joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426abc
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040aec4
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x426b11
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x426b0b
test ah, 4
je 0x426b0b
test al, 0x10
je 0x426b0b
mov eax, esi
call fcn.0040aec4
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x426b11
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42b024
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x42b05d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.0040a3bc
jmp 0x42b066
mov eax, ebx
mov edx, esi
call fcn.0040a614
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42b070
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push 3
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x42b094
movzx eax, word [esp]
jmp 0x42b096
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42c7b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x42c8d7
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0042c5b8
mov esi, eax
mov eax, dword [0x7c245c]
cmp byte [eax], 0
je 0x42c87d
mov eax, dword [0x7c1f1c]
call fcn.00407bac
call fcn.00407130
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x42c780]
call fcn.0040d204
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x42c8f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x42c8b9
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x7c1e4c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x7c6634]
call fcn.0040d7d0
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c8de
lea eax, [ebp - 4]
mov edx, dword [0x42c780]
call fcn.0040d328
pop eax
jmp eax
Function at 0x42dbd0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42dc13
mov eax, dword [ebp - 0x10c]
mov dword [0x7c68f4], eax
mov eax, 0x7c68f8
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040af78
mov eax, 0x7c68fc
call fcn.0040a224
xor eax, eax
mov dword [0x7c6900], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x7c67b8], 0xa
jl 0x42dd69
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42dd74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42dd69
xor eax, eax
push ebp
push 0x42dd62
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42ddd0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42dcc2
cmp dword [ebp - 8], 2
jle 0x42dcc2
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42dc95
adc edx, 0
mov eax, 0x7c68fc
call fcn.0040b050
lea eax, [ebp - 8]
push eax
mov eax, dword [0x7c68fc]
call fcn.0040aec4
push eax
push 0
push 0
push 0x42ddd0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42dd1c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42ddf0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42dd1c
cmp dword [ebp - 8], 2
jle 0x42dd1c
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42dcf1
adc edx, 0
mov eax, 0x7c68fc
call fcn.0040b050
lea eax, [ebp - 8]
push eax
mov eax, dword [0x7c68fc]
call fcn.0040aec4
push eax
push 0
push 0
push 0x42ddf0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x7c6900
push 0
push 0
push 0x42de04
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42dd49
xor eax, eax
mov dword [0x7c6900], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dd69
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x6ef710], 1
mov esp, ebp
pop ebp
ret
Function at 0x451bd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x451be4
add esp, 0xfffffff0
call fcn.00408a64
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44bc6c]
call fcn.0046f544
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x450c0c]
call fcn.00472314
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x450c0c]
call fcn.00472314
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x451c39
call fcn.00408abc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c3c60
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4c3cae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004c3140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c3cc7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c698c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x7c98ac
cmp dword [edi], 0
jne 0x4c6a08
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x7c98a8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6f04cc
mov ecx, 2
call fcn.0040729c
mov edx, 0x4c6964
lea eax, [esi + 5]
call fcn.004c6984
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004c6984
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4c69dd
mov dword [0x7c98a8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4e0308
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4e031f
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4e030f
mov eax, ecx
pop ebx
ret

Function at 0x5051cc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0
call sub.kernel32.dll_SetLastError
push esp
push 0
push 0
push 5
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x5051fc
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040af78
add esp, 0x20c
pop ebx
ret
Function at 0x509890
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x509a4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a65c
mov eax, dword [ebp - 4]
call fcn.005091dc
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x5098e2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b340
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0050a4e4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x5099c3
xor eax, eax
push ebp
push 0x5099bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0050947c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00509a84
test al, al
je 0x509998
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a3bc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x509998
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040aec4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005093dc
test al, al
je 0x509992
mov eax, dword [ebp - 8]
call fcn.0040aec4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040af24
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00509890
dec ebx
cmp ebx, 0xffffffff
jne 0x509941
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5099c3
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0050947c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x7c9900], 0
je 0x509a03
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040aec4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00509468
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005093dc
mov ebx, eax
jmp 0x509a2a
mov eax, dword [ebp - 4]
call fcn.0040aec4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00509468
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.005093dc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509a56
lea eax, [ebp - 0x3c]
call fcn.0040a224
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a284
pop eax
jmp eax
Function at 0x50a3c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.005091f4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040aec4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.005093dc
test al, al
jne 0x50a428
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7c21ec]
mov dl, 1
mov eax, dword [0x507fc0]
call fcn.0042cb10
call fcn.0040991c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x50a434
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040aec4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.005093dc
test al, al
jne 0x50a495
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7c2774]
mov dl, 1
mov eax, dword [0x507fc0]
call fcn.0042cb10
call fcn.0040991c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00509224
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x541b88
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x7c9ae0], 0
je 0x541cc9
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x7c2334]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x541cc9
mov eax, dword [0x7c9ae4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x7c9ae0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x541c98
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x7c9ae0]
call fcn.004ac7dc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x541c90
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x21d], 0
je 0x541c90
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x7c]
test al, al
je 0x541c90
mov eax, dword [ebp - 0x14]
call fcn.0054e5ec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x541c90
push ebp
call fcn.00541b44
pop ecx
test al, al
jne 0x541c90
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00408848
test al, al
je 0x541c90
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00408848
cmp byte [ebp - 1], 0
je 0x541c90
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00413664
test al, al
je 0x541c90
mov edx, dword [ebp - 0x14]
mov eax, dword [0x7c9ae4]
call fcn.005412c4
inc edi
dec ebx
jne 0x541bed
mov eax, dword [0x7c9ae4]
cmp dword [eax + 8], 0
jle 0x541cb0
mov eax, dword [0x7c9ae4]
call fcn.00541378
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x541cc9
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005419ac
pop ecx
test al, al
jne 0x541cc9
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5868f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a318
xor eax, eax
push ebp
push 0x586a33
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x586a04
xor edx, edx
push ebp
push 0x5869fd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x58693d
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5869d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x5869bf
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x586980
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040aec4
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.0040729c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5869c6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
pop eax
jmp eax
mov ecx, dword [0x7c1ce8]
mov dl, 1
mov eax, dword [0x41e4b8]
call fcn.0042ca3c
call fcn.0040991c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x586a3a
lea eax, [ebp - 4]
call fcn.0040a224
pop eax
jmp eax

Function at 0x5af95c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.0040a3bc
test ebx, ebx
je 0x5af9b0
mov eax, dword [esi]
call fcn.0040aec4
push eax
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageW
sub ebx, eax
test ebx, ebx
jle 0x5af9b0
mov eax, dword [esi]
test eax, eax
je 0x5af9a5
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sub edx, ebx
mov eax, esi
call fcn.0040b050
pop edi
pop esi
pop ebx
ret

Function at 0x5b949c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.005b9564
test eax, eax
je 0x5b94ee
mov edi, dword [ebx + 8]
test edi, edi
je 0x5b94ca
test edi, edi
je 0x5b94ca
mov edx, esi
mov eax, edi
call fcn.00544a20
jmp 0x5b94fc
push 0x100
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.005b9564
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a3bc
jmp 0x5b94fc
mov ecx, esi
mov edx, 0x5b951c
mov eax, ebx
call fcn.005b9424
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a614
add esp, 0x200
pop edi
pop esi
pop ebx
ret
Function at 0x5d1cec
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040a224
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5d1d3e
push 0x100
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5d1d37
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.0040af78
jmp 0x5d1d3e
mov eax, esi
call fcn.0040a224
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d7b8c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d7cf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x6f5664], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x5081e4]
call fcn.00509330
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5d7cc5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00509418
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040af78
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5d7d0c
call fcn.0040b128
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.005096a8
test al, al
je 0x5d7cad
lea ecx, [ebp - 4]
mov edx, 0x5d7d80
mov eax, dword [ebp - 0xc]
call fcn.00509f3c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042fec8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5d7cad
xor edx, edx
push ebp
push 0x5d7ca6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5d7d98
mov eax, dword [ebp - 8]
push eax
call fcn.00416044
test eax, eax
je 0x5d7c8d
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5d7c8d
call fcn.005d7b18
test eax, eax
je 0x5d7c7d
mov eax, dword [ebx + 0x50]
jmp 0x5d7c80
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x6f5664]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d7cad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d7ccc
mov eax, dword [ebp - 0xc]
call fcn.00408470
pop eax
jmp eax

Function at 0x5d7dfc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5d7e43
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5d7e26
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5d7e37
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5d7e43
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5ee27c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5ee28e
add esp, 0xfffffff0
call fcn.00408a64
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c3f94
mov eax, dword [0x7c1e5c]
mov dword [eax + 4], ebx
mov dword [eax], 0x5ee750
mov eax, dword [0x7c1e78]
mov dword [eax + 4], ebx
mov dword [eax], 0x5ee75c
mov eax, ebx
call fcn.005ee768
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x481458]
call fcn.00408440
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x481458]
call fcn.00408440
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x481458]
call fcn.00408440
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x481458]
call fcn.00408440
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x481458]
call fcn.00408440
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5e8524
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x50dff4]
call fcn.00514d14
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x50dff4]
call fcn.00514d14
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x50dff4]
call fcn.00514d14
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x50dff4]
call fcn.00514d14
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x50dff4]
call fcn.00514d14
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005eed48
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eeb78
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eeb78
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eeb78
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eeb78
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5eeb78
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ee40e
call fcn.00408abc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret