joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435b38
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x435b4a
add esp, 0xfffffff0
call fcn.00403bb8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041edc0
mov eax, dword [0x477198]
mov dword [eax + 4], ebx
mov dword [eax], 0x435ee4
mov eax, dword [0x4771a8]
mov dword [eax + 4], ebx
mov dword [eax], 0x435ef0
mov eax, ebx
call fcn.00435efc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x432128
push eax
push 0
push 0
mov eax, dword [0x47733c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4212f0]
call fcn.00422734
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4212f0]
call fcn.00422734
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4212f0]
call fcn.00422734
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0043632c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x436200
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x436200
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x436200
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x435c87
call fcn.00403c10
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x435fdc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x436190
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x436171
mov dl, 1
mov eax, dword [0x4167d8]
call fcn.0040387c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004045e4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
sub eax, 1
jno 0x436041
call fcn.004037ec
test eax, eax
jl 0x436160
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044a678
test al, al
je 0x436153
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4361a0
lea eax, [ebp - 0x254]
call fcn.0040996c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x436153
xor eax, eax
push ebp
push 0x43614c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4361d8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x436135
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404864
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x436135
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436153
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x436056
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ae80
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436197
lea eax, [ebp - 0x260]
call fcn.004045e4
ret

Function at 0x436bb8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x478b10]
cmp byte [eax + 0xa5], 0
jne 0x436c29
cmp dword [0x478b28], 0
jne 0x436bea
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x436b74
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x478b28], eax
cmp dword [0x478b24], 0
jne 0x436c05
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x478b24], eax
cmp dword [0x478b2c], 0
jne 0x436c29
push esp
push 0
push 0
push 0x436b18
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x478b2c], eax
pop edx
ret
Function at 0x436d20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x436d37
add esp, 0xfffffff0
call fcn.00403bb8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041edc0
mov eax, dword [0x477324]
cmp word [eax + 2], 0
jne 0x436d5f
mov eax, dword [0x477324]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004382d4
mov eax, dword [0x477404]
cmp word [eax + 2], 0
jne 0x436d79
mov eax, dword [0x477404]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00438504
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416174]
call fcn.0040387c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421aa0]
call fcn.004276e8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x436f08
mov eax, dword [0x477214]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427ab8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x438b68
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x477214]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d6ac
test eax, eax
je 0x436e70
mov edx, eax
add edx, 1
lea eax, [ebp - 0x101]
call fcn.00409360
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d6d4
test eax, eax
je 0x436e84
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404864
mov eax, dword [0x4770c4]
cmp byte [eax], 0
jne 0x436ebd
mov eax, ebx
call fcn.00437030
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00438d4c
mov eax, ebx
call fcn.0043979c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x436efd
call fcn.00403c10
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4372b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x478b10]
cmp dword [eax + 0x30], 0
je 0x43736b
cmp dword [ebx + 0x94], 0
jne 0x43735d
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x437240
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x43735d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43731a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
sub esi, 1
jno 0x43732d
call fcn.004037ec
cmp esi, 0
jl 0x43735d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004187ac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x437332
add dword [ebx + 0x94], 1
jno 0x43736b
call fcn.004037ec
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x437ef8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x437f2d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046d4
jmp 0x437f3a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404638
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x438f28
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x438f69
mov eax, esi
call fcn.00445828
test al, al
je 0x438f69
mov eax, dword [ebx + 0x84]
call fcn.00445598
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x438f69
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445598
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x43c484
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x478b74], 0
je 0x43c5dc
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4773dc]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43c5dc
mov eax, dword [0x478b78]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x478b74]
mov ebx, dword [eax + 8]
sub ebx, 1
jno 0x43c4e7
call fcn.004037ec
test ebx, ebx
jl 0x43c5ab
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x478b74]
call fcn.004187ac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43c5a3
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43c5a3
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43c5a3
mov eax, dword [ebp - 0x14]
call fcn.00445598
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43c5a3
push ebp
call fcn.0043c440
pop ecx
test al, al
jne 0x43c5a3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43c55f
mov eax, dword [ebp - 0x14]
call fcn.0044402c
dec eax
jle 0x43c5a3
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403aa8
cmp byte [ebp - 1], 0
je 0x43c5a3
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43c5a3
mov edx, dword [ebp - 0x14]
mov eax, dword [0x478b78]
call fcn.0043bbcc
inc edi
dec ebx
jne 0x43c4f2
mov eax, dword [0x478b78]
cmp dword [eax + 8], 0
jle 0x43c5c3
mov eax, dword [0x478b78]
call fcn.0043bc64
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43c5dc
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043c2a8
pop ecx
test al, al
jne 0x43c5dc
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fd44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x43fd90
mov eax, esi
call fcn.0042f108
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43fd90
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x43fd90
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x43fed5
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x43fdd0
cmp eax, 0x108
ja 0x43fdd0
mov eax, esi
call fcn.0042f108
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43fecc
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x43fed5
jmp 0x43fecc
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x43feb5
cmp eax, 0x20a
ja 0x43feb5
test byte [esi + 0x50], 0x80
jne 0x43fe09
sub eax, 0x203
je 0x43fdff
sub eax, 3
je 0x43fdff
sub eax, 3
jne 0x43fe09
sub dword [ebx], 2
jae 0x43fe09
call fcn.004037ec
mov eax, dword [ebx]
sub eax, 0x200
je 0x43fe1d
dec eax
je 0x43fe32
dec eax
je 0x43fe4f
dec eax
je 0x43fe32
jmp 0x43fe56
mov ecx, ebx
mov eax, dword [0x4773dc]
mov eax, dword [eax]
mov edx, esi
call fcn.00438de0
jmp 0x43fecc
cmp byte [esi + 0x5d], 1
jne 0x43fe48
mov eax, esi
mov si, 0xffed
call fcn.00403aa8
jmp 0x43fed5
or word [esi + 0x54], 1
jmp 0x43fecc
and word [esi + 0x54], 0xfffe
jmp 0x43fecc
mov eax, dword [0x478b30]
cmp byte [eax + 0x20], 0
je 0x43fecc
mov eax, dword [0x478b30]
cmp dword [eax + 0x1c], 0
je 0x43fecc
mov eax, dword [ebx]
mov edx, dword [0x478b30]
cmp eax, dword [edx + 0x1c]
jne 0x43fecc
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0042f04c
mov byte [ebp - 0xc], al
mov eax, dword [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403aa8
jmp 0x43fed5
cmp eax, 0xb00b
jne 0x43fecc
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0043e5a4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443674
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x443690
cmp dword [esi + 4], 0
je 0x4436bd
test byte [ebx + 0x55], 1
jne 0x4436af
mov eax, ebx
call fcn.00442148
test eax, eax
jne 0x4436af
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4437cd
mov edx, esi
mov eax, ebx
call fcn.00443108
jmp 0x4437cd
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4437c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00445598
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043fc6c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00443674
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00445598
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4437cd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a318
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4775b8]
cmp byte [eax + 0xc], 0
je 0x44a485
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a47e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x478b84], 0
jne 0x44a36c
push 0x44a48c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44a494
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b84], eax
cmp dword [0x475bd8], 0
jne 0x44a467
push 0x44a4a4
call sub.kernel32.dll_LoadLibraryA
mov dword [0x475bd8], eax
cmp dword [0x475bd8], 0
je 0x44a467
push 0x44a4b0
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b88], eax
push 0x44a4c0
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b8c], eax
push 0x44a4d4
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b90], eax
push 0x44a4ec
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b94], eax
push 0x44a504
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b98], eax
push 0x44a518
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478b9c], eax
push 0x44a530
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478ba0], eax
push 0x44a548
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478ba4], eax
push 0x44a564
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478ba8], eax
push 0x44a570
mov eax, dword [0x475bd8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x478bac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a485
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44e324
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004045e4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44e373
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404864
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459c44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x459caf
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
test eax, eax
jns 0x459c7d
call fcn.004037e4
push eax
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404864
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00459c2c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459cb6
lea eax, [ebp - 0xc]
call fcn.004045e4
ret

Function at 0x45a4b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x45a5fc
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 0xd], 0
cmp byte [0x475e40], 0
jne 0x45a4f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a658
xor esi, esi
xor edi, edi
mov eax, dword [ebp - 0xc]
sub eax, 1
jae 0x45a502
call fcn.004037ec
test eax, eax
jb 0x45a5ee
inc eax
mov dword [ebp - 0x14], eax
xor edx, edx
add esi, 1
jae 0x45a51a
call fcn.004037ec
and esi, 0xff
cmp esi, 0xff
jbe 0x45a52d
call fcn.004037e4
xor eax, eax
mov al, byte [esi + 0x478c38]
add edi, eax
jae 0x45a53e
call fcn.004037ec
and edi, 0xff
cmp edi, 0xff
jbe 0x45a551
call fcn.004037e4
mov cl, byte [edi + 0x478c38]
cmp esi, 0xff
jbe 0x45a564
call fcn.004037e4
mov byte [esi + 0x478c38], cl
cmp eax, 0xff
jbe 0x45a576
call fcn.004037e4
cmp edi, 0xff
jbe 0x45a583
call fcn.004037e4
mov byte [edi + 0x478c38], al
cmp esi, 0xff
jbe 0x45a596
call fcn.004037e4
xor ecx, ecx
mov cl, byte [esi + 0x478c38]
add eax, ecx
jae 0x45a5a7
call fcn.004037ec
and eax, 0xff
cmp edx, 0x7fff
jbe 0x45a5b9
call fcn.004037e4
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
cmp eax, 0xff
jbe 0x45a5cb
call fcn.004037e4
xor cl, byte [eax + 0x478c38]
cmp edx, 0x7fff
jbe 0x45a5de
call fcn.004037e4
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x14]
jne 0x45a510
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a658
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f35c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45f3ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp byte [esi + 0x30], 0
jne 0x45f3a3
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004086d8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404638
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x34]
call fcn.004089ac
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
call fcn.00404bf8
mov esi, eax
push ebx
mov ecx, esi
sub ecx, 1
jno 0x45f3c7
call fcn.004037ec
mov eax, dword [ebx]
mov edx, 1
call fcn.00404b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f3f5
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404608
ret

Function at 0x460670
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x46084c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x46086b
add edx, 3
sar edx, 2
test edx, edx
jle 0x460978
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4608a1
je 0x4608e1
sub ecx, 0x2b
je 0x4608d7
sub ecx, 4
je 0x4608dc
dec ecx
sub ecx, 0xa
jb 0x4608ca
jmp 0x4608e4
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4608b3
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4608bd
jmp 0x4608e4
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4608e4
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4608e4
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4608e4
mov byte [eax], 0x3e
jmp 0x4608e4
mov byte [eax], 0x3f
jmp 0x4608e4
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x460883
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x460935
cmp byte [esp + 7], 0xff
jne 0x460935
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x46096d
cmp dl, 0xff
je 0x46096d
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x46087a
add esp, 0x10
pop ebp
pop edi
pop esi
ret