joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d673c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5d674e
add esp, 0xfffffff0
call fcn.00408c10
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1b78
mov eax, dword [0x5fdfe4]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d6c10
mov eax, dword [0x5fdff4]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d6c1c
mov eax, ebx
call fcn.005d6c28
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5d0934
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005d7208
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d7038
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d7038
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d7038
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d7038
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d7038
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d68ce
call fcn.00408c68
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d6dd4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d6f84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5d6f63
mov dl, 1
mov eax, dword [0x484dbc]
call fcn.004b0d14
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a3cc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d6f52
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0054cf9c
test al, al
je 0x5d6f45
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d6f94
lea eax, [ebp - 0x394]
call fcn.00426cf0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5d6f45
xor eax, eax
push ebp
push 0x5d6f3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d7004
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5d6f25
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b008
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5d6f25
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6f45
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d6e45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b0c3c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6f8b
lea eax, [ebp - 0x3a0]
call fcn.0040a3cc
pop eax
jmp eax

Function at 0x5d7b9c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x605c74]
cmp byte [eax + 0xc5], 0
jne 0x5d7c0e
cmp dword [0x605c9c], 0
jne 0x5d7bce
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5fdd9c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x605c9c], eax
cmp dword [0x605c98], 0
jne 0x5d7be9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x605c98], eax
cmp dword [0x605ca0], 0
jne 0x5d7c0e
push esp
push 0
push 0
mov eax, dword [0x5fdd98]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x605ca0], eax
pop edx
ret
Function at 0x5d8188
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d819f
add esp, 0xfffffff0
call fcn.00408c10
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1b78
mov eax, dword [0x5fde70]
cmp byte [eax], 0
jne 0x5d81cc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x5fe21c]
cmp word [eax + 2], 0
jne 0x5d81e6
mov eax, dword [0x5fe21c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005da64c
mov eax, dword [0x5fe360]
cmp word [eax + 2], 0
jne 0x5d8200
mov eax, dword [0x5fe360]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005daa64
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50fd38]
call fcn.005168b4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5db010
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x514ea8]
call fcn.00520ec8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5d83f0
mov eax, dword [0x5fe0a4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005213e4
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5db2fc
mov dl, 1
mov eax, dword [0x481070]
call fcn.004085f4
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5fe0a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426af0
test eax, eax
je 0x5d8313
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00426948
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00426ad4
test eax, eax
je 0x5d832b
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b008
push ebx
push 0x5da020
call fcn.005cc61c
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5fde70]
cmp byte [eax], 0
jne 0x5d837c
mov eax, ebx
call fcn.005d85b8
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005db6a4
mov eax, ebx
call fcn.005dc1e0
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d83e7
call fcn.00408c68
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d88e8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5d898a
cmp dword [ebx + 0xac], 0
jne 0x5d8984
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d8828
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d8984
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d894a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d8984
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004abb1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d8959
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d8ccc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x605c74]
cmp dword [eax + 0x190], 0
je 0x5d8e35
test bl, bl
jne 0x5d8d88
cmp dword [esi + 0xb4], 0
jne 0x5d8d7d
mov eax, esi
call fcn.005dc030
push eax
push 0x5d8bcc
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d8d4e
mov eax, dword [0x605c74]
cmp byte [eax + 0xeb], 0
je 0x5d8d4e
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d8d2f
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d8d4e
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d8d37
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d8d7d
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004abb1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d8d5d
inc dword [esi + 0xb4]
jmp 0x5d8e35
cmp dword [esi + 0xb4], 0
jle 0x5d8e35
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d8e35
cmp dword [esi + 0x58], 0
je 0x5d8dea
mov eax, dword [0x605c74]
cmp byte [eax + 0xeb], 0
je 0x5d8dea
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d8dcb
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d8dea
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d8dd3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d8e19
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004abb1c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d8df9
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c8abc]
call fcn.0040d3e8
pop edi
pop esi
pop ebx
ret
Function at 0x5d9c2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d9c89
cmp byte [ebx + 0xeb], 0
jne 0x5d9c89
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a564
mov eax, dword [esi]
test eax, eax
je 0x5d9c76
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d9c96
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7bc
jmp 0x5d9c96
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7bc
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5db8b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5db929
mov eax, esi
call fcn.00546a34
test al, al
je 0x5db929
mov eax, dword [ebx + 0x98]
call fcn.005465cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5db929
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5db91a
push 0
mov eax, dword [ebx + 0x98]
call fcn.005465cc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0053c804
jmp 0x5db929
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005db6c4
pop esi
pop ebx
ret
Function at 0x5e40e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5e416a
mov eax, dword [ebx + 8]
call fcn.005465cc
mov ecx, eax
mov dl, 1
mov eax, dword [0x5563e4]
call fcn.005400b0
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0055f028
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5e39b4
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005465cc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005465cc
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5e41ec
mov eax, dword [ebx + 8]
call fcn.005465cc
mov ecx, eax
mov dl, 1
mov eax, dword [0x5563e4]
call fcn.005400b0
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0055f028
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5e3a00
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.005465cc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.005465cc
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5e426a
mov eax, dword [ebx + 8]
call fcn.005465cc
mov ecx, eax
mov dl, 1
mov eax, dword [0x556ed8]
call fcn.005400b0
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005465cc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005465cc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5ea2ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ea302
or bx, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ea312
or bx, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ea322
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x5eba7c
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5fe328]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ebaa8
push 0
mov eax, dword [0x5fe328]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x5ebec8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00426bd8
add esp, 0x20c
pop ebx
ret

Function at 0x5ebef4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ebf77
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005ed258
test al, al
je 0x5ebf3e
lea eax, [ebp - 0x210]
call fcn.005ebec8
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x5ebf90
call fcn.0040b1b8
jmp 0x5ebf5c
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x20a]
call fcn.00426bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ebf7e
lea eax, [ebp - 0x210]
call fcn.0040a3cc
pop eax
jmp eax

Function at 0x5ec308
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
xor edx, edx
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a4c0
xor eax, eax
push ebp
push 0x5ec3b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040af6c
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2bc]
test ebx, ebx
jne 0x5ec38e
lea eax, [ebp - 0x2c0]
call fcn.005ebef4
mov edx, dword [ebp - 0x2c0]
lea eax, [ebp - 8]
mov ecx, 0x5ec3d0
call fcn.0040b1b8
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.005ec3ec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec3bd
lea eax, [ebp - 0x2c0]
call fcn.0040a3cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a42c
pop eax
jmp eax
Function at 0x5ecaec
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x5ecb03
mov bl, 1
jmp 0x5ecbed
call fcn.0042e134
cmp eax, 2
jne 0x5ecb17
call fcn.0042e148
cmp eax, 4
jg 0x5ecb48
call fcn.0042e134
dec eax
jne 0x5ecbd7
call fcn.0042e148
cmp eax, 4
jg 0x5ecb48
call fcn.0042e148
cmp eax, 4
jne 0x5ecbd7
call fcn.0042e150
test eax, eax
jle 0x5ecbd7
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x5ecb8f
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x5ecbe3
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x5ecbe3
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ecc64
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ecdf8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a3cc
lea eax, [ebp - 4]
call fcn.0040a3cc
mov eax, esi
call fcn.0040a3cc
mov eax, edi
call fcn.0040a3cc
test ebx, ebx
je 0x5ecdb5
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ecdb5
push ebx
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jle 0x5ecdb5
push 0x104
lea eax, [ebp - 0x212]
push eax
push ebx
call sub.user32.dll_GetWindowTextW
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040b008
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.005ec1f8
mov edx, dword [ebp - 0x218]
mov eax, esi
call fcn.0040a7bc
push 0x104
lea eax, [ebp - 0x212]
push eax
push ebx
call sub.user32.dll_GetClassNameW
lea eax, [ebp - 0x224]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040b008
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.005ec1f8
mov edx, dword [ebp - 0x220]
mov eax, edi
call fcn.0040a7bc
lea edx, [ebp - 0x228]
mov eax, ebx
call fcn.005ececc
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
call fcn.0040b044
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a804
mov eax, dword [ebp - 4]
call fcn.005ebd08
test al, al
je 0x5ecdb5
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005ebfa4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.0040a7bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ecdff
lea eax, [ebp - 0x228]
call fcn.0040a414
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.0040a42c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a42c
pop eax
jmp eax

Function at 0x5ece08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5eceb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a414
push 0
push 0
call sub.kernel32.dll_GetSystemDirectoryW
mov ebx, eax
test ebx, ebx
jbe 0x5ece9e
mov eax, ebx
add eax, eax
call fcn.00406fb4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ece97
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov ebx, eax
test ebx, ebx
jbe 0x5ece7f
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040acec
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, 0x5ecec8
call fcn.0040add0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ece9e
mov eax, dword [ebp - 4]
call fcn.00406fe8
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ecebd
lea eax, [ebp - 8]
call fcn.0040a414
pop eax
jmp eax
Function at 0x5ed2dc
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 0xa
sete al
add esp, 0x114
ret

Function at 0x5ed300
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 5
jne 0x5ed321
cmp dword [esp + 8], 0
je 0x5ed325
xor eax, eax
jmp 0x5ed327
mov al, 1
add esp, 0x114
ret