joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e05cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e069b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4dfe30]
call fcn.004e06c4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e0674
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4e06b4
call fcn.0040ef94
mov edx, dword [ebp - 8]
mov eax, dword [0x550238]
mov eax, dword [eax]
call fcn.00523714
call fcn.004dfe98
call sub.user32.dll_GetFocus
mov edx, dword [0x550238]
mov edx, dword [edx]
cmp eax, dword [edx + 0x170]
jne 0x4e0657
push 0x7a
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4e065e
call sub.user32.dll_WaitMessage
jmp 0x4e0631
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e067b
mov eax, dword [ebp - 4]
call fcn.004041cc
ret

Function at 0x4e58c8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4e58d0
push ecx
push ebx
xor eax, eax
push ebp
push 0x4e5a1a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004b6f50
mov edx, dword [ebp - 0x10]
mov eax, 0x556d00
call fcn.00406610
lea eax, [ebp - 0x14]
mov ecx, dword [0x556d00]
mov edx, 0x4e5a34
call fcn.00406acc
mov eax, dword [ebp - 0x14]
call fcn.004bb650
mov eax, dword [0x55031c]
cmp byte [eax], 0
je 0x4e592b
mov eax, dword [0x556d00]
call fcn.004bad58
lea edx, [ebp - 0x18]
mov eax, dword [0x556d00]
call fcn.00478acc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x4e5a7c
call fcn.00406acc
push 0
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4e59c1
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.004b45dc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040decc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.0047b0b8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
mov ecx, 2
mov al, 0x67
call fcn.004b45ac
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x40b778]
call fcn.00412bb4
call fcn.00404c3c
lea eax, [ebp - 8]
call fcn.004bbf00
cmp dword [ebp - 8], 0
je 0x4e59f2
lea eax, [ebp - 0xc]
mov ecx, 0x4e5a98
mov edx, dword [ebp - 4]
call fcn.00406acc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004e5870
mov eax, dword [ebp - 0xc]
call fcn.004bbf58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5a21
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00406608
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00406608
ret
Function at 0x4e8100
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x556fd1], 1
call fcn.004b8d54
test al, al
jne 0x4e8152
push 5
mov eax, dword [0x550238]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x550238]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x55024c]
mov eax, dword [eax + 0x120]
mov cl, 2
xor edx, edx
call fcn.004e7fe4
ret

Function at 0x4eb568
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4eb58d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ed364
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4ed390
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4ed399
call fcn.004ec07c
mov eax, 0xa
call fcn.0047b4bc
call fcn.004ec07c
call fcn.004ed330
test al, al
jne 0x4ed36e
pop ebx
ret

Function at 0x4ed8bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x54fd54]
cmp dword [eax], 0
je 0x4ed967
mov eax, dword [0x54fd54]
mov eax, dword [eax]
call fcn.005357c8
test al, al
je 0x4ed967
mov eax, dword [0x54fd54]
mov eax, dword [eax]
cmp byte [eax + 0x1e2], 0
je 0x4ed911
cmp byte [ebx + 0x389], 0
jne 0x4ed911
mov eax, dword [0x550238]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4ed915
xor eax, eax
jmp 0x4ed917
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x54fd54]
mov eax, dword [eax]
call fcn.0053541c
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x4ed967
test bl, bl
je 0x4ed953
push 5
mov eax, dword [0x54fd54]
mov eax, dword [eax]
call fcn.0053541c
push eax
call sub.user32.dll_ShowWindow
jmp 0x4ed967
push 0
mov eax, dword [0x54fd54]
mov eax, dword [eax]
call fcn.0053541c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4eda18
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x556f8a], 0
push 0x4edaf0
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
push 0x4edb0c
push ebx
call fcn.00409820
test eax, eax
je 0x4edaa4
lea edx, [esp + 4]
push edx
call eax
push 0x4edb34
push ebx
call fcn.00409820
mov esi, eax
test esi, esi
je 0x4edaae
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x4edaae
cmp dword [esp], 0
je 0x4edaae
call fcn.004b5c2c
test al, al
je 0x4edaae
push 0x4edb54
push ebx
call fcn.00409820
test eax, eax
je 0x4edaae
push 0x4edb88
push 0x4edba8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409820
test eax, eax
je 0x4edaae
mov byte [0x556f8a], 1
jmp 0x4edaae
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
movzx eax, word [esp + 4]
sub ax, 1
jb 0x4edac7
sub ax, 5
je 0x4edad0
sub ax, 3
je 0x4edad9
jmp 0x4edae2
mov byte [0x54f2f4], 1
jmp 0x4edae9
mov byte [0x54f2f4], 3
jmp 0x4edae9
mov byte [0x54f2f4], 2
jmp 0x4edae9
mov byte [0x54f2f4], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4edbc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4edc34
mov edx, 0x80000002
xor eax, eax
call fcn.0047a55c
test eax, eax
jne 0x4edc2d
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4edc88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4edc24
cmp dword [ebp - 0xc], 4
jne 0x4edc24
cmp dword [ebp - 8], 4
jne 0x4edc24
movzx eax, word [ebp - 0x10]
mov word [0x556fa0], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret

Function at 0x4ede30
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4ededf
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x556f9c], eax
cmp byte [0x556f89], 0
je 0x4ededf
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x4eded0
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4ededf
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x556fa0], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x556fa2], al
movzx eax, word [esp + 0x22c]
mov word [0x556fa4], ax
jmp 0x4ededf
cmp eax, 4
jne 0x4ededf
call fcn.004edbc4
call fcn.004edca0
add esp, 0x230
ret
Function at 0x506d20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x506dc8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x506de4
push ebx
push 0x506df4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00406bb0
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403674
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x506da6
mov eax, dword [0x55024c]
mov eax, dword [eax + 0x1a4]
call fcn.00506c78
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506dcf
lea eax, [ebp - 4]
call fcn.00406600
ret
Function at 0x507768
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x507956
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0047a104
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004b6dd4
test al, al
jne 0x5077d5
xor eax, eax
push ebp
push 0x5077cb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004b72c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5077d5
push 0
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
mov eax, dword [0x55709c]
call fcn.0040669c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x507804
mov eax, dword [0x55024c]
mov eax, dword [eax + 0x1a0]
call fcn.00506c78
push 0x80
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x553b50]
push eax
push 0
mov ecx, 0x507964
mov edx, 0x507968
xor eax, eax
call fcn.0040a3cc
mov dword [ebp - 8], eax
push 0x506e38
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x5570c8], eax
xor eax, eax
push ebp
push 0x50791f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x550238]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00479ad8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x507984
call fcn.0040ef94
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.004799b8
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406a0c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00506d20
mov dword [ebp - 0xc], eax
call fcn.00506dfc
test al, al
jne 0x5078ff
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x5078dd
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507926
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x508ca8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x508f8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x550238]
mov eax, dword [eax]
mov edx, 0x508fa4
call fcn.00523714
push 0x508fb8
mov eax, dword [0x553b50]
push eax
call sub.user32.dll_LoadIconW
test eax, eax
je 0x508d06
mov edx, dword [0x550238]
mov edx, dword [edx]
mov edx, dword [edx + 0x9c]
xchg edx, eax
call fcn.0043a6f0
push 5
mov eax, dword [0x550238]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x508f51
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e838c
lea eax, [ebp - 0x10]
call fcn.00479f7c
mov eax, dword [ebp - 0x10]
call fcn.0040ea40
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00479ad8
mov edx, dword [ebp - 0x14]
mov eax, 0x55709c
call fcn.00406610
call fcn.00507030
lea ecx, [ebp - 0x18]
mov edx, 0x508fe4
mov eax, dword [0x55709c]
call fcn.00478bbc
mov edx, dword [ebp - 0x18]
mov eax, 0x5570a0
call fcn.00406610
lea ecx, [ebp - 0x1c]
mov edx, 0x508ffc
mov eax, dword [0x55709c]
call fcn.00478bbc
mov edx, dword [ebp - 0x1c]
mov eax, 0x5570a4
call fcn.00406610
push 2
push 0
push 1
mov ecx, dword [0x55709c]
mov dl, 1
mov eax, dword [0x4b31c8]
call fcn.004b3508
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x508e28
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004b34c8
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004b34a0
cmp dword [ebp - 0xc], 0x67734d49
je 0x508e03
mov cl, 1
xor edx, edx
mov eax, dword [0x5570a4]
call fcn.004b478c
jmp 0x508e12
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x55709c]
call fcn.004b478c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508e2f
mov eax, dword [ebp - 4]
call fcn.004041cc
ret
Function at 0x50ae28
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x50affa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.0040674c
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x54f88c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040669c
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.0047a55c
test eax, eax
jne 0x50afdf
xor eax, eax
push ebp
push 0x50afd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.004850f4
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x50aeb9
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x50aee6
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00407070
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x50af08
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00407070
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x50af7e
sub eax, 0xe9
je 0x50af22
sub eax, 0x19
je 0x50afbd
jmp 0x50af77
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50af39
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x50af4c
call fcn.00404d30
jmp 0x50afdf
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50af63
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040674c
jmp 0x50aead
call fcn.00404d30
jmp 0x50afdf
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.004850f4
lea eax, [ebp - 4]
call fcn.00407070
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.0040674c
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.00495394
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00483624
inc ebx
jmp 0x50aead
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50afdb
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b001
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406608
ret
Function at 0x511778
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5117fc
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x5117e4
mov ebx, esi
test ebx, ebx
je 0x5117aa
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040669c
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x511818
call fcn.00406acc
mov eax, dword [ebp - 8]
call fcn.0040669c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x5117e6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511803
lea eax, [ebp - 8]
call fcn.00406600
ret

Function at 0x511844
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x511889
mov ebx, esi
test ebx, ebx
je 0x511861
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040669c
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040669c
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
jmp 0x51188b
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x517ae0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x517b01
test edi, 0x40000
je 0x517b1b
test bl, bl
jne 0x517b9c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x517b9c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x517b4e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x517b63
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x517b72
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x517b83
cmp byte [esp + 2], 0
je 0x517b9c
cmp byte [esp + 2], 0
je 0x517b94
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x517b9c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x517e48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x517e6e
mov eax, esp
push eax
push 0x517e10
call sub.user32.dll_EnumWindows
jmp 0x517e81
mov eax, esp
push eax
push 0x517df0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret
Function at 0x517f44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x517f98]
test si, 4
je 0x517f59
or bl, 1
test si, 8
je 0x517f63
or bl, 4
test si, 1
je 0x517f6d
or bl, 8
test si, 2
je 0x517f77
or bl, 0x10
test si, 0x10
je 0x517f81
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x517f90
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x517f9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x517fd8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x517fb6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x517fc5
or bl, 4
test esi, 0x20000000
je 0x517fd0
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5209ec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5209fe
add esp, 0xfffffff0
call fcn.00404698
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00430220
mov eax, dword [0x54fea4]
mov dword [eax + 4], ebx
mov dword [eax], 0x520e00
mov eax, dword [0x54feb4]
mov dword [eax + 4], ebx
mov dword [eax], 0x520e0c
mov eax, ebx
call fcn.00520e18
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x422214]
call fcn.0040419c
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x51b89c
push eax
push 0
push 0
mov eax, dword [0x550140]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x432370]
call fcn.00433df0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x432370]
call fcn.00433df0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x432370]
call fcn.00433df0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x432370]
call fcn.00433df0
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.005213ac
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x521234
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x521234
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x521234
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x521234
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x520b51
call fcn.004046f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret