joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bdd64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.005bdd14
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x5c719c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c71ae
add esp, 0xfffffff0
call fcn.00408518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2134
mov eax, dword [0x657358]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c7668
mov eax, dword [0x657368]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c7674
mov eax, ebx
call fcn.005c7680
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5c1b54
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c7c5c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7a8c
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7a8c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7a8c
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7a8c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c7a8c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c732e
call fcn.00408570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c782c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c79d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c79b8
mov dl, 1
mov eax, dword [0x48dc8c]
call fcn.004b175c
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409cfc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c79a7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.006034f8
test al, al
je 0x5c799a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c79e8
lea eax, [ebp - 0x394]
call fcn.00424124
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c799a
xor eax, eax
push ebp
push 0x5c7993
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c7a58
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c797c
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a910
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c797c
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c799a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c789d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b1680
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c79de
lea eax, [ebp - 0x3a0]
call fcn.00409cfc
ret

Function at 0x5c85e4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x65e10c]
cmp byte [eax + 0xc5], 0
jne 0x5c8656
cmp dword [0x65e130], 0
jne 0x5c8616
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x656d48]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x65e130], eax
cmp dword [0x65e12c], 0
jne 0x5c8631
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x65e12c], eax
cmp dword [0x65e134], 0
jne 0x5c8656
push esp
push 0
push 0
mov eax, dword [0x656d44]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x65e134], eax
pop edx
ret
Function at 0x5c8a78
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c8a8f
add esp, 0xfffffff0
call fcn.00408518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2134
mov eax, dword [0x6571d8]
cmp byte [eax], 0
jne 0x5c8abc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x65758c]
cmp word [eax + 2], 0
jne 0x5c8ad6
mov eax, dword [0x65758c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cae6c
mov eax, dword [0x657700]
cmp word [eax + 2], 0
jne 0x5c8af0
mov eax, dword [0x657700]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cb070
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4ec6b8]
call fcn.004f2d98
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5cb5e8
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f160c]
call fcn.004fd080
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c8ce0
mov eax, dword [0x65741c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fd59c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5cb8d0
mov dl, 1
mov eax, dword [0x48a0fc]
call fcn.00407e60
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x65741c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00423f24
test eax, eax
je 0x5c8c0a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00423d7c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423f08
test eax, eax
je 0x5c8c22
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a910
push ebx
push 0x5ca848
call fcn.005bdc64
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6571d8]
cmp byte [eax], 0
jne 0x5c8c73
mov eax, ebx
call fcn.005c8ec4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005cbb08
mov eax, ebx
call fcn.005cc7a8
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c8cd7
call fcn.00408570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c9208
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c92aa
cmp dword [ebx + 0xac], 0
jne 0x5c92a4
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c9144
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c92a4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c926a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c92a4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004acae8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c9279
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c9564
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x65e10c]
cmp dword [eax + 0x188], 0
je 0x5c96de
test bl, bl
jne 0x5c9629
cmp dword [esi + 0xb4], 0
jne 0x5c961e
mov eax, esi
call fcn.005cc5f8
push eax
push 0x5c9458
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c95ef
mov eax, dword [0x65e10c]
cmp byte [eax + 0xeb], 0
je 0x5c95ef
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c95d0
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c95ef
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c95d8
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c961e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acae8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c95fe
inc dword [esi + 0xb4]
jmp 0x5c96de
cmp dword [esi + 0xb4], 0
jle 0x5c96de
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c96de
cmp dword [esi + 0x58], 0
je 0x5c9693
mov eax, dword [0x65e10c]
cmp byte [eax + 0xeb], 0
je 0x5c9693
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c9674
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c9693
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c967c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c96c2
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acae8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c96a2
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ba4a8]
call fcn.0040c214
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5ca37c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ca3d9
cmp byte [ebx + 0xeb], 0
jne 0x5ca3d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e84
mov eax, dword [esi]
test eax, eax
je 0x5ca3c6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ca3e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0dc
jmp 0x5ca3e6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0dc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cbd1c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5cbd8d
mov eax, esi
call fcn.005fcfc4
test al, al
je 0x5cbd8d
mov eax, dword [ebx + 0x98]
call fcn.005fcbf0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5cbd8d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5cbd7e
push 0
mov eax, dword [ebx + 0x98]
call fcn.005fcbf0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005f35ec
jmp 0x5cbd8d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005cbb28
pop esi
pop ebx
ret
Function at 0x5d2cf8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d2d76
mov eax, dword [ebx + 8]
call fcn.005fcbf0
mov ecx, eax
mov dl, 1
mov eax, dword [0x51c90c]
call fcn.005f6cac
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00528880
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d25c8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005fcbf0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005fcbf0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d2df0
mov eax, dword [ebx + 8]
call fcn.005fcbf0
mov ecx, eax
mov dl, 1
mov eax, dword [0x51c90c]
call fcn.005f6cac
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00528880
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d2614
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005fcbf0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005fcbf0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d2e5e
mov eax, dword [ebx + 8]
call fcn.005fcbf0
mov ecx, eax
mov dl, 1
mov eax, dword [0x51d3a8]
call fcn.005f6cac
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005fcbf0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005fcbf0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5dc8ac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409cfc
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5dc8fe
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5dc8f7
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a910
jmp 0x5dc8fe
mov eax, esi
call fcn.00409cfc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5e2358
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e24b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x656ed8], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4e6878]
call fcn.004e79c4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5e248d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004e7aac
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a910
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5e24d0
call fcn.0040aac0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004e7d38
test al, al
je 0x5e2477
lea ecx, [ebp - 4]
mov edx, 0x5e2544
mov eax, dword [ebp - 0xc]
call fcn.004e85c4
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042bb9c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5e2477
xor edx, edx
push ebp
push 0x5e2470
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5e255c
mov eax, dword [ebp - 8]
push eax
call fcn.00414c60
test eax, eax
je 0x5e2459
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5e2459
call fcn.005e22e4
test eax, eax
je 0x5e2449
mov eax, dword [ebx + 0x50]
jmp 0x5e244c
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x656ed8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e2477
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e2494
mov eax, dword [ebp - 0xc]
call fcn.00407e90
ret

Function at 0x5e25c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5e2607
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5e25ea
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5e25fb
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5e2607
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5f0a18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x65e1b0], 0
je 0x5f0b59
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x6576b8]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x5f0b59
mov eax, dword [0x65e1b4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x65e1b0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5f0b28
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x65e1b0]
call fcn.004acae8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x5f0b20
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x215], 0
je 0x5f0b20
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x74]
test al, al
je 0x5f0b20
mov eax, dword [ebp - 0x14]
call fcn.005fcbf0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f0b20
push ebp
call fcn.005f09d4
pop ecx
test al, al
jne 0x5f0b20
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb8
call fcn.00408268
test al, al
je 0x5f0b20
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 9]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00408268
cmp byte [ebp - 9], 0
je 0x5f0b20
lea edx, [ebp - 8]
lea eax, [ebp - 0x28]
call fcn.00412830
test al, al
je 0x5f0b20
mov edx, dword [ebp - 0x14]
mov eax, dword [0x65e1b4]
call fcn.005f0118
inc edi
dec ebx
jne 0x5f0a7d
mov eax, dword [0x65e1b4]
cmp dword [eax + 8], 0
jle 0x5f0b40
mov eax, dword [0x65e1b4]
call fcn.005f01cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5f0b59
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005f083c
pop ecx
test al, al
jne 0x5f0b59
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f947c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00412d18
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005f30a8
test ebx, ebx
jne 0x5f94cf
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005f92f4
mov ebx, eax
test ebx, ebx
je 0x5f95c5
cmp esi, ebx
je 0x5f94f8
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x5f950d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5f9545
add eax, 0xffffff5f
sub eax, 2
jb 0x5f955d
dec eax
sub eax, 2
jb 0x5f9571
dec eax
sub eax, 2
jb 0x5f9567
jmp 0x5f957b
add eax, 0xfffffdff
sub eax, 2
jb 0x5f955d
dec eax
sub eax, 2
jb 0x5f9571
dec eax
sub eax, 2
jb 0x5f9567
jmp 0x5f957b
mov byte [esp + 0x120], 0
jmp 0x5f9583
mov byte [esp + 0x120], 2
jmp 0x5f9583
mov byte [esp + 0x120], 1
jmp 0x5f9583
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005bdd14
mov esi, eax
call fcn.005efac4
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.005f4c40
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5f95c7
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x6317a0
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x6317c1
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x6317c1
xor eax, eax
ret
mov al, 1
ret

Function at 0x63884c
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x63886d
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x63886d
xor eax, eax
ret
mov al, 1
ret
Function at 0x6464dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x6465b3
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x6465b3
cmp dword [ebp - 8], 0
je 0x6465b3
cmp dword [ebp - 0xc], 0
je 0x6465b3
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6465b3
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
call fcn.004077cc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
dec eax
test eax, eax
jb 0x6465b3
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
xor edx, edx
div dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
and eax, 1
test eax, eax
jne 0x646585
mov al, byte [ebp - 0x14]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
xor al, byte [edx]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov byte [edx], al
jmp 0x64659b
mov al, byte [ebp - 0xc]
sub al, byte [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
xor al, byte [edx]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov byte [edx], al
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
xor byte [edx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x64655b
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x6468ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6468e6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004e6538
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x6467c8
push 0
push 0
call sub.kernel32.dll_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x646903
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret