joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001be0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov eax, esp
mov dword [eax], 0xb1aee
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
jmp 0x10001c61
mov eax, dword [esp + 0x3c]
add eax, 1
cmp eax, 0x6c
mov dword [esp + 0x40], eax
je 0x10001d18
jmp 0x10001c61
mov eax, esp
mov dword [eax], 0xd65852
mov eax, dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x1f2
mov dword [ecx + 4], 0x1f2
mov dword [ecx], 0x45214b
mov ecx, dword [sym.imp.USER32.dll_GetMenuDefaultItem]
mov dword [esp + 0x38], eax
call ecx
sub esp, 0xc
mov dword [esp + 0x34], eax
jmp 0x10001d06
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov edx, esp
mov dword [edx], 0x97a
mov edx, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], ecx
call edx
sub esp, 4
xor ecx, ecx
mov edx, dword [esp + 0x3c]
sub edx, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
je 0x10001d06
jmp 0x10001c9b
mov eax, dword [esp + 0x3c]
sub eax, 0x33
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
je 0x10001c21
jmp 0x10001cb6
mov eax, dword [esp + 0x1c]
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
mov dword [ecx + 0xc], 0xdeb
mov dword [ecx + 8], 0x4c5
mov dword [ecx + 4], 0xdeb
mov ecx, dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov dword [esp + 0x18], eax
call ecx
sub esp, 0x10
mov ecx, dword [esp + 0x18]
add ecx, 1
cmp ecx, 0xa
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
je 0x10001c07
jmp 0x10001cb6
mov eax, dword [esp + 0x3c]
add eax, 1
mov dword [esp + 0x40], eax
jmp 0x10001c61
mov esp, ebp
pop ebp
ret
Function at 0x10074930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.10074f50
xor ecx, ecx
mov dword [0x10117794], 0xd42
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x100749a5
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x44]
mov dword [esp + 8], ecx
call fcn.10075190
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 0xf64e5
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x134e00
mov ecx, dword [ebp - 0x40]
add ecx, 0x5889c
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x20c0
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x170
mov edi, edx
add edi, esi
add edi, 0xc4
mov esi, dword [edi]
imul edi, eax, 0x170
add edx, edi
add edx, 4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
add byte [eax], al
add byte [0x348], bh
mov ecx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x100749a5
lea eax, [0x10076977]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10117794], 0x13
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
call fcn.10074d80
mov eax, dword [0x10117794]
add eax, 0x6e0
mov dword [0x10117794], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call fcn.100758b0
mov ecx, eax
mov dword [0x101177ac], eax
mov eax, esp
mov edx, dword [ebp - 0x44]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x170
mov edi, edx
add edi, esi
add edi, 0xc4
mov esi, dword [edi]
imul edi, eax, 0x170
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x170
add edx, ebx
add edx, 4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x40]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.10075830
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x348
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
je 0x1007495d
jmp 0x10074a70
Function at 0x10074e00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10074e00]
mov ecx, dword [0x10117794]
add ecx, 0x1d0d
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x10074e3a
mov eax, 0x2631
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x10074e20
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10074e20
mov eax, dword [ebp - 0x10]
mov dword [0x10117794], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret

Function at 0x10075220
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101177a0], 0
mov byte [0x101177a4], 0
mov dword [0x10117798], 0x23b0
mov dword [0x1011779c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10075278
xor eax, eax
mov dword [0x1011779c], 0
mov dword [ebp - 0x20], eax
jmp 0x100752a0
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1011779c]
add eax, 1
mov dword [0x1011779c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10075278
jmp 0x10075267
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x101177a0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
idiv ecx
mov dword [0x101177a0], edx
mov dword [0x10117794], 0x1f82
mov ecx, dword [0x1011779c]
mov edi, dword [ebp - 0x18]
mov bl, byte [edi + ecx]
mov byte [0x101177a4], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x101177a4]
mov ecx, dword [0x101177a0]
mov byte [edi + ecx], bl
mov ecx, dword [0x1011779c]
add ecx, 1
mov dword [0x1011779c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], ecx
jl 0x100752a0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100758e0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1011779c], 0
mov dword [0x101177a0], 0
mov dword [0x101177a8], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x100759eb
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x1011779c]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x1011779c], edx
mov dword [0x10117794], 0x158e
mov esi, dword [0x101177a0]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101177a0], edx
mov ecx, dword [0x1011779c]
mov bl, byte [edi + ecx]
mov byte [0x101177a4], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x101177a4]
mov ecx, dword [0x101177a0]
mov byte [edi + ecx], bl
mov ecx, dword [0x1011779c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x101177a0]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x101177a8], edx
mov dword [0x10117794], 0x1c30
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov bl, byte [ecx + esi]
xor bl, byte [edi + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], bl
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x20], esi
jne 0x1007592f
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40931c
Capabilities:
Create thread
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x409284
call fcn.004041c8
mov esi, dword [0x40a164]
xor eax, eax
push ebp
push 0x409488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40a140]
mov dword [esi], eax
mov edx, dword [0x40a160]
xor eax, eax
call fcn.004026c4
mov eax, 0x100000
call fcn.00402494
mov edx, dword [0x40a154]
mov dword [edx], eax
cmp dword [esi], 0x100000
jg 0x40946d
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004026c4
mov eax, dword [ebp - 0x14]
mov edx, 0x40
call fcn.00404904
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40946d
mov eax, dword [esi]
call fcn.00402494
mov edx, dword [0x40a14c]
mov dword [edx], eax
push 0
push 0x41803c
mov eax, dword [esi]
push eax
mov eax, dword [0x40a14c]
mov eax, dword [eax]
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
cmp eax, dword [0x41803c]
jne 0x40946d
mov eax, dword [0x40a15c]
push eax
mov ecx, dword [0x40a158]
mov edx, dword [esi]
mov eax, dword [0x40a14c]
mov eax, dword [eax]
call fcn.00405064
test al, al
je 0x40946d
call fcn.00407eb0
call fcn.00408730
test al, al
jne 0x40946d
mov ecx, 0x409498
mov edx, 0x4094a0
mov eax, 0x80000002
call fcn.004051a4
test al, al
jne 0x409439
call fcn.00408ed0
push 0x418038
push 0
push 0
push 0x408910
push 0
push 0
call sub.kernel32.dll_CreateThread
push 0x418038
push 0
push 0
push 0x408a3c
push 0
push 0
call sub.kernel32.dll_CreateThread
call fcn.00408384
lea eax, [ebp - 0x18]
call fcn.00407148
mov eax, dword [ebp - 0x18]
mov edx, dword [0x40a160]
mov edx, dword [edx]
call fcn.00406d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40948f
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403140
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41927cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x41927fb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.04193794
jmp 0x4192819
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.04192700
mov edi, eax
test ebx, ebx
je 0x4192819
cmp dword [esi], 0
je 0x4192819
dec ebx
jmp 0x4192802
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4192ae4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4192b7c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4192b5c
xor eax, eax
push ebp
push 0x4192b55
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4192b98
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4192b5c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x419436c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4194508
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x419441c
xor eax, eax
push ebp
push 0x4194415
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x41943fe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4194528
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419441c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x41944fd
cmp byte [ebp - 0xd], 0
jne 0x419445e
cmp byte [ebp - 0x12], 0
je 0x41944fd
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4194477
dec ebx
cmp byte [ebx], 0x2e
je 0x4194486
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4194476
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x41944fd
inc ebx
cmp byte [ebp - 0x12], 0
je 0x41944b3
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x41944fd
cmp byte [ebp - 0xd], 0
je 0x41944fd
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x41944fd
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419700c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4197045
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.04193794
jmp 0x419704e
mov eax, ebx
mov edx, esi
call fcn.04193748
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4197058
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4197079
mov al, byte [esp]
jmp 0x419707b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41a0404
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41a040a
ret

Function at 0x41a857c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x114], 0
je 0x41a8598
cmp dword [esi + 4], 0
je 0x41a85bf
mov eax, ebx
call fcn.041a77b0
test eax, eax
jne 0x41a85b1
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x41a86cf
mov edx, esi
mov eax, ebx
call fcn.041a8220
jmp 0x41a86cf
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41a86c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.041a9b7c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.041a66b8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.041a857c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.041a9b7c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a86cf
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ab664
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.041936b0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x41ab6c5
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
cmp byte [ebp - 0x101], 0
jne 0x41ab6c5
cmp byte [ebp - 0x102], 0
je 0x41ab6c5
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.041938dc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41aca54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x28], 0
je 0x41acad5
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41aca86
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41aca98
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x41acaa4
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.041ac8e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41acac9
push ebp
mov eax, dword [ebp - 4]
call fcn.041ac9c4
pop ecx
mov ebx, eax
cmp bl, 2
je 0x41acaa4
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ae8fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x41bd6d8
cmp dword [edi], 0
jne 0x41ae978
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x41bd6d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x41bc6f4
mov ecx, 2
call fcn.041926c0
mov edx, 0x41ae8d4
lea eax, [esi + 5]
call fcn.041ae8f4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.041ae8f4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41ae94d
mov dword [0x41bd6d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41aea9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41aeaec]
test si, 4
je 0x41aeab0
or bl, 1
test si, 8
je 0x41aeaba
or bl, 4
test si, 1
je 0x41aeac4
or bl, 8
test si, 2
je 0x41aeace
or bl, 0x10
test si, 0x10
je 0x41aead8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41aeae7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x41aeaf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41aeb28]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41aeb09
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41aeb18
or bl, 4
test esi, 0x20000000
je 0x41aeb23
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41b2be0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41b2d85
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4199efc]
call fcn.04192c3c
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.041936b0
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x41b2d5b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.041aae04
test al, al
je 0x41b2d4e
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x41b2d94
lea eax, [ebp - 0x254]
call fcn.04196e9c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41b2d4e
xor eax, eax
push ebp
push 0x41b2d47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x41b2dcc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41b2d30
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.041938dc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x41b2d30
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.041938dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b2d4e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x41b2c51
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0419c828
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b2d8c
lea eax, [ebp - 0x260]
call fcn.041936b0
ret