joyce8/EMBER2024-capa huggingface dataset:
Function at 0x277d8551
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x277d85a3
push dword [ebp - 4]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x277d85aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 8], esi
push eax
push esi
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x277d8662
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x277d8662
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x2001f
push esi
push 0x2782a69c
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x277d866f
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.277d8551
pop ecx
pop ecx
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x24]
inc dword [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
test eax, eax
je 0x277d85d9
xor eax, eax
cmp dword [ebp - 0x10], esi
sete al
jmp 0x277d85a5
push dword [ebp - 0xc]
call edi
jmp 0x277d8662

Function at 0x277d8676
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
cmp dword [ebp + 0xc], 0
push edi
mov esi, str.HELP
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jne 0x277d8694
xor eax, eax
pop edi
pop esi
leave
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
cmp esi, dword [ebp + 0xc]
jae 0x277d86c0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, esi
jmp 0x277d8690
Function at 0x277db14d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x277c4388
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x277db1a8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x277ca478
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x277db198
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
xor eax, eax
jmp 0x277db1a3
Function at 0x277e226b
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, dword [esp + 8]
push 2
push esi
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x277e228a
and byte [esi + 1], al
mov byte [esi], 0x2c
pop esi
ret 4
Function at 0x277e64a2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
xor esi, esi
test byte [ebx + eax*4 + 0x48], 2
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x277e659a
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jge 0x277e64d5
push 2
pop esi
push 0x10
call edi
test ax, ax
jge 0x277e64e1
or esi, 1
push 0x12
call edi
test ax, ax
jge 0x277e64ed
or esi, 4
push dword [ebp + 8]
mov ecx, ebx
call fcn.277e647f
mov dword [ebp + 8], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov word [ebp - 0x3c], si
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x3a]
mov eax, dword [ebx + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test byte [ebx + 0xc], 1
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x26], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x2a], edi
mov dword [ebp - 0x22], eax
je 0x277e65a0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x48]
push eax
lea esi, [ebx + 4]
push 0xfffffc7b
push esi
call fcn.277b9878
cmp edi, 2
jne 0x277e65a8
mov eax, dword [ebp - 0x1e]
add dword [ebx + 0x24], eax
neg eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x18]
push 2
push eax
push dword [esi]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push dword [esi]
call fcn.278118d5
lea eax, [ebp - 0x18]
push 0
push eax
mov ecx, ebx
call fcn.277e6386
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
jmp 0x277e6533
cmp edi, 1
jne 0x277e65b5
mov eax, dword [ebp - 0x1e]
sub dword [ebx + 0x24], eax
jmp 0x277e6555
cmp edi, 8
jne 0x277e65c7
mov eax, dword [ebp - 0x1e]
add dword [ebx + 0x20], eax
neg eax
mov dword [ebp - 8], eax
jmp 0x277e6558
cmp edi, 4
jne 0x277e6558
mov eax, dword [ebp - 0x1e]
sub dword [ebx + 0x20], eax
jmp 0x277e65c2
Function at 0x277e8271
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 0xc]
push ebx
movzx ecx, ax
shr eax, 0x10
push esi
mov esi, dword [ebp + 8]
cmp eax, 0x100
push edi
mov dword [ebp + 0xc], ecx
je 0x277e83b8
cmp eax, 0x200
je 0x277e8393
cmp eax, 0x300
jne 0x277e8369
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x147
push dword [esi + 0x18]
call ebx
cmp eax, 0xffffffff
jne 0x277e837b
test byte [esi + 0x4c], 1
je 0x277e837b
mov eax, dword [esi + 0x34]
test eax, eax
je 0x277e837b
mov edi, 0x104
lea ecx, [ebp - 0x104]
push edi
push ecx
push eax
call fcn.27815d76
lea eax, [ebp - 0x208]
push edi
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.277e92c9
xor ecx, ecx
test eax, eax
mov eax, dword [esi + 0x4c]
setne cl
and ecx, 1
and al, 0xfd
shl ecx, 1
or ecx, eax
test cl, 2
mov dword [esi + 0x4c], ecx
je 0x277e8353
lea eax, [ebp - 0x208]
push eax
push 0xffffffffffffffff
push esi
call fcn.277e9214
cmp eax, 0xffffffff
jne 0x277e8353
push 0
push eax
push 0x14e
push dword [esi + 0x18]
call ebx
movzx eax, word [ebp + 0xc]
push dword [esi]
or eax, 0x50000
push eax
push 0x111
push dword [esi + 4]
call ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
sete al
leave
ret 0xc
mov edi, 0x104
lea eax, [ebp - 0x104]
push edi
push eax
push esi
call fcn.277e80db
jmp 0x277e82f2
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, dword [esi + 0x18]
je 0x277e8369
push 1
push esi
call fcn.277e7f4c
push 0
push edi
push 8
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x277e8369
test byte [esi + 0x4c], 0x10
jne 0x277e8369
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ebx, 0xb1
push 0
push ebx
push dword [esi + 0x1c]
call edi
push 0xffffffffffffffff
push 0
push ebx
push dword [esi + 0x1c]
call edi
push 0
push 0xfffffcdc
push esi
call fcn.277b9878
and dword [esi + 0x4c], 0xfffffffd
jmp 0x277e8369
Function at 0x277e8d16
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov eax, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x277e8e6f
push 0
push eax
mov eax, dword [ebp + 8]
push 0x150
push dword [eax + 0x18]
call edi
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x277e8eb3
cmp esi, 0xffffffff
je 0x277e8eb3
and dword [ebp - 0x24], 0
test byte [ebx], 1
je 0x277e8d75
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x277e8e7f
mov dword [ebp - 0x24], 1
mov ecx, dword [ebx]
test cl, 2
je 0x277e8d8c
cmp dword [esi + 4], 0xffffffff
jne 0x277e8d86
or dword [ebp - 0x24], 2
mov eax, dword [esi + 4]
mov dword [ebx + 0x10], eax
test cl, 4
je 0x277e8da1
cmp dword [esi + 8], 0xffffffff
jne 0x277e8d9b
or dword [ebp - 0x24], 4
mov eax, dword [esi + 8]
mov dword [ebx + 0x14], eax
test cl, 8
je 0x277e8db6
cmp dword [esi + 0xc], 0xffffffff
jne 0x277e8db0
or dword [ebp - 0x24], 8
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x18], eax
test cl, 0x10
je 0x277e8dcf
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
jne 0x277e8eab
or dword [ebp - 0x24], 0x10
and dword [ebx + 0x1c], 0
test cl, 0x20
je 0x277e8dda
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x277e8e65
push 9
mov esi, ebx
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
test al, 1
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ecx
je 0x277e8e0b
cmp dword [ebp - 0x18], 0
je 0x277e8e0b
mov eax, dword [ebp - 0x1c]
and byte [eax], 0
lea eax, [ebp - 0x30]
push eax
push 0xfffffce0
push dword [ebp + 8]
call fcn.277b9878
mov eax, dword [ebp - 0x24]
test al, 0x10
je 0x277e8e29
mov ecx, dword [ebp - 8]
mov dword [ebx + 0x1c], ecx
test al, 2
je 0x277e8e33
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x10], ecx
test al, 4
je 0x277e8e3d
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x14], ecx
test al, 8
je 0x277e8e47
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], ecx
test al, 1
je 0x277e8e51
mov ecx, dword [ebp - 0x1c]
mov dword [ebx + 8], ecx
test eax, 0x10000000
je 0x277e8e65
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
call fcn.277e8cc2
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
add eax, 0x34
mov dword [ebp + 0xc], eax
mov esi, eax
jmp 0x277e8d49
cmp dword [ebx + 4], 0xffffffff
je 0x277e8e96
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.27815d76
jmp 0x277e8d75
push dword [ebx + 8]
mov eax, dword [ebp + 8]
push dword [ebx + 0xc]
push 0xd
push dword [eax + 0x1c]
call edi
jmp 0x277e8d75
mov dword [ebx + 0x1c], eax
jmp 0x277e8dcf
xor eax, eax
jmp 0x277e8e68
Function at 0x277eca6d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
mov esi, dword [ebp + 8]
mov eax, 0x400
test word [esi + 0xe0], ax
je 0x277ecab2
mov ecx, dword [esi + 8]
test cl, 8
je 0x277ecab7
lea ecx, [ebp - 0x80]
push pe_nt_image_headers32
push ecx
push 0x1003
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x80]
add esi, 0x5c
push eax
push esi
call fcn.277eb023
pop esi
leave
ret 4
test cl, 4
lea ecx, [ebp - 0x80]
push pe_nt_image_headers32
push ecx
je 0x277ecac9
push 0x20
jmp 0x277eca9e
push 0x1f
jmp 0x277eca9e
Function at 0x277ed568
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
cmp edi, 0x73
pop edx
jne 0x277ed597
test byte [esi + 0xe0], 2
jne 0x277ed597
push 0
push esi
call fcn.277ecd89
pop edi
xor eax, eax
pop esi
leave
ret 0xc
test byte [esi + 8], 0x10
je 0x277ed5aa
cmp edi, 0x71
jne 0x277ed5aa
push esi
call fcn.277ed207
jmp 0x277ed58f
mov cx, word [esi + 0xe0]
test ch, 2
je 0x277ed5f6
mov eax, edi
sub eax, 0x25
je 0x277ed5f1
dec eax
dec eax
jne 0x277ed58f
test ch, 1
je 0x277ed58f
lea eax, [esi + 0x5c]
push edx
push eax
call fcn.277eb4e8
cmp eax, 0xffffffff
je 0x277ed58f
and word [esi + 0xe0], 0xfdff
lea eax, [esi + 0xb0]
push 1
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x277ed58f
or edx, 0xffffffff
jmp 0x277ed5c1
cmp edi, 0x24
jne 0x277ed623
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x277ed623
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x10]
push 1
push eax
push esi
call fcn.277ed78b
jmp 0x277ed58f
push dword [ebp + 0x10]
lea eax, [esi + 0x5c]
push edi
push eax
push esi
call fcn.277eb7ec
test eax, eax
je 0x277ed640
push esi
call fcn.277ed6df
jmp 0x277ed58f
test byte [esi + 8], 2
je 0x277ed58f
cmp dword [esi + 0x7c], 0xffffffff
jne 0x277ed58f
or byte [esi + 0xe1], 2
jmp 0x277ed5de

Function at 0x277ed8aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
push 0x277cb908
xor edi, edi
mov dword [esi], 0x7ed
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x277cb8f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x277ed8f1
push esi
push edi
push edi
push 0x20000030
push 1
push 0x400
call eax
mov eax, edi
pop edi
pop esi
leave
ret 4
lea eax, [ebp + 8]
push eax
push 1
push edi
push 0x277cb918
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x277ed8e9
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x277cb950
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x277ed8e9
lea eax, [ebp - 0x14]
push eax
call fcn.277ed867
pop ecx
mov dword [esi], eax
jmp 0x277ed8e9

Function at 0x277ed94d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0x1009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0xc]
push eax
call fcn.277ed867
mov esi, dword [ebp + 0xc]
pop ecx
cmp si, 0x64
jae 0x277ed9a7
lea eax, [ebp + 0xc]
push eax
call fcn.277ed8aa
test eax, eax
mov ecx, 0x7ed
jl 0x277ed993
mov ecx, dword [ebp + 0xc]
push 0x64
mov eax, ecx
xor edx, edx
pop edi
div edi
sub ecx, edx
cmp si, dx
jbe 0x277ed9b0
lea esi, [esi + ecx - 0x64]
mov ax, si
pop edi
pop esi
leave
ret 8
add esi, ecx
jmp 0x277ed9a7
Function at 0x277ede0a
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
cmp dword [esp + 0xc], 0
je 0x277ede25
or eax, 0x1000000
push 0x32
push dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
ret 0xc

Function at 0x277f0d37
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 0x5c], edi
je 0x277f0d50
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp + 0xc]
push 0x14
pop eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
mov dword [ebp - 0x60], eax
je 0x277f0d66
mov ecx, dword [ebx + 0x1c]
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x70]
push eax
push 0xfffffe61
push esi
call fcn.277b9878
push dword [esi]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
test byte [ebp - 8], 1
jne 0x277f0e33
test edi, edi
je 0x277f0e33
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x277f0e33
push 4
call fcn.2781585f
push 4
mov dword [ebp - 4], eax
call fcn.2781585f
test ebx, ebx
mov edi, eax
mov esi, ebx
je 0x277f0dd1
push esi
push 0
push edi
call fcn.27815a43
mov esi, dword [esi]
test esi, esi
jne 0x277f0dc2
mov esi, dword [ebp + 0x10]
push esi
push 0
push dword [ebp - 4]
call fcn.27815a43
mov esi, dword [esi]
test esi, esi
jne 0x277f0dd4
mov eax, dword [ebp - 4]
mov esi, dword [eax]
dec esi
js 0x277f0e22
push esi
xor ebx, ebx
push dword [ebp - 4]
call fcn.2781593b
cmp esi, dword [edi]
mov dword [ebp + 0x10], eax
jge 0x277f0e08
push esi
push edi
call fcn.2781593b
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
je 0x277f0e1f
push 1
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call fcn.277f1049
dec esi
jns 0x277f0ded
mov ebx, dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.278158a8
push edi
call fcn.278158a8
mov esi, dword [ebp + 8]
test byte [ebp - 8], 2
jne 0x277f0e56
test ebx, ebx
je 0x277f0e56
test byte [ebx + 0x10], 0x20
jne 0x277f0e56
push 1
push ebx
push 2
push esi
call fcn.277f1049
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x277f2163
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp dword [esi + 0x30], edi
je 0x277f21ac
push 0
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x41d
mov dword [esi + 0x30], edi
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
pop eax
pop edi
pop esi
ret 8
xor eax, eax
jmp 0x277f21a7

Function at 0x277f3557
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
test byte [esi + 0x18], 0x80
pop edi
mov dword [ebp - 4], edi
je 0x277f357b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, dword [esi + 0xcc]
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x277f3592
push esi
call fcn.277f33da
mov eax, edi
jmp 0x277f3574
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x277f35a1
mov dword [ebp + 0xc], edi
push ebx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 0
je 0x277f3651
dec eax
je 0x277f3654
dec eax
je 0x277f358e
mov edi, dword [esi + 0x28]
xor eax, eax
cmp edi, eax
je 0x277f362f
mov ecx, dword [edi + 0x1c]
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], eax
je 0x277f3664
mov dword [ebp - 0x1c], eax
push 5
push edi
push esi
call fcn.277f0a9f
or byte [esi + 0x18], 0x80
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x18], 0x7f
lea eax, [ebp - 0x38]
push eax
push 0xfffffe65
push esi
call fcn.277b9878
test eax, eax
mov dword [ebp - 4], eax
je 0x277f362f
cmp dword [ebp + 0xc], 0
jne 0x277f362f
cmp dword [ebp - 0x28], 0
je 0x277f362f
cmp dword [edi + 0xc], 0xffffffff
je 0x277f3692
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
push esi
call fcn.277f1ded
cmp ebx, dword [esi + 0xcc]
jne 0x277f3642
and dword [esi + 0x28], 0
and dword [esi + 0xcc], 0
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
jmp 0x277f3574
mov dword [ebp + 0xc], edi
push 2
push 0xfffffffffffffff4
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x277f35bb
mov ebx, 0x104
lea eax, [ebp - 0x13c]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
or dword [ebp - 0x2c], 1
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jmp 0x277f35dc
lea eax, [ebp - 0x38]
push eax
push 0xfffffe6c
push esi
call fcn.277b9878
jmp 0x277f362f
Function at 0x277f8150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x277f8238
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x14]
push ebx
push esi
call fcn.277f7f02
test byte [ebp + 8], 4
mov edi, eax
je 0x277f8191
cmp dword [ebp + 0xc], 0
je 0x277f8191
push 0
push 0xfffffecf
push edi
push esi
call fcn.277f7cad
mov eax, dword [ebp + 8]
test al, 0xe
je 0x277f81c5
cmp dword [ebp + 0xc], 0
jne 0x277f81c5
push dword [esi]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], ebx
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0x64
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test byte [ebp + 8], 0xc
je 0x277f8259
cmp dword [ebp + 0xc], 0
jne 0x277f8259
push edi
push esi
call fcn.277f7530
push edi
push dword [esi + 0x2c]
call fcn.278156d8
movsx ecx, word [eax]
movsx edx, word [eax + 2]
sub ecx, edx
mov dword [esi + 0x44], ecx
movsx ecx, word [eax]
mov dword [esi + 0x40], ecx
sub ecx, ebx
mov dword [esi + 0x3c], ecx
movsx eax, word [eax + 2]
mov dword [esi + 0x48], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 1
push eax
push 0xfffffece
push edi
push esi
call fcn.277f7cad
test eax, eax
jne 0x277f823f
and dword [esi + 0x38], eax
push esi
call fcn.277bf786
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebx
leave
ret 0x14
push esi
call fcn.277f77b1
test eax, eax
jne 0x277f8238
push ebx
push esi
call fcn.277f8139
push eax
push esi
call fcn.277f80ed
jmp 0x277f8238
test byte [ebp + 8], 2
je 0x277f8238
test byte [esi + 8], 2
je 0x277f8238
cmp dword [ebp + 0xc], 0
je 0x277f827b
push 0
push 0xfffffed1
push edi
push esi
call fcn.277f7cad
jmp 0x277f8238
or dword [esi + 0x34], 1
push 5
push dword [esi + 0x30]
push esi
call fcn.277f8fa4
jmp 0x277f8238

Function at 0x277f9cec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 1
lea eax, [ebp - 4]
pop esi
xor edi, edi
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x277f9d4c
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.UseDoubleClickTimer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x277f9d43
mov esi, dword [ebp - 0xc]
push 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x277fafee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x277fb12f
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.27805630
test eax, eax
je 0x277fb12f
call fcn.277fafc9
test eax, eax
jne 0x277fb12f
xor edi, edi
push edi
push 0xfffffffffffffff3
push esi
call fcn.277b9878
test eax, eax
jne 0x277fb12f
test byte [esi + 8], 4
je 0x277fb136
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.277fe8a2
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0xc], ebx
je 0x277fb12f
cmp ebx, dword [esi + 0x170]
je 0x277fb12f
test byte [esi + 0x20], 0x40
je 0x277fb0bc
mov eax, dword [esi + 0xe8]
lea edi, [esi + 0xe8]
test al, 8
je 0x277fb0bc
test al, 4
je 0x277fb0bc
mov ebx, dword [esi]
push 0x2e
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
and dword [edi], 0xfffffff7
lea eax, [esi + 0xec]
push eax
push 0xffffffffffffff8e
push esi
call fcn.277b9878
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x277fb12f
mov ebx, dword [ebp + 0xc]
push 2
push ebx
push esi
mov dword [esi + 0x170], ebx
call fcn.27800774
test byte [ebp - 0x10], 6
mov dword [ebp + 0xc], eax
je 0x277fb12f
xor edi, edi
cmp dword [ebp + 8], edi
je 0x277fb0de
push 4
pop edi
cmp dword [ebp - 4], 0
je 0x277fb0e7
or edi, 8
test eax, eax
jne 0x277fb0f5
push 0x277cbb30
call fcn.278113e7
push dword [ebp + 0xc]
push edi
push ebx
push esi
call fcn.277ff1af
xor edi, edi
cmp dword [ebp - 4], edi
je 0x277fb119
xor eax, eax
cmp dword [ebp + 8], edi
sete al
push eax
push edi
push eax
push ebx
push esi
call fcn.277fdd97
cmp dword [ebp + 8], edi
jne 0x277fb121
mov dword [esi + 0x58], ebx
push esi
call fcn.277fae0e
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov dword [ebp - 4], ecx
call edi
xor ecx, ecx
test ax, ax
setl cl
mov dword [ebp + 8], ecx
jmp 0x277fb047