joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577748
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5777e4.0
jmp dword [ecx*4 + 0x57777d]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5777af
sub dl, 8
je 0x5777be
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x577414
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x577468
jmp case.0x5777e4.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5777e4.0
movzx ecx, byte [ecx + 0x5777eb]
jmp dword [ecx*4 + 0x5777fc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x577508
jmp case.0x5777e4.0
cmp dl, 3
jne 0x577829
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x577560
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x57751c
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5775a4
jmp case.0x5777e4.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x577854
sub dl, 8
je 0x577860
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5775d0
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x577634
jmp case.0x5777e4.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x57787f
sub dl, 8
je 0x57788b
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5776e4
jmp case.0x5777e4.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x57770c
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x57792d
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0057696c
test eax, eax
je 0x57792d
mov eax, ebx
call fcn.00577938
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5778c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x577938
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x577969
dec al
je 0x5779a4
dec al
je 0x5779e8
dec al
je 0x577a5a
jmp 0x577af5
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x577af5
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x577979
jmp 0x577af5
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x577af5
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5779b4
jmp 0x577af5
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x577af5
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x577a1b
xor edx, edx
mov dword [esp + 4], edx
jmp 0x577a30
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x577a48
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x5779f8
jmp 0x577af5
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x577af5
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x577ac1
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00574aa8
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x577a76
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x57d540
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x57d5f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 8
mov eax, dword [ebp - 4]
call fcn.0056ccc4
test al, al
je 0x57d58f
push 8
call sub.user32.dll_GetClipboardData
mov esi, eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov dx, 8
mov ebx, dword [eax]
call dword [ebx + 0x64]
jmp 0x57d5e1
mov dl, 1
mov eax, dword [0x4ce70c]
call fcn.004d7548
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57d5da
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0057d2b0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d5e1
mov eax, dword [ebp - 8]
call fcn.004072c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d5fe
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x581698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movss xmm2, dword [ebp + 8]
shufps xmm2, xmm2, 0
push ebx
push esi
push edi
push ebp
push eax
push edx
push ecx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebp, dword [ebp + 0xc]
shl ecx, 1
mov ebx, dword [eax]
mov edx, dword [eax + 4]
imul ebx, esi
imul edx, esi
xor ebx, edi
xor edx, edi
imul ebx, ebp
imul edx, ebp
mov dword [eax], ebx
mov dword [eax + 4], edx
add eax, 8
dec ecx
jne 0x5816b6
pop ecx
pop edx
pop eax
movaps xmm1, xmmword [edx]
movdqa xmm0, xmmword [eax]
mulps xmm1, xmm2
psrld xmm0, 0x18
cvttps2dq xmm1, xmm1
paddq xmm1, xmm0
psrad xmm1, 8
movdqa xmmword [edx], xmm1
add eax, 0x10
add edx, 0x10
dec ecx
jne 0x5816d9
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x59c698
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59c707
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0x12]
push eax
push 0x1004
mov eax, ebx
call fcn.0059c718
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x12]
mov ecx, 7
call fcn.00409fcc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00406ef0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x59c6f1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c70e
lea eax, [ebp - 0x18]
call fcn.00408f98
ret
Function at 0x5e7b68
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040907c
xor eax, eax
push ebp
push 0x5e7d1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax - 0x254], 0
je 0x5e7bb4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x254]
call eax
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp + 8]
mov byte [edx - 0x255], al
mov eax, dword [ebp + 8]
inc dword [eax - 0x25c]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x260]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a17c
mov eax, dword [ebx]
call fcn.005e7a3c
test al, al
je 0x5e7c07
mov eax, dword [ebp + 8]
cmp dword [eax - 0x264], 0
je 0x5e7cd4
mov eax, dword [ebx]
call fcn.0051c91c
mov edx, dword [ebp + 8]
cmp dword [edx - 0x264], 2
sete dl
cmp al, dl
je 0x5e7cd4
mov eax, ebx
call fcn.00408f98
mov eax, dword [ebp + 8]
add eax, 0xfffffdb0
push eax
lea eax, [ebp - 8]
mov ecx, 0x5e7d38
mov edx, dword [ebp - 4]
call fcn.0040a17c
mov eax, dword [ebp - 8]
call fcn.00409f10
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x5e7d04
mov eax, dword [ebp + 8]
test byte [eax - 0x250], 0x10
je 0x5e7cb7
mov eax, dword [ebp + 8]
add eax, 0xfffffd98
mov edx, dword [ebp + 8]
add edx, 0xfffffddc
mov ecx, 0x104
call fcn.00409fcc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x268]
call fcn.005e7b18
test al, al
je 0x5e7cb7
mov eax, dword [ebp + 8]
cmp byte [eax - 0x255], 0
jne 0x5e7cce
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push dword [eax - 0x268]
push 0x5e7d4c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a204
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.005e7b68
pop ecx
cmp dword [ebx], 0
jne 0x5e7cce
mov eax, dword [ebp + 8]
add eax, 0xfffffdb0
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5e7c40
push esi
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp + 8]
cmp dword [eax - 0x264], 0
je 0x5e7d04
cmp dword [ebx], 0
je 0x5e7d04
mov eax, dword [ebx]
call fcn.0051c91c
mov edx, dword [ebp + 8]
cmp dword [edx - 0x264], 2
sete dl
cmp al, dl
je 0x5e7d04
mov eax, ebx
call fcn.00408f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7d26
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408ff8
ret
Function at 0x5e815c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
push ebx
xor edx, edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040907c
lea eax, [ebp - 0x278]
mov edx, dword [0x419918]
call fcn.0040a93c
xor eax, eax
push ebp
push 0x5e82e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x5e82fc
mov edx, dword [ebp - 4]
call fcn.0040a17c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00421fc0
mov ebx, eax
test ebx, ebx
jne 0x5e829b
test byte [ebp - 0x268], 0x10
jne 0x5e8221
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.0040a17c
mov eax, dword [ebp - 8]
call fcn.00422050
test al, al
jne 0x5e8286
push 0x80
mov eax, dword [ebp - 8]
call fcn.00409f10
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 8]
call fcn.00422050
jmp 0x5e8286
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x5e8286
mov eax, dword [ebp - 0x264]
call fcn.005e7b18
test al, al
je 0x5e8286
mov eax, dword [ebp + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 0x264]
push 0x5e8310
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.0040a204
mov eax, dword [ebp - 0x280]
call fcn.005e815c
pop ecx
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.0040a17c
mov eax, dword [ebp - 0x284]
call fcn.004229e0
lea eax, [ebp - 0x278]
call fcn.00422010
mov ebx, eax
test ebx, ebx
je 0x5e81da
lea eax, [ebp - 0x278]
call fcn.00422034
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e82e9
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00408ff8
lea eax, [ebp - 0x278]
mov edx, dword [0x419918]
call fcn.0040aa18
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ff8
ret

Function at 0x5e83bc
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00409f10
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
jne 0x5e83da
mov eax, ebx
call fcn.004229e0
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x5e88f0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x5e8916
mov eax, ebx
mov edx, 0x5e8938
call fcn.00409378
jmp 0x5e8924
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00409fcc
add esp, 0x20c
pop ebx
ret

Function at 0x5e894c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW_1
test eax, eax
jne 0x5e8979
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00409fcc
jmp 0x5e8980
mov eax, ebx
call fcn.005e88f0
mov eax, ebx
call fcn.00527630
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x5e8ac8
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, eax
push 0
push 0x5e8b54
call sub.user32.dll_FindWindowW
mov ebx, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x5e8b4b
test esi, esi
jge 0x5e8afb
cmp dword [0x6a69d0], 0x7fffffff
setne al
mov esi, eax
and esi, 0x7f
mov dword [esp], 0x24
test esi, esi
jne 0x5e8b24
push esp
push 4
call sub.shell32.dll_SHAppBarMessage
mov dword [0x6a69d0], eax
mov eax, dword [0x6a69d0]
xor eax, 1
xor eax, 2
mov dword [esp + 0x20], eax
jmp 0x5e8b43
cmp dword [0x6a69d0], 0x7fffffff
je 0x5e8b4b
mov eax, dword [0x6a69d0]
mov dword [esp + 0x20], eax
mov dword [0x6a69d0], 0x7fffffff
push esp
push 0xa
call sub.shell32.dll_SHAppBarMessage
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x5e8acf
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, eax
push 0
push 0x5e8b54
call sub.user32.dll_FindWindowW
mov ebx, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x5e8b4b
test esi, esi
jge 0x5e8afb
cmp dword [0x6a69d0], 0x7fffffff
setne al
mov esi, eax
and esi, 0x7f
mov dword [esp], 0x24
test esi, esi
jne 0x5e8b24
push esp
push 4
call sub.shell32.dll_SHAppBarMessage
mov dword [0x6a69d0], eax
mov eax, dword [0x6a69d0]
xor eax, 1
xor eax, 2
mov dword [esp + 0x20], eax
jmp 0x5e8b43
cmp dword [0x6a69d0], 0x7fffffff
je 0x5e8b4b
mov eax, dword [0x6a69d0]
mov dword [esp + 0x20], eax
mov dword [0x6a69d0], 0x7fffffff
push esp
push 0xa
call sub.shell32.dll_SHAppBarMessage
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x5ff940
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5ff961
test edi, 0x40000
je 0x5ff97b
test bl, bl
jne 0x5ff9fc
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5ff9fc
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5ff9ae
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5ff9c3
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5ff9d2
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5ff9e3
cmp byte [esp + 2], 0
je 0x5ff9fc
cmp byte [esp + 2], 0
je 0x5ff9f4
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5ff9fc
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5ffca4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5ffcca
mov eax, esp
push eax
push 0x5ffc6c
call sub.user32.dll_EnumWindows
jmp 0x5ffcdd
mov eax, esp
push eax
push 0x5ffc4c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5ffda0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x5ffe10]
test bl, 4
je 0x5ffdb4
or si, 1
test bl, 8
je 0x5ffdbd
or si, 4
test bl, 1
je 0x5ffdc6
or si, 8
test bl, 2
je 0x5ffdcf
or si, 0x10
test bl, 0x10
je 0x5ffdd8
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ffde8
or si, 2
test bh, 0x40
je 0x5ffdf2
or si, 0x80
test bh, 0x80
je 0x5ffe0b
or si, 0x100
movzx eax, bx
test eax, 0x10000
je 0x5ffe0b
or si, 0x200
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5ffe14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x5ffe50]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ffe2f
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ffe3f
or bx, 4
test esi, 0x20000000
je 0x5ffe4b
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x5ffea4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.005ffe54
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x608958
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x60896a
add esp, 0xfffffff0
call fcn.0040786c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004a3b18
mov eax, dword [0x749920]
mov dword [eax + 4], ebx
mov dword [eax], 0x608e20
mov eax, dword [0x749930]
mov dword [eax + 4], ebx
mov dword [eax], 0x608e2c
mov eax, ebx
call fcn.00608e38
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x470c74]
call fcn.00407294
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x470c74]
call fcn.00407294
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x470c74]
call fcn.00407294
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x470c74]
call fcn.00407294
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x470c74]
call fcn.00407294
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x603b44
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4ca734]
call fcn.004d07a0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4ca734]
call fcn.004d07a0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4ca734]
call fcn.004d07a0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4ca734]
call fcn.004d07a0
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4ca734]
call fcn.004d07a0
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.00609568
mov eax, dword [ebx + 0x8c]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x609298
mov eax, dword [ebx + 0x90]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x609298
mov eax, dword [ebx + 0x88]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x609298
mov eax, dword [ebx + 0x94]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x609298
mov eax, dword [ebx + 0x98]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x609298
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x608aea
call fcn.004078c4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x609038
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6091e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x6091c4
mov dl, 1
mov eax, dword [0x474518]
call fcn.00497160
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00408f98
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x6091b3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0050be94
test al, al
je 0x6091a6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x6091f4
lea eax, [ebp - 0x394]
call fcn.00422db8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6091a6
xor eax, eax
push ebp
push 0x60919f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x609264
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x609188
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409fcc
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x609188
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6091a6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x6090a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.00497084
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6091ea
lea eax, [ebp - 0x3a0]
call fcn.00408f98
ret

Function at 0x609ec4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x753a54]
cmp byte [eax + 0xc5], 0
jne 0x609f36
cmp dword [0x753a70], 0
jne 0x609ef6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x6a6c20]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x753a70], eax
cmp dword [0x753a6c], 0
jne 0x609f11
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x753a6c], eax
cmp dword [0x753a74], 0
jne 0x609f36
push esp
push 0
push 0
mov eax, dword [0x6a6c1c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x753a74], eax
pop edx
ret