joyce8/EMBER2024-capa huggingface dataset:
Function at 0x567377
Capabilities:
Encode data using xor

Disassembly:
imul dword [edi]
mov dl, 0xbe
pushfd
rcl dword [edx - 0x27], cl
fldcw word [ebx]
outsd dx, dword [esi]
jno 0x5672df
fistp word [eax - 0x3c]
xchg ebx, eax
jmp 0x5672f1
sti
invalid
invalid
xlatb
jb 0x567382
and edx, dword [esi + 0xcc31db3]
xchg edi, eax
jge 0x5672f8
test esp, ecx
test eax, 0xa5f8f3a
pop eax
xor dword [edx - 0x1778c6ea], esp
jecxz 0x567320
or ecx, eax
push eax
mov ch, 0xac
sub ch, byte [eax]
test ebx, 0x19f5c92a
push 0x3d6302e3
sub al, 0x8a
mov byte [ebx + 0x18], al
or eax, 0xc296d615
lahf
xlatb
mov dh, 0xf2
cmpsb byte [esi], byte es:[edi]
salc
lds esp, [ebx - 0x6b]
test dword [0x55115b95], esp
push ebp
push es
pop ss
ja 0x56730f
inc eax
xor al, 0x97
sal dword [edx], 0x68
imul dword ds:[edx - 0x7b]
jecxz 0x567338
cmp bl, byte [edi + 0x2696b1de]
lea eax, [ebx + ebx*8 + 0x7c51c2fa]
pop ss
outsd dx, dword [esi]
add eax, dword [esi + 0x47]
push edi
jne 0x56740e
dec ebp
dec ecx
push es
and eax, 0xa591a4b2
xor eax, 0x5a03cb91
cmc
mov al, byte [0x97ce751d]
adc esp, dword [esp + ecx*4]
sub al, 0xdc
xchg esp, eax
push ss
sub ah, byte [edi + eax*8 - 0x17bc93dd]
adc dword [ebx], ebx
inc ebx
sbb byte [edi + 0x26], ah
movsb byte es:[edi], byte [esi]
adc dh, byte [edi]
mov eax, 0x43ec2729
stosd dword es:[edi], eax
xchg ecx, eax
nop
add eax, 0xba371b91
loop 0x567403
cmp al, 0x70
add esi, dword [eax + 0x7ab978b]
pop ds
push 0xffffffffffffffc3
div dword [ebx + 0x5df6a1a7]
cmc
xchg ebp, eax
cmpsd dword [esi], dword es:[edi]
invalid
and dword [edx - 0xfac4d35], esp
arpl word [edi], sp
arpl word [edi], ax
iretd
retf 0xf7db

Function at 0x6050e6
Capabilities:
Encode data using xor

Disassembly:
push es
inc esi
mov dh, 0xf6
je 0x605104
push ebx
rcl dword [ebp + edi*4 - 0x1c9197d9], cl
sti
dec edx
or al, 0xdd
mov dword [edx + 0x4ddbedf], esp
out 0xaa, al
cmp eax, 0xa70665fb
cmpsd dword [esi], dword es:[edi]
enter 0x42b3, 0x4b
mov ebx, 0xddaf1e84
lahf
push ebx
cwde
out 0x2d, al
lcall 0xb35c, 0x4c1694c1
adc ecx, ebx
and al, ah
add eax, 0x9dc98ee
invalid

Function at 0x63b245
Capabilities:
Encode data using xor

Disassembly:
test dword [edx - 0x34], esp
invalid
out dx, al
test eax, 0xdc042a3b
pushfd
inc ecx
wait
jb 0x63b241
add al, 0xb3
out dx, eax
inc ecx
xchg byte [0x69c54045], bh
fisttp dword [ebp + 0x5afb9d2b]
sbb eax, 0x525cfbda
mov cl, cl
xchg esi, eax
xchg esp, eax
xor ch, byte [ebx - 0x121898f0]
call 0xd87b849a
mov ebx, 0x36c50ddc
and byte [edx + 0x2cd014f2], ah
mov ebp, 0xbb22e3fa
and al, 0x1d
invalid

Function at 0x8c212b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x8c1ea3
pop ecx
sub eax, 0x533475bf
call fcn.008c2166
mov eax, esi
and eax, esi
dec eax
xor dword [edx], ecx
and esi, esi
add esi, 1
mov eax, 0x4e01ca55
inc edx
inc esi
cmp edx, edi
jne fcn.008c212b
or eax, esi
ret
Function at 0x40f0ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409d34
and dword [ebp - 4], 0
cmp dword [0x419bac], 0
mov ebx, eax
jne 0x40f1a0
push 0x413b90
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f251
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x413b84
push edi
call esi
test eax, eax
je 0x40f251
push eax
call fcn.00409cc2
mov dword [esp], 0x413b74
push edi
mov dword [0x419bac], eax
call esi
push eax
call fcn.00409cc2
mov dword [esp], 0x413b60
push edi
mov dword [0x419bb0], eax
call esi
push eax
call fcn.00409cc2
mov dword [esp], 0x413b44
push edi
mov dword [0x419bb4], eax
call esi
push eax
call fcn.00409cc2
pop ecx
mov dword [0x419bbc], eax
test eax, eax
je 0x40f1a0
push 0x413b2c
push edi
call esi
push eax
call fcn.00409cc2
pop ecx
mov dword [0x419bb8], eax
mov eax, dword [0x419bb8]
cmp eax, ebx
je 0x40f1f8
cmp dword [0x419bbc], ebx
je 0x40f1f8
push eax
call fcn.00409d3d
push dword [0x419bbc]
mov esi, eax
call fcn.00409d3d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f1f8
test edi, edi
je 0x40f1f8
call esi
test eax, eax
je 0x40f1ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f1ef
test byte [ebp - 0xc], 1
jne 0x40f1f8
or dword [ebp + 0x10], 0x200000
jmp 0x40f231
mov eax, dword [0x419bb0]
cmp eax, ebx
je 0x40f231
push eax
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f231
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f231
mov eax, dword [0x419bb4]
cmp eax, ebx
je 0x40f231
push eax
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f231
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419bac]
call fcn.00409d3d
pop ecx
test eax, eax
je 0x40f251
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f253
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438c8e
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ecx
and edi, eax
or edi, eax
call fcn.00438cb6
or eax, edi
xor dword [esi], ecx
or edi, eax
sub eax, 0xaaa8b2db
inc esi
or edi, eax
cmp esi, ebx
jne fcn.00438c8e
dec edi
ret
Function at 0x403360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033f8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033d8
xor eax, eax
push ebp
push 0x4033d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403414
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033d8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45600c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040c8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x458048], 0
je 0x404129
cmp word [0x45821c], 0xd7b2
jne 0x4040f1
cmp dword [0x458224], 0
jbe 0x4040f1
mov eax, 0x458218
call dword [0x458234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x456054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404150
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45601c], 0
jne 0x404145
push 0
push 0x456074
push 0x456054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40b0fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b135
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404334
jmp 0x40b13e
mov eax, ebx
mov edx, esi
call fcn.00404298
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b148
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b169
mov al, byte [esp]
jmp 0x40b16b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b7f0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b668
mov eax, dword [0x456f84]
cmp byte [eax], 0
je 0x40b85d
mov eax, dword [0x456ddc]
call fcn.00402c7c
call fcn.00402870
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004088c8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b8a4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b893
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x456d98]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x458714]
call fcn.00405960
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40c534
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c598
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044ac
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408470
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c59f
lea eax, [ebp - 0xc]
call fcn.00404244
ret
Function at 0x423984
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x458a78
cmp dword [edi], 0
jne 0x423a00
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x458a74]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4565d4
mov ecx, 2
call fcn.00402904
mov edx, 0x42395c
lea eax, [esi + 5]
call fcn.0042397c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042397c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4239d5
mov dword [0x458a74], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424b8c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424b92
ret

Function at 0x426fd4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x427025
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x42700c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426ffc
jmp 0x427025
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x42700d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f89c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x42f7e8
call sub.user32.dll_EnumWindows
ret

Function at 0x42f9c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x42fa3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0042f40c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x42f9e5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0042f064
cmp dword [ebp - 4], 0
je 0x42fa27
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.004046f4
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fa44
lea eax, [ebp - 4]
call fcn.00404244
ret

Function at 0x4325fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x458c00], 0
je 0x43274b
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x456f30]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43274b
mov eax, dword [0x458c04]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x458c00]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43271a
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x458c00]
call fcn.0041af60
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x432712
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x432712
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x432712
mov eax, dword [ebp - 0x14]
call fcn.0043b0d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x432712
push ebp
call fcn.004325b8
pop ecx
test al, al
jne 0x432712
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x4326ce
mov eax, dword [ebp - 0x14]
call fcn.00439c6c
dec eax
jle 0x432712
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004036ec
cmp byte [ebp - 1], 0
je 0x432712
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x432712
mov edx, dword [ebp - 0x14]
mov eax, dword [0x458c04]
call fcn.00431d80
inc edi
dec ebx
jne 0x432661
mov eax, dword [0x458c04]
cmp dword [eax + 8], 0
jle 0x432732
mov eax, dword [0x458c04]
call fcn.00431e10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43274b
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00432420
pop ecx
test al, al
jne 0x43274b
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435d08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x435d54
mov eax, esi
call fcn.0044b66c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x435d54
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x435d54
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x435e93
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x435d94
cmp eax, 0x108
ja 0x435d94
mov eax, esi
call fcn.0044b66c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x435e8a
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x435e93
jmp 0x435e8a
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x435e73
cmp eax, 0x20a
ja 0x435e73
test byte [esi + 0x50], 0x80
jne 0x435dc6
sub eax, 0x203
je 0x435dc3
sub eax, 3
je 0x435dc3
sub eax, 3
jne 0x435dc6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x435dda
dec eax
je 0x435def
dec eax
je 0x435e0c
dec eax
je 0x435def
jmp 0x435e13
mov ecx, ebx
mov eax, dword [0x456f30]
mov eax, dword [eax]
mov edx, esi
call fcn.00454cb8
jmp 0x435e8a
cmp byte [esi + 0x5d], 1
jne 0x435e05
mov eax, esi
mov si, 0xffed
call fcn.004036ec
jmp 0x435e93
or word [esi + 0x54], 1
jmp 0x435e8a
and word [esi + 0x54], 0xfffe
jmp 0x435e8a
mov eax, dword [0x458bbc]
cmp byte [eax + 0x20], 0
je 0x435e8a
mov eax, dword [0x458bbc]
cmp dword [eax + 0x1c], 0
je 0x435e8a
mov eax, dword [ebx]
mov edx, dword [0x458bbc]
cmp eax, dword [edx + 0x1c]
jne 0x435e8a
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044b5b0
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004036ec
jmp 0x435e93
cmp eax, 0xb00b
jne 0x435e8a
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00434634
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439308
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x439324
cmp dword [esi + 4], 0
je 0x439351
test byte [ebx + 0x55], 1
jne 0x439343
mov eax, ebx
call fcn.00437f60
test eax, eax
jne 0x439343
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x439461
mov edx, esi
mov eax, ebx
call fcn.00438e28
jmp 0x439461
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43945a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043b0d8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00435c3c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00439308
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043b0d8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439461
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f7b4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x457080]
cmp byte [eax + 0xc], 0
je 0x43f921
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f91a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x458c10], 0
jne 0x43f808
push 0x43f928
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43f930
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c10], eax
cmp dword [0x456abc], 0
jne 0x43f903
push 0x43f940
call sub.kernel32.dll_LoadLibraryA
mov dword [0x456abc], eax
cmp dword [0x456abc], 0
je 0x43f903
push 0x43f94c
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c14], eax
push 0x43f95c
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c18], eax
push 0x43f970
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c1c], eax
push 0x43f988
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c20], eax
push 0x43f9a0
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c24], eax
push 0x43f9b4
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c28], eax
push 0x43f9cc
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c2c], eax
push 0x43f9e4
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c30], eax
push 0x43fa00
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c34], eax
push 0x43fa0c
mov eax, dword [0x456abc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458c38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f921
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x443684
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404244
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4436d3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044ac
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44b570]
test si, 4
je 0x44b534
or bl, 1
test si, 8
je 0x44b53e
or bl, 4
test si, 1
je 0x44b548
or bl, 8
test si, 2
je 0x44b552
or bl, 0x10
test si, 0x10
je 0x44b55c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b56b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44b574
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44b5ac]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b58d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b59c
or bl, 4
test esi, 0x20000000
je 0x44b5a7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x451bc8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x451bda
add esp, 0xfffffff0
call fcn.0040383c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422900
mov eax, dword [0x456da0]
mov dword [eax + 4], ebx
mov dword [eax], 0x451f6c
mov eax, dword [0x456dac]
mov dword [eax + 4], ebx
mov dword [eax], 0x451f78
mov eax, ebx
call fcn.00451f84
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44e44c
push eax
push 0
push 0
mov eax, dword [0x456ec4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x424290]
call fcn.004256d4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x424290]
call fcn.004256d4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x424290]
call fcn.004256d4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004523a4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452280
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452280
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452280
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451d17
call fcn.00403894
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret