joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406240
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x40629c
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.KERNEL32.DLL_ReadFile
dec eax
pop eax
pop ecx
jne 0x40628e
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x406283
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x40627e
mov eax, 0x64
jmp 0x406293
call sub.KERNEL32.DLL_GetLastError
call fcn.004028b8
xor eax, eax
jmp 0x40627e
mov eax, 0x67
jmp 0x406293

Function at 0x4062a4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x4062ff
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.KERNEL32.DLL_WriteFile
dec eax
pop eax
pop ecx
jne 0x4062f1
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4062e6
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x4062e1
mov eax, 0x65
jmp 0x4062f6
call sub.KERNEL32.DLL_GetLastError
call fcn.004028b8
xor eax, eax
jmp 0x4062e1
mov eax, 0x67
jmp 0x4062f6

Function at 0x406344
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x406387
push 0
push dword [ebx]
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
je 0x40637e
push eax
push 1
push 0
push 0
push dword [ebx]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
je 0x40637e
pop edx
cmp eax, edx
setae al
pop ebx
ret
call fcn.004028c8
mov al, 1
jmp 0x40637c
mov eax, 0x67
call fcn.004028b8
mov al, 0xff
jmp 0x40637c

Function at 0x4063cc
Capabilities:
Delete file

Disassembly:
mov edx, dword [eax + 4]
sub edx, 0xd7b0
cmp edx, 3
ja 0x4063f3
lea eax, [eax + 0x48]
push eax
call sub.KERNEL32.DLL_DeleteFileA
dec eax
jne 0x4063e7
ret
call sub.KERNEL32.DLL_GetLastError
call fcn.004028b8
jmp 0x4063e6
mov eax, 0x66
jmp 0x4063ec

Function at 0x406440
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x406470
push 0
push dword [ebx]
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
je 0x406466
xor edx, edx
div dword [ebx + 8]
pop ebx
ret
call fcn.004028c8
or eax, 0xffffffff
jmp 0x406464
mov eax, 0x67
call fcn.004028b8
or eax, 0xffffffff
jmp 0x406464

Function at 0x406480
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
mov ecx, dword [ebx + 4]
sub ecx, 0xd7b1
je 0x406493
sub ecx, 2
jne 0x4064bc
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.KERNEL32.DLL_ReadFile
pop edx
dec eax
jne 0x4064b0
cmp edx, dword [ebx + 8]
jne 0x4064c3
pop ebx
ret
call sub.KERNEL32.DLL_GetLastError
call fcn.004028b8
jmp 0x4064ae
mov eax, 0x67
jmp 0x4064b5
mov eax, 0x64
jmp 0x4064b5
Function at 0x406888
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x4068c3
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.KERNEL32.DLL_WriteFile
pop edx
dec eax
jne 0x4068b7
cmp edx, dword [ebx + 8]
jne 0x4068ca
mov eax, ebx
pop ebx
ret
call sub.KERNEL32.DLL_GetLastError
call fcn.004028b8
jmp 0x4068b3
mov eax, 5
jmp 0x4068bc
mov eax, 0x65
jmp 0x4068bc

Function at 0x4070f8
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0xc
fstp xword [esp]
pop ebx
pop edx
pop ecx
shr ebx, 0x18
adc bl, 0
adc edx, 0
adc cx, 0
jo 0x40713a
add edx, edx
add cx, cx
rcr edx, 1
shr cx, 1
sub cx, 0x3f7e
jle 0x407130
test ch, ch
jg 0x40713a
mov byte [eax], cl
mov byte [eax + 1], bl
mov dword [eax + 2], edx
pop ebx
ret
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
pop ebx
ret
pop ebx
mov al, 8
jmp fcn.00402854

Function at 0x409870
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004042b4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
pop ebx
ret

Function at 0x409884
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.004042b4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x4098a6
call sub.KERNEL32.DLL_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c570
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40c5a9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f58
jmp 0x40c5b2
mov eax, ebx
mov edx, esi
call fcn.00403f0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5bc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x40c5dd
mov al, byte [esp]
jmp 0x40c5df
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x417ce8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
dec eax
jne 0x417cfb
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x419864
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41986a
ret
Function at 0x41c2b4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41c305
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41c2ec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41c2dc
jmp 0x41c305
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41c2ed
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425268
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [0x7ea6b4], 0
jne 0x4253e5
call sub.KERNEL32.DLL_GetVersion
mov dword [ebp - 8], eax
cmp byte [ebp - 8], 4
jae 0x4252bd
mov ax, word [ebp - 8]
call fcn.0040819c
cmp al, 0x59
jae 0x4252bd
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov word [ebp - 2], ax
push 0x4253ec
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x7ea6b4], eax
movzx eax, word [ebp - 2]
push eax
call sub.KERNEL32.DLL_SetErrorMode
cmp dword [0x7ea6b4], 0
jl 0x4252d9
cmp dword [0x7ea6b4], 0x20
jge 0x4252d9
mov dword [0x7ea6b4], 1
cmp dword [0x7ea6b4], 0x20
jl 0x4253e5
push 0x4253f8
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x843820], eax
mov eax, dword [0x841528]
mov eax, dword [eax]
push eax
call dword [0x843820]
test eax, eax
je 0x4253d0
push 0x425408
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [fcn.00843824], eax
push 0x425418
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x843828], eax
push 0x42542c
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x84382c], eax
push 0x425440
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x7ea690], eax
push 0x425454
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x7ea694], eax
push 0x425464
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x843830], eax
push 0x425478
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x843834], eax
push 0x42548c
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x843838], eax
push 0x4254a0
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x7ea68c], eax
jmp 0x4253e5
mov eax, dword [0x7ea6b4]
push eax
call sub.KERNEL32.DLL_FreeLibrary
mov dword [0x7ea6b4], 1
pop ecx
pop ecx
pop ebp
ret
Function at 0x4255e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x843840], 0
jne 0x4256a2
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc_1
mov dword [ebp - 8], eax
inc dword [0x7ea688]
mov eax, dword [0x7ea688]
mov edx, dword [ebp - 8]
mov dword [eax*4 + 0x84367c], edx
mov eax, dword [0x84383c]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x7ea6b8
mov ecx, 2
call fcn.00402a38
mov edx, 0x42559c
mov eax, dword [ebp - 8]
add eax, 5
call fcn.004255bc
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.004255bc
mov edx, dword [ebp - 0xc]
mov dword [edx + 1], eax
mov eax, dword [0x843840]
mov edx, dword [ebp - 0xc]
mov dword [edx + 5], eax
mov eax, dword [ebp - 0xc]
mov dword [0x843840], eax
add dword [ebp - 0xc], 0xd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x42565c
mov eax, dword [ebp - 8]
mov dword [0x84383c], eax
mov eax, dword [0x843840]
mov dword [ebp - 4], eax
mov eax, dword [0x843840]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 5]
mov dword [0x843840], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x425808
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x425860]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x425822
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x42582c
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x425836
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x425840
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x42584a
or byte [ebp - 3], 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x42585a
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x425864
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x4258a8]
mov byte [ebp - 5], al
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x425885
or byte [ebp - 5], 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x425895
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x42589f
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x42b6ec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42b8ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x410758]
call fcn.004032b4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403e74
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x118]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x42b87e
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x118]
call fcn.0043c7f8
test al, al
je 0x42b872
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x118]
mov dword [ebp - 0x260], eax
mov byte [ebp - 0x25c], 0
lea ecx, [ebp - 0x260]
mov edx, 0x42b8bc
lea eax, [ebp - 0x258]
call fcn.0040a654
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x42b872
xor eax, eax
push ebp
push 0x42b86b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x42b8f4
mov eax, dword [ebp - 0x14]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x42b854
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.004040a0
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x118]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x118]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x42b854
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.004040a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b872
mov eax, dword [ebp - 0x14]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x42b761
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dl, 1
call fcn.00413de4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b8b5
lea eax, [ebp - 0x264]
call fcn.00403e74
ret
Function at 0x42bc74
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x843810]
cmp byte [eax + 0x85], 0
jne 0x42bceb
cmp dword [0x84384c], 0
jne 0x42bca9
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x42bc30
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x84384c], eax
cmp dword [0x843848], 0
jne 0x42bcc4
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x843848], eax
cmp dword [0x843850], 0
jne 0x42bceb
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x42bbd0
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x843850], eax
pop ecx
pop ebp
ret

Function at 0x42bdac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0042bd44
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42bdcd
xor eax, eax
call fcn.0042bd7c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_ShowWindow
cmp byte [ebp - 9], 0
je 0x42bde7
mov al, 1
call fcn.0042bd7c
mov esp, ebp
pop ebp
ret

Function at 0x42c3f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x843810]
cmp dword [eax + 0x24], 0
je 0x42c4a8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
jne 0x42c4a2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x42c370
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
cmp dword [eax + 8], 0
je 0x42c4a2
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x42c465
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x42c4a2
mov dword [ebp - 0xc], eax
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.00411878
push eax
call sub.USER32.DLL_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x42c477
mov eax, dword [ebp - 4]
inc dword [eax + 0x74]
mov esp, ebp
pop ebp
ret

Function at 0x42ceb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x84], 0
je 0x42cef5
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00403f58
jmp 0x42cf03
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x6c]
call fcn.00403f0c
mov esp, ebp
pop ebp
ret
Function at 0x42ddb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x64], 0
je 0x42ddf7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
call fcn.004395fc
test al, al
je 0x42ddf7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
call fcn.00439350
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x42ddf7
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
call fcn.00439350
push eax
call sub.USER32.DLL_ShowWindow
pop ecx
pop ebp
ret

Function at 0x42eafc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.00403e74
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42eb67
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.USER32.DLL_GetKeyNameTextA
cmp byte [ebp - 0x10b], 0
jne 0x42eb67
cmp byte [ebp - 0x10c], 0
je 0x42eb67
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004040a0
mov esp, ebp
pop ebp
ret

Function at 0x430458
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x28], 0
je 0x4304e5
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 4]
mov word [ebp - 6], ax
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x43048e
add word [ebp - 6], 0x2000
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4304a0
add word [ebp - 6], 0x4000
mov eax, dword [ebp - 0x10]
test byte [eax + 0xb], 0x20
je 0x4304af
add word [ebp - 6], 0x8000
mov byte [ebp - 0x12], 0
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.0043026c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4304d7
push ebp
mov eax, dword [ebp - 4]
call fcn.004303b8
pop ecx
mov byte [ebp - 0x12], al
cmp byte [ebp - 0x12], 2
je 0x4304af
cmp dword [ebp - 4], 0
setne byte [ebp - 0x11]
mov al, byte [ebp - 0x11]
mov esp, ebp
pop ebp
ret
Function at 0x43735c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x114], 0
je 0x43737d
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x4373a9
mov eax, dword [ebp - 4]
call fcn.004361b8
test eax, eax
jne 0x437399
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4374d3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00436f18
jmp 0x4374d3
push 0
call sub.USER32.DLL_GetDC
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4374cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00439350
push eax
call sub.USER32.DLL_BeginPaint
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00434b1c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043735c
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 4], edx
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x70]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00439350
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4374d3
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 0x14]
push eax
call sub.GDI32.DLL_DeleteObject
ret
mov esp, ebp
pop ebp
ret
Function at 0x43c2cc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x842340]
cmp byte [eax + 8], 0
je 0x43c457
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43c450
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8438a8], 0
jne 0x43c325
push 0x43c45c
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 4], eax
push 0x43c464
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438a8], eax
cmp dword [0x7ea924], 0
jne 0x43c439
push 0x43c474
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x7ea924], eax
cmp dword [0x7ea924], 0
jl 0x43c35a
cmp dword [0x7ea924], 0x20
jge 0x43c35a
xor eax, eax
mov dword [0x7ea924], eax
cmp dword [0x7ea924], 0
je 0x43c439
push 0x43c480
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438ac], eax
push 0x43c490
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438b0], eax
push 0x43c4a4
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438b4], eax
push 0x43c4bc
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438b8], eax
push 0x43c4d4
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438bc], eax
push 0x43c4e8
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438c0], eax
push 0x43c500
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438c4], eax
push 0x43c518
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438c8], eax
push 0x43c534
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438cc], eax
push 0x43c540
mov eax, dword [0x7ea924]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x8438d0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c457
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x44b7e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.004042b4
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004042b4
push eax
mov eax, edi
call fcn.004042b4
push eax
mov eax, esi
call fcn.004042b4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x400]
mov eax, dword [ebp + 8]
call fcn.00403f58
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8