joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4230fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x42312d
je 0x423187
sub eax, 7
je 0x42314e
dec eax
je 0x423178
sub eax, 0x17
je 0x42322c
jmp 0x42326a
add eax, 0xffffff00
sub eax, 9
jb 0x423218
add eax, 0xffffff09
sub eax, 0xb
jb 0x4231e0
jmp 0x42326a
mov eax, ebx
call fcn.00434c24
mov edi, eax
test edi, edi
je 0x4232ca
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x4232d3
jmp 0x4232ca
test byte [ebx + 0x44], 0x20
jne 0x4232d3
jmp 0x4232ca
mov edx, esi
mov eax, ebx
call fcn.004207c8
cmp dword [esi + 0xc], 0xffffffff
jne 0x4232d3
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406a64
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0041f314
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00422fd4
test eax, eax
je 0x4232d3
mov dword [esi + 0xc], 1
jmp 0x4232d3
mov edx, esi
mov eax, ebx
call fcn.00423068
test al, al
je 0x4232ca
cmp dword [esi + 0xc], 0
jne 0x4232d3
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00425764
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x4232d3
mov eax, ebx
call fcn.0041fe64
test al, al
jne 0x4232d3
jmp 0x4232ca
mov eax, ebx
call fcn.00425764
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x4232ca
cmp dword [0x442690], 0
je 0x4232ca
mov eax, dword [0x442690]
cmp ebx, dword [eax + 0x24]
jne 0x4232ca
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x442690]
call fcn.004206fc
jmp 0x4232ca
mov eax, dword [0x443740]
cmp byte [eax + 0x20], 0
je 0x4232ca
mov eax, dword [0x443740]
cmp dword [eax + 0x1c], 0
je 0x4232ca
mov eax, dword [esi]
mov edx, dword [0x443740]
cmp eax, dword [edx + 0x1c]
jne 0x4232ca
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00434b68
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00402fc4
jmp 0x4232d3
mov edx, esi
mov eax, ebx
call fcn.004207c8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423794
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4237b0
cmp dword [esi + 4], 0
je 0x4237dd
test byte [ebx + 0x45], 1
jne 0x4237cf
mov eax, ebx
call fcn.00422738
test eax, eax
jne 0x4237cf
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4238ed
mov edx, esi
mov eax, ebx
call fcn.0042340c
jmp 0x4238ed
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4238e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00425764
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004206fc
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00423794
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00425764
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4238ed
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cf44
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403a58
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42cf93
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403c88
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4437d8
cmp dword [edi], 0
jne 0x4349bc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4437d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x442824
mov ecx, 2
call fcn.004027f0
mov edx, 0x434918
lea eax, [esi + 5]
call fcn.00434938
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00434938
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x434991
mov dword [0x4437d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x434ad8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x434b28]
test si, 4
je 0x434aec
or bl, 1
test si, 8
je 0x434af6
or bl, 4
test si, 1
je 0x434b00
or bl, 8
test si, 2
je 0x434b0a
or bl, 0x10
test si, 0x10
je 0x434b14
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x434b23
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x434b2c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x434b64]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x434b45
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x434b54
or bl, 4
test esi, 0x20000000
je 0x434b5f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43ad94
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x43ada6
add esp, 0xfffffff0
call fcn.004030d0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411dfc
mov eax, ebx
call fcn.0043b0e0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x437884
push eax
push 0
push 0
mov eax, dword [0x442b88]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4132c4]
call fcn.004145a0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x4132c4]
call fcn.004145a0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4132c4]
call fcn.004145a0
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0043b4c0
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43b3dc
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43b3dc
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43b3dc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43aeb5
call fcn.00403128
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43b1c0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b36b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x43b34c
mov dl, 1
mov eax, dword [0x40c110]
call fcn.00402db8
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403a58
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43b33b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00429b60
test al, al
je 0x43b32e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43b37c
lea eax, [ebp - 0x254]
call fcn.00408734
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43b32e
xor eax, eax
push ebp
push 0x43b327
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43b3b4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43b310
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403c88
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43b310
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b32e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43b231
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040ed94
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b372
lea eax, [ebp - 0x260]
call fcn.00403a58
ret

Function at 0x43bbb8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4437c8]
cmp byte [eax + 0x95], 0
jne 0x43bc29
cmp dword [0x4437e4], 0
jne 0x43bbea
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x43bb74
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4437e4], eax
cmp dword [0x4437e0], 0
jne 0x43bc05
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x4437e0], eax
cmp dword [0x4437e8], 0
jne 0x43bc29
push esp
push 0
push 0
push 0x43bb18
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4437e8], eax
pop edx
ret
Function at 0x43bd20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43bd37
add esp, 0xfffffff0
call fcn.004030d0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411dfc
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40be10]
call fcn.00402db8
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x4139f8]
call fcn.00419420
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43beac
mov eax, dword [0x442abc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004197f0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43d8d0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x442abc]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409a60
test eax, eax
je 0x43be2a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004080c4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00409a88
test eax, eax
je 0x43be3e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403c88
mov eax, dword [0x4429e0]
cmp byte [eax], 0
jne 0x43be6f
mov eax, ebx
call fcn.0043bf98
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43bea1
call fcn.00403128
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c208
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4437c8]
cmp dword [eax + 0x24], 0
je 0x43c2ab
cmp dword [ebx + 0x84], 0
jne 0x43c2a5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43c198
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43c2a5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43c26e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43c2a5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d4d4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43c27d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x43ccb8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43cced
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b40
jmp 0x43ccf7
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403aac
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43dc44
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x43dc7c
mov eax, esi
call fcn.00425a60
test al, al
je 0x43dc7c
mov eax, dword [ebx + 0x74]
call fcn.00425764
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43dc7c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00425764
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x43ee4c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0043ebc8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403e9c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x43eeaa
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x442b8c]
mov dl, 1
mov eax, dword [0x43eaec]
call fcn.00409150
call fcn.00403528
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43fc6c
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x43fc82
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret

Function at 0x43fc84
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [esp], eax
cmp dword [esp], 0
je 0x43fcb1
push 0
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop edx
pop ebx
ret
Function at 0x4035b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x40362f
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40362f
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40362f
mov eax, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403614
mov eax, dword [ebp - 4]
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jae 0x403626
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [edi + esi - 2], ax
jmp 0x403612
xor al, al
jmp 0x403620

Function at 0x404a35
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [ebp + 8]
mov esi, eax
cmp ebx, esi
jne 0x43da81
xor eax, eax
inc eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
xor edi, edi
test esi, esi
jne 0x43da96
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43daaa
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43db85
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov dword [ebp + 8], eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call esi
push 1
push edi
push dword [ebp + 8]
call esi
push 1
push dword [ebp - 4]
push edi
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43db61
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push eax
push eax
push 0x12
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
xor eax, eax
push eax
push eax
push eax
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 8]
test eax, eax
je 0x43db66
push 4
jmp 0x43db63
push 3
pop ebx
jmp 0x43db69
mov ebx, dword [ebp - 0xc]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call esi
push 0
push edi
push dword [ebp + 8]
call esi
push 0
push dword [ebp - 4]
push edi
call esi
jmp 0x43db88
push 2
pop ebx
mov eax, ebx
pop edi
jmp 0x404a53
Function at 0x404fe9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x405021
push edi
push 0
push 0x48faf0
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x43dd5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x405020
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x405020
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x405020
mov ecx, dword [ebx]
push 0
push edi
push eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
push edx
push edx
push edx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0x405020
Function at 0x42d703
Capabilities:
Encode data using xor

Disassembly:
shl dword es:[0x840fb400], 0xa1
add edi, esp
push 0x20
lahf
mov edi, eax
loop 0x42d6ea
aad 0xfe
jmp [edx + 0x10]

Function at 0x477590
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
mov edi, esi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0x4b70b0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0x4b70b0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4b70b0]
cmp esi, dword [ebp + 8]
jb 0x477607
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x4775c3
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0x47761e
fadd qword [0x4bbac8]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10