joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500c8634
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0xb4]
push edi
mov ecx, ebx
call fcn.500c00a7
test eax, eax
jne 0x500c86ad
lea ecx, [esi + 0xb8]
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
je 0x500c86ad
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x500c86ad
mov eax, dword [ecx + 0x18]
cmp eax, dword [esi + 0xd0]
jne 0x500c86ad
mov eax, dword [ecx]
call dword [eax + 0x3c]
test eax, eax
je 0x500c86ad
mov edi, dword [eax + 0x18]
test edi, edi
je 0x500c86ad
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push edi
jge 0x500c868d
push 2
jmp 0x500c868f
push 1
push 0x110a
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x500c86ad
push 1
push 1
push eax
mov ecx, ebx
call fcn.500c7e3c
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x500c8635
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0xb4]
push edi
mov ecx, ebx
call fcn.500c00a7
test eax, eax
jne 0x500c86ad
lea ecx, [esi + 0xb8]
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
je 0x500c86ad
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x500c86ad
mov eax, dword [ecx + 0x18]
cmp eax, dword [esi + 0xd0]
jne 0x500c86ad
mov eax, dword [ecx]
call dword [eax + 0x3c]
test eax, eax
je 0x500c86ad
mov edi, dword [eax + 0x18]
test edi, edi
je 0x500c86ad
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push edi
jge 0x500c868d
push 2
jmp 0x500c868f
push 1
push 0x110a
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x500c86ad
push 1
push 1
push eax
mov ecx, ebx
call fcn.500c7e3c
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x500cf378
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 4], 0
je 0x500cf39b
push 4
add ecx, 0x2b4
push ecx
push 4
push 0
push 0x5000f4a0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 4

Function at 0x500d3c9b
Capabilities:
Get graphical window text

Disassembly:
push 0x1573
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
push dword [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp fcn.5024c948

Function at 0x500d3d66
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
push 0x104
lea eax, [esp + 4]
push eax
push 0x1573
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
add esp, 0x104
ret
Function at 0x500e96c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push 0x50010904
mov esi, SysAllocStringLen
xor ebx, ebx
push esi
inc ebx
call fcn.50272bbe
test eax, eax
jne 0x500e96f6
push dword [ebp - 0x14]
xor ebx, ebx
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [ebp - 0x18]
push eax
push 0x500108b0
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
call fcn.50272bbe
test eax, eax
jne 0x500e9718
push dword [ebp - 0x18]
inc edi
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
je 0x500e987c
test edi, edi
je 0x500e987c
lea eax, [ebp - 8]
push eax
push 0x50010878
push esi
call fcn.50272bbe
test eax, eax
jne 0x500e987c
mov dword [ebp - 4], 0x19
mov esi, 0x5000843c
push dword [ebp - 4]
lea eax, [ebp - 0x38]
push 0x50010864
push eax
call dword [sym.imp.vsansi.dll_wsprintfW]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x660], bx
mov ecx, 0x81
lea edi, [ebp - 0x65e]
rep stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x410
call dword [sym.imp.vsansi.dll_RegQueryValueExW]
test eax, eax
jne 0x500e9868
cmp dword [ebp - 0x10], 1
jne 0x500e9868
lea ecx, [ebp - 0x458]
call fcn.500a785c
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x458]
call fcn.500a6e2f
mov edi, esi
shr edi, 0x10
cmp di, bx
je 0x500e97ea
push 0xc
pop eax
call fcn.50260700
mov eax, esp
push esi
push eax
call fcn.5024c7db
jmp 0x500e97ec
mov eax, esi
push 1
push eax
lea ecx, [ebp - 0x458]
call fcn.50272bbe
push ebx
lea ecx, [ebp - 0x458]
call fcn.500a70fc
push eax
call fcn.50272bbe
test eax, eax
je 0x500e984e
cmp di, bx
je 0x500e9828
push 0xc
pop eax
call fcn.50260700
mov eax, esp
push esi
push eax
call fcn.5024c7db
jmp 0x500e982a
mov eax, esi
push 1
push eax
lea ecx, [ebp - 0x458]
call fcn.50272bbe
push ebx
lea ecx, [ebp - 0x458]
call fcn.500a70fc
push eax
call fcn.50272bbe
test eax, eax
jne 0x500e985d
push ebx
lea eax, [ebp - 0x458]
push 1
push eax
call fcn.500e960b
lea ecx, [ebp - 0x458]
call fcn.501b7afc
dec dword [ebp - 4]
cmp dword [ebp - 4], ebx
jg 0x500e974b
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
lea esp, [ebp - 0x66c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x500f0645
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x90
push esi
mov esi, dword [ebp + 0x7c]
push edi
lea eax, [ebp + 0x78]
push eax
push dword [esi + 8]
xor edi, edi
push dword [ebp + 0x78]
mov dword [ebp + 0x60], edi
call dword [sym.imp.vsansi.dll_RegOpenKeyW]
test eax, eax
jne 0x500f0773
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x68]
push eax
push edi
push edi
push edi
push dword [ebp + 0x78]
mov dword [ebp + 0x64], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x500f076a
mov eax, dword [ebp + 0x68]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 8
push dword [0x50297d50]
call dword [sym.imp.kernel32.dll_HeapAlloc]
cmp eax, edi
mov dword [esi + 4], eax
je 0x500f0763
cmp dword [ebp + 0x68], edi
mov dword [ebp + 0x7c], edi
jbe 0x500f076a
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x64], 0x80
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x500f0752
lea eax, [ebp - 0x20]
push eax
call fcn.5003ed1e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
lea ecx, [ecx + ecx*2]
mov dword [edx + ecx*8], eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x500f0750
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8 + 4]
push eax
push 0x50011f00
push dword [ebp + 0x6c]
call fcn.50272bbe
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8 + 8]
push eax
push 0x50005f7c
push dword [ebp + 0x6c]
call fcn.50272bbe
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esi]
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x68]
jb 0x500f06c7
jmp 0x500f076a
mov dword [ebp + 0x60], 0x8007000e
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x60]
pop edi
pop esi
add ebp, 0x70
leave
ret 8
Function at 0x500f57ef
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
mov esi, ecx
push 0x476
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x10], eax
cmp eax, ebp
mov eax, dword [esp + 0x24]
je 0x500f59af
mov ebx, dword [esp + 0x20]
mov dword [eax], ebp
mov eax, dword [ebx]
cmp eax, ebp
je 0x500f59b5
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x500f5841
push eax
push ecx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x500f59b5
mov eax, dword [ebx + 4]
mov ecx, 0x100
cmp eax, ecx
jb 0x500f5980
cmp eax, 0x108
ja 0x500f5980
cmp eax, ecx
mov dword [esp + 0x20], ebp
jne 0x500f58ff
mov eax, dword [ebx + 8]
cmp eax, 9
jne 0x500f593f
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov edi, eax
call ebp
test ax, ax
jl 0x500f5956
push 0x10
call ebp
test ax, ax
jge 0x500f591f
xor ebp, ebp
inc ebp
push ebp
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, eax
jne 0x500f58ff
push 5
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
push 8
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x50012b7c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x500f58fb
mov esi, dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push eax
push eax
push edi
call esi
push ebp
push eax
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, ebp
jmp 0x500f59b7
mov dword [esp + 0x20], ebp
mov eax, dword [ebx]
mov edi, dword [esp + 0x10]
cmp eax, edi
je 0x500f5965
push eax
push edi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x500f5965
xor ebp, ebp
cmp dword [esp + 0x20], ebp
je 0x500f5980
jmp 0x500f5967
push 0
push 0
push 0x474
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp edi, eax
jne 0x500f58ff
mov dword [esp + 0x20], 1
jmp 0x500f58ff
cmp eax, 0x21
je 0x500f5949
cmp eax, 0x22
jne 0x500f58ff
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x500f58ff
push ebx
mov ecx, esi
call fcn.500f49ab
neg eax
sbb eax, eax
inc eax
jmp 0x500f59b7
xor ebp, ebp
push 8
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp eax, ebp
je 0x500f5980
push ebx
mov ecx, eax
call fcn.500f4732
test eax, eax
je 0x500f59aa
push ebx
mov ecx, esi
call fcn.500f49ab
test eax, eax
jne 0x500f59b5
push ebp
push ebp
push 0x476
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x500f59aa
mov eax, dword [esp + 0x24]
mov dword [eax], 1
xor eax, eax
inc eax
jmp 0x500f59b7
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x50106788
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x38], edi
jne 0x501067c5
lea eax, [esp + 8]
push eax
push 4
push esi
push 0x50106773
push edi
push edi
mov dword [esi + 0x40], edi
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x38], eax
je 0x501067c5
push 0xfffffffffffffffe
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [esi + 0x38]
call dword [sym.imp.kernel32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 0x38], edi
pop edi
setne al
pop esi
pop ecx
ret
Function at 0x5011bf6c
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5029ab04]
and dword [0x5029ab20], 0
and dword [0x5029ab1c], 0
test eax, eax
je 0x5011bf9c
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5011bf9c
push 0
push dword [0x5029ab04]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x5029ab10], 0
je 0x5011bfaf
push 0x5029ab00
call fcn.5011bf53
ret

Function at 0x5011dcba
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x5011dc9e
push 0x3e8
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x268], eax
pop esi
jne 0x5011dcea
mov eax, 0x80004005
pop ecx
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
xor eax, eax
pop ecx
ret

Function at 0x50126770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x264]
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], ebx
jne 0x50126797
call fcn.501262f2
jmp 0x50126844
cmp dword [esi + 0x38], edi
jne 0x501267a3
xor eax, eax
jmp 0x50126844
push edi
push 0x80000080
push 2
push edi
push 2
push 0x40000000
lea eax, [esi + 0x44]
push eax
call dword [sym.imp.vsansi.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x501267ce
mov dword [ebp - 0x10], 0x80004005
jmp 0x50126841
cmp ebx, edi
mov dword [esi + 0x30], 1
mov dword [ebp - 4], edi
jbe 0x50126838
push dword [ebp - 4]
lea ecx, [esi + 0x260]
call fcn.502583d6
lea ecx, [ebp - 8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
call fcn.50272bbe
mov ebx, dword [ebp - 8]
push ebx
call dword [sym.imp.MSVCR70.dll_wcslen]
pop ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_WriteFile]
cmp ebx, edi
je 0x5012682d
push ebx
push edi
push dword [0x50297d50]
call dword [sym.imp.kernel32.dll_HeapFree]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jb 0x501267dc
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x501269cc
Capabilities:
Write file on windows

Disassembly:
and dword [ecx + 0x24], 0
jmp fcn.50126770
Function at 0x50129832
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov eax, esi
mov ebx, SysAllocStringLen
and eax, ebx
mov dword [0x502974b8], eax
pop eax
setne al
push eax
push 0x130c
push dword [0x502974c0]
call edi
mov eax, dword [0x502974b8]
neg eax
sbb eax, eax
and eax, 8
push eax
push dword [0x502974bc]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x502974b8], 0
je 0x5012989b
push 0
lea eax, [esi - 0x80000000]
push eax
push 0x186
push dword [0x502974bc]
call edi
test ebx, esi
jne 0x501298c1
xor eax, eax
cmp esi, dword [eax*4 + 0x50129300]
je 0x501298c6
inc eax
cmp eax, 0x2f
jle 0x501298a1
xor eax, eax
cmp esi, dword [eax*4 + 0x5028a2d8]
je 0x501298d1
inc eax
cmp eax, 0x10
jl 0x501298b2
mov eax, 0xff
pop edi
pop esi
mov dword [0x502974a0], eax
pop ebx
ret 4
add eax, 0x30
jmp 0x501298c6

Function at 0x5012a49b
Capabilities:
Write clipboard data

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
je 0x5012a4bb
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x5012a4bb
mov esi, 0x8007000e
mov eax, esi
pop esi
ret 8
Function at 0x5013b737
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x5013b74b
and dword [esi + 4], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 8]
test eax, eax
je 0x5013b75c
and dword [esi + 8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5013b775
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
pop esi
ret

Function at 0x50146417
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5014644a
push esi
call fcn.5014644e
mov al, byte [esi + 0x11]
cmp al, 2
jne 0x50146444
push dword [esi + 0xc]
call fcn.500a74d8
mov ecx, dword [esi + 0xc]
call fcn.500a70fc
push eax
call dword [sym.imp.vsansi.dll_DeleteFileW]
push esi
call fcn.501463de
pop esi
ret 4
Function at 0x501544aa
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x20
push edi
mov edi, ecx
ja 0x5015451c
je 0x501544d8
cmp esi, 9
je 0x50154530
cmp esi, 0xd
je 0x501544cf
cmp esi, 0x1b
je 0x50154530
xor eax, eax
pop edi
pop esi
ret 0xc
mov ecx, edi
call fcn.50153a7b
jmp 0x501544c8
cmp dword [esp + 0xc], 0x100
jne 0x501544c8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jge 0x501544c8
push 0x10
call esi
test ax, ax
jl 0x501544c8
push 0x12
call esi
test ax, ax
jl 0x501544c8
mov ecx, edi
call fcn.50272bbe
cmp eax, 1
jne 0x501544c8
push eax
mov ecx, edi
call fcn.50272bbe
xor eax, eax
inc eax
jmp 0x501544ca
cmp esi, 0x21
jb 0x501544c8
cmp esi, 0x22
jbe 0x50154530
cmp esi, 0x26
je 0x50154530
cmp esi, 0x28
jne 0x501544c8
mov ecx, edi
call fcn.50272bbe
test eax, eax
jne 0x501544c8
push dword [esp + 0x14]
push esi
push dword [esp + 0x14]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x50154517
Function at 0x50159187
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x50159197
mov eax, 0x8000ffff
pop esi
ret
push 1
push 0xf1
lea ecx, [esi + 0x10]
call fcn.5026d90b
test eax, eax
jne 0x501591b1
mov eax, 0x8007000e
pop esi
ret
push dword [esi + 8]
mov dword [esi + 4], 1
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ecx, esi
jne 0x501591cf
call fcn.50272bbe
jmp 0x501591d7
push dword [esi + 8]
call fcn.50272bbe
and dword [esi + 4], 0
xor ecx, ecx
test eax, eax
setge cl
and dword [esi + 0xc], 0
mov dword [esi], ecx
pop esi
ret

Function at 0x50167c4b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x50167c6b
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x50167c6b
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x58], 0
pop esi
jne 0x50167c78
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
ret

Function at 0x5016b670
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
xor eax, eax
xor ebp, ebp
cmp dword [esp + 0xc], ebp
push esi
setg al
push edi
push 0x11
mov esi, ecx
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push ebp
push 0x401
push dword [esi + 0x108]
xor ebx, ebx
test ax, ax
setl bl
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebx, ebp
je 0x5016b6f7
push 1
mov ecx, esi
call fcn.501657b1
cmp ax, 1
jle 0x5016b751
test byte [esi + 0x12c], 2
je 0x5016b6de
cmp edi, ebp
je 0x5016b6d4
mov ecx, dword [esi + 0x64]
call fcn.5018db51
jmp 0x5016b6ea
mov ecx, dword [esi + 0x68]
call fcn.5018db2b
jmp 0x5016b6ea
cmp edi, ebp
mov ecx, dword [esi + 0x68]
jne 0x5016b6d7
call fcn.5018db3e
push edi
push 1
push eax
mov ecx, esi
call fcn.50272bbe
jmp 0x5016b751
cmp edi, ebp
je 0x5016b706
test byte [esi + 0x13c], 0x80
jne 0x5016b70f
jmp 0x5016b751
test byte [esi + 0x13d], 1
je 0x5016b751
mov ebx, dword [0x50296ecc]
jmp 0x5016b739
dec ebx
cmp edi, ebp
je 0x5016b725
test byte [esi + 0x13c], 0x80
jmp 0x5016b72c
test byte [esi + 0x13d], 1
je 0x5016b73d
mov ecx, dword [esi + 0x68]
push 1
push edi
call fcn.50272bbe
cmp ebx, ebp
jne 0x5016b717
push 1
push ebp
mov ecx, esi
call fcn.50272bbe
push 2
push ebp
mov ecx, esi
call fcn.50272bbe
push ebp
push 1
push 0x401
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x5017736b
Capabilities:
Set registry value

Disassembly:
push ecx
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
push esi
mov esi, ecx
je 0x50177417
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
pop ebx
push ebx
lea eax, [esi + 0x80]
push eax
push ebx
push 0
push 0x50019e68
push ebp
call edi
push ebx
lea eax, [esi + 0x84]
push eax
push ebx
push 0
push 0x50019e58
push ebp
call edi
push ebx
lea eax, [esi + 0x738]
push eax
push ebx
push 0
push 0x5000f4a0
push ebp
call edi
and dword [esp + 0x1c], 0
and dword [esp + 0x10], 0
push 0xa
push 0x5028aa6b
push dword [esp + 0x18]
call dword [sym.imp.MSVCR70.dll__itoa]
mov ecx, dword [esi + 0x2d4]
add esp, 0xc
push dword [esp + 0x1c]
call fcn.500fced4
movzx eax, ax
push ebx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0
push 0x5028aa60
push ebp
call edi
inc dword [esp + 0x1c]
inc dword [esp + 0x10]
cmp word [esp + 0x1c], bx
jb 0x501773cb
pop edi
pop ebx
pop esi
pop ebp
pop ecx
pop ecx
ret 4
Function at 0x5017bf54
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x28c
mov eax, 0x5001b6d4
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], eax
mov eax, 0x5001b6c0
push edi
mov dword [ebp - 8], 0x5001b6a8
mov dword [ebp], 0x5001b690
mov dword [ebp + 4], 0x5001b678
mov dword [ebp + 0xc], 0x5001b654
mov dword [ebp + 0x10], 0x5001b648
mov dword [ebp + 0x18], 0x5001b63c
mov dword [ebp + 0x1c], 0x5001b62c
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], 0x5001b614
mov dword [ebp + 0x28], 0x5001b5fc
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x30], 0x5001b408
mov dword [ebp + 0x34], 0x5001b5e8
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], 0x5001b5cc
mov dword [ebp + 0x40], 0x5001b5bc
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x48], 0x5001b5a4
mov dword [ebp + 0x4c], 0x5001b58c
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], 0x5001b438
mov dword [ebp + 0x58], 0x5001b580
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], 0x5001b56c
mov dword [ebp + 0x64], 0x5001b560
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x6c], 0x5001b4f8
lea esi, [ebp - 8]
mov dword [ebp + 0x74], 0xa
push dword [esi + 4]
push dword [esi]
push dword [0x5029a6cc]
call dword [sym.imp.vsansi.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x5017c0ac
push edi
push dword [0x5029a6cc]
call dword [sym.imp.kernel32.dll_LoadResource]
push edi
push dword [0x5029a6cc]
mov ebx, eax
call dword [sym.imp.kernel32.dll_SizeofResource]
test ebx, ebx
mov dword [ebp + 0x70], eax
je 0x5017c0ac
push ebx
call dword [sym.imp.kernel32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x5017c0ac
push dword [esi + 8]
lea eax, [ebp - 0x214]
push dword [0x50297874]
push 0x104
push eax
call fcn.50272bbe
lea eax, [ebp - 0x214]
push eax
call fcn.5017b874
mov edi, eax
cmp edi, 0xffffffff
je 0x5017c0ac
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x70]
push ebx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
add esi, 0xc
dec dword [ebp + 0x74]
jne 0x5017c020
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x50194da7
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.5019348e
mov ecx, 0x3ee
cmp eax, ecx
jg 0x50194e0d
je 0x50194de2
cmp eax, 0x146
je 0x50194dde
add ecx, 0xfffffffc
cmp eax, ecx
je 0x50194dd9
jle 0x50194e34
cmp eax, 0x3ec
jg 0x50194e34
mov ecx, esi
pop esi
jmp fcn.50193f91
mov ecx, esi
pop esi
jmp 0x50194e03
push 0
jmp 0x50194e2d
push 0
push 0
push 0x190
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
mov ecx, esi
pop esi
jle 0x50194e08
jmp fcn.50193e82
jmp fcn.50194b53
sub eax, 0x460
je 0x50194e2b
dec eax
dec eax
je 0x50194e23
dec eax
jne 0x50194e34
mov ecx, esi
pop esi
jmp fcn.50194a3e
mov ecx, esi
pop esi
jmp fcn.50194cc5
push 1
mov ecx, esi
call fcn.50272bbe
pop esi
ret
Function at 0x50196ff9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 4], 0x100
push edi
jne 0x501970ef
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jge 0x501970ef
xor ebx, ebx
cmp dword [0x5029b59c], ebx
jne 0x501970f1
mov eax, dword [esi + 8]
cmp eax, 9
je 0x50197053
cmp eax, 0x20
jbe 0x501970f1
cmp eax, 0x22
ja 0x501970f1
xor ecx, ecx
cmp eax, 0x21
sete cl
jmp 0x5019705f
push 0x10
call edi
xor ecx, ecx
test ax, ax
setl cl
mov esi, dword [esp + 0x14]
test byte [esi + 8], 0x20
mov ebp, ecx
je 0x50197080
xor eax, eax
cmp ebp, ebx
setne al
add eax, 0xffffff31
push eax
push esi
call fcn.50196fa9
jmp 0x501970ea
cmp dword [esi + 0x14], ebx
push ebx
je 0x501970be
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 9
mov ebx, 0x110a
push ebx
push dword [esi + 0x40]
call edi
push eax
xor eax, eax
test ebp, ebp
setne al
add eax, 6
push eax
push ebx
push dword [esi + 0x40]
call edi
test eax, eax
je 0x501970ea
push eax
push 9
push 0x110b
push dword [esi + 0x40]
call edi
jmp 0x501970ea
push ebx
push 0x130b
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebp, ebx
je 0x501970da
mov ecx, dword [esi + 0x1c]
lea eax, [eax + ecx - 1]
jmp 0x501970db
inc eax
xor edx, edx
div dword [esi + 0x1c]
push 1
push ebx
push edx
push esi
call fcn.50272bbe
xor eax, eax
inc eax
jmp 0x5019711b
xor ebx, ebx
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
mov eax, dword [esp + 0x14]
push esi
push dword [eax]
je 0x5019710c
call dword [sym.imp.vsansi.dll_IsDialogMessageW]
jmp 0x50197112
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret 8