joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bff0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 1
push dword [esi]
mov dword [ebp - 4], esi
call fcn.0043d342
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 1
push eax
cmp dword [ebp + 8], ebx
jge 0x43c048
push 0x25
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x43c070
push 0x27
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
mov edi, dword [ebp - 4]
push 0x101
push dword [edi]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [edi]
call fcn.0043d342
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 4

Function at 0x43c82d
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp byte [ebp + 0xc], 1
jne 0x43c858
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43c871
push 1
jmp 0x43c859
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8

Function at 0x43d4f2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 8], ebx
call fcn.0040bcce
push dword [ebx]
call fcn.0040103b
test al, al
je 0x43d517
xor al, al
jmp 0x43d593
mov ecx, ebx
call fcn.0043d59a
mov ebx, eax
test ebx, ebx
jne 0x43d529
mov ebx, 0x7fff
xor ecx, ecx
push 2
lea esi, [ebx + 1]
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041f4ea
pop ecx
mov edi, eax
mov eax, dword [ebp - 8]
push edi
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x43d58a
push edi
call fcn.004217d0
pop ecx
push edi
cmp eax, ebx
jne 0x43d582
lea ecx, [ebp - 0x18]
call fcn.0043d2ff
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040c1de
lea ecx, [ebp - 0x18]
call fcn.0040cb37
jmp 0x43d58a
mov ecx, dword [ebp + 8]
call fcn.00406a63
push edi
call fcn.0041f55e
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x442551
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [ebx]
push edi
mov edi, dword [ebp + 8]
lea eax, [ecx + 4]
mov esi, dword [ecx + edi]
mov dword [ebx], eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
mov dword [ebp + 8], esi
neg ecx
or ecx, eax
push ecx
call fcn.0041f4ea
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
push esi
push ecx
mov edi, eax
push edi
call fcn.0041ee80
mov ecx, dword [ebp + 8]
add dword [ebx], esi
xor eax, eax
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x4425ac
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x4425a3
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x442b37
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x442bda
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x442cbf
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x442b7f
cmp byte [ebp - 0xf0], al
jne 0x442b88
cmp byte [edi + 0x1a], 0
jne 0x442b88
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x442b97
cmp byte [edi + 0x1b], 0
jne 0x442b97
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x442ba9
cmp byte [edi + 0x1c], 0
jne 0x442ba9
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x442bbb
cmp byte [edi + 0x1d], 0
jne 0x442bbb
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x442cbf
cmp byte [edi + 0x1e], 0
jne 0x442cbf
mov byte [esi + 4], 1
jmp 0x442cbf
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442c07
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x442c10
cmp byte [edi + 0x1a], 0
jne 0x442c10
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442c36
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x442c40
cmp byte [edi + 0x1b], 0
jne 0x442c40
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442c60
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x442c6a
cmp byte [edi + 0x1c], 0
jne 0x442c6a
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442c8a
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x442c94
cmp byte [edi + 0x1d], 0
jne 0x442c94
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442cb4
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x442cbe
cmp byte [edi + 0x1e], 0
jne 0x442cbe
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x442e5b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x442e73
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x442e7d
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x442e87
mov byte [esi + 0x17], 1
xor eax, eax
cmp byte [esi + 0x14], al
je 0x442e96
cmp byte [esi + 0x1a], al
je 0x442e96
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x442ea3
cmp byte [esi + 0x1b], al
je 0x442ea3
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x442eb0
cmp byte [esi + 0x1c], al
je 0x442eb0
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x442ebd
cmp byte [esi + 0x1d], al
je 0x442ebd
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x442eca
cmp byte [esi + 0x1e], al
je 0x442eca
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x442f4c
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443084
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x442f0f
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x443084
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.00442ab3
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x442f84
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x442fa2
cmp byte [esi + 0x1a], 0
jne 0x442fa2
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.004441de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00443a61
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x442fc4
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x442fe2
cmp byte [esi + 0x1b], 0
jne 0x442fe2
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.004441de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00443a61
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x442ffe
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x443019
cmp byte [esi + 0x1c], 0
jne 0x443019
push 0x11
lea ecx, [ebp - 0xc]
call fcn.004441de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00443a61
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x443035
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x443050
cmp byte [esi + 0x1d], 0
jne 0x443050
push 0x12
lea ecx, [ebp - 0xc]
call fcn.004441de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00443a61
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x443067
push 0x5b
call edi
test bx, ax
je 0x443082
cmp byte [esi + 0x1e], 0
jne 0x443082
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.004441de
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00443a61
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4438a3
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x443904
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0044411c
mov ecx, dword [ebp - 4]
call fcn.00442b1c
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0044411c
mov ecx, dword [ebp - 4]
call fcn.00442b03
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x44390c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, word [edi + 8]
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
mov byte [ebp - 8], bl
mov byte [ebp - 4], bh
mov dword [ebp - 0xc], eax
je 0x4439f7
cmp bl, 0x14
je 0x4439f7
cmp bl, 0x90
je 0x4439f7
cmp bl, 0x91
je 0x4439f7
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x4439de
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443988
movzx eax, bl
or byte [ebp + eax - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 1
call fcn.00442d4a
cmp al, 1
jne 0x4439a3
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x4439b4
cmp byte [esi + 0x1d], 0
jne 0x4439b4
cmp bl, 0x12
jne 0x4439d2
cmp byte [esi + 0x16], 0
jne 0x4439d2
cmp byte [esi + 0x1c], 0
jne 0x4439d2
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x104
jmp 0x4439ec
movzx eax, bl
push edi
push eax
push 0x100
jmp 0x4439ec
mov eax, dword [ebp - 0xc]
movzx eax, ax
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x443a53
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443a23
mov ecx, edi
call fcn.00442d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x443a14
push 1
jmp 0x443a16
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044411c
jmp 0x443a53
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x24], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x22], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
push eax
push ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00442b1c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x443a61
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov bl, byte [edi]
cmp dword [esi + 0x20], 0
mov bh, byte [edi + 7]
mov byte [ebp - 4], bl
mov byte [ebp - 8], bh
je 0x443b3c
cmp bl, 0x14
je 0x443b3c
cmp bl, 0x90
je 0x443b3c
cmp bl, 0x91
je 0x443b3c
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443b98
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443ada
movzx eax, bl
xor byte [ebp + eax - 0x124], 0x80
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 0xc0000001
call fcn.00442d4a
cmp al, 1
jne 0x443af8
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x443b09
cmp byte [esi + 0x1d], 0
jne 0x443b09
cmp bl, 0x12
jne 0x443b27
cmp byte [esi + 0x16], 0
jne 0x443b27
cmp byte [esi + 0x1c], 0
jne 0x443b27
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x105
jmp 0x443b31
movzx eax, bl
push edi
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x443b98
mov ecx, edi
call fcn.00442e0a
test al, al
je 0x443b68
mov ecx, edi
call fcn.00442d4a
push ecx
mov ecx, esi
cmp al, 1
jne 0x443b59
push 3
jmp 0x443b5b
push 2
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0044411c
jmp 0x443b98
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x1e], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x24]
inc ecx
push eax
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 6
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00442b03
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x443bc3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x443bf4
cmp byte [esi + 1], 0
jne 0x443bf4
cmp byte [esi + 2], 0
jne 0x443bf4
cmp byte [esi + 3], 0
jne 0x443bf4
cmp byte [esi + 4], 0
je 0x443da2
cmp dword [edi + 0x20], 0
push ebx
je 0x443d2a
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x443d2a
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443c7e
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x443c3c
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x443c4d
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x443c59
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x443c65
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x443c71
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x443c8f
cmp byte [esi + 1], 0
je 0x443ca6
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x443cc3
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x443d07
cmp byte [esi + 2], 0
jne 0x443cec
cmp byte [edi + 0x1c], 0
jne 0x443cec
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x443d02
test al, al
je 0x443d07
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x443d9a
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x443d9a
xor ebx, ebx
cmp byte [esi], bl
je 0x443d43
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 1], bl
je 0x443d5b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 2], bl
je 0x443d70
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 3], bl
je 0x443d85
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 4], bl
je 0x443d9a
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0044411c
mov ecx, edi
call fcn.00442b1c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443da8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x443dd9
cmp byte [esi + 1], 0
jne 0x443dd9
cmp byte [esi + 2], 0
jne 0x443dd9
cmp byte [esi + 3], 0
jne 0x443dd9
cmp byte [esi + 4], 0
je 0x443f95
cmp dword [edi + 0x20], 0
push ebx
je 0x443f17
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x443f17
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x443e63
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x443e21
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x443e32
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x443e3e
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x443e4a
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x443e56
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x443e74
cmp byte [esi + 1], 0
je 0x443e8d
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x443eac
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x443ef2
cmp byte [esi + 2], 0
jne 0x443ed5
cmp byte [edi + 0x1c], 0
jne 0x443ed5
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x443eed
test al, al
je 0x443ef2
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x443f8d
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x443f8d
cmp byte [esi], 0
push 2
pop ebx
je 0x443f32
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 1], 0
je 0x443f4b
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 2], 0
je 0x443f61
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 3], 0
je 0x443f77
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0044411c
cmp byte [esi + 4], 0
je 0x443f8d
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0044411c
mov ecx, edi
call fcn.00442b03
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443f9b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x444020
jne 0x443faf
push 0
jmp 0x44401a
cmp esi, 0xf
jae 0x444019
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x444019
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x443fd2
fadd qword [0x4b6a00]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0041e2bd
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x443fdb
jmp 0x444020
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret 4

Function at 0x444170
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x444194
xor al, al
jmp 0x4441d9
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x444190
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x4441c4
mov byte [esi + 1], 1
test bl, 2
je 0x4441cd
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x4441d7
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x445dde
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00445baf
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
leave
ret 8
Function at 0x445f85
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20020
call fcn.0042f8a0
push esi
lea eax, [ebp - 0x20020]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.00446ebb
lea eax, [ebp - 0x10020]
push eax
mov edx, 0x7fff
mov ecx, esi
call fcn.00446ebb
pop ecx
pop ecx
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
pop esi
test eax, eax
jne 0x44600e
cmp byte [ebp + 8], al
je 0x44600a
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call fcn.004215e3
pop ecx
pop ecx
test eax, eax
je 0x446006
lea eax, [ebp - 0x10020]
push eax
lea eax, [ebp - 0x20020]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
leave
ret
xor al, al
leave
ret
lea ecx, [ebp - 0x20020]
call fcn.004472cb
test al, al
je 0x44600a
lea ecx, [ebp - 0x10020]
call fcn.004472cb
test al, al
je 0x4460b8
cmp byte [ebp + 8], 0
je 0x44600a
lea eax, [ebp - 0x20020]
push str..
push eax
call fcn.00420cf4
lea eax, [ebp - 0x20020]
push eax
call fcn.00420cdb
xor ecx, ecx
mov word [ebp + eax*2 - 0x2001e], cx
lea eax, [ebp - 0x10020]
push eax
call fcn.00420cdb
xor ecx, ecx
mov word [ebp + eax*2 - 0x1001e], cx
lea eax, [ebp - 0x20020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10020]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0x20], eax
mov eax, 0x614
add esp, 0x10
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
leave
ret
lea ecx, [ebp - 0x10020]
call fcn.00446318
test al, al
je 0x44600a
lea ecx, [ebp - 0x10020]
call fcn.004472cb
test al, al
jmp 0x446034