joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x678828
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x71d5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x55e3fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x55e3fa
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x55e3fa
mov esi, dword [edi + 8]
imul esi, dword [edi + 4]
add esi, esi
add esi, esi
cmp word [edi + 0xe], 0x20
mov dword [ebp - 0x14], 0
jne 0x55e478
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + 0x28]
cmp eax, ecx
jb 0x55e478
lea ecx, [ebp - 0x2c]
call fcn.00413b77
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00414282
push 0x34
call fcn.0050102f
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x55e40e
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00414303
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x28
push edi
push 0x28
push ebx
call fcn.005000fd
add esp, 0x10
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov dword [ebx + 0x14], esi
mov eax, dword [ebp - 0x28]
push ebx
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x55e45d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x55e45d
push esi
add edi, 0x28
push edi
push eax
call fcn.0051e240
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x14], ecx
push ebx
call fcn.00500ff5
add esp, 4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00414303
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5627a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x678e40
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x71d5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0xe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x5628e9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5628d3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x562960
xor ebx, ebx
cmp ax, word [esi + 4]
jb 0x562832
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov esi, ecx
lea ecx, [ebp - 0x34]
call fcn.0055e4d0
mov edx, dword [ebp + 0x18]
movzx eax, bx
lea ecx, [eax*8]
sub ecx, eax
movzx edi, byte [esi + ecx*2 + 7]
lea eax, [esi + ecx*2]
movzx esi, byte [eax + 6]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 4], 0
cmp ecx, esi
jne 0x562867
cmp edx, edi
je 0x56286f
test ecx, ecx
jne 0x5628a2
test edx, edx
jne 0x5628a2
movzx edx, word [eax + 0x12]
mov eax, dword [ebp + 8]
push 0
push edi
push esi
push edx
push eax
lea ecx, [ebp - 0x34]
call fcn.005604a0
test eax, eax
je 0x5628c4
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x10]
push edi
push esi
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.005625c0
test eax, eax
je 0x5628c4
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00560490
mov ecx, dword [ebp + 0xc]
inc ebx
cmp bx, word [ecx + 4]
jb 0x562830
jmp 0x562813
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00560490
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x58]
call fcn.0055e4d0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push 0
push edx
push eax
push edi
push esi
mov dword [ebp - 4], 1
call fcn.005604a0
test eax, eax
jne 0x562932
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.00560490
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push eax
push ecx
lea edx, [ebp - 0x58]
push edx
mov ecx, ebx
call fcn.005625c0
lea ecx, [ebp - 0x58]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00560490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x56b100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6794e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x71d5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov ecx, edi
call fcn.005264f0
push eax
lea eax, [ebp + 0x10]
push eax
mov ecx, esi
call fcn.0042179b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push 0xc5c5c5
push 1
sub ecx, eax
push ecx
dec edx
push edx
push eax
mov ecx, esi
call fcn.004219f2
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0053d760
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x1c]
push 0xfffffffffffffff6
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [esi]
push 0x2c
mov ecx, edi
mov dword [ebp - 0x24], eax
call fcn.005264f0
mov edx, dword [ebp - 0x24]
push eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, ebx
call fcn.0058d7c0
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
push 0x8024
lea edi, [ebp - 0x20]
push edi
push ecx
push eax
mov eax, dword [edx + 0x68]
mov ecx, esi
mov byte [ebp - 4], 1
call eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56b207
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.0053d7e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005000ee
mov esp, ebp
pop ebp
ret 0x18
Function at 0x572270
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push eax
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [ebp - 4]
push ecx
push 4
push esi
push 0x5721f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
test eax, eax
je 0x5722bf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5722d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xc], edi
je 0x572356
mov eax, dword [esi + 0x14]
push ebx
push eax
mov dword [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [ebp - 4]
push ecx
push edx
mov dword [ebp - 4], edi
call ebx
test eax, eax
je 0x572344
jmp 0x572310
cmp dword [ebp - 4], 0x103
jne 0x572344
mov eax, dword [esi + 0xc]
inc edi
cmp edi, 0xa
ja 0x57233b
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0xc]
lea ecx, [ebp - 4]
push ecx
push edx
call ebx
test eax, eax
jne 0x572310
jmp 0x572344
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x573060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x5730fa
mov eax, dword [ebp + 8]
shr eax, 8
push edi
mov edi, dword [esi + 0x34]
cmp al, 2
jne 0x5730f9
test edi, edi
je 0x5730f9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
lea eax, [esi + 4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x5730ae
mov edx, dword [ebx]
mov eax, dword [edx + 0x24]
mov ecx, ebx
call eax
cmp dword [eax + 0x14], 0
jne 0x5730ae
mov eax, dword [edi + 0x2c]
jmp 0x5730d2
mov ecx, dword [esi + 0x34]
cmp dword [ecx + 0x58], 0
mov ecx, dword [ebp + 0x10]
jne 0x5730bd
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x5730d0
add ecx, dword [edi + 0x3c]
cmp eax, ecx
jl 0x5730d2
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00572f90
cmp dword [ebp + 8], 0x202
je 0x5730f0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x5730f9
push 0
mov ecx, ebx
call fcn.00572f00
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5767d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679c0d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x71d5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0059e2b0
xor ebx, ebx
xor eax, eax
xor ecx, ecx
push 0x3c
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CXTPCommandBarsFrameHook.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 8], ebx
call fcn.00407dd2
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x576863
mov ecx, eax
call fcn.005e8fa0
jmp 0x576865
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.WM_SKINFRAMEWORK_UPDATESTATE
mov byte [ebp - 4], bl
mov dword [esi + 0x58], eax
call edi
push str.WM_SKINFRAMEWORK_QUERYSTATE
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
cmp dword [0x72ba48], ebx
jne 0x576899
push str.WM_GETFRAMEHOOK
call edi
mov dword [0x72ba48], eax
push 0x44
mov dword [esi + 0x48], ebx
call fcn.00407dd2
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x5768ba
mov ecx, eax
call fcn.00557da0
jmp 0x5768bc
xor eax, eax
push 0x14
push 0xf060
mov ecx, esi
mov byte [ebp - 4], bl
mov dword [esi + 0x2c], eax
call fcn.00575cc0
push 9
push 0xf030
mov ecx, esi
call fcn.00575cc0
push 9
push 0xf120
mov ecx, esi
call fcn.00575cc0
push 8
push 0xf020
mov ecx, esi
call fcn.00575cc0
push 0x575de0
push esi
call fcn.005767a0
add esp, 8
push eax
push 0x294f
call fcn.005ce750
mov ecx, eax
call fcn.005cce40
mov ecx, dword [esi + 0x58]
push eax
call fcn.005e99b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x576940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679c38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x71d5e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push esi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call fcn.0059f950
mov ecx, eax
call fcn.0059fbb0
cmp dword [esi + 0xc], edi
je 0x5769ec
cmp dword [esi + 0x48], edi
je 0x5769be
lea ecx, [ebp - 0xd]
call fcn.0060ab00
mov ecx, dword [esi + 0xc]
push edi
push edi
push edi
push edi
push ecx
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0059c140
lea ecx, [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
call fcn.005cceb0
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0xc]
push edi
push edi
push edx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0xc]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov edx, dword [esi + 0xc]
push 0x37
push edi
push edi
push edi
push edi
push edi
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
mov dword [esi + 0xc], edi
mov dword [esi + 0x48], edi
call fcn.00576610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x578330
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov ecx, 7
mov esi, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x410
push ecx
call edi
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffe00
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ecx
cmp edx, 0xd
ja 0x57838a
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
shl edx, 0x10
lea ecx, [ebp - 0x24]
push ecx
or edx, eax
push 0
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x20]
push 0x407
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5784c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x71d5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
mov ebx, ecx
call esi
test ax, ax
js 0x5785e6
push 2
call esi
test ax, ax
js 0x5785e6
push 4
call esi
test ax, ax
js 0x5785e6
push edi
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [ebx + 0x7c], edi
jle 0x5785bb
lea ecx, [ecx]
test edi, edi
js 0x5785e1
cmp edi, dword [ebx + 0x7c]
jge 0x5785e1
mov ecx, dword [ebx + 0x78]
mov esi, dword [ecx + edi*4]
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5785b1
mov eax, dword [esi + 0x20]
push eax
call fcn.0040cf29
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], edx
test byte [esi + 8], 1
lea ecx, [ebp - 0x14]
push ecx
je 0x57857c
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x578583
mov ecx, eax
call fcn.00414022
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push edx
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x5785b1
test byte [esi + 8], 1
jne 0x5785ce
lea edx, [ebp - 0x1c]
push edx
push 0
mov ecx, ebx
call fcn.005777e0
cmp eax, dword [esi + 0x20]
je 0x5785ce
inc edi
cmp edi, dword [ebx + 0x7c]
jl 0x578520
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000ee
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000ee
mov esp, ebp
pop ebp
ret
call fcn.00409f06
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.005000ee
mov esp, ebp
pop ebp
ret
Function at 0x5797b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679dcd
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x71d5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x168], esi
call fcn.0041231e
xor ebx, ebx
mov dword [esi], vtable.CXTPToolTipContext.0
lea edi, [esi + 0x44]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x98], vtable.CFont.0
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa0], vtable.CFont.0
push ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x60], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
push 0x2c
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x64]
push ebx
push eax
call fcn.005036f0
add esp, 0xc
call fcn.005717a0
mov ecx, eax
call fcn.00572b50
push ebx
push ebx
push ebx
mov dword [esi + 0x34], eax
or eax, 0xffffffff
push ebx
push edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x38], 1
mov dword [esi + 0x40], 2
call dword [sym.imp.USER32.dll_SetRect]
push 0x154
or eax, 0xffffffff
lea ecx, [ebp - 0x164]
push ebx
push ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
call fcn.005036f0
add esp, 0xc
push ebx
lea edx, [ebp - 0x164]
push edx
push 0x154
push 0x29
mov dword [ebp - 0x164], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov dword [ebp - 0x78], 0x190
call fcn.00591530
mov ecx, eax
call fcn.00590f70
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov byte [ebp - 0x71], al
lea eax, [ebp - 0x88]
push eax
call edi
push eax
lea ecx, [esi + 0x98]
call fcn.00414556
lea ecx, [ebp - 0x88]
push ecx
mov dword [ebp - 0x78], 0x2bc
call edi
push eax
lea ecx, [esi + 0xa0]
call fcn.00414556
mov dword [esi + 0xa8], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005000ee
mov esp, ebp
pop ebp
ret
Function at 0x57dd20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov ecx, dword [esi + 0xd8]
call fcn.00556920
mov ebx, eax
mov eax, dword [esi + 0xb0]
cmp eax, 0xffffffff
je 0x57dd85
cmp dword [esi + 0xdc], 5
jne 0x57dd85
cmp dword [esi + 0xd4], 1
jne 0x57dd85
test ebx, ebx
je 0x57dd62
cmp dword [ebx + 0x40], eax
je 0x57dd85
cmp eax, dword [esi + 0xac]
jne 0x57dd7a
mov edx, dword [esi]
mov eax, dword [edx + 0x16c]
push 0
push 0xffffffffffffffff
mov ecx, esi
call eax
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0057d400
mov ecx, esi
test ebx, ebx
je 0x57de65
push edi
call fcn.0057bf90
test eax, eax
jne 0x57de4a
mov edx, dword [ebx]
mov eax, dword [edx + 0xd8]
mov ecx, ebx
call eax
test eax, eax
je 0x57de4a
push esi
push 0x71faa0
call fcn.00418d79
add esp, 8
test eax, eax
je 0x57de4a
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x57de4a
mov ecx, esi
call fcn.0057bf60
mov edi, eax
test edi, edi
je 0x57de4a
cmp dword [edi + 0x60], 0
je 0x57de4a
mov ecx, dword [edi + 0x74]
cmp dword [ecx + 0x44], 0
je 0x57de4a
push 1
mov ecx, edi
call fcn.0051fc20
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0057d400
mov edx, dword [esi]
mov eax, dword [edx + 0x16c]
push 0
push 0xffffffffffffffff
mov ecx, esi
call eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x110]
push eax
push ecx
mov ecx, ebx
call edx
push 0
mov ecx, edi
call fcn.0051fc20
mov eax, dword [edi]
mov edx, dword [eax + 0x54]
push 0
mov ecx, edi
call edx
mov ecx, edi
call fcn.0051f990
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0xf4]
push ecx
push edx
mov ecx, ebx
call eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.0040ce83
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x588060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
cmp ebx, 0x112
ja 0x5881a1
je 0x5880f7
mov eax, ebx
sub eax, 2
je 0x5880b2
sub eax, 3
je 0x58808e
sub eax, 0x42
jne 0x588299
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x124]
jne 0x588299
mov ecx, dword [esi - 0x54]
push 0
push 0x2fbf
push 0x113
push ecx
jmp 0x588293
cmp dword [esi + 0x128], 0
je 0x588299
lea ecx, [esi - 0x74]
call fcn.0057d610
test eax, eax
je 0x5880ce
mov eax, dword [eax + 0x20]
cmp dword [ebp + 8], eax
jne 0x588299
mov edx, dword [esi + 0x128]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x128], 0
jmp 0x588299
lea edi, [esi - 0x74]
mov ecx, edi
call fcn.00555150
test eax, eax
je 0x588299
push 0x51e4e0
mov ecx, 0x72ba3c
call fcn.00420cbd
test eax, eax
jne 0x588121
call fcn.00409f06
cmp dword [eax + 4], 0
jg 0x588299
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x588299
mov ecx, edi
call fcn.0057bf90
test eax, eax
jne 0x588299
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
and edx, 0xfff0
cmp edx, 0xf100
jne 0x588299
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x588299
mov edx, dword [edi]
mov eax, dword [edx + 0x21c]
push 0x12
mov ecx, edi
call eax
test eax, eax
jne 0x588195
mov ecx, edi
call fcn.0057bf60
test eax, eax
je 0x588195
push 0
push edi
mov ecx, eax
call fcn.0051fce0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14
cmp ebx, 0x220
jb 0x588299
cmp ebx, 0x222
jbe 0x588283
cmp ebx, 0x230
jne 0x588299
mov edx, dword [esi - 0x74]
mov eax, dword [edx + 0x184]
lea edi, [esi - 0x74]
mov ecx, edi
call eax
mov ecx, edi
test eax, eax
je 0x588260
call fcn.0057bf90
test eax, eax
je 0x58820f
mov ecx, edi
call fcn.0057d610
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x14
test dword [esi + 0x54], 0x400
mov ebx, dword [ebp + 0x10]
jne 0x588235
mov eax, dword [ebx]
test eax, eax
jne 0x58822d
mov esi, dword [esi + 0x128]
test esi, esi
je 0x588235
mov eax, esi
push eax
mov ecx, edi
call fcn.00587ad0
mov ecx, edi
call fcn.0057d610
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, edi
call fcn.00587a00
pop edi
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x14
call fcn.0057d610
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x6c]
call eax
test eax, eax
jne 0x588299
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebx
pop ebp
ret 0x14
mov edx, dword [esi - 0x54]
push 0
push 0x2fbf
push 0x113
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push ebx
push eax
mov ecx, esi
call fcn.0057d540
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x58d290
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xa8]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret