joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec230
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ec3eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409494
mov eax, dword [ebp - 4]
call fcn.004ebb80
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4ec282
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00409fb4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004ece6c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ec361
xor eax, eax
push ebp
push 0x4ec35a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004ebe20
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004ec420
test al, al
je 0x4ec338
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004091f4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4ec338
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00409ba8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
test al, al
je 0x4ec332
mov eax, dword [ebp - 8]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00409c10
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004ec230
dec ebx
cmp ebx, 0xffffffff
jne 0x4ec2e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec361
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004ebe20
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x5df060], 0
je 0x4ec3a1
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ebe0c
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
mov ebx, eax
jmp 0x4ec3c8
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ebe0c
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec3f2
lea eax, [ebp - 0x3c]
call fcn.0040906c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004090cc
ret
Function at 0x4ec361
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ec3eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409494
mov eax, dword [ebp - 4]
call fcn.004ebb80
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4ec282
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00409fb4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004ece6c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ec361
xor eax, eax
push ebp
push 0x4ec35a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004ebe20
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004ec420
test al, al
je 0x4ec338
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004091f4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4ec338
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00409ba8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
test al, al
je 0x4ec332
mov eax, dword [ebp - 8]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00409c10
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004ec230
dec ebx
cmp ebx, 0xffffffff
jne 0x4ec2e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec361
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004ebe20
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x5df060], 0
je 0x4ec3a1
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ebe0c
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
mov ebx, eax
jmp 0x4ec3c8
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004ebe0c
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004ebd80
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec3f2
lea eax, [ebp - 0x3c]
call fcn.0040906c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004090cc
ret
Function at 0x4ecd48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004ebb98
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00409ba8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004ebd80
test al, al
jne 0x4ecdb0
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5d8e0c]
mov dl, 1
mov eax, dword [0x4ea96c]
call fcn.00427ca0
call fcn.00408768
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ecdbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00409ba8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004ebd80
test al, al
jne 0x4ece1d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5d9134]
mov dl, 1
mov eax, dword [0x4ea96c]
call fcn.00427ca0
call fcn.00408768
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004ebbc8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ed41c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ed544
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004ebe20
xor eax, eax
push ebp
push 0x4ed51f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ec420
test al, al
je 0x4ed503
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ed2fc
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004091f4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4ed503
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ebd80
test al, al
je 0x4ed4ff
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00409c10
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004ed2fc
pop ecx
inc edi
dec ebx
jne 0x4ed4a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed526
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004ebe20
ret
Function at 0x4ed554
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ed7a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004ebe20
xor eax, eax
push ebp
push 0x4ed778
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ec420
test al, al
je 0x4ed75c
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004091f4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4ed75c
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00409ba8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ebd80
test al, al
je 0x4ed750
mov eax, dword [ebp - 4]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00409c10
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ece6c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4ed750
xor eax, eax
push ebp
push 0x4ed749
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004ebe20
xor eax, eax
push ebp
push 0x4ed72b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00409c10
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ebe24
mov eax, dword [ebp - 4]
call fcn.00409ba8
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00409c10
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ece6c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4ed708
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004ed41c
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004ed554
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed70f
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4ed5df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed77f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004ebe20
ret
Function at 0x4f5e7c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4f5e82
ret
Function at 0x500e88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x501036
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x501012
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x501012
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x500e50]
call fcn.0040b024
add esp, 4
lea eax, [ebp - 4]
call fcn.0040c6c0
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x5d8c84]
push eax
call sub.windowscodecs.dll_WICConvertBitmapSource
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ae08
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00406e84
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x4f4740]
call fcn.004fd81c
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x500ff0
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.004ff494
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
push 0
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.004fe4a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x501012
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50103d
lea eax, [ebp - 8]
mov edx, dword [0x500e50]
call fcn.0040b148
lea eax, [ebp - 4]
call fcn.0040c6c0
ret
Function at 0x51154c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5df208], 0
je 0x51168d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5d8ecc]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x51168d
mov eax, dword [0x5df20c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5df208]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x51165c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5df208]
call fcn.004a8f64
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x511654
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1fd], 0
je 0x511654
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x511654
mov eax, dword [ebp - 0x14]
call fcn.0051d20c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x511654
push ebp
call fcn.00511508
pop ecx
test al, al
jne 0x511654
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407774
test al, al
je 0x511654
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00407774
cmp byte [ebp - 1], 0
je 0x511654
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040f294
test al, al
je 0x511654
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5df20c]
call fcn.00510c6c
inc edi
dec ebx
jne 0x5115b1
mov eax, dword [0x5df20c]
cmp dword [eax + 8], 0
jle 0x511674
mov eax, dword [0x5df20c]
call fcn.00510d20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x51168d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00511370
pop ecx
test al, al
jne 0x51168d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x519c68
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040f784
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00513b08
test ebx, ebx
jne 0x519cbb
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00519ae4
mov ebx, eax
test ebx, ebx
je 0x519db1
cmp esi, ebx
je 0x519ce4
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x519cf9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x519d31
add eax, 0xffffff5f
sub eax, 2
jb 0x519d49
dec eax
sub eax, 2
jb 0x519d5d
dec eax
sub eax, 2
jb 0x519d53
jmp 0x519d67
add eax, 0xfffffdff
sub eax, 2
jb 0x519d49
dec eax
sub eax, 2
jb 0x519d5d
dec eax
sub eax, 2
jb 0x519d53
jmp 0x519d67
mov byte [esp + 0x120], 0
jmp 0x519d6f
mov byte [esp + 0x120], 2
jmp 0x519d6f
mov byte [esp + 0x120], 1
jmp 0x519d6f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005a290c
mov esi, eax
call fcn.005105fc
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00515508
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x519db3
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x54d2c4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409150
xor eax, eax
push ebp
push 0x54d403
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x54d3d6
xor edx, edx
push ebp
push 0x54d3cf
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x54d311
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x54d3a4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x54d393
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x54d356
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00409ba8
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004065c0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d39a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x5d8b44]
mov dl, 1
mov eax, dword [0x41c2b8]
call fcn.00427bd0
call fcn.00408768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d40a
lea eax, [ebp - 4]
call fcn.0040906c
ret

Function at 0x551be8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x551c24]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x551c00
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x551c10
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x551c20
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x571b84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00571c34
test eax, eax
je 0x571bbf
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00571c34
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004091f4
jmp 0x571bcd
mov ecx, esi
mov edx, 0x571bec
mov eax, ebx
call fcn.00571b0c
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040944c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5922c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040906c
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x592312
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x59230b
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00409c4c
jmp 0x592312
mov eax, esi
call fcn.0040906c
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x597aa0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x597bff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5d8938], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4eab88]
call fcn.004ebcd4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x597bd5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004ebdbc
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00409c4c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x597c18
call fcn.00409dfc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004ec048
test al, al
je 0x597bbf
lea ecx, [ebp - 4]
mov edx, 0x597c8c
mov eax, dword [ebp - 0xc]
call fcn.004ec8d0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a134
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x597bbf
xor edx, edx
push ebp
push 0x597bb8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x597ca4
mov eax, dword [ebp - 8]
push eax
call fcn.004110b4
test eax, eax
je 0x597ba1
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x597ba1
call fcn.00597a2c
test eax, eax
je 0x597b91
mov eax, dword [ebx + 0x50]
jmp 0x597b94
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5d8938]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x597bbf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x597bdc
mov eax, dword [ebp - 0xc]
call fcn.00407428
ret

Function at 0x597d08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x597d4f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x597d32
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x597d43
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x597d4f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret