joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3c24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
xor eax, eax
push ebp
push 0x4c3db1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x88], 0
je 0x4c3d00
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x74]
call fcn.00404fcc
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004c0c88
test al, al
je 0x4c3cef
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c3cef
cmp dword [ebp - 0x18], 3
jne 0x4c3cef
cmp dword [ebp - 0x14], 8
jne 0x4c3cef
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 9]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004c0c88
jmp 0x4c3d86
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov ebx, eax
test ebx, ebx
je 0x4c3d7b
mov al, byte [ebx + 0x10]
cmp al, 6
jne 0x4c3d2f
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov byte [ebp - 9], 1
jmp 0x4c3d86
cmp al, 2
jne 0x4c3d3f
fild dword [ebx + 0x14]
fstp qword [esi]
wait
mov byte [ebp - 9], 1
jmp 0x4c3d86
cmp al, 3
jne 0x4c3d6e
lea eax, [ebp - 0x1c]
mov edx, dword [ebx + 0x14]
call fcn.0040513c
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
mov edx, esi
call fcn.004bda5c
cmp dword [ebp - 0x14], 0
jle 0x4c3d86
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
jmp 0x4c3d86
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
jmp 0x4c3d86
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3db8
lea eax, [ebp - 0x1c]
call fcn.00404f34
lea eax, [ebp - 0x10]
call fcn.00404f34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f58
ret
Function at 0x4c3dc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
xor eax, eax
push ebp
push 0x4c3ed6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x88], 0
je 0x4c3e55
lea eax, [ebp - 0x10]
mov edx, dword [esi + 0x74]
call fcn.00404fcc
xor ebx, ebx
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004c0c88
test al, al
je 0x4c3e47
push 8
lea eax, [ebp + 8]
push eax
push 3
push 0
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.004c0c88
jmp 0x4c3ebb
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x74]
call fcn.00404fcc
xor ebx, ebx
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004c0c88
test al, al
jne 0x4c3e80
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004c0c88
jmp 0x4c3ebb
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.004bf6bc
mov byte [eax + 0x10], 6
mov edx, dword [ebp + 8]
mov dword [eax + 0x18], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edx
mov bl, 1
mov byte [esi + 0x7b], 1
cmp byte [esi + 0x7a], 0
jne 0x4c3eaf
mov eax, esi
call fcn.004c2cb4
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004c0c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3edd
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f58
ret

Function at 0x4c6cc4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5a1450
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4c6ce6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4c6ce8
shr eax, 1
dec edx
jne 0x4c6cd4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4c6ccd
mov byte [0x5a1850], 1
pop esi
pop ebx
ret

Function at 0x4c6d04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5a1850], 0
jne 0x4c6d1b
call fcn.004c6cc4
mov eax, edi
dec eax
test eax, eax
jl 0x4c6d44
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a1450]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4c6d25
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4c951c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4c954d
dec al
je 0x4c9589
dec al
je 0x4c95cd
dec al
je 0x4c9638
jmp 0x4c96c2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4c96c2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4c955d
jmp 0x4c96c2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c96c2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4c9599
jmp 0x4c96c2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c96c2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4c95fb
xor ebp, ebp
jmp 0x4c960c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4c9615
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4c95dd
jmp 0x4c96c2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c96c2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4c9690
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004c6d4c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4c964c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fe968
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fea3b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edi, eax
and edi, 0xffff
push 0
push 0
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
mov esi, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405590
push esi
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040c408
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00405204
push eax
mov eax, ebx
call fcn.00405404
push eax
push 5
push esi
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
mov eax, dword [ebp - 4]
mov edx, edi
call fcn.00405c70
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004058f8
push eax
mov eax, ebx
call fcn.00405204
push eax
mov eax, ebx
call fcn.00405404
push eax
push 5
push esi
call sub.kernel32.dll_MultiByteToWideChar_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fea42
lea eax, [ebp - 8]
call fcn.00404f34
ret
Function at 0x4ff04c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x4ff22f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x59c274]
cmp byte [eax], 0
je 0x4ff1ff
mov ax, word [ebp - 0x14]
add eax, 0xfffffff8
sub ax, 2
jb 0x4ff209
sub ax, 3
je 0x4ff209
sub ax, 0xe
je 0x4ff209
lea eax, [ebp - 4]
mov edx, 5
call fcn.00405c70
lea eax, [ebp - 0x118]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x4ff209
test byte [ebp - 0x107], 0x80
jne 0x4ff209
movzx esi, word [ebp - 0x14]
push 0
push 5
mov eax, dword [ebp - 4]
call fcn.004058f8
push eax
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call dword [0x5a191c]
cmp eax, 1
jle 0x4ff162
lea edx, [ebp - 4]
xchg edx, eax
call fcn.00405c70
cmp byte [ebx + 0xc], 0
je 0x4ff153
cmp dword [ebx + 8], 1
jl 0x4ff14b
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x102
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebx + 0xc], 0
xor eax, eax
mov dword [ebx + 8], eax
jmp 0x4ff209
inc dword [ebx + 8]
jmp 0x4ff209
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
jmp 0x4ff209
cmp byte [ebx + 0xc], 0
je 0x4ff1e6
cmp eax, 1
jne 0x4ff1e6
mov eax, dword [ebp - 4]
mov dl, byte [eax]
mov cl, byte [ebx + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.00500658
mov edx, eax
lea eax, [ebp - 0x11c]
call fcn.00405844
mov edx, dword [ebp - 0x11c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebx + 0x18]
mov edx, 0x4ff244
call fcn.00405a24
jne 0x4ff1e0
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040577c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405c70
mov eax, dword [ebp - 8]
mov ax, word [eax]
mov edx, dword [ebp - 8]
mov word [edx + 2], ax
xor eax, eax
mov al, byte [ebx + 0xc]
mov edx, dword [ebp - 8]
mov word [edx], ax
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov byte [ebx + 0xc], 0
jmp 0x4ff209
test eax, eax
jle 0x4ff209
lea edx, [ebp - 4]
xchg edx, eax
call fcn.00405c70
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
jmp 0x4ff209
lea edx, [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff236
lea eax, [ebp - 0x11c]
call fcn.0040571c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405734
ret
Function at 0x503144
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x503217
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edi, eax
and edi, 0xffff
push 0
push 0
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
mov esi, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405590
push esi
mov eax, dword [ebp - 8]
call fcn.00405404
push eax
push 0x1004
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040c408
mov esi, eax
push 0
push 0
mov eax, ebx
call fcn.00405204
push eax
mov eax, ebx
call fcn.00405404
push eax
push 5
push esi
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
mov eax, dword [ebp - 4]
mov edx, edi
call fcn.00405c70
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004058f8
push eax
mov eax, ebx
call fcn.00405204
push eax
mov eax, ebx
call fcn.00405404
push eax
push 5
push esi
call sub.kernel32.dll_MultiByteToWideChar_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50321e
lea eax, [ebp - 8]
call fcn.00404f34
ret
Function at 0x50a504
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50a87b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
test byte [eax + 9], 8
je 0x50a83d
mov eax, dword [ebp - 4]
call fcn.0046f898
push eax
call sub.imm32.dll_ImmGetContext
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50a848
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xf4]
test al, al
jne 0x50a848
mov eax, dword [0x59c274]
cmp byte [eax], 0
je 0x50a661
xor edx, edx
push ebp
push 0x50a620
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
call fcn.0040571c
push 0x50a888
call sub.kernel32.dll_GetModuleHandleA_2
test eax, eax
je 0x50a600
push 0x50a890
push 0x50a888
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov eax, esi
test eax, eax
je 0x50a600
test eax, eax
je 0x50a600
push 0
push 0
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405c70
mov eax, dword [ebp - 0x14]
call fcn.004058f8
xor ecx, ecx
mov edx, ebx
call fcn.004a7998
push ebx
mov eax, dword [ebp - 0x14]
call fcn.004058f8
push eax
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a627
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0046f898
push eax
call sub.imm32.dll_ImmReleaseContext
ret
lea eax, [ebp - 0x10]
call fcn.00404f34
xor eax, eax
push ebp
push 0x50a6cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call sub.imm32.dll_ImmGetCompositionStringA
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405590
push ebx
mov eax, dword [ebp - 0x10]
call fcn.00405404
push eax
push 0x800
mov eax, dword [ebp - 0xc]
push eax
call sub.imm32.dll_ImmGetCompositionStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a6d4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0046f898
push eax
call sub.imm32.dll_ImmReleaseContext
ret
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a882
lea eax, [ebp - 0x2c]
call fcn.0040571c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405734
lea eax, [ebp - 0x14]
call fcn.0040571c
lea eax, [ebp - 0x10]
call fcn.00404f34
ret
Function at 0x50d358
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x50d5b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 4], 0xd
jne 0x50d3c2
mov eax, dword [ebx + 8]
call fcn.00481578
mov dl, byte [0x50d5c8]
cmp dl, al
jne 0x50d3c2
cmp byte [esi + 0x294], 0
je 0x50d3c2
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
push 0x102
mov eax, esi
call fcn.0046f898
push eax
call sub.user32.dll_SendMessageA
mov word [ebx + 4], 0
jmp 0x50d5a2
xor edi, edi
mov eax, dword [0x59c274]
cmp byte [eax], 0
je 0x50d57f
mov ax, word [ebx + 4]
add eax, 0xfffffff8
sub ax, 2
jb 0x50d57f
sub ax, 3
je 0x50d57f
sub ax, 0xe
je 0x50d57f
lea eax, [ebp - 4]
mov edx, 5
call fcn.00405c70
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x50d57f
test byte [ebp - 0xf3], 0x80
jne 0x50d57f
movzx edi, word [ebx + 4]
push 0
push 5
mov eax, dword [ebp - 4]
call fcn.004058f8
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx + 8]
push eax
push edi
call dword [0x5a1934]
mov edi, eax
cmp edi, 1
jle 0x50d4da
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405c70
cmp byte [esi + 0x358], 0
je 0x50d4c0
cmp dword [esi + 0x35c], 1
jl 0x50d4b5
lea eax, [esi + 0x354]
mov edx, dword [ebp - 4]
call fcn.00405758
mov byte [esi + 0x360], 1
push 0
xor eax, eax
mov al, byte [esi + 0x358]
push eax
push 0x102
mov eax, esi
call fcn.0046f898
push eax
call sub.user32.dll_SendMessageA
mov byte [esi + 0x358], 0
xor eax, eax
mov dword [esi + 0x35c], eax
jmp 0x50d57f
inc dword [esi + 0x35c]
jmp 0x50d57f
lea eax, [esi + 0x354]
mov edx, dword [ebp - 4]
call fcn.00405758
mov byte [esi + 0x360], 1
jmp 0x50d57f
cmp byte [esi + 0x358], 0
je 0x50d55c
cmp edi, 1
jne 0x50d55c
mov eax, dword [ebp - 4]
mov dl, byte [eax]
mov cl, byte [esi + 0x358]
mov eax, dword [esi + 0x350]
call fcn.00500658
mov edx, eax
lea eax, [esi + 0x354]
call fcn.00405844
mov eax, dword [esi + 0x354]
mov edx, 0x50d5d0
call fcn.00405a24
jne 0x50d553
lea eax, [ebp - 4]
mov edx, 2
call fcn.00405c70
mov eax, dword [ebp - 4]
mov ax, word [eax]
mov edx, dword [ebp - 4]
mov word [edx + 2], ax
xor eax, eax
mov al, byte [esi + 0x358]
mov edx, dword [ebp - 4]
mov word [edx], ax
lea eax, [esi + 0x354]
mov edx, dword [ebp - 4]
call fcn.00405758
mov byte [esi + 0x358], 0
jmp 0x50d57f
test edi, edi
jle 0x50d57f
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405c70
lea eax, [esi + 0x354]
mov edx, dword [ebp - 4]
call fcn.00405758
mov byte [esi + 0x360], 1
test edi, edi
jg 0x50d58e
mov edx, ebx
mov eax, esi
call fcn.0046e754
jmp 0x50d5a2
mov edx, ebx
mov eax, esi
call fcn.0046e754
mov word [ebx + 4], 0
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d5bf
lea eax, [ebp - 4]
call fcn.0040571c
ret
Function at 0x518394
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5184d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0xc]
call fcn.004058e8
mov edx, dword [ebp - 4]
mov edi, esi
mov eax, edi
call fcn.004f18bc
lea eax, [edi + 0x1d8]
mov edx, dword [ebx + 0x10]
call fcn.00404f88
mov edx, dword [ebx + 0x20]
mov eax, edi
call fcn.00469100
mov dl, byte [ebx + 0x24]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov dl, byte [ebx + 0x2c]
mov eax, edi
call fcn.004efc64
mov edx, dword [ebx + 0x18]
mov eax, edi
call fcn.004f0ac4
lea eax, [edi + 0x1d4]
mov edx, dword [ebx + 0x1c]
call fcn.00404f88
mov dl, byte [ebx + 0x38]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xac]
lea eax, [edi + 0x1d0]
mov edx, dword [ebx + 0x14]
call fcn.00404f88
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x1c]
mov eax, edi
call fcn.004efc34
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x14]
mov eax, edi
call fcn.004f0aa4
mov dl, byte [ebx + 0x30]
mov eax, edi
call fcn.004ee98c
mov edx, dword [ebx + 0x34]
mov eax, edi
call fcn.004f0a50
mov dl, byte [ebx + 0x41]
mov eax, edi
call fcn.004f13e4
mov dl, byte [ebx + 0x42]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov dl, byte [ebx + 0x40]
mov eax, edi
call fcn.004f0ab4
mov dl, byte [ebx + 0x43]
mov eax, edi
call fcn.004ee994
mov dl, byte [ebx + 0x44]
mov eax, edi
call fcn.004f0db4
mov eax, dword [ebx + 0x3c]
cmp eax, 0xffffffff
jne 0x5184a4
push 2
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, esi
call fcn.0046871c
jmp 0x5184ad
mov edx, eax
mov eax, esi
call fcn.0046871c
mov dl, byte [ebx + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, dword [ebx + 0x28]
mov eax, esi
call fcn.004f2a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5184de
lea eax, [ebp - 4]
call fcn.0040571c
ret
Function at 0x52aeb0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
cmp dword [edi + 4], 0
je 0x52aed1
mov edx, edi
mov eax, ebx
call fcn.0046d54c
jmp 0x52b038
push 0
call sub.user32.dll_GetDC
mov esi, eax
lea edx, [ebp - 0x70]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
lea edx, [ebp - 0x80]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x78]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x52b031
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_BeginPaint
mov esi, eax
lea eax, [ebp - 0x60]
push eax
push esi
call sub.gdi32.dll_GetClipBox
lea eax, [ebp - 0x60]
push eax
call sub.user32.dll_IsRectEmpty
test eax, eax
je 0x52af65
lea edx, [ebp - 0x60]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
jmp 0x52af72
push 1
push 1
lea eax, [ebp - 0x60]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0046a150
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov edx, edi
mov eax, ebx
call fcn.0052aeb0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
xor eax, eax
mov dword [edi + 4], eax
push 0xcc0020
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x54]
push ecx
mov ecx, dword [ebp - 0x58]
push ecx
push edx
push eax
push esi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b038
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret