax, eax
push ebp
push 0x402b29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404bb0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404d68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c11
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404d84
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404c7e
xor eax, eax
push ebp
push 0x404c77
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c60
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404da4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c7e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404d5f
cmp byte [ebp - 0xd], 0
jne 0x404cc0
cmp byte [ebp - 0x12], 0
je 0x404d5f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404cd9
dec ebx
cmp byte [ebx], 0x2e
je 0x404ce8
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404cd8
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404d5f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d15
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404d5f
cmp byte [ebp - 0xd], 0
je 0x404d5f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404d5f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4052bc
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x405317
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.kernel32.dll_WriteFile
dec eax
pop eax
pop ecx
jne 0x405309
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4052fe
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x4052f9
mov eax, 0x65
jmp 0x40530e
call sub.kernel32.dll_GetLastError
call fcn.00402798
xor eax, eax
jmp 0x4052f9
mov eax, 0x67
jmp 0x40530e
Function at 0x407c64
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403948
add esp, 0x104
pop ebx
ret

Function at 0x408510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408549
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403948
jmp 0x408552
mov eax, ebx
mov edx, esi
call fcn.004038fc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40855c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40857d
mov al, byte [esp]
jmp 0x40857f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x411cf0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x411d05
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x413c48
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x413c4e
ret

Function at 0x416134
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x416185
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41616c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41615c
jmp 0x416185
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41616d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42099c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x449764], 0
sete dl
or al, dl
jne 0x420ae0
mov eax, dword [0x449768]
mov bx, 0xffff
call fcn.00402e1c
mov eax, dword [0x449764]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x420aaf
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x449764]
call fcn.0040d054
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x420aa7
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x420aa7
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x420aa7
mov eax, dword [ebp - 0x10]
call fcn.00428820
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x420aa7
push ebp
call fcn.00420958
pop ecx
test al, al
jne 0x420aa7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x420a63
mov eax, dword [ebp - 0x10]
call fcn.00427164
dec eax
jle 0x420aa7
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402e1c
cmp byte [ebp - 0x15], 0
je 0x420aa7
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x420aa7
mov edx, dword [ebp - 0x10]
mov eax, dword [0x449768]
call fcn.00420208
inc edi
dec esi
jne 0x4209f6
mov eax, dword [0x449768]
cmp dword [eax + 8], 0
jle 0x420ac7
mov eax, dword [0x449768]
call fcn.00420298
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x420ae0
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00420810
pop ecx
test al, al
jne 0x420ae0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4262f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x426321
je 0x42637b
sub eax, 7
je 0x426342
dec eax
je 0x42636c
sub eax, 0x17
je 0x4263fc
jmp 0x42643a
add eax, 0xffffff00
sub eax, 9
jb 0x4263e8
add eax, 0xffffff09
sub eax, 0xb
jb 0x4263d2
jmp 0x42643a
mov eax, ebx
call fcn.004369c4
mov edi, eax
test edi, edi
je 0x42649a
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x4264a3
jmp 0x42649a
test byte [ebx + 0x44], 0x20
jne 0x4264a3
jmp 0x42649a
mov edx, esi
mov eax, ebx
call fcn.00423bdc
cmp dword [esi + 0xc], 0xffffffff
jne 0x4264a3
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.004067b8
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00422694
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004261a0
test eax, eax
je 0x4264a3
mov dword [esi + 0xc], 1
jmp 0x4264a3
mov edx, esi
mov eax, ebx
call fcn.00426264
test al, al
jne 0x4264a3
jmp 0x42649a
mov eax, ebx
call fcn.00423254
test al, al
jne 0x4264a3
jmp 0x42649a
mov eax, ebx
call fcn.00428820
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x42649a
cmp dword [0x4486b8], 0
je 0x42649a
mov eax, dword [0x4486b8]
cmp ebx, dword [eax + 0x24]
jne 0x42649a
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4486b8]
call fcn.00423af8
jmp 0x42649a
mov eax, dword [0x44972c]
cmp byte [eax + 0x20], 0
je 0x42649a
mov eax, dword [0x44972c]
cmp dword [eax + 0x1c], 0
je 0x42649a
mov eax, dword [esi]
mov edx, dword [0x44972c]
cmp eax, dword [edx + 0x1c]
jne 0x42649a
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004368d8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.00402e1c
jmp 0x4264a3
mov edx, esi
mov eax, ebx
call fcn.00423bdc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426934
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x426950
cmp dword [esi + 4], 0
je 0x42697d
test byte [ebx + 0x45], 1
jne 0x42696f
mov eax, ebx
call fcn.004259a4
test eax, eax
jne 0x42696f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x426a8d
mov edx, esi
mov eax, ebx
call fcn.004265ac
jmp 0x426a8d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x426a86
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428820
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00423af8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00426934
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428820
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426a8d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4303ac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403864
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43040d
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x43040d
cmp byte [ebp - 0x102], 0
je 0x43040d
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403a90
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4366a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4497e0
cmp dword [edi], 0
jne 0x436724
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4497dc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x448844
mov ecx, 2
call fcn.004027cc
mov edx, 0x436680
lea eax, [esi + 5]
call fcn.004366a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004366a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4366f9
mov dword [0x4497dc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x436848
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x436898]
test si, 4
je 0x43685c
or bl, 1
test si, 8
je 0x436866
or bl, 4
test si, 1
je 0x436870
or bl, 8
test si, 2
je 0x43687a
or bl, 0x10
test si, 0x10
je 0x436884
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x436893
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43689c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4368d4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4368b5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4368c4
or bl, 4
test esi, 0x20000000
je 0x4368cf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43cf78
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43d11d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40bcd4]
call fcn.00402c10
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403864
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43d0f3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042cec4
test al, al
je 0x43d0e6
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43d12c
lea eax, [ebp - 0x254]
call fcn.00408380
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43d0e6
xor eax, eax
push ebp
push 0x43d0df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43d164
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43d0c8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403a90
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43d0c8
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d0e6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43cfe9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040ebd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d124
lea eax, [ebp - 0x260]
call fcn.00403864
ret

Function at 0x43d8c0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4497b0]
cmp byte [eax + 0x8d], 0
jne 0x43d931
cmp dword [0x4497ec], 0
jne 0x43d8f2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x43d87c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4497ec], eax
cmp dword [0x4497e8], 0
jne 0x43d90d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4497e8], eax
cmp dword [0x4497f0], 0
jne 0x43d931
push esp
push 0
push 0
push 0x43d820
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4497f0], eax
pop edx
ret