joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d080]
sub esp, 4
test ebx, ebx
je 0x401f15
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f0e
test esi, esi
je 0x401f0e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ef0
mov dword [esp], 0x40d088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402250
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402275
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402280
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402275
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4022c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4022be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4189dc
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
push ebx
push ebp
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
lea esi, [eax + edx + 0x18]
movzx edx, word [eax + 6]
test edx, edx
jle 0x418a53
xor ebp, ebp
mov eax, dword [esi + 0x10]
test eax, eax
je 0x418a22
push eax
mov eax, dword [esi + 0x14]
add eax, dword [esp + 0x1c]
mov ebx, dword [esi + 0xc]
push eax
add ebx, edi
push ebx
call fcn.004136b4
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [esi + 0x18], ebx
jmp 0x418a45
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x38]
test eax, eax
jle 0x418a4b
push eax
mov eax, dword [esi + 0xc]
push 0
add eax, edi
push eax
mov dword [esi + 0x18], eax
call fcn.00413670
add esp, 0xc
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
movzx edx, word [edx + 6]
inc ebp
add esi, 0x28
cmp ebp, edx
jl 0x4189fb
pop ebp
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x419a1d
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x408944
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop edi
call fcn.00408970
mov eax, ecx
mov eax, eax
xor dword [edx], edi
or eax, ecx
and ecx, ecx
inc edx
cmp edx, esi
jne fcn.00408944
sub ecx, 0x1ea5d3fb
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43cf53
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43ccda
inc ebx
sub ebx, 0xa5fe55a2
call fcn.0043cf87
or ebx, ebx
xor dword [eax], esi
and edi, edi
add eax, 1
add ebx, 0x9e11d11d
cmp eax, edx
jne fcn.0043cf53
add ebx, 1
add ebx, 0xc8c6919d
ret
Function at 0x4029f4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403f80
test esi, esi
jne 0x402a2a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404070
jmp 0x402a48
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402908
mov edi, eax
test esi, esi
je 0x402a48
cmp dword [ebx], 0
je 0x402a48
dec esi
jmp 0x402a31
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4030b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403150
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403130
xor eax, eax
push ebp
push 0x403129
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40316c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403130
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x454020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e04
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45604c], 0
je 0x403e65
cmp word [0x456220], 0xd7b2
jne 0x403e2d
cmp dword [0x456228], 0
jbe 0x403e2d
mov eax, 0x45621c
call dword [0x456238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e8c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x454030], 0
jne 0x403e81
push 0
push 0x454064
push 0x45406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405464
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405694
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405694
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4054e7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4056b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405570
xor eax, eax
push ebp
push 0x405569
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004052ac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40554e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4056d0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40554e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405570
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40568a
cmp byte [ebp - 0xd], 0
jne 0x4055b7
cmp byte [ebp - 0x12], 0
je 0x40568a
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4055d0
dec ebx
cmp byte [ebx], 0x2e
je 0x4055df
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4055cf
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40568a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40561c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40568a
cmp byte [ebp - 0xd], 0
je 0x40568a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40568a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405d5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405dc2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004041f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402c7c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405dac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405dc9
lea eax, [ebp - 0x10]
call fcn.00403f80
ret

Function at 0x40b088
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0c1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404070
jmp 0x40b0ca
mov eax, ebx
mov edx, esi
call fcn.00403fd4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b0d4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b0f5
mov al, byte [esp]
jmp 0x40b0f7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b77c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b5f4
mov eax, dword [0x455128]
cmp byte [eax], 0
je 0x40b7f8
mov eax, dword [0x454f30]
call fcn.00402ae8
call fcn.00402834
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004087c0
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b840
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b82e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x454ed8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x456668]
call fcn.00405270
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c0dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c1b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404018
lea eax, [ebp - 8]
call fcn.00404490
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404440
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c19c
mov eax, ebx
call fcn.004026cc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c195
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404440
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c17f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c1c4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c17f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c19c
mov eax, dword [ebp - 0x10]
call fcn.004026ec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1b9
lea eax, [ebp - 8]
call fcn.00403f80
ret

Function at 0x40c630
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c694
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004041f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040826c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c69b
lea eax, [ebp - 0xc]
call fcn.00403f80
ret

Function at 0x41db64
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x456888
cmp dword [edi], 0
jne 0x41dbe0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x456884]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45447c
mov ecx, 2
call fcn.004028c8
mov edx, 0x41db3c
lea eax, [esi + 5]
call fcn.0041db5c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041db5c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41dbb5
mov dword [0x456884], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41edf4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41edfa
ret
Function at 0x42123c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x42128d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x421274
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x421264
jmp 0x42128d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x421275
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a3c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404440
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x42a420
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x455248]
mov dl, 1
mov eax, dword [0x429f80]
call fcn.0040b93c
call fcn.004039bc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042a088
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42bcf8
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42bc44
call sub.user32.dll_EnumWindows
ret

Function at 0x42be18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42be95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042b878
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42be3d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042b478
cmp dword [ebp - 4], 0
je 0x42be7f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404440
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42be9c
lea eax, [ebp - 4]
call fcn.00403f80
ret
Function at 0x42eb38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x456b58], 0
je 0x42ec87
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4550c4]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x42ec87
mov eax, dword [0x456b5c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x456b58]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x42ec56
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x456b58]
call fcn.00416ed8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42ec4e
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x42ec4e
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x42ec4e
mov eax, dword [ebp - 0x14]
call fcn.0043769c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42ec4e
push ebp
call fcn.0042eaf4
pop ecx
test al, al
jne 0x42ec4e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x42ec0a
mov eax, dword [ebp - 0x14]
call fcn.004361cc
dec eax
jle 0x42ec4e
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403444
cmp byte [ebp - 1], 0
je 0x42ec4e
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42ec4e
mov edx, dword [ebp - 0x14]
mov eax, dword [0x456b5c]
call fcn.0042e2c0
inc edi
dec ebx
jne 0x42eb9d
mov eax, dword [0x456b5c]
cmp dword [eax + 8], 0
jle 0x42ec6e
mov eax, dword [0x456b5c]
call fcn.0042e350
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42ec87
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0042e95c
pop ecx
test al, al
jne 0x42ec87
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432220
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x43226c
mov eax, esi
call fcn.0044763c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43226c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x43226c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4323ab
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4322ac
cmp eax, 0x108
ja 0x4322ac
mov eax, esi
call fcn.0044763c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4323a2
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4323ab
jmp 0x4323a2
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x43238b
cmp eax, 0x20a
ja 0x43238b
test byte [esi + 0x50], 0x80
jne 0x4322de
sub eax, 0x203
je 0x4322db
sub eax, 3
je 0x4322db
sub eax, 3
jne 0x4322de
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4322f2
dec eax
je 0x432307
dec eax
je 0x432324
dec eax
je 0x432307
jmp 0x43232b
mov ecx, ebx
mov eax, dword [0x4550c4]
mov eax, dword [eax]
mov edx, esi
call fcn.00450e88
jmp 0x4323a2
cmp byte [esi + 0x5d], 1
jne 0x43231d
mov eax, esi
mov si, 0xffed
call fcn.00403444
jmp 0x4323ab
or word [esi + 0x54], 1
jmp 0x4323a2
and word [esi + 0x54], 0xfffe
jmp 0x4323a2
mov eax, dword [0x456b14]
cmp byte [eax + 0x20], 0
je 0x4323a2
mov eax, dword [0x456b14]
cmp dword [eax + 0x1c], 0
je 0x4323a2
mov eax, dword [ebx]
mov edx, dword [0x456b14]
cmp eax, dword [edx + 0x1c]
jne 0x4323a2
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00447580
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403444
jmp 0x4323ab
cmp eax, 0xb00b
jne 0x4323a2
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00430b88
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43582c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x435848
cmp dword [esi + 4], 0
je 0x435875
test byte [ebx + 0x55], 1
jne 0x435867
mov eax, ebx
call fcn.00434438
test eax, eax
jne 0x435867
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x435985
mov edx, esi
mov eax, ebx
call fcn.00435350
jmp 0x435985
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43597e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043769c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00432154
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043582c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043769c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435985
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret