joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b99e
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x30]
mov edi, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.00409c59
lea ecx, [ebp - 0x20]
call fcn.00409c59
lea ecx, [ebp - 0x40]
call fcn.00409c59
push 0x4b38f4
lea ecx, [ebp - 0x30]
call fcn.004045de
push esi
lea ecx, [ebp - 0x30]
call fcn.00403e34
push str.CLSID
lea ecx, [ebp - 0x30]
call fcn.00403e34
lea ecx, [ebp - 0x20]
call fcn.00408a3d
test edi, edi
je 0x43ba21
push 0x5c
pop eax
cmp word [edi], ax
je 0x43ba21
cmp word [edi + 2], ax
je 0x43ba21
push 0x4b3928
lea ecx, [ebp - 0x20]
call fcn.004045de
push edi
lea ecx, [ebp - 0x20]
call fcn.00403e34
cmp dword [ebp + 0xc], ebx
je 0x43ba72
push 0x20
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.00422430
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], ebx
call fcn.00408eac
push str.IPC_
lea ecx, [ebp - 0x40]
call fcn.00403e34
mov eax, dword [ebp - 0x40]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
js 0x43bafe
lea eax, [ebp - 0x10]
push eax
push reloc.WSOCK32.dll_bind
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x43bafe
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x43baf9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43baf4
mov eax, dword [ebp - 0xc]
push dword [ebp + 8]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov word [ebp + eax*2 - 0x26c], cx
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov esi, eax
push dword [ebp - 8]
call edi
push dword [ebp - 0x10]
call edi
lea ecx, [ebp - 0x40]
call fcn.00406e3b
lea ecx, [ebp - 0x20]
call fcn.00406e3b
lea ecx, [ebp - 0x30]
call fcn.00406e3b
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43c2b5
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
xor ebx, ebx
push ebx
push dword [eax]
mov edi, ecx
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43c30c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43c30f
push dword [esi]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x43c30f
push esi
push dword [esi]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x43c30f
xor ebx, ebx
inc ebx
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x43c759
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
call fcn.0043c47e
test al, al
je 0x43c76b
pop ebp
jmp fcn.0043c4b7
pop ebp
jmp fcn.0043c771

Function at 0x43c902
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0x14]
push dword [ebp + 0x1c]
and eax, 2
push 0
or eax, 4
shr eax, 1
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
neg eax
sbb eax, eax
neg eax
pop ebp
ret 0x18

Function at 0x43ca64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov ebx, eax
push 0
push ebx
call edi
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push 0
push 0
lea eax, [ebx + 8]
push eax
call edi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + 4], eax
xor eax, eax
push eax
push eax
push ebx
push 0x43cad5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x43ce0c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov esi, ecx
push 0xb0
push dword [esi]
mov dword [ebp - 0x10], esi
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x43ce3c
xor al, al
jmp 0x43ceb6
push ebx
xor ebx, ebx
push ebx
push ebx
push 0xe
push dword [esi]
call edi
mov edi, eax
test edi, edi
je 0x43ceb3
cmp edi, dword [ebp - 8]
jb 0x43ceb3
cmp edi, dword [ebp - 4]
jb 0x43ceb3
xor ecx, ecx
push 2
lea esi, [edi + 1]
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bca
pop ecx
push eax
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0xc]
test eax, eax
je 0x43cea8
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x43ce97
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.004045de
mov bl, 1
push esi
call fcn.00420c3e
pop ecx
mov al, bl
jmp 0x43ceb5
xor al, al
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x43d854
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 1
push dword [esi]
mov dword [ebp - 4], esi
call fcn.0043ea60
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 1
push eax
cmp dword [ebp + 8], ebx
jge 0x43d8ac
push 0x25
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x43d8d4
push 0x27
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
mov edi, dword [ebp - 4]
push 0x101
push dword [edi]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [edi]
call fcn.0043ea60
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 4

Function at 0x43e092
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp byte [ebp + 0xc], 1
jne 0x43e0bd
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43e0d6
push 1
jmp 0x43e0be
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8

Function at 0x43ec10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00408a3d
push dword [ebx]
call fcn.00418fcd
test al, al
je 0x43ec32
xor al, al
jmp 0x43ecae
mov ecx, ebx
call fcn.0043ecb5
test eax, eax
mov ecx, 0x7fff
cmove eax, ecx
mov dword [ebp - 8], eax
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420bca
pop ecx
mov edi, eax
push edi
push esi
push 0xd
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x43eca5
push edi
call fcn.00422eb0
pop ecx
push edi
cmp eax, dword [ebp - 8]
jne 0x43ec9d
lea ecx, [ebp - 0x18]
call fcn.0043ea1d
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.00408aa0
lea ecx, [ebp - 0x18]
call fcn.00406e3b
jmp 0x43eca5
mov ecx, dword [ebp + 8]
call fcn.004045de
push edi
call fcn.00420c3e
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x443ae3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [ebx]
push edi
mov edi, dword [ebp + 8]
lea eax, [ecx + 4]
mov esi, dword [ecx + edi]
mov dword [ebx], eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
mov dword [ebp + 8], esi
neg ecx
or ecx, eax
push ecx
call fcn.00420bca
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
push esi
push ecx
mov edi, eax
push edi
call fcn.00420560
mov ecx, dword [ebp + 8]
add dword [ebx], esi
xor eax, eax
add esp, 0x10
mov word [esi + edi], ax
test ecx, ecx
jle 0x443b3e
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x443b35
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x443fa3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x444046
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44412b
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x443feb
cmp byte [ebp - 0xf0], al
jne 0x443ff4
cmp byte [edi + 0x1a], 0
jne 0x443ff4
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x444003
cmp byte [edi + 0x1b], 0
jne 0x444003
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x444015
cmp byte [edi + 0x1c], 0
jne 0x444015
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x444027
cmp byte [edi + 0x1d], 0
jne 0x444027
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x44412b
cmp byte [edi + 0x1e], 0
jne 0x44412b
mov byte [esi + 4], 1
jmp 0x44412b
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444073
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x44407c
cmp byte [edi + 0x1a], 0
jne 0x44407c
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4440a2
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x4440ac
cmp byte [edi + 0x1b], 0
jne 0x4440ac
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4440cc
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x4440d6
cmp byte [edi + 0x1c], 0
jne 0x4440d6
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4440f6
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x444100
cmp byte [edi + 0x1d], 0
jne 0x444100
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x444120
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x44412a
cmp byte [edi + 0x1e], 0
jne 0x44412a
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x444d4f
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x444db0
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004455cf
mov ecx, dword [ebp - 4]
call fcn.00443f87
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004455cf
mov ecx, dword [ebp - 4]
call fcn.00443f6c
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x444db8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, word [edi + 8]
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
mov byte [ebp - 8], bl
mov byte [ebp - 4], bh
mov dword [ebp - 0xc], eax
je 0x444ea3
cmp bl, 0x14
je 0x444ea3
cmp bl, 0x90
je 0x444ea3
cmp bl, 0x91
je 0x444ea3
mov ecx, edi
call fcn.00444276
test al, al
je 0x444e8a
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x444e34
movzx eax, bl
or byte [ebp + eax - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 1
call fcn.004441b6
cmp al, 1
jne 0x444e4f
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x444e60
cmp byte [esi + 0x1d], 0
jne 0x444e60
cmp bl, 0x12
jne 0x444e7e
cmp byte [esi + 0x16], 0
jne 0x444e7e
cmp byte [esi + 0x1c], 0
jne 0x444e7e
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x104
jmp 0x444e98
movzx eax, bl
push edi
push eax
push 0x100
jmp 0x444e98
mov eax, dword [ebp - 0xc]
movzx eax, ax
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x444eff
mov ecx, edi
call fcn.00444276
test al, al
je 0x444ecf
mov ecx, edi
call fcn.004441b6
push ecx
mov ecx, esi
cmp al, 1
jne 0x444ec0
push 1
jmp 0x444ec2
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004455cf
jmp 0x444eff
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x24], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x22], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x28]
inc ecx
push eax
push ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00443f87
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x444f0d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov bl, byte [edi]
cmp dword [esi + 0x20], 0
mov bh, byte [edi + 7]
mov byte [ebp - 4], bl
mov byte [ebp - 8], bh
je 0x444fe8
cmp bl, 0x14
je 0x444fe8
cmp bl, 0x90
je 0x444fe8
cmp bl, 0x91
je 0x444fe8
mov ecx, edi
call fcn.00444276
test al, al
je 0x445044
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x444f86
movzx eax, bl
xor byte [ebp + eax - 0x124], 0x80
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, dword [ebp + 8]
movzx edi, bh
shl edi, 0x10
or edi, 0xc0000001
call fcn.004441b6
cmp al, 1
jne 0x444fa4
or edi, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x444fb5
cmp byte [esi + 0x1d], 0
jne 0x444fb5
cmp bl, 0x12
jne 0x444fd3
cmp byte [esi + 0x16], 0
jne 0x444fd3
cmp byte [esi + 0x1c], 0
jne 0x444fd3
or edi, 0x20000000
movzx eax, bl
push edi
push eax
push 0x105
jmp 0x444fdd
movzx eax, bl
push edi
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x445044
mov ecx, edi
call fcn.00444276
test al, al
je 0x445014
mov ecx, edi
call fcn.004441b6
push ecx
mov ecx, esi
cmp al, 1
jne 0x445005
push 3
jmp 0x445007
push 2
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004455cf
jmp 0x445044
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x20], ax
movzx eax, word [edi + 8]
mov word [ebp - 0x1e], ax
push 0x1c
xor ecx, ecx
lea eax, [ebp - 0x24]
inc ecx
push eax
push ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 6
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.00443f6c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44506f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x4450a0
cmp byte [esi + 1], 0
jne 0x4450a0
cmp byte [esi + 2], 0
jne 0x4450a0
cmp byte [esi + 3], 0
jne 0x4450a0
cmp byte [esi + 4], 0
je 0x44524e
cmp dword [edi + 0x20], 0
push ebx
je 0x4451d6
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4451d6
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44512a
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x4450e8
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x4450f9
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x445105
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x445111
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x44511d
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x44513b
cmp byte [esi + 1], 0
je 0x445152
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x44516f
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4451b3
cmp byte [esi + 2], 0
jne 0x445198
cmp byte [edi + 0x1c], 0
jne 0x445198
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x4451ae
test al, al
je 0x4451b3
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x445246
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x445246
xor ebx, ebx
cmp byte [esi], bl
je 0x4451ef
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 1], bl
je 0x445207
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 2], bl
je 0x44521c
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 3], bl
je 0x445231
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 4], bl
je 0x445246
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004455cf
mov ecx, edi
call fcn.00443f87
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x445254
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [esi], 0
mov edi, ecx
jne 0x445285
cmp byte [esi + 1], 0
jne 0x445285
cmp byte [esi + 2], 0
jne 0x445285
cmp byte [esi + 3], 0
jne 0x445285
cmp byte [esi + 4], 0
je 0x445441
cmp dword [edi + 0x20], 0
push ebx
je 0x4453c3
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4453c3
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44530f
cmp byte [esi], 0
mov al, byte [ebp - 0xf0]
mov ecx, 0x80
je 0x4452cd
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x4452de
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x4452ea
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x4452f6
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x445302
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x445320
cmp byte [esi + 1], 0
je 0x445339
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x445358
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x44539e
cmp byte [esi + 2], 0
jne 0x445381
cmp byte [edi + 0x1c], 0
jne 0x445381
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x445399
test al, al
je 0x44539e
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x445439
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x445439
cmp byte [esi], 0
push 2
pop ebx
je 0x4453de
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 1], 0
je 0x4453f7
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 2], 0
je 0x44540d
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 3], 0
je 0x445423
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004455cf
cmp byte [esi + 4], 0
je 0x445439
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004455cf
mov ecx, edi
call fcn.00443f6c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x445447
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x4454d3
jne 0x44545b
push 0
jmp 0x4454cd
cmp esi, 0xf
jae 0x4454cc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4454cc
movd xmm0, esi
cvtdq2pd xmm0, xmm0
shr esi, 0x1f
addsd xmm0, qword [esi*8 + 0x4b7590]
movsd qword [ebp - 0x28], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.0041fb1a
movsd xmm1, qword [ebp - 0x20]
divsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x28]
comisd xmm0, xmm1
ja 0x445487
jmp 0x4454d3
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret 4

Function at 0x445623
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x445647
xor al, al
jmp 0x44568c
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x445643
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x445677
mov byte [esi + 1], 1
test bl, 2
je 0x445680
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x44568a
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x4472ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.0044707e
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
leave
ret 8