joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56c79c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x56c867
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, ecx
test eax, eax
je 0x56c7c3
sub eax, 4
mov eax, dword [eax]
mov edx, eax
test edx, edx
jns 0x56c7ce
call fcn.00417038
mov eax, ecx
mov ecx, edx
add ecx, ecx
add ecx, eax
cmp ecx, eax
jbe 0x56c7ec
movzx ebx, word [eax]
xor edx, ebx
imul edx, edx, 0x1000193
add eax, 2
cmp ecx, eax
ja 0x56c7da
mov ebx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.00571cc8
test al, al
je 0x56c837
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.0057101c
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.0041a114
jne 0x56c84f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.004194f0
jmp 0x56c84f
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.005718d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c86e
lea eax, [ebp - 4]
call int.00419100
pop eax
jmp eax
Function at 0x588dd0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x588f8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00419538
mov eax, dword [ebp - 4]
call fcn.005886ac
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x588e22
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0041a194
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00589a24
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x588f03
xor eax, eax
push ebp
push 0x588efc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.005889bc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00588fc4
test al, al
je 0x588ed8
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00419298
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x588ed8
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00419d78
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0058891c
test al, al
je 0x588ed2
mov eax, dword [ebp - 8]
call fcn.00419d78
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00419dd8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00588dd0
dec ebx
cmp ebx, 0xffffffff
jne 0x588e81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588f03
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.005889bc
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
jmp eax
cmp byte [0x779fc4], 0
je 0x588f43
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00419d78
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005889a8
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0058891c
mov ebx, eax
jmp 0x588f6a
mov eax, dword [ebp - 4]
call fcn.00419d78
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005889a8
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0058891c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588f96
lea eax, [ebp - 0x3c]
call int.00419100
lea eax, [ebp - 8]
mov edx, 2
call fcn.00419160
pop eax
jmp eax
Function at 0x589900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.005886c4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00419d78
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0058891c
test al, al
jne 0x589968
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7726fc]
mov dl, 1
mov eax, dword [0x587490]
call fcn.0043c0e0
call fcn.004188cc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x589974
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00419d78
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.0058891c
test al, al
jne 0x5899d5
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7726f8]
mov dl, 1
mov eax, dword [0x587490]
call fcn.0043c0e0
call fcn.004188cc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.005886f4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5cafb0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5cb116
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x5caff2
or ebx, 0xffff
mov eax, esi
call fcn.00419d78
mov esi, eax
jmp 0x5caff4
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call fcn.00760192
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x2f76
jne 0x5cb024
mov eax, edi
call int.00419100
jmp 0x5cb0f9
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x7a
je 0x5cb074
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x77a018]
call fcn.0043a56c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x772e54]
mov dl, 1
mov eax, dword [0x5cf58c]
call fcn.0043c0e0
call fcn.004188cc
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.00419f04
mov eax, dword [edi]
test eax, eax
je 0x5cb08c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x5cb0f9
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.00419d78
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call fcn.00760192
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5cb0f9
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x77a018]
call fcn.0043a56c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x772e54]
mov dl, 1
mov eax, dword [0x5cf58c]
call fcn.0043c0e0
call fcn.004188cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cb11d
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00419160
pop eax
jmp eax

Function at 0x5f1cb8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5f1cbe
ret
Function at 0x60f124
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x77a2a4], 0
je 0x60f265
push 0x11
call fcn.0075fd7a
test ax, 0x8000
setne al
mov edx, dword [0x7724e4]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x60f265
mov eax, dword [0x77a2a8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x77a2a4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x60f234
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x77a2a4]
call fcn.004c123c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x60f22c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x21d], 0
je 0x60f22c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x7c]
test al, al
je 0x60f22c
mov eax, dword [ebp - 0x14]
call fcn.0061bcb4
push eax
call fcn.0075fe9a
test eax, eax
je 0x60f22c
push ebp
call fcn.0060f0e0
pop ecx
test al, al
jne 0x60f22c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.004177fc
test al, al
je 0x60f22c
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.004177fc
cmp byte [ebp - 1], 0
je 0x60f22c
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00421e04
test al, al
je 0x60f22c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x77a2a8]
call fcn.0060e85c
inc edi
dec ebx
jne 0x60f189
mov eax, dword [0x77a2a8]
cmp dword [eax + 8], 0
jle 0x60f24c
mov eax, dword [0x77a2a8]
call fcn.0060e910
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x60f265
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0060ef48
pop ecx
test al, al
jne 0x60f265
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6182b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call fcn.0075fdc8
call fcn.00422360
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00611818
test ebx, ebx
jne 0x61830b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00618168
mov ebx, eax
test ebx, ebx
je 0x618401
cmp esi, ebx
je 0x618334
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x618349
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x618381
add eax, 0xffffff5f
sub eax, 2
jb 0x618399
dec eax
sub eax, 2
jb 0x6183ad
dec eax
sub eax, 2
jb 0x6183a3
jmp 0x6183b7
add eax, 0xfffffdff
sub eax, 2
jb 0x618399
dec eax
sub eax, 2
jb 0x6183ad
dec eax
sub eax, 2
jb 0x6183a3
jmp 0x6183b7
mov byte [esp + 0x120], 0
jmp 0x6183bf
mov byte [esp + 0x120], 2
jmp 0x6183bf
mov byte [esp + 0x120], 1
jmp 0x6183bf
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call fcn.0075fd92
lea eax, [esp + 0x14]
call fcn.0070b5c8
mov esi, eax
call fcn.0060dee0
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.006134c0
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x618403
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x6acb00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004191f4
xor eax, eax
push ebp
push 0x6acc43
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.0075ff12
test eax, eax
je 0x6acc14
xor edx, edx
push ebp
push 0x6acc0d
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x6acb4d
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6acbe0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x6acbcf
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x6acb90
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00419d78
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00416044
call fcn.0075fcb4
mov eax, dword [ebp - 8]
push eax
push 0xd
call fcn.0075ff90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6acbd6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
pop eax
jmp eax
mov ecx, dword [0x772b84]
mov dl, 1
mov eax, dword [0x42c178]
call fcn.0043c00c
call fcn.004188cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6acc4a
lea eax, [ebp - 4]
call int.00419100
pop eax
jmp eax

Function at 0x6b8808
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2d1], 0
jne 0x6b88da
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d0], 1
xor eax, eax
push ebp
push 0x6b88b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
call fcn.0061bcb4
push eax
call fcn.00760026
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
xor edx, edx
call fcn.00610fec
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d1], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2ec], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x174]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.006113e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00616964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b88bb
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d0], 0
pop eax
jmp eax
pop ebx
pop ecx
pop ebp
ret
Function at 0x6b9334
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2d1], 0
je 0x6b941c
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d0], 1
xor eax, eax
push ebp
push 0x6b93f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
mov dl, 5
call fcn.00610fec
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
call fcn.0061bcb4
push eax
call fcn.00760026
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d1], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2ec]
mov eax, dword [ebp - 4]
call fcn.006113e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov eax, dword [eax + 0x2c8]
call fcn.0070b9c4
test al, al
je 0x6b93dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov edx, dword [ebp - 4]
call fcn.0070c890
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00616964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b93fd
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d0], 0
pop eax
jmp eax
pop ebx
pop ecx
pop ebp
ret

Function at 0x6e247c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.006e2544
test eax, eax
je 0x6e24ce
mov edi, dword [ebx + 8]
test edi, edi
je 0x6e24aa
test edi, edi
je 0x6e24aa
mov edx, esi
mov eax, edi
call fcn.00611fe8
jmp 0x6e24dc
push 0x100
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.006e2544
push eax
call fcn.0075fe4c
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00419298
jmp 0x6e24dc
mov ecx, esi
mov edx, 0x6e24fc
mov eax, ebx
call fcn.006e2404
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.004194f0
add esp, 0x200
pop edi
pop esi
pop ebx
ret

Function at 0x6f69fc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call int.00419100
push 0
movzx eax, bl
push eax
call fcn.0075fed0
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x6f6a4e
push 0x100
lea eax, [esp + 4]
push eax
push ebx
call fcn.0075fd74
test eax, eax
je 0x6f6a47
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.00419e2c
jmp 0x6f6a4e
mov eax, esi
call int.00419100
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x6fc894
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6fc9f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x76dba4], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call fcn.0075fd8c
mov dl, 1
mov eax, dword [0x5876b4]
call fcn.00588800
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x6fc9cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00588958
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00419e2c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x6fca14
call fcn.00419fdc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00588be8
test al, al
je 0x6fc9b5
lea ecx, [ebp - 4]
mov edx, 0x6fca88
mov eax, dword [ebp - 0xc]
call fcn.0058947c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0043f6a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6fc9b5
xor edx, edx
push ebp
push 0x6fc9ae
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x6fcaa0
mov eax, dword [ebp - 8]
push eax
call fcn.00424598
test eax, eax
je 0x6fc995
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x6fc995
call fcn.006fc820
test eax, eax
je 0x6fc985
mov eax, dword [ebx + 0x50]
jmp 0x6fc988
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x76dba4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fc9b5
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6fc9d4
mov eax, dword [ebp - 0xc]
call fcn.0041742c
pop eax
jmp eax

Function at 0x6fcb04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x6fcb4b
push 0x10
call fcn.0075fd7a
test ax, ax
jge 0x6fcb2e
add bx, 0x2000
push 0x11
call fcn.0075fd7a
test ax, ax
jge 0x6fcb3f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x6fcb4b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x70b0e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call fcn.0075fe3a
mov edi, eax
test bl, bl
je 0x70b105
test edi, 0x40000
je 0x70b11f
test bl, bl
jne 0x70b1a0
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x70b1a0
push esi
call fcn.0075fe82
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call fcn.0075fe9a
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x70b152
push 0
push esi
call fcn.00760026
test bl, bl
je 0x70b167
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call fcn.0075fff0
jmp 0x70b176
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call fcn.0075fff0
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x70b187
cmp byte [esp + 2], 0
je 0x70b1a0
cmp byte [esp + 2], 0
je 0x70b198
push 6
push esi
call fcn.00760026
jmp 0x70b1a0
push 5
push esi
call fcn.00760026
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x70b540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x70b552
or si, 1
test bl, 8
je 0x70b55b
or si, 4
test bl, 1
je 0x70b564
or si, 8
test bl, 2
je 0x70b56d
or si, 0x10
test bl, 0x10
je 0x70b576
or si, 0x20
push 0x12
call fcn.0075fd7a
test ax, ax
jge 0x70b586
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x70b58c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call fcn.0075fd7a
test ax, ax
jge 0x70b5a5
or bx, 1
push 0x11
call fcn.0075fd7a
test ax, ax
jge 0x70b5b5
or bx, 4
test esi, 0x20000000
je 0x70b5c1
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x7172b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x7172cb
add esp, 0xfffffff0
call fcn.00417a18
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004d7798
mov eax, dword [0x772434]
cmp byte [eax], 0
jne 0x7172f8
push 0
call fcn.007600c4
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x7724fc]
cmp word [eax + 2], 0
jne 0x717312
mov eax, dword [0x7724fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00719778
mov eax, dword [0x7724b8]
cmp word [eax + 2], 0
jne 0x71732c
mov eax, dword [0x7724b8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00719b90
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5ebab4]
call fcn.005f2638
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x71a13c
mov dl, 1
mov eax, dword [0x497584]
call fcn.004173fc
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x497584]
call fcn.004173fc
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x5f0c24]
call fcn.005fcc4c
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x71751c
mov eax, dword [0x772480]
mov eax, dword [eax]
push eax
call fcn.0075feb8
mov edx, eax
mov eax, esi
call fcn.005fd168
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x71a428
mov dl, 1
mov eax, dword [0x497584]
call fcn.004173fc
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x772480]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00435e38
test eax, eax
je 0x71743f
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00435c90
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00435e1c
test eax, eax
je 0x717457
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.0075fbe8
push eax
call fcn.0075fbe2
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00419e2c
push ebx
push 0x71914c
call fcn.0070b524
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x772434]
cmp byte [eax], 0
jne 0x7174a8
mov eax, ebx
call fcn.007176e4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0071a7d0
mov eax, ebx
call fcn.0071b30c
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x717513
call fcn.00417a70
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret