joyce8/EMBER2024-capa huggingface dataset:
Function at 0x637724
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd34
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x6378af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x637770
mov edx, dword [ebx + 4]
cmp eax, dword [edx + 8]
jle 0x637889
lea edx, [ebp - 0x2cc]
mov eax, dword [ebp - 4]
call fcn.00422ff8
mov eax, dword [ebp - 0x2cc]
lea edx, [ebp - 8]
call fcn.005f7780
mov eax, dword [ebp - 8]
mov edx, 0x6378cc
call fcn.00409aec
sete al
test al, al
je 0x6377ab
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408b70
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.006380f4
test al, al
je 0x6377c8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x637889
mov eax, dword [ebx + 4]
or ecx, 0xffffffff
mov edx, dword [ebp - 8]
call fcn.00637fc4
xor edx, edx
push ebp
push 0x63787f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4e76b4]
call fcn.004f21d8
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x63786e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x101
push 0x2b4
lea eax, [ebp - 0x2c8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004096e8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [ebp - 0x2c8]
test eax, eax
jbe 0x637858
mov edx, eax
mov eax, dword [ebp - 0x14]
call fcn.004f25d4
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 0x14]
call fcn.005c8078
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00638134
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x637875
mov eax, dword [ebp - 0x14]
call fcn.004069e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6378b6
lea eax, [ebp - 0x2cc]
call fcn.00408748
lea eax, [ebp - 8]
mov edx, 2
call fcn.004087a8
ret

Function at 0x66442c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push 0
push 0x80
push 3
push 0
push 7
push 0
mov eax, ebx
call fcn.004096e8
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x66446a
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x6644a6
xor eax, eax
push ebp
push 0x66449f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6644a6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x690598
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push esi
push edi
push ebx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [esi], eax
add esi, 4
add edx, 4
dec ecx
jne 0x6905b2
mov ecx, 0x30
mov edi, dword [esi - 0x1c]
mov eax, dword [esi - 8]
mov ebx, eax
mov edx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x6905cb
pop ebx
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret
Function at 0x6ab078
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6ab0a6
mov eax, ebx
call fcn.006abb34
cmp dword [ebx + 0x40], 0
je 0x6ab09f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6ab117
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6ab109
cmp dword [ebx + 8], 0
je 0x6ab0c8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6ab0da
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6ab109
cmp dword [ebx + 8], 0
je 0x6ab0bb
cmp eax, 3
je 0x6ab0ed
dec eax
jne 0x6ab0bb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6ab0bb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6ab0bb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6ab135
cmp dword [ebx + 0x14], 0xcc
je 0x6ab135
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006ab140
pop ebx
ret

Function at 0x6c87dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x6c8856
push dword fs:[edx]
mov dword fs:[edx], esp
movzx edx, byte [eax + 0x348]
mov ecx, edx
sub cl, 1
jae 0x6c883e
push 4
lea eax, [ebp - 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 4]
mov ecx, 2
call fcn.004097a4
mov eax, dword [ebp - 8]
call fcn.00421fc0
sub eax, 1
jae 0x6c883a
mov bl, 1
jmp 0x6c8840
mov bl, 2
jmp 0x6c8840
mov ebx, edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c885d
lea eax, [ebp - 8]
call fcn.00408748
ret
Function at 0x6d16d4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x6d17f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dl, byte [esi + 0x321]
je 0x6d17de
mov eax, edx
mov byte [esi + 0x321], al
test al, al
je 0x6d179a
mov eax, esi
call fcn.00510ea8
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00510f78
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x318]
call fcn.005116a8
mov ebx, dword [esi + 0x318]
mov edx, dword [esi + 0x58]
mov eax, ebx
call fcn.00510ba4
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00511590
mov edx, dword [ebp - 0x14]
mov eax, dword [esi + 0x318]
call fcn.005115e4
lea edx, [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x188]
mov byte [esi + 0x2d4], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x128]
cmp byte [esi + 0x322], 1
jne 0x6d17de
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xa4]
jmp 0x6d17de
mov eax, dword [esi + 0x318]
mov byte [eax + 0x2fc], 1
call sub.user32.dll_ReleaseCapture
mov byte [esi + 0x2d4], 0
xor edx, edx
mov eax, dword [esi + 0x314]
call fcn.006cdec8
push 0
mov eax, dword [esi + 0x318]
call fcn.0051a434
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov si, 0xffa7
call fcn.00406ca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d17fb
lea eax, [ebp - 0x14]
call fcn.00408748
ret
Function at 0x6de6c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov ebx, eax
xor esi, esi
test byte [ebx + 0x5c8], 8
je 0x6de7a1
mov eax, dword [ebx + 0x308]
test eax, eax
jl 0x6de7d0
cmp dword [ebx + 0x30c], 0
jl 0x6de7d0
mov edx, eax
mov eax, dword [ebx + 0x5b8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov esi, eax
push esp
mov ecx, dword [ebx + 0x30c]
mov edx, dword [ebx + 0x308]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x208]
mov edx, dword [ebx + 0x30c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x164]
mov edx, eax
mov ecx, esp
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x74]
mov edx, esp
mov eax, ebx
call fcn.006ded50
test byte [ebx + 0x518], 0x40
jne 0x6de752
dec dword [esp + 8]
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.006dc134
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 4]
jle 0x6de779
xor edx, edx
mov eax, dword [ebx + 0x35c]
call fcn.005114ac
jmp 0x6de891
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.006dc134
mov eax, dword [esp + 0x20]
cmp eax, dword [esp]
jle 0x6de7d0
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.006dc134
mov eax, dword [esp + 0x20]
mov dword [esp], eax
jmp 0x6de7d0
test byte [ebx + 0x5c8], 0x40
je 0x6de891
mov edx, dword [ebx + 0x364]
mov eax, dword [ebx + 0x5b8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov esi, eax
mov ecx, esp
mov edx, dword [ebx + 0x364]
mov eax, ebx
call fcn.006dc69c
mov eax, esp
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.0040e460
cmp dword [esp], 0
jge 0x6de7e8
xor eax, eax
mov dword [esp], eax
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.006dc134
mov eax, dword [esp + 0x20]
cmp eax, dword [esp]
jle 0x6de80f
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.006dc134
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov ebx, dword [ebx + 0x35c]
push 0
mov eax, ebx
call fcn.0051a434
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x50]
test al, 0x10
setne al
and eax, 0x7f
mov eax, dword [eax*4 + 0x9c238c]
or eax, 0x40
push eax
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 8]
sub eax, ebp
push eax
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 8]
sub eax, edi
push eax
push ebp
push edi
push 0
mov eax, ebx
call fcn.0051a434
push eax
call sub.user32.dll_SetWindowPos
mov eax, ebx
call fcn.0051a434
push eax
call sub.user32.dll_SetFocus
lea edx, [esp + 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x60]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, ebx
call fcn.0051a434
push eax
call sub.user32.dll_InvalidateRect
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x710d18
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x710d2a
add esp, 0xfffffff0
call fcn.00406f54
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00534040
push 2
call sub.user32.dll_GetSystemMetrics
add eax, 2
mov dword [ebx + 0x340], eax
mov byte [ebx + 0x331], 0
mov byte [ebx + 0x345], 0
mov byte [ebx + 0x384], 1
mov byte [ebx + 0x3c5], 0
mov byte [ebx + 0x3c6], 0
call sub.kernel32.dll_GetVersion_1
movzx edx, al
movzx eax, ax
shr eax, 8
movzx eax, al
cmp edx, 5
ja 0x710d8f
cmp edx, 5
jne 0x710d8b
cmp eax, 1
jae 0x710d8f
xor eax, eax
jmp 0x710d91
mov al, 1
mov byte [ebx + 0x34c], al
mov eax, 0x710eac
call fcn.004296a0
shr eax, 0x10
and eax, 0xff
cmp eax, 5
setg al
mov byte [ebx + 0x34d], al
mov byte [ebx + 0x3b0], 1
mov byte [ebx + 0x34e], 0
xor eax, eax
mov dword [ebx + 0x360], eax
mov dl, 1
mov eax, dword [0x4e2964]
call fcn.004e8dcc
mov esi, eax
mov dword [ebx + 0x358], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x71298c
mov dword [ebx + 0x354], 4
xor eax, eax
mov dword [ebx + 0x368], eax
mov byte [ebx + 0x36c], 1
mov dword [ebx + 0x338], 0xff000005
mov dword [ebx + 0x378], 0x1fffffff
mov dword [ebx + 0x37c], 0x1fffffff
mov dword [ebx + 0x380], 0x1fffffff
mov dword [ebx + 0x3a0], 0x1fffffff
mov dword [ebx + 0x3a4], 0x1fffffff
mov dword [ebx + 0x390], 0x1fffffff
mov dword [ebx + 0x398], 0x1fffffff
mov dword [ebx + 0x39c], 0x1fffffff
mov dword [ebx + 0x3a8], 0x1fffffff
mov dword [ebx + 0x394], 0x1fffffff
mov dword [ebx + 0x3ac], 0x1fffffff
mov byte [ebx + 0x3c7], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x710e98
call fcn.00406fac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x71125c
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x71127d
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x71127d
xor eax, eax
ret
mov al, 1
ret

Function at 0x727f64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004096e8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x727f7d
test al, 0x10
jne 0x727f81
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x7356b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x73575c
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x810]
mov edx, dword [ebp - 4]
call fcn.0042323c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x810]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x735746
mov eax, ebx
call fcn.00404e98
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x810]
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x73576c
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x73573f
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x73573f
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00404eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x735763
lea eax, [ebp - 4]
call fcn.00408748
ret

Function at 0x739020
Capabilities:
Check os version

Disassembly:
call sub.kernel32.dll_GetVersion_1
movzx edx, al
movzx eax, ax
shr eax, 8
movzx eax, al
cmp edx, 5
ja 0x739043
cmp edx, 5
jne 0x739040
cmp eax, 1
jae 0x739043
xor eax, eax
ret
mov al, 1
ret

Function at 0x739164
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040882c
xor eax, eax
push ebp
push 0x739210
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
lea eax, [ebp - 0x210]
mov edx, dword [ebp - 4]
call fcn.0042323c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x7391fa
mov eax, ebx
call fcn.00404e98
mov esi, eax
push esi
push ebx
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x739220
push esi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x7391f3
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfeef04bd
jne 0x7391f3
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
mov eax, esi
call fcn.00404eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x739217
lea eax, [ebp - 4]
call fcn.00408748
ret
Function at 0x757cbc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x757ce3
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x757e75
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x757e62
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x757d32
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x757d28
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x757e47
test al, 8
je 0x757dab
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x757d90
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0050f8ec
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageW
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x757dcd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0050f8ec
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageW
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0050f8ec
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x10
je 0x757e28
mov byte [ebp - 0x34], 1
or eax, 0x1e
and eax, 0xfffffffe
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x757bf8
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x757e47
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x757bf8
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x757e69
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7581e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
push ebp
push 0x75829f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x7582b0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x758289
mov dword [ebp - 0xc], 0x40
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x7582dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x758289
test esi, esi
jne 0x758260
cmp dword [ebp - 8], 1
je 0x758264
xor ebx, ebx
jmp 0x758289
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x50]
mov ecx, 0x20
call fcn.004097a4
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x10]
call fcn.00405e84
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x758289
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7582a6
lea eax, [ebp - 0x54]
call fcn.00408748
ret
Function at 0x758900
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x758aa3
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClientRect
test eax, eax
je 0x758aa3
lea eax, [ebp - 0x20]
call fcn.0040e46c
test al, al
jne 0x758aa3
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ValidateRect
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x758aa3
xor ecx, ecx
push ebp
push 0x758a9c
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_GetClipBox
test eax, eax
je 0x758a63
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x40]
call fcn.0040e36c
test al, al
je 0x758a63
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x758a63
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x758a63
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
push 0
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SetWindowOrgEx
mov ebx, dword [ebp - 0xc]
push ebx
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_RestoreDC
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
sub ecx, eax
push ecx
push edx
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
call fcn.00407e80
jmp 0x758ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x758aa3
cmp dword [ebp - 0xc], 0
je 0x758a7f
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x758a8e
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_InvalidateRect
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x759310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7593fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x9f1d24]
cmp dword [eax], 5
jl 0x759340
mov eax, dword [0x9f24a4]
cmp dword [eax], 2
je 0x759349
mov byte [ebp - 5], 1
jmp 0x7593e4
mov byte [ebp - 5], 0
push 0x759418
push ebx
push 0x759468
lea eax, [ebp - 4]
mov edx, 3
call fcn.004099dc
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004096e8
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x7593e4
xor edx, edx
push ebp
push 0x7593dd
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x7593bb
cmp word [ebp - 0x14], 0
jne 0x7593c2
cmp eax, 0xea
jne 0x7593c6
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7593e4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x759401
lea eax, [ebp - 4]
call fcn.00408748
ret

Function at 0x75a51c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyW
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x75a55c
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
jle 0x75a55c
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004097a4
jmp 0x75a568
mov eax, esi
mov edx, 0x75a580
call fcn.00408b28
add esp, 0x200
pop esi
pop ebx