joyce8/EMBER2024-capa huggingface dataset:
Function at 0x657ad8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004c1348
mov eax, dword [ebp - 8]
call fcn.004c1348
mov eax, dword [ebp + 8]
call fcn.004c1348
xor eax, eax
push ebp
push 0x657b81
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004bed18
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov eax, 0x657b90
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.004c2244
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004c2244
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.SHELL32.DLL_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657b88
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c12c4
lea eax, [ebp + 8]
call fcn.004c1264
ret

Function at 0x657bf8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004c1348
mov eax, dword [ebp - 8]
call fcn.004c1348
xor eax, eax
push ebp
push 0x657c74
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00657b9c
test al, al
je 0x657c3f
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00657ad8
jmp 0x657c59
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004c2244
push eax
push 0x657c80
push ebx
call sub.SHELL32.DLL_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657c7b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004c12c4
ret

Function at 0x657c8c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x657d62
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004c168c
lea eax, [ebp - 4]
call fcn.004c183c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004c2244
push eax
call sub.VERSION.DLL_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x657d4c
mov eax, ebx
call fcn.004be358
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x657d45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004c2244
push eax
call sub.VERSION.DLL_GetFileVersionInfoW
test eax, eax
je 0x657d2f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x657d74
mov eax, dword [ebp - 0x10]
push eax
call sub.VERSION.DLL_VerQueryValueW
test eax, eax
je 0x657d2f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657d4c
mov eax, dword [ebp - 0x10]
call fcn.004be374
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657d69
lea eax, [ebp - 4]
call fcn.004c1264
ret
Function at 0x65de90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004c1348
xor eax, eax
push ebp
push 0x65dfbe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x65df91
xor eax, eax
push ebp
push 0x65df8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c1730
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x65df5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x65df4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c1730
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004c2244
mov edx, ebx
pop ecx
call fcn.004be5ac
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65df55
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x7e9494]
mov dl, 1
mov eax, dword [0x49cce8]
call fcn.004a8fd8
call fcn.004c09e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65dfc5
lea eax, [ebp - 4]
call fcn.004c1264
ret
Function at 0x66e400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x66e40f
add esp, 0xfffffff0
call fcn.004bfcc0
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004bf760
mov dword [edi + 0x10], 0xff00000f
mov dword [edi + 0x14], 0xff0000
mov dword [edi + 0x7c], 0x1fffffff
mov dword [edi + 0x80], 0x1fffffff
mov dword [edi + 0x18], 0xff00000f
mov dword [edi + 0x1c], 0xffffff
mov dword [edi + 0x20], 0xffff
mov dword [edi + 0x24], 0x1fffffff
mov dword [edi + 0x28], 0xff00000f
mov dword [edi + 0x2c], 0x1fffffff
mov dword [edi + 0x30], 0xff00000f
mov dword [edi + 0x34], 0x1fffffff
mov dword [edi + 0x38], 0x1fffffff
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x40], 0xffffff
mov dword [edi + 0x44], 0xffffff
mov dword [edi + 0x48], 0x1fffffff
mov dword [edi + 0x4c], 0x1fffffff
mov byte [edi + 0x50], 1
mov byte [edi + 0x51], 1
mov byte [edi + 0x52], 1
mov byte [edi + 0x53], 1
mov dword [edi + 0x54], 0x1fffffff
mov dword [edi + 0x58], 0x1fffffff
mov dword [edi + 0x5c], 0xffffff
mov dword [edi + 0x60], 0xffffff
mov byte [edi + 0x64], 1
mov byte [edi + 0x65], 1
mov byte [edi + 0x66], 1
mov byte [edi + 0x67], 1
mov dword [edi + 0x68], 0xffffff
mov dword [edi + 0x6c], 0xff0000
mov dword [edi + 0x70], 0xff0000
mov dword [edi + 0x74], 0xff0000
mov dl, 1
mov eax, dword [0x66077c]
call fcn.0066e36c
mov esi, eax
mov dword [edi + 0x78], esi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x66ebb8
mov dl, 1
mov eax, dword [0x503658]
call fcn.00509c44
mov esi, eax
mov dword [edi + 0x84], esi
mov eax, esi
mov edx, 0x66e5d0
call fcn.0050a158
mov eax, dword [edi + 0x84]
mov edx, 8
call fcn.0050a1d0
mov eax, dword [edi + 0x84]
movzx edx, byte [0x66e5e0]
call fcn.0050a1fc
mov cl, 0xe8
mov dl, 0xc7
mov al, 0xae
call fcn.004b98d0
mov dword [edi + 0x8c], eax
mov cl, 0xff
mov dl, 0xfa
mov al, 0xbf
call fcn.004b98d0
mov dword [edi + 0x98], eax
mov cl, 0xbd
mov dl, 0xff
mov al, 0xff
call fcn.004b98d0
mov dword [edi + 0x94], eax
mov cl, 0xff
mov dl, 0xfb
mov al, 0xd0
call fcn.004b98d0
mov dword [edi + 0x90], eax
mov cl, 0xfd
mov dl, 0xf4
mov al, 0xed
call fcn.004b98d0
mov dword [edi + 0x88], eax
mov eax, edi
test bl, bl
je 0x66e5bc
call fcn.004bfd18
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x671334
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6760e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0xc], 0
jl 0x6760be
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x294]
call fcn.0046361c
cmp eax, dword [ebp - 0xc]
jle 0x6760be
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x14], 0x1fffffff
mov dword [ebp - 0x18], 0x1fffffff
mov dword [ebp - 0x1c], 0x1fffffff
mov dword [ebp - 0x20], 0x1fffffff
mov edi, 0x1fffffff
mov dword [ebp - 0x48], 0x1fffffff
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x22], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov bl, 1
lea ecx, [ebp - 0x94]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006786d0
cmp dword [ebp - 0x94], 0xffffffff
jg 0x67140a
cmp dword [ebp - 0x8c], 0xffffffff
jg 0x67140a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x294]
mov edx, dword [ebp - 0xc]
call fcn.00670398
movzx eax, byte [eax + 0x18]
xor al, 1
mov byte [ebp - 0xd], al
jmp 0x6760be
mov byte [ebp - 0xd], 1
mov byte [ebp - 0x66], 0
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x2d], 1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x29c]
cmp dword [eax + 0x2c], 0
jle 0x67143f
cmp byte [eax + 0x29], 0
je 0x671443
xor eax, eax
jmp 0x671445
mov al, 1
mov byte [ebp - 0x65], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x294]
mov edx, dword [ebp - 0xc]
call fcn.00670398
cmp byte [eax + 0x49], 0
je 0x671475
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x294]
mov edx, dword [ebp - 0xc]
call fcn.00670398
mov esi, dword [eax + 0x4c]
jmp 0x671481
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x288]
mov esi, dword [eax + 0x38]
mov eax, dword [esi + 0x98]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
call fcn.0067cb38
Function at 0x6926ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x6926bb
add esp, 0xfffffff0
call fcn.004bfcc0
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004bf760
mov dword [edi + 0x10], 0xff00000f
mov dword [edi + 0x14], 0xff0000
mov dword [edi + 0x7c], 0x1fffffff
mov dword [edi + 0x80], 0x1fffffff
mov dword [edi + 0x18], 0xff00000f
mov dword [edi + 0x1c], 0xffffff
mov dword [edi + 0x20], 0xffff
mov dword [edi + 0x24], 0x1fffffff
mov dword [edi + 0x28], 0xff00000f
mov dword [edi + 0x2c], 0x1fffffff
mov dword [edi + 0x30], 0xff00000f
mov dword [edi + 0x34], 0x1fffffff
mov dword [edi + 0x38], 0x1fffffff
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x40], 0xffffff
mov dword [edi + 0x44], 0xffffff
mov dword [edi + 0x48], 0x1fffffff
mov dword [edi + 0x4c], 0x1fffffff
mov byte [edi + 0x50], 1
mov byte [edi + 0x51], 1
mov byte [edi + 0x52], 1
mov byte [edi + 0x53], 1
mov dword [edi + 0x54], 0x1fffffff
mov dword [edi + 0x58], 0x1fffffff
mov dword [edi + 0x5c], 0xffffff
mov dword [edi + 0x60], 0xffffff
mov byte [edi + 0x64], 1
mov byte [edi + 0x65], 1
mov byte [edi + 0x66], 1
mov byte [edi + 0x67], 1
mov dword [edi + 0x68], 0xffffff
mov dword [edi + 0x6c], 0xff0000
mov dword [edi + 0x70], 0xff0000
mov dword [edi + 0x74], 0xff0000
mov dl, 1
mov eax, dword [0x682afc]
call fcn.0069244c
mov esi, eax
mov dword [edi + 0x78], esi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x692ea0
mov dl, 1
mov eax, dword [0x503658]
call fcn.00509c44
mov esi, eax
mov dword [edi + 0x84], esi
mov eax, esi
mov edx, 0x69289c
call fcn.0050a158
mov eax, dword [edi + 0x84]
mov edx, 8
call fcn.0050a1d0
mov eax, dword [edi + 0x84]
movzx edx, byte [0x6928ac]
call fcn.0050a1fc
mov eax, dword [edi + 0x84]
mov dword [eax + 0xc], edi
mov dword [eax + 8], 0x692ecc
mov cl, 0xe8
mov dl, 0xc7
mov al, 0xae
call fcn.004b98d0
mov dword [edi + 0x8c], eax
mov cl, 0xff
mov dl, 0xfa
mov al, 0xbf
call fcn.004b98d0
mov dword [edi + 0x9c], eax
mov cl, 0x63
mov dl, 0xcc
mov al, 0xf8
call fcn.004b98d0
mov dword [edi + 0x94], eax
mov cl, 0xbd
mov dl, 0xff
mov al, 0xff
call fcn.004b98d0
mov dword [edi + 0x98], eax
mov cl, 0xff
mov dl, 0xfb
mov al, 0xd0
call fcn.004b98d0
mov dword [edi + 0x90], eax
mov cl, 0xfd
mov dl, 0xf4
mov al, 0xed
call fcn.004b98d0
mov dword [edi + 0x88], eax
mov eax, edi
test bl, bl
je 0x692889
call fcn.004bfd18
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x6ab0e0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 4], 5
ja 0x6ab10c
cmp dword [esp + 4], 5
jne 0x6ab108
cmp dword [esp + 8], 1
jae 0x6ab10c
xor eax, eax
jmp 0x6ab10e
mov al, 1
add esp, 0x114
ret

Function at 0x6b6958
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x260], 0
je 0x6b6974
cmp dword [esi + 4], 0
je 0x6b69a1
test byte [ebx + 0x55], 1
jne 0x6b6993
mov eax, ebx
call fcn.0054b120
test eax, eax
jne 0x6b6993
mov edx, esi
mov eax, ebx
call fcn.00552254
jmp 0x6b6ab1
mov edx, esi
mov eax, ebx
call fcn.0054c9b8
jmp 0x6b6ab1
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6b6aaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0054f634
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00547b90
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.006b6958
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0054f634
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b6ab1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x73b964
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00741b14
test al, al
je 0x73b986
call fcn.0064d490
test al, al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x260], 0
je 0x73b998
cmp dword [esi + 4], 0
je 0x73b9cb
mov eax, dword [ebp - 4]
test byte [eax + 0x55], 1
jne 0x73b9bc
mov eax, dword [ebp - 4]
call fcn.0054b120
test eax, eax
jne 0x73b9bc
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00552254
jmp 0x73bba6
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0054c9b8
jmp 0x73bba6
push 0
call sub.USER32.DLL_GetDC
mov ebx, eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x58]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x6c]
push eax
push ebx
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
push ebx
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x73badc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
call fcn.0054f634
push eax
call sub.USER32.DLL_BeginPaint
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00547b90
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0073b964
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x58]
push eax
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x6c]
push eax
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
call fcn.0054f634
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73bba6
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x748350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x74835f
add esp, 0xfffffff0
call fcn.004bfcc0
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004bf760
mov dword [edi + 0x10], 0xff00000f
mov dword [edi + 0x14], 0xff0000
mov dword [edi + 0x7c], 0x1fffffff
mov dword [edi + 0x80], 0x1fffffff
mov dword [edi + 0x18], 0xff00000f
mov dword [edi + 0x1c], 0xffffff
mov dword [edi + 0x20], 0xffff
mov dword [edi + 0x24], 0x1fffffff
mov dword [edi + 0x28], 0xff00000f
mov dword [edi + 0x2c], 0x1fffffff
mov dword [edi + 0x30], 0xff00000f
mov dword [edi + 0x34], 0x1fffffff
mov dword [edi + 0x38], 0x1fffffff
mov dword [edi + 0x3c], 0xffffff
mov dword [edi + 0x40], 0xffffff
mov dword [edi + 0x44], 0xffffff
mov dword [edi + 0x48], 0x1fffffff
mov dword [edi + 0x4c], 0x1fffffff
mov byte [edi + 0x50], 1
mov byte [edi + 0x51], 1
mov byte [edi + 0x52], 1
mov byte [edi + 0x53], 1
mov dword [edi + 0x54], 0x1fffffff
mov dword [edi + 0x58], 0x1fffffff
mov dword [edi + 0x5c], 0xffffff
mov dword [edi + 0x60], 0xffffff
mov byte [edi + 0x64], 1
mov byte [edi + 0x65], 1
mov byte [edi + 0x66], 1
mov byte [edi + 0x67], 1
mov dword [edi + 0x68], 0xffffff
mov dword [edi + 0x6c], 0xff0000
mov dword [edi + 0x70], 0xff0000
mov dword [edi + 0x74], 0xff0000
mov cl, 0xe8
mov dl, 0xc7
mov al, 0xae
call fcn.004b98d0
mov dword [edi + 0x8c], eax
mov cl, 0xff
mov dl, 0xfa
mov al, 0xbf
call fcn.004b98d0
mov dword [edi + 0x90], eax
mov cl, 0x63
mov dl, 0xcc
mov al, 0xf8
call fcn.004b98d0
mov dword [edi + 0x94], eax
mov cl, 0xbd
mov dl, 0xff
mov al, 0xff
call fcn.004b98d0
mov dword [edi + 0xa0], eax
mov cl, 0xff
mov dl, 0xfb
mov al, 0xd0
call fcn.004b98d0
mov dword [edi + 0x98], eax
mov cl, 0xfd
mov dl, 0xf4
mov al, 0xed
call fcn.004b98d0
mov dword [edi + 0x9c], eax
mov dl, 1
mov eax, dword [0x6ce700]
call fcn.0072e46c
mov esi, eax
mov dword [edi + 0x78], esi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x748bf8
mov dl, 1
mov eax, dword [0x503658]
call fcn.00509c44
mov dword [edi + 0x84], eax
call fcn.006aaeec
test al, al
je 0x7484f3
mov eax, dword [edi + 0x84]
mov edx, 0x748554
call fcn.0050a158
jmp 0x748503
mov eax, dword [edi + 0x84]
mov edx, 0x748574
call fcn.0050a158
mov eax, dword [edi + 0x84]
mov edx, 8
call fcn.0050a1d0
mov eax, dword [edi + 0x84]
movzx edx, byte [0x748584]
call fcn.0050a1fc
mov byte [edi + 0x88], 1
mov eax, edi
test bl, bl
je 0x748541
call fcn.004bfd18
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x7675f8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
push 0
push ebx
call sub.USER32.DLL_MapVirtualKeyW
shl eax, 0x10
sub ebx, 8
je 0x767626
sub ebx, 5
je 0x767626
add ebx, 0xfffffffd
sub ebx, 3
jb 0x767626
or eax, 0x1000000
push 0xff
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextW
mov edx, esi
mov eax, esp
call fcn.004a4804
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x776d34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004c2244
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x776d4d
test al, 0x10
jne 0x776d51
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x776d58
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd24
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.004c1348
xor eax, eax
push ebp
push 0x776f47
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.004befdc
mov edi, eax
lea eax, [ebp - 0x2cc]
xor ecx, ecx
mov edx, 0x2b4
call fcn.004bed18
cmp dword [ebp + 0x20], 0
je 0x776e15
cmp dword [ebp - 0x10], 0
je 0x776e15
mov dl, 1
mov eax, dword [ebp + 0x20]
call fcn.004a3c5c
test al, al
jne 0x776dcb
mov eax, dword [ebp + 0x20]
call fcn.00776d34
test al, al
je 0x776dee
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004c2244
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
jmp 0x776e0f
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.004c2244
push eax
call sub.SHELL32.DLL_SHGetFileInfoW
mov edi, dword [ebp - 0x2c8]
cmp byte [ebp + 0x1c], 0
je 0x776e3c
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0x776f58
call sub.SHELL32.DLL_SHGetFileInfoW
mov esi, eax
jmp 0x776e5b
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0
push 0x776f58
call sub.SHELL32.DLL_SHGetFileInfoW
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.COMCTL32.DLL_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0045f4fc
test bl, bl
je 0x776e9b
cmp byte [ebp + 0x14], 0
jne 0x776e9b
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0050bb70
push eax
push edi
push esi
call sub.COMCTL32.DLL_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x776f31
mov dl, 1
mov eax, dword [0x507428]
call fcn.00510b84
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, ebx
call fcn.005114a4
call fcn.0050bb70
push eax
push edi
push esi
call sub.COMCTL32.DLL_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004be8e0
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d4], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004be8e0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d0], eax
mov ecx, ebx
lea edx, [ebp - 0x2dc]
mov eax, dword [ebp - 4]
call fcn.00776c58
mov eax, ebx
call fcn.004bf790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x776f4e
lea eax, [ebp + 0x20]
call fcn.004c1264
ret