joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eee63
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xbd599d15
inc esp
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
imul esp, dword [ebp + 0x10], 0xf2a30f40
salc
bound eax, qword [eax - 0x6fdfd39a]
nop
arpl word [eax + 0xa], dx
cmpsb byte [esi], byte es:[edi]
pop esi
jbe 0x4eee78
lodsd eax, dword [esi]
test byte [ebp + 0x16], ah
pop ebp
add al, 0x31
mov esp, 0xf14450b4
mov esi, 0x70b1239
pushal
jns 0x4eeeec
popfd
invalid
and byte [ebp - 0x30], dh
inc esi
rcl byte [edx + 3]
pop ebp
mov al, 0x5d
insb byte es:[edi], dx
xor al, dl
dec esp
cmpsb byte [esi], byte es:[edi]
xchg ebx, eax
pop eax
cmp dword [edx], edx
xchg esi, eax
xor byte [edx + ebp - 0x21], 0xe9
jbe 0x4eeec4
jmp 0xfd33db50
in al, 0xfc
mov cl, 0xa1
add edx, dword [eax]
pop esp
push 0xd36ac077
dec ebx
sbb al, byte [edx + 1]
and ch, byte [ecx + 0x7c]
dec edi
int1
mov byte [0xb60db10d], al
pop ds
sub bl, byte [edi + 0x7b]
push ebx
jge 0x4eeed5
or al, 0x60
lahf
outsb dx, byte [esi]
mov ebx, 0xd1ccb1f3
adc dword [0x3565ac63], ecx
xor ebx, dword [ecx]
insb byte es:[edi], dx
out dx, al
jge 0x4eeebc
or dword [ecx + ebx*4], 0x35
mov al, 0x2c
mov dl, 0x5c
invalid

Function at 0x537d83
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx + 0x362f51cd], ebx
inc esp
inc esi
and dword [eax - 0x69ff0eef], ebx
fistp word [edi + 0x78]
lcall 0xeca2, 0x29a124b2
mov ch, 0x5b
lcall 0xfd90, 0x935209d
nop
and dword [esi - 0x661b92af], ecx
insb byte es:[edi], dx
dec ecx
invalid
add bl, byte [ecx]
jno 0x537d6a
jp 0x537dc1
fadd qword [edi]
pop edx
mov eax, 0x91064fcc
push es
dec edx
or eax, 0xca104d71
cmc
std
dec esp
insb byte es:[edi], dx
sbb eax, 0xb33787fe
mul ebp
je 0x537d51
int3
bound edx, qword [esi]
sal byte [esp + ebp], 0xa9
jae 0x537d1a
mov al, byte [0xb63d93f9]
mov ecx, dword [ecx + 0x242d600f]
sub esi, esi
stc
invalid
dec esp
shr byte [ecx + 0x70], 1
lodsb al, byte [esi]
loop 0x537d46
push esi
and dword [ecx + edx*2], edi
jg 0x537dd0
dec ecx
push ecx
jmp 0xe7e9b2c
push ecx
or al, 0xf4
pushfd
cmp eax, 0x6daa3b85
test dword [ebx], edi
stosb byte es:[edi], al
insd dword es:[edi], dx
push 0xd51527b8
pushal
xor byte [ebp + 0x6906ad3d], al
fidiv word cs:[ecx + 0x48b18081]
add eax, 0xcf3c85ca
jecxz 0x537d9e
je 0x537e36
popal
push cs
push esp
adc esi, dword [esi + 0x1c1787f8]
push ebx
loopne 0x537df4
test byte [eax + 0x3a239cfa], 0x9c
mov bl, 0x92
or byte [ebx + ecx*4 - 0x27], bl
jmp 0x537da3
fldpi
invalid
push 0xfffffffffffffff7
lea edi, [eax + eax*8 + 0x11444e7d]
dec esp
jno 0x537ddc
test dword [ebp + 0x4e7dc0bc], 0x714c1144
fsubr qword [ebp - 0x4e]
test al, 8
out dx, eax
insd dword es:[edi], dx
mov dl, 0xa8
or bh, ch
xor eax, dword [ecx]
enter 0xc09, 0x7c
sbb eax, 0x14b373ee
test eax, 0x83841640
test dword [edi + edi - 0x31353c0f], esi
mov edx, 0x2bbe204f
loopne 0x537df5
mov eax, 0x6fb1dfbb
mov ebp, 0xf9b262d8
and dl, byte [ecx + 0x3f]
xor byte [eax + 0x3b], ah
xchg ebp, eax
in al, 0xed
ret 0x1cfd
Function at 0x5be9b3
Capabilities:
Encode data using xor

Disassembly:
in al, 0xba
add edi, dword [edx - 1]
sti
dec ebp
or eax, 0x14ad0dce
sub ebx, esp
ljmp 0x2683
das
ja 0x5bea2e
and al, 0x59
pop ecx
scasd eax, dword es:[edi]
jp 0x5be9de
imul esi, ebp, 0xffffffc9
leave
loop 0x5be9df
push es
push cs
cmp ah, byte [esi + ecx - 0x68e562a4]
or al, 9
loop 0x5be991
movsb byte es:[edi], byte [esi]
push cs
pop esp
popfd
sbb dl, byte [edi - 0x371df6f4]
popfd
loope 0x5be9fe
js 0x5be98a
add byte [edx + ecx*4 - 0x1aa6dd96], al
stosb byte es:[edi], al
mov ebp, 0xd87ec67a
jne 0x5be9bf
neg ebx
feni8087_nop
std
loopne 0x5be9de
sar dword [edx], 0xea
les edi, [ebx - 0x80]
ljmp 0x1aae
mov al, 0x29
pop esp
sub ecx, 0x85e62421
dec edx
xchg esp, eax
push 0xca08f8ba
bound ebx, qword [esi + eax + 0x49acc894]
push ss
jb 0x5be9af
adc edx, dword [0xfafb122e]
pop es
pop ss
pop edx
lodsb al, byte [esi]
xchg esp, eax
aad 0xee
cwde
ror dword [esi + ebp*4 + 0x44], 0xd2
popal
jp 0x5bea4f
and byte [ebx - 0x62], ch
jle 0x5be9b9
imul ebx, dword [esi + 0x2148867e], 0x7a
fild word [edi + eax*4]
dec eax
and dword [edx - 0x21], edi
add al, 0x87
adc al, 0xdd
mov dword [eax], ecx
xor dl, byte [esi + 0x5feab0ab]
or byte [edx], dh
xchg esi, eax
stosd dword es:[edi], eax
mov al, 0xea
pop edi
ret 0xa62c
arpl bx, di
mov ebx, 0xf1a88bdc
sti
push ecx
inc eax
sub ah, cl
pop eax
inc eax
adc eax, edi
and dh, byte [eax]
mov ecx, 0xc8fbae0c
xor byte [ecx - 0x370451f4], bh
jge 0x5bea3c
arpl dx, bx
sal eax, cl
in eax, dx
out dx, al
push ecx
cmp dword [edx], 0xfffffff0
push esp
jns 0x5bea60
xchg ebx, eax
test eax, 0x888b8920
call 0x5878e458
lcall 0x2ebe, 0xdd3eea58
cmp ch, byte [edx - 0x67e11975]
add dword [edi - 0x80], ebx
dec esp
mov esi, 0xa986e1dc
or dl, al
and dword [0xbe297dc3], ebx
shl byte [ecx], 1
sbb eax, 0xbe297dc3
outsb dx, byte [esi]
dec esp
mov bh, 0x18
into
mov dh, 0x38
lodsb al, byte [esi]
js 0x5beaf5
scasd eax, dword es:[edi]
mov eax, 0x897ef4e8
sbb byte [esi - 0x72], 0x37
mov byte [edi - 0x24], dh
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
sbb dword [ebp - 0x26e853aa], ebx
sbb byte [ebx - 6], bl
push cs
fidivr word [edi - 0x46]
cmp eax, 0x30f2d9ea
leave
push 0xb2cb58bc
ja 0x5bea98
inc edx
cdq
stosb byte es:[edi], al
sub ch, byte [edx]
add ebx, dword [ecx]
sbb dword [eax], ebx
pop edi
pop esp
mov eax, 0xf88ec818
clc
sti
push cs
or ebp, dword [edx + ebx*4]
cwde
push 0x77883674
xchg edi, eax
pop ecx
sbb ah, byte [ecx + edi*2 - 0x13]
jns 0x5beae4
stosd dword es:[edi], eax
into
push es
sbb dword [edx - 0x40], ecx
pop eax
inc edx
invalid
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ecx, dword [esi - 0x74f7ba75]
or eax, 0xf5efc8
push eax
and dword [0xd2746840], 0x40
add byte [ecx - 1], dl
adc eax, 0xf840c180
out 0xac, al
rcr dword [edi], 0x64
les esi, [esi]
test eax, eax
jp 0x401787
push eax
push 0x5378d254
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xb8
js 0x40179e
add byte [eax], al
add byte [esi], dh
js 0x40179e
inc ecx
add byte [edi - 0x40], dl
mov eax, dword [0x414072]
je 0x4017bb
push edi
shl byte [ecx + 0x414072], 0x74
adc al, 0x68
inc eax
cmp al, 0x41
ja 0x401821
push 0x77413c40
je 0x401796
call 0x445850
sahf
inc eax
add al, 0
mov cx, word [0xd84102c2]
jmp 0x4017cf
mov edx, dword [0x11800]
push edx
cmpsd dword [esi], dword es:[edi]
call fcn.00405850
mov ax, 0xf40d
pop ss
inc ecx
add byte [ebx + 0x1a1808], ah
mov dword [0x1a1808], eax
mov eax, dword [0x4102b2]
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
mov word [0x410bb4], cx
test eax, eax
push edi
jne 0x40184a
mov edx, dword [0x411853]
push edx
push str.Benchmarking__s
call esi
jnp 0x401875
mov edi, 0xc48d0041
or byte [ebp - 0x5eea8b40], al
je 0x40180c
inc ecx
add byte [eax + 0x68], dl
inc eax
sbb al, byte [ecx]
push eax
push 0x411a40
push 0x409184
call esi
mov dh, 0xc4
or al, 0xa1
fcomi st(3)
inc eax
add byte [ebp - 0x2b7f4940], al
inc eax
test eax, eax
mov dh, 0x80
aam 0x40
add byte [ebp + 5], dh
mov eax, 0x40d47c
push eax
push 0xb140d428
call esi
mov ecx, dword [0x40c9c8]
and dword [ecx + 0x20], 0x51
call dword [0x40a754]
add esp, 0x2b
mov edx, dword [0x40d018]
mov esi, dword [0x40ed58]
push 0xb0e660
push edx
invalid
sbb al, dl
mov dword [eax], 0xa310c483
enter 0x410b, 0
push 0
push ecx
jns 0x4018ee
mov dword [0xe8004117], eax
add dword [esi], 0x74c06565
or byte [edi + 0x363a0868], cl
add al, ch
mov byte [0x830000b3], al
sbb cl, byte [eax]
mov eax, dword [0x41027c]
test eax, eax
out dx, al
xor eax, 0x41f1aca1
add byte [ebx + 0x410b9c84], cl
add byte [ebx - 0x49bfb789], cl
add byte [edx], ch
push 0x20d19c
push eax
mov eax, dword [0x41404c]
push ecx
push str.Host:
push edx
push eax
call 0xbd585a
mov eax, dword [0x48a37095]
inc eax
inc ecx
add byte [ebp + 0x4048a1b2], dh
inc ecx
invalid
mov ecx, dword [0x2441404c]
push 0
push cs
pushfd
rcr dword [eax], 1
add byte [eax + 0x44], ch
aam 0x40
inc ebx
push 0x40d424
push eax
push ecx
call fcn.0040b290
cmp al, ah
sub dword [ebx + 0x4341cf48], esp
mov ecx, dword [0x50d90284]
test ecx, ecx
jne 0x40193a
mov edx, dword [0x41f14c]
push 0
xor bl, byte [eax]
aam 0x28
xchg byte [edx + edx*2 + 0x3f5ed3], al
add byte [ebx + 0x48a31040], al
test byte [edx - 0x2d], dl
pop esi
aas
add byte [eax], al
add dword [eax + 0x10], 0xffffffa3
dec eax
inc eax
inc ecx
add byte [ebx + 0x4102600d], cl
add byte [ebx - 0x2d188037], cl
adc eax, 0x410268
mov ecx, dword [0x410260]
mov ecx, ecx
jg 0x40192b
rcl byte [0x410268], cl
invalid

Function at 0x408692
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul edx, dword [ebx + 0x264ab70f], 0x9028728b
Function at 0x402f7c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x459008], 0x8088405
inc edx
mov dword [ebx + 0x459008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403658
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x459024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4036d0
xor eax, eax
push ebp
push 0x4036c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40370c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x459024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x459024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4044e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x555048], 0
je 0x404545
cmp word [0x55521c], 0xd7b2
jne 0x40450d
cmp dword [0x555224], 0
jbe 0x40450d
mov eax, 0x555218
call dword [0x555234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40456c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x459030], 0
jne 0x404561
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40ba60
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b8d8
mov eax, dword [0x5549cc]
cmp byte [eax], 0
je 0x40badc
mov eax, dword [0x5547e0]
call fcn.00403020
call fcn.00402de8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408af8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bb24
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bb12
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x554788]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5577f4]
call fcn.00405860
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c446
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004046fc
lea eax, [ebp - 4]
call fcn.00404b78
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b28
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c430
mov eax, ebx
call fcn.00402c8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c429
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b28
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c413
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c458
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c413
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c430
mov eax, dword [ebp - 0x10]
call fcn.00402ca8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c44d
lea eax, [ebp - 4]
call fcn.00404664
ret
Function at 0x41b154
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x558300
cmp dword [edi], 0
jne 0x41b1d0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x5582fc]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x459ad8
mov ecx, 2
call fcn.00402e7c
mov edx, 0x41b12c
lea eax, [esi + 5]
call fcn.0041b14c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041b14c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41b1a5
mov dword [0x5582fc], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d6fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404b28
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41d754
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x554af0]
mov dl, 1
mov eax, dword [0x41d220]
call fcn.0040bc20
call fcn.004040ac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041d328
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41e5b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e5b6
ret
Function at 0x428e8c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404664
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x428eda
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cf5c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d08f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x41d280]
call fcn.0041d350
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x42d065
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0041d3f0
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004048d4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x42d0a4
call fcn.00404974
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0041d454
lea ecx, [ebp - 4]
mov edx, 0x42d0e0
mov eax, dword [ebp - 0xc]
call fcn.0041d684
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040d628
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x42d048
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x42d0ec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x45a430]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d04f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x42d13c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x42d183
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42d166
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x42d177
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x42d183
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x431c74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x558534], 0
je 0x431dbd
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x55496c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x431dbd
mov eax, dword [0x558538]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x558534]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x431d8c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x558534]
call fcn.00414104
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x431d84
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x431d84
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x431d84
mov eax, dword [ebp - 0x14]
call fcn.0043be98
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x431d84
push ebp
call fcn.00431c30
pop ecx
test al, al
jne 0x431d84
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403a4c
test al, al
je 0x431d84
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403a4c
cmp byte [ebp - 1], 0
je 0x431d84
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x431d84
mov edx, dword [ebp - 0x14]
mov eax, dword [0x558538]
call fcn.004313a0
inc edi
dec ebx
jne 0x431cd9
mov eax, dword [0x558538]
cmp dword [eax + 8], 0
jle 0x431da4
mov eax, dword [0x558538]
call fcn.00431458
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x431dbd
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00431a94
pop ecx
test al, al
jne 0x431dbd
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439094
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406528
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00433ffc
test ebx, ebx
jne 0x4390e7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00438fd0
mov ebx, eax
test ebx, ebx
je 0x4391d2
cmp esi, ebx
je 0x439110
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x439125
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x43915d
add eax, 0xffffff5f
sub eax, 2
jb 0x439175
dec eax
sub eax, 2
jb 0x439189
dec eax
sub eax, 2
jb 0x43917f
jmp 0x439193
add eax, 0xfffffdff
sub eax, 2
jb 0x439175
dec eax
sub eax, 2
jb 0x439189
dec eax
sub eax, 2
jb 0x43917f
jmp 0x439193
mov byte [esp + 0x120], 0
jmp 0x43919b
mov byte [esp + 0x120], 2
jmp 0x43919b
mov byte [esp + 0x120], 1
jmp 0x43919b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004467c8
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0043573c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4391d4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x439e40
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x439e5c
cmp dword [esi + 4], 0
je 0x439e89
test byte [ebx + 0x55], 1
jne 0x439e7b
mov eax, ebx
call fcn.00438294
test eax, eax
jne 0x439e7b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x439f99
mov edx, esi
mov eax, ebx
call fcn.00439848
jmp 0x439f99
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x439f92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043be98
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043573c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00439e40
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043be98
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439f99
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret