joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46110c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x461123
add esp, 0xfffffff0
call fcn.00403f90
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004207c0
mov eax, dword [0x49ab80]
cmp word [eax + 2], 0
jne 0x46114b
mov eax, dword [0x49ab80]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462ba4
mov eax, dword [0x49aca8]
cmp word [eax + 2], 0
jne 0x461165
mov eax, dword [0x49aca8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462db0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416e8c]
call fcn.00403c3c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416e8c]
call fcn.00403c3c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x416e8c]
call fcn.00403c3c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x426208]
call fcn.0042de98
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x46131c
mov eax, dword [0x49a9f8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e26c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x463484
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49a9f8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e588
test eax, eax
je 0x46126c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409d40
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e5bc
test eax, eax
je 0x461280
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404ddc
mov byte [ebx + 0xd4], 0
push ebx
push 0x462888
call fcn.0042193c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x49a7e8]
cmp byte [eax], 0
jne 0x4612d1
mov eax, ebx
call fcn.00461460
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00463698
mov eax, ebx
call fcn.004641fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x461311
call fcn.00403fe8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4616e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46177f
cmp dword [ebx + 0x94], 0
jne 0x461779
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x461668
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461779
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46173f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461779
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041955c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46174e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461998
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x49fcd4]
cmp dword [eax + 0x30], 0
je 0x461af5
test bl, bl
jne 0x461a46
cmp dword [esi + 0x9c], 0
jne 0x461a3b
mov eax, esi
call fcn.00464078
push eax
push 0x4618c4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x461a0c
mov eax, dword [0x49fcd4]
call fcn.00464758
test al, al
je 0x461a0c
mov eax, dword [0x49fcf8]
call fcn.00405e28
mov edi, eax
cmp edi, 0
jl 0x461a0c
push 0
mov eax, dword [0x49fcf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4619f6
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x461a3b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041955c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x461a1b
inc dword [esi + 0x9c]
jmp 0x461af5
cmp dword [esi + 0x9c], 0
jle 0x461af5
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x461af5
cmp dword [esi + 0x44], 0
je 0x461aa1
mov eax, dword [0x49fcd4]
call fcn.00464758
test al, al
je 0x461aa1
mov eax, dword [0x49fcf8]
call fcn.00405e28
mov edi, eax
cmp edi, 0
jl 0x461aa1
push 5
mov eax, dword [0x49fcf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x461a8b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x461ad0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041955c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x461ab0
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x49fcf8
mov ecx, 1
mov edx, dword [0x4618a4]
call fcn.00405fdc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4625dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x462646
mov eax, ebx
call fcn.00464758
test al, al
jne 0x462646
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404c5c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x462633
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x462653
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404bc0
jmp 0x462653
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404bc0
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x46387c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4638ea
mov eax, esi
call fcn.0044c6a0
test al, al
je 0x4638ea
mov eax, dword [ebx + 0x84]
call fcn.0044c300
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4638ea
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4638de
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c300
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00444144
jmp 0x4638ea
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004636b8
pop esi
pop ebx
ret

Function at 0x482748
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4827a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00482738
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00480028
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047fb40
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4827a9
lea eax, [ebp - 4]
call fcn.00404b6c
ret
Function at 0x48be50
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407ad4]
call fcn.004055fc
xor eax, eax
push ebp
push 0x48bff1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49a68c], 0
jne 0x48beab
mov ecx, dword [0x49a808]
mov dl, 1
mov eax, dword [0x408100]
call fcn.0040d73c
call fcn.004044e0
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0040358c
mov eax, ebx
call fcn.004054ac
mov dword [ebp - 0x24], eax
mov esi, 0x48c000
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004066cc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004054bc
test eax, eax
jle 0x48bf94
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48bf80
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404ddc
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48bf26
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404df4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48bf3c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404df4
mov eax, dword [ebp - 0x54]
call fcn.00404ffc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404ddc
mov eax, dword [ebp - 0x58]
call fcn.00404ffc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48bf82
xor eax, eax
test al, al
je 0x48bf8d
mov ebx, 0x15
jmp 0x48bf99
mov ebx, 0x10
jmp 0x48bf99
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x49a68c]
call fcn.0048bcd0
mov eax, dword [ebp - 4]
call fcn.0048bcd0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004066e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bff8
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404b90
lea eax, [ebp - 0xc]
mov edx, dword [0x407ad4]
call fcn.004056cc
ret
Function at 0x402d15
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x4052b9]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x4052b9]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov ch, byte [edi]
mov al, byte [0x405199]
jmp 0x402d56
add al, byte [esi]
xor al, ch
mov byte [edi], al
mov eax, edx
cmp esi, eax
jne 0x402d65
mov esi, ebx
dec esi
inc esi
pop ecx
inc edi
dec ecx
jne 0x402d49
jmp 0x402d71
mov edi, esi
push 0x39
push 0x4052b9
push 0x111
push dword [0x405295]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x4052b9]
mov edi, dword [0x4052bd]
mov esi, dword [0x4052ad]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402d9d
mov esi, dword [0x405194]
mov ecx, dword [0x405190]
push ecx
add ecx, esi
mov dword [0x405279], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x4052ad]
mov ebx, esi
add ebx, eax
mov dword [0x405275], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x402e44
cmp eax, ecx
jae 0x402de9
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x402dfa
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402df1
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x402e0d
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x402e06
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x402e2e
inc al
cmp al, 0
jne 0x402e26
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402e2a
mov al, 0
dec al
dec cl
jmp 0x402e40
dec cl
inc al
cmp al, 0
jne 0x402e3e
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x402e40
dec al
jmp 0x402de0
mov ecx, dword [0x405279]
sub ecx, esi
test ecx, ecx
je 0x402e59
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x402e50
mov edi, dword [0x4052ad]
mov dword [0x4052ad], edi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40147c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40148e
mov eax, dword [0x4ba08b]
shl eax, 2
mov dword [0x4ba08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004ad500
pop edx
call fcn.004ad464
call fcn.004ad540
push 0
call fcn.004ae94c
pop ecx
push 0x4ba034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4ba093], eax
push 0
jmp fcn.004b3e64

Function at 0x417ca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x4c1750
call fcn.004adcac
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.004ad374
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x417d19
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x417d19
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.004ad394
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x417d19
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x417d36
cmp dword [ebp - 0x34], 0
je 0x417d36
mov edx, dword [ebp - 0x34]
jmp 0x417d3b
mov edx, 0x4c13c4
lea eax, [ebp - 4]
call fcn.004b7c84
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.004ad384
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004b7ec4
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004b7e94
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x417db9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420adc
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x420a28
call sub.USER32.DLL_EnumWindows
ret

Function at 0x420c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x420c7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042064c
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x420c25
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004202a4
cmp dword [ebp - 4], 0
je 0x420c67
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004aaf1c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420c84
lea eax, [ebp - 4]
call fcn.004aaa6c
ret
Function at 0x42f984
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004aaa6c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42f9d3
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004aacd4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4359b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435c10
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x435a13
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00435478
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0049c170
cmp al, 1
jne 0x435a13
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00435790
test al, al
je 0x435b9f
cmp dword [ebp - 8], 0
jge 0x435a31
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00435478
mov eax, dword [ebp - 0x210]
call fcn.004aad24
cmp ebx, eax
jge 0x435a7b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00435478
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4c9b58]
and eax, 0xff
bt dword [edx], eax
jae 0x435a7b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x435a8f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0043598c
cmp ebx, dword [ebp - 8]
je 0x435b91
lea eax, [ebp - 0x108]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x435abb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004aa11c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c2590]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.DLL_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x435b7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004aa11c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c2590]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.0046538c
push eax
call sub.USER32.DLL_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004aa11c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c2590]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046538c
push eax
call sub.USER32.DLL_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435b85
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x435bf2
cmp dword [ebp - 8], 0
jge 0x435baa
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00435478
mov eax, dword [ebp - 0x218]
call fcn.004aad24
cmp eax, dword [ebp - 8]
jg 0x435be4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00435478
mov eax, dword [ebp - 0x21c]
call fcn.004aad24
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043598c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435c17
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004aaa90
ret
Function at 0x44050c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x440512
ret

Function at 0x442f10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x442f61
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x442f48
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x442f38
jmp 0x442f61
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x442f49
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c2dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c32c]
test si, 4
je 0x44c2f0
or bl, 1
test si, 8
je 0x44c2fa
or bl, 4
test si, 1
je 0x44c304
or bl, 8
test si, 2
je 0x44c30e
or bl, 0x10
test si, 0x10
je 0x44c318
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c327
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44c330
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44c368]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c349
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44c358
or bl, 4
test esi, 0x20000000
je 0x44c363
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x452ca4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x452cb6
add esp, 0xfffffff0
call fcn.004aa284
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004930e0
mov eax, dword [0x4c9aa0]
mov dword [eax + 4], ebx
mov dword [eax], 0x453048
mov eax, dword [0x4c9aa4]
mov dword [eax + 4], ebx
mov dword [eax], 0x453054
mov eax, ebx
call fcn.00453060
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x488b14]
call fcn.004a9ef0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x488b14]
call fcn.004a9ef0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x488b14]
call fcn.004a9ef0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x488b14]
call fcn.004a9ef0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x488b14]
call fcn.004a9ef0
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44f528
push eax
push 0
push 0
mov eax, dword [0x4c9a88]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x43f918]
call fcn.00441054
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x43f918]
call fcn.00441054
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x43f918]
call fcn.00441054
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004534c8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4533a4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4533a4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4533a4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452df3
call fcn.004aa2dc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret