joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5c20
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
jne 0x4e5c53
mov eax, dword [0x5c7aa8]
cmp eax, 0x66
jb 0x4e5c42
mov esi, 0x3ff
jmp 0x4e5c53
cmp eax, 0x64
sbb esi, esi
and esi, 0xfffffe3c
add esi, 0x1ff
mov eax, dword [ebp + 0x10]
mov ecx, 3
mov edi, dword [0x5cb7d8]
test eax, eax
push edi
push 4
push dword [0x5cd55c]
cmovne ecx, eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp - 8]
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x4e5d11
jmp 0x4e5ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4e5cf1
push ebx
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, dword [ebp - 4]
push edi
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push 0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp - 8]
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x4e5d11
push ebx
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x5cb7d8]
cmp edi, 0x20000
mov ecx, dword [ebp + 0x14]
cmovbe eax, edi
mov dword [0x5cb7d8], eax
mov eax, dword [ebp - 0xc]
pop edi
mov dword [ecx], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ea500
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 2
push 0
push 1
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xffffffffffffffff
push ecx
mov esi, edx
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x4ea541
lfence
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetProcessMappedFileName
push dword [ebp - 4]
mov esi, eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ec160
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
call fcn.004ebee0
mov esi, eax
test esi, esi
je 0x4ec2f6
cmp dword [esi + 0xc], 0
lea eax, [esi + 0xc]
jne 0x4ec1b4
push 0
push 1
push 0
push 0x1f0003
push eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov edi, eax
test edi, edi
js 0x4ec299
cmp dword [esi + 0x10], 0
lea edi, [esi + 0x10]
jne 0x4ec1dc
push 0
push 1
push 0
push 0x1f0003
push edi
call dword [sym.imp.ntdll.dll_NtCreateEvent]
mov edi, eax
test edi, edi
js 0x4ec299
lea edi, [esi + 0x10]
cmp dword [esi + 0x14], 0
lea ebx, [esi + 0x14]
jne 0x4ec22f
push dword [esi + 0xc]
call dword [sym.imp.ntdll.dll_NtClearEvent]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClearEvent]
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x4ec100
push 0x8000
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov edi, eax
test edi, edi
js 0x4ec299
push 0
push 0
lfence
push dword [esi + 0x10]
lea edi, [esi + 0x10]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov eax, dword [ebp - 0xc]
push 0
push dword [esi + 0xc]
mov dword [esi + 4], 0x4ec320
mov dword [esi + 8], eax
call dword [sym.imp.ntdll.dll_NtSetEvent]
push dword [ebp - 8]
push 0
push dword [edi]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov edi, eax
mov dword [esi + 4], 0
xor ecx, ecx
lea eax, [ebp - 8]
lock or dword [eax], ecx
mov dword [esi + 8], ecx
test edi, edi
je 0x4ec299
push 0xc0000001
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtTerminateThread]
push 0
push 0
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebx], 0
mov edi, 0xc0000001
push esi
push 0x5cf358
call dword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
cmp dword [0x5cf76c], 0
je 0x4ec2fb
xor ecx, ecx
mov eax, 0x5cf76c
xchg dword [eax], ecx
test ecx, ecx
je 0x4ec2fb
lea esp, [esp]
mov esi, dword [ecx]
lea eax, [ecx + 0x10]
lock btr dword [eax], 1
jb 0x4ec2e4
push 0
push 0
push ecx
push dword [0x5cf310]
call dword [sym.imp.ntdll.dll_NtReleaseKeyedEvent]
lea ecx, [ecx]
test eax, eax
js 0x4ec2ec
mov ecx, esi
test esi, esi
jne 0x4ec2c0
jmp 0x4ec2fb
push eax
lfence
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov edi, 0xc0000001
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
Function at 0x4ec6c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
push edi
push dword [0x5cd4e4]
mov edi, ecx
mov dword [ebp - 0xc], esi
lea eax, [esi*4]
mov dword [ebp - 0x10], edi
push eax
call sym.ProcessHacker.exe_PhCreateObject
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
xor ebx, ebx
mov dword [ebp - 8], eax
test esi, esi
je 0x4ec7f7
mov ecx, dword [ebp + 8]
lea eax, [ecx*4]
mov dword [ebp - 4], eax
jmp 0x4ec710
push dword [0x5cd4e4]
push eax
call sym.ProcessHacker.exe_PhCreateObject
push dword [0x5cf03c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
je 0x4ec7c1
mov eax, dword [esi]
cmp eax, 0x40
jae 0x4ec743
mov dword [esi + eax*4 + 4], edi
inc dword [esi]
jmp 0x4ec7c1
mov ecx, dword [esi + 0x10c]
test ecx, ecx
jne 0x4ec772
push 0x100
push 4
push dword [0x5cd55c]
mov dword [esi + 0x108], 0x40
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 0x10c], eax
mov ecx, eax
mov eax, dword ds:[esi + 0x104]
mov edx, dword [esi + 0x108]
cmp eax, edx
jne 0x4ec7b8
lea eax, ds:[edx + edx]
mov dword [esi + 0x108], eax
shl eax, 2
push eax
push ecx
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x104]
mov ecx, dword [esi + 0x10c]
mov dword [ecx + eax*4], edi
inc dword [esi + 0x104]
push dword [ebp - 4]
mov esi, dword [ebp - 8]
push 0
push edi
mov dword [esi + ebx*4], edi
call fcn.00536b00
mov eax, dword ds:[ebp - 4]
inc ebx
add esp, 0xc
cmp ebx, dword [ebp - 0xc]
jb 0x4ec710
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword ds:[edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ee480
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
movzx eax, word [ecx]
mov word [ebp - 0x18], ax
add eax, 2
cmp dword [ecx], 0xfffe
mov word [ebp - 0x16], ax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x14], eax
jbe 0x4ee4b6
mov eax, 0xc0000106
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004ee0c0
lea ecx, ds:[ebp - 4]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
js 0x4ee5f3
mov edx, dword ds:[ecx]
cmp edx, 7
je 0x4ee5ee
cmp edx, 8
je 0x4ee5ee
cmp dword [ebp + 0xc], 0
je 0x4ee555
push dword ds:[ecx + 4]
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov ecx, dword [ebp - 4]
mov ebx, eax
push ebx
push 4
push dword [0x5cd55c]
mov edi, dword [ecx + 4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push ebx
mov esi, eax
push edi
push esi
call fcn.00537fe0
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
mov dword [eax], esi
mov edi, dword ds:[ebp + 0x10]
test edi, edi
je 0x4ee5e1
mov eax, dword [ecx + 8]
test eax, eax
js 0x4ee5d7
lea ecx, [eax + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
lea ecx, [eax + ecx*4]
movzx eax, word [ecx]
mov dword [ebp - 0xc], eax
test ax, ax
jne 0x4ee591
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
mov dword [edi], esi
jmp 0x4ee5de
push dword [0x5cd4f8]
mov ecx, dword [ecx + 4]
movzx eax, ax
add eax, 0xa
mov dword [ebp - 0x10], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0xc]
movzx ecx, ax
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4ee5d3
push ecx
push eax
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
mov dword [edi], esi
jmp 0x4ee5de
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4ee5f3
mov eax, dword [ecx]
mov dword [edx], eax
jmp 0x4ee5f3
mov ebx, 0xc0000073
mov eax, dword [ebp - 8]
test eax, eax
je 0x4ee609
push eax
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4ee614
push ecx
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50b4a0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [ebp + 0x14]
test bl, 1
je 0x50b4e3
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetOwnerSecurityDescriptor]
test eax, eax
mov ecx, 1
cmovns esi, ecx
test bl, 2
je 0x50b4fe
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetGroupSecurityDescriptor]
test eax, eax
js 0x50b4fe
or esi, 2
mov eax, ebx
and eax, 4
mov dword [ebp - 0x1c], eax
je 0x50b528
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 2]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetDaclSecurityDescriptor]
test eax, eax
js 0x50b528
cmp byte [ebp - 2], 0
je 0x50b528
or esi, 4
and ebx, 8
je 0x50b553
lea eax, ds:[ebp - 1]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 2]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetSaclSecurityDescriptor]
test eax, eax
js 0x50b553
cmp byte [ebp - 2], 0
je 0x50b553
or esi, 8
cmp dword [ebp + 0xc], 1
jne 0x50b5b5
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlGetControlSecurityDescriptor]
test eax, eax
js 0x50b5b5
cmp dword [ebp - 0x1c], 0
mov cx, word [ebp - 8]
je 0x50b595
movzx eax, cx
test eax, 0x1000
je 0x50b58f
or esi, 0x80000000
jmp 0x50b595
or esi, 0x20000000
test ebx, ebx
je 0x50b5b5
movzx eax, cx
test eax, 0x2000
je 0x50b5af
or esi, 0x40000000
jmp 0x50b5b5
or esi, 0x10000000
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
pop edi
pop esi
pop ebx
test eax, eax
je 0x50b5e5
jle 0x50b5e7
movzx eax, ax
or eax, 0xc0070000
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50f7c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, ecx
mov edi, edx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x50f8ed
push str.BinaryData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x50f809
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x50f8e7
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edx, dword [edi + 0x18]
mov ecx, eax
mov esi, edx
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
cmp edx, dword [edi + 0x1c]
jle 0x50f83a
mov esi, dword [edi + 0x1c]
mov dword [edi + 0x1c], edx
mov dword [edi + 0x18], esi
jmp 0x50f83d
mov edx, dword [edi + 0x1c]
test byte [edi + 0x28], 0x10
je 0x50f898
cmp esi, 0xffffffff
jne 0x50f86a
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x50f856
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
push ecx
mov ecx, dword [ebp - 4]
mov edx, edi
push esi
call fcn.0050f9e0
mov ecx, dword [ebp - 8]
jmp 0x50f8b5
mov ecx, dword [ebp - 4]
push edx
push esi
mov edx, edi
call fcn.0050f900
push dword ds:[ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, edi
push esi
call fcn.0050f9e0
mov ecx, dword [ebp - 4]
mov edx, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0050f400
mov ecx, dword [ebp - 8]
jmp 0x50f8b5
cmp esi, 0xffffffff
jne 0x50f8ab
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x50f8ab
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
mov eax, dword [edi + 4]
sub eax, esi
cmp ecx, eax
cmova ecx, eax
mov eax, dword ds:[edi]
push ecx
push dword [ebp - 0xc]
add eax, esi
push eax
call fcn.00537fe0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push 0x105
push 0
push 0
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5130c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x14]
mov edi, ecx
push eax
push edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x5132bf
mov eax, dword ds:[ebp - 8]
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x14]
je 0x5132bf
cmp dword [esi + 0x1b4], 0
jg 0x51316d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov eax, dword [esi + 0x1b8]
test eax, eax
jne 0x51313b
mov dword [esi + 0x1b8], ebx
jmp 0x51314d
push 2
push ebx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x513160
test eax, eax
je 0x5132bf
jmp 0x5132b4
test dword [esi + 0x20], 0x200000
je 0x51322c
cmp dword [esi + 0x180], 0
jne 0x51322c
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x51322c
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x180], eax
test eax, eax
je 0x51322c
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x18c], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x48]
push eax
mov dword [esi + 0x198], eax
mov eax, dword [esi + 0x194]
inc eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x188], eax
test eax, eax
jne 0x51320a
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x180], 0
jmp 0x51322c
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword ds:[esi + 0x188]
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x184], eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
test ebx, ebx
je 0x5132bf
mov ecx, dword [ebp - 0x50]
mov edx, esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x180]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x5132a8
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00517e60
mov edx, dword ds:[ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push 0xcc0020
push edx
push ecx
push dword [esi + 0x180]
sub eax, edx
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x5132b4
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push ebx
call fcn.00517e60
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x517060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x5170ac
lea esp, [esp]
cmp esi, 0x28
je 0x5170ac
cmp esi, 0x24
je 0x5170ac
cmp esi, 0x23
je 0x5170ac
cmp esi, 0x21
je 0x5170ac
cmp esi, 0x22
je 0x5170ac
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x51725a
lea eax, ds:[esi - 0x21]
cmp eax, 7
ja case.0x5170c9.37
jmp dword [eax*4 + 0x517270]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x5170c9.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x5170c9.36
dec edi
jmp 0x517177
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x5170c9.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x517177
lea edi, [ecx - 1]
jmp 0x517177
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x51710b
mov edi, dword [edi + 0x20]
jmp 0x51710d
xor edi, edi
test byte [ebx + 0x20], 8
je 0x517118
mov edx, dword [ebx + 0x58]
jmp 0x51711a
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x51725a
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x51725a
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x517154
nop
cmp edi, eax
jbe 0x517148
mov edi, eax
jmp 0x517177
cmp edi, edx
jb case.0x5170c9.36
sub edi, edx
jmp 0x517177
xor edi, edi
jmp 0x517177
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x517168
mov edi, esi
jmp 0x517177
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x517177
mov edi, dword [ebp - 0x1c]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 0x15]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.00516920
test si, si
jns 0x5171cd
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x5171cd
lea eax, [ebp - 0x20]
cmp edi, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x5171e9
cmp byte [ebp - 0x15], 0
jne 0x517217
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push edi
mov ecx, ebx
call fcn.005167a0
mov edx, dword ds:[ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.005164e0
test al, al
je 0x517217
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.00516b00
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x51725a
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x51ce40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5bb378
push 0x5359e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5c7004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebp + 0x10]
mov dword [esi + 8], ebx
mov dword [ebp - 4], 0
push 0x40
mov edx, edi
mov ecx, esi
call fcn.0051d460
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x5a4d
cmp word [edi], ax
je 0x51cebe
mov eax, 0xc000012f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x51cf98
cmp eax, 0x10000000
jae 0x51cf98
cmp eax, ebx
jae 0x51cf98
lea edx, [eax + edi]
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
push 0x18
mov ecx, esi
call fcn.0051d460
mov edx, dword [esi + 0xc]
movzx eax, word [edx + 6]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0x14]
lea eax, [eax + ecx*8]
add eax, 0x18
push eax
mov ecx, esi
call fcn.0051d460
mov dword ds:[ebp - 4], 0xfffffffe
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0x4550
jne 0x51cf98
movzx eax, word [ecx + 0x18]
mov word [esi + 0x18], ax
mov edx, 0x10b
cmp ax, dx
je 0x51cf3e
mov edx, 0x20b
cmp ax, dx
jne 0x51cf98
movzx eax, word [ecx + 6]
mov dword [esi + 0x10], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51d120
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
xor bl, bl
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0
test edi, edi
jne 0x51d20e
test ecx, ecx
jne 0x51d176
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
push 0
push 0
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov esi, eax
test esi, esi
js 0x51d2eb
push 0
push 0
push 0x60
push 1
push 1
push 0x80
lea eax, [esp + 0x48]
mov dword [esp + 0x50], 0x18
mov dword [esp + 0x58], eax
lea eax, [esp + 0x68]
push 0
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x5c], 0
push eax
push 0x100081
lea eax, [esp + 0x48]
mov dword [esp + 0x6c], 0x40
push eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x51d200
test esi, esi
js 0x51d2eb
mov edi, dword [esp + 0x20]
mov bl, 1
push 5
push 0x18
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x64]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
js 0x51d2b1
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
push edi
push 0x8000000
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 2
push eax
push 0
push 5
lea eax, [esp + 0x28]
mov dword [esp + 0x34], ecx
push eax
lfence
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test esi, esi
js 0x51d2b1
mov eax, dword [esp + 0x18]
push 2
push 0
push 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
js 0x51d2b1
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x51d2c6
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test bl, bl
je 0x51d2d1
push edi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword ds:[esp + 0x7c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
lfence
jmp 0x51d2d1