joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00413664
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00559e94
test ebx, ebx
jne 0x560573
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00560440
mov ebx, eax
test ebx, ebx
je 0x560669
cmp esi, ebx
je 0x56059c
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x5605b1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5605e9
add eax, 0xffffff5f
sub eax, 2
jb 0x560601
dec eax
sub eax, 2
jb 0x560615
dec eax
sub eax, 2
jb 0x56060b
jmp 0x56061f
add eax, 0xfffffdff
sub eax, 2
jb 0x560601
dec eax
sub eax, 2
jb 0x560615
dec eax
sub eax, 2
jb 0x56060b
jmp 0x56061f
mov byte [esp + 0x120], 0
jmp 0x560627
mov byte [esp + 0x120], 2
jmp 0x560627
mov byte [esp + 0x120], 1
jmp 0x560627
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0061b884
mov esi, eax
call fcn.005565e0
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0055ba08
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x56066b
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x587880
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x58796d
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x58793f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x58792e
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00407068
mov eax, dword [ebp - 4]
call fcn.005875bc
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x587917
mov ecx, dword [0x7167bc]
mov dl, 1
mov eax, dword [0x442724]
call fcn.0042bc80
call fcn.0040969c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587935
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret

Function at 0x587b4c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x587bf1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x587bc4
mov edx, ebx
mov eax, dword [0x526b84]
call fcn.0052fa90
test al, al
je 0x587bb4
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0052f988
call fcn.00409790
jmp 0x587bf8
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x587b7e
mov ecx, dword [0x716848]
mov dl, 1
mov eax, dword [0x5874c4]
call fcn.0042bc80
call fcn.0040969c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587bf8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x587c00
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x587c55
push dword fs:[edx]
mov dword fs:[edx], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587c5c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x587c64
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x587cb9
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587cc0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x587d30
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x587da5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005875bc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0052fa70
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x587d8f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587dac
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x587db4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x587e29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005875bc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x6c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x587e13
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587e30
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x59c958
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a084
xor eax, eax
push ebp
push 0x59ca95
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x59ca68
xor edx, edx
push ebp
push 0x59ca61
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x59c9a5
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x59ca36
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x59ca25
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x59c9e8
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040aa08
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00407068
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ca2c
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x716780]
mov dl, 1
mov eax, dword [0x41e188]
call fcn.0042bc80
call fcn.0040969c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ca9c
lea eax, [ebp - 4]
call fcn.00409fa0
ret

Function at 0x5c4c50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.0040a128
test ebx, ebx
je 0x5c4ca4
mov eax, dword [esi]
call fcn.0040aa08
push eax
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageW
sub ebx, eax
test ebx, ebx
jle 0x5c4ca4
mov eax, dword [esi]
test eax, eax
je 0x5c4c99
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sub edx, ebx
mov eax, esi
call fcn.0040ab98
pop edi
pop esi
pop ebx
ret

Function at 0x5cdca0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.005cdd68
test eax, eax
je 0x5cdcf2
mov edi, dword [ebx + 8]
test edi, edi
je 0x5cdcce
test edi, edi
je 0x5cdcce
mov edx, esi
mov eax, edi
call fcn.0055a538
jmp 0x5cdd00
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.005cdd68
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a128
jmp 0x5cdd00
mov ecx, esi
mov edx, 0x5cdd20
mov eax, ebx
call fcn.005cdc28
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a380
add esp, 0x200
pop edi
pop esi
pop ebx
ret
Function at 0x609534
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409fa0
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x609586
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x60957f
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040aac0
jmp 0x609586
mov eax, esi
call fcn.00409fa0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x60f34c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x60f4ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x7154ec], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x51d8a8]
call fcn.0051e9f4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x60f481
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0051eadc
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040aac0
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x60f4c4
call fcn.0040ac70
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0051ed68
test al, al
je 0x60f46b
lea ecx, [ebp - 4]
mov edx, 0x60f538
mov eax, dword [ebp - 0xc]
call fcn.0051f5f8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042ee14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x60f46b
xor edx, edx
push ebp
push 0x60f464
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x60f550
mov eax, dword [ebp - 8]
push eax
call fcn.004159e0
test eax, eax
je 0x60f44d
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x60f44d
call fcn.0060f2d8
test eax, eax
je 0x60f43d
mov eax, dword [ebx + 0x50]
jmp 0x60f440
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x7154ec]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f46b
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f488
mov eax, dword [ebp - 0xc]
call fcn.004081cc
ret

Function at 0x60f5b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x60f5fb
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x60f5de
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x60f5ef
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x60f5fb
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x61b3a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x61b3c1
test edi, 0x40000
je 0x61b3db
test bl, bl
jne 0x61b45c
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x61b45c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x61b40e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x61b423
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x61b432
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x61b443
cmp byte [esp + 2], 0
je 0x61b45c
cmp byte [esp + 2], 0
je 0x61b454
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x61b45c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x61b700
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x61b726
mov eax, esp
push eax
push 0x61b6c8
call sub.user32.dll_EnumWindows
jmp 0x61b739
mov eax, esp
push eax
push 0x61b6a8
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x61b7fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x61b80e
or si, 1
test bl, 8
je 0x61b817
or si, 4
test bl, 1
je 0x61b820
or si, 8
test bl, 2
je 0x61b829
or si, 0x10
test bl, 0x10
je 0x61b832
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x61b842
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x61b848
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x61b861
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x61b871
or bx, 4
test esi, 0x20000000
je 0x61b87d
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x625244
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x625256
add esp, 0xfffffff0
call fcn.004087f4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00483518
mov eax, dword [0x71686c]
mov dword [eax + 4], ebx
mov dword [eax], 0x625718
mov eax, dword [0x71687c]
mov dword [eax + 4], ebx
mov dword [eax], 0x625724
mov eax, ebx
call fcn.00625730
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x61f784
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.00625d0c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x625b3c
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x625b3c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x625b3c
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x625b3c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x625b3c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6253d6
call fcn.0040884c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6258dc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x625a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x625a69
mov dl, 1
mov eax, dword [0x4465b4]
call fcn.00471724
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409fa0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x625a58
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0056adc4
test al, al
je 0x625a4b
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x625a98
lea eax, [ebp - 0x394]
call fcn.00426e3c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x625a4b
xor eax, eax
push ebp
push 0x625a44
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x625b08
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x625a2d
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aac0
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x625a2d
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aac0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625a4b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x62594d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.0047164c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625a8f
lea eax, [ebp - 0x3a0]
call fcn.00409fa0
ret

Function at 0x626698
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x71dc60]
cmp byte [eax + 0xc5], 0
jne 0x62670a
cmp dword [0x71dc84], 0
jne 0x6266ca
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x715604]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x71dc84], eax
cmp dword [0x71dc80], 0
jne 0x6266e5
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x71dc80], eax
cmp dword [0x71dc88], 0
jne 0x62670a
push esp
push 0
push 0
mov eax, dword [0x715600]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x71dc88], eax
pop edx
ret
Function at 0x626b2c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x626b43
add esp, 0xfffffff0
call fcn.004087f4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00483518
mov eax, dword [0x7166b4]
cmp byte [eax], 0
jne 0x626b70
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x716acc]
cmp word [eax + 2], 0
jne 0x626b8a
mov eax, dword [0x716acc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00628f0c
mov eax, dword [0x716c54]
cmp word [eax + 2], 0
jne 0x626ba4
mov eax, dword [0x716c54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00629110
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x523704]
call fcn.0052a600
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x629694
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x528ae8]
call fcn.00534dbc
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x626d94
mov eax, dword [0x71692c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005352d8
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x62997c
mov dl, 1
mov eax, dword [0x442b3c]
call fcn.0040819c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x71692c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426c3c
test eax, eax
je 0x626cbe
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00426a40
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00426c20
test eax, eax
je 0x626cd6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aac0
push ebx
push 0x6288ec
call fcn.0061b7e0
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x7166b4]
cmp byte [eax], 0
jne 0x626d27
mov eax, ebx
call fcn.00626f5c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00629bb4
mov eax, ebx
call fcn.0062a860
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x626d8b
call fcn.0040884c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret