joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d8b50
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x5d8b73
push 0x108
push 0x7905d8
call fcn.0052630c
test eax, eax
je 0x5d8b73
int3
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x54], 0
je 0x5d8c58
cmp dword [ebp + 0xc], 0
jne 0x5d8bbe
mov ecx, dword [ebp - 0x14]
call fcn.005289e0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d8b9e
xor eax, eax
jmp 0x5d8cb6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5d8c4b
cmp dword [ebp + 0x10], 0
jne 0x5d8bfd
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00522a8b
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5d8be0
xor eax, eax
jmp 0x5d8cb6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5d8c4b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00522a8b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5d8c19
xor eax, eax
jmp 0x5d8cb6
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x5d8cb6
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x68], 0
jne 0x5d8c75
push 0x12a
push 0x790610
call fcn.0052630c
test eax, eax
je 0x5d8c75
int3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xfff
jl 0x5d8c9d
push 0x12b
push 0x790648
call fcn.0052630c
test eax, eax
je 0x5d8c9d
int3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5d9b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x5d9ca6
call fcn.0052998f
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5d9c39
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5d9c10
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0
mov ecx, 0x872a00
call fcn.00528427
push eax
push 0x16f
push 0x791184
lea ecx, [ebp - 0x20]
call fcn.0052ae3e
push eax
call fcn.0052c1ad
add esp, 0x10
xor eax, eax
jmp 0x5d9d14
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d9c37
push 0x175
push 0x7911f4
call fcn.0052630c
test eax, eax
je 0x5d9c37
int3
jmp 0x5d9ca6
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x5d9c5c
push 0x17d
push 0x79122c
call fcn.0052630c
test eax, eax
je 0x5d9c5c
int3
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x5d9ca6
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x5d9c9b
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0
mov ecx, 0x872a00
call fcn.00528427
push eax
push 0x183
push 0x791264
lea ecx, [ebp - 0x28]
call fcn.0052ae3e
push eax
call fcn.0052c1ad
add esp, 0x10
jmp 0x5d9ca6
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x5d9c5c
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x5d9ccf
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x5d9cee
cmp dword [ebp - 0xc], 0
je 0x5d9cee
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00524b33
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
je 0x5d9d11
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [eax]
mov eax, dword [edx + 0xa8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6068d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x60697c
cmp dword [ebp + 8], 0
je 0x60697c
lea edx, [ebp - 4]
push edx
push 0x7a9914
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [ebp - 0x10]
push edx
call fcn.00526910
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x62b740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x62b75f
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x62b7ba
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x62b783
call fcn.00527c2a
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x62b7a2
call fcn.00527c2a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x62b7ba
call fcn.00527c2a
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 2]
cmp ecx, 0xffff
jne 0x62b876
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 0x80000000
je 0x62b845
call fcn.0052ae2f
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.005276bc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x62b80d
push 0x12c
push 0x7c766c
call fcn.0052630c
test eax, eax
je 0x62b80d
int3
cmp dword [ebp - 0x18], 0
je 0x62b843
push 0x7c76a4
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x62b843
xor eax, eax
jne 0x62b843
push 0x131
push 0x7c76b4
call fcn.0052630c
test eax, eax
je 0x62b843
int3
jmp 0x62b876
mov edx, dword [ebp - 0x14]
and edx, 0xffff
movzx eax, dx
and eax, 0xff
movzx ecx, al
cmp ecx, 3
jne 0x62b876
xor edx, edx
jne 0x62b876
push 0x137
push 0x7c76ec
call fcn.0052630c
test eax, eax
je 0x62b876
int3
call fcn.0052ae2f
cmp dword [eax + 0x3c], 0
je 0x62b890
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.0052570e
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00523eef
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x5c], 0
je 0x62b8c0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x5c], 0
cmp dword [ebp - 4], 0
je 0x62b8d5
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x5c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
or edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x63ce90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x109
push 0x7d3684
mov eax, dword [ebp - 8]
push eax
call fcn.0052b988
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x63cec9
push 0x10a
push 0x7d36bc
call fcn.0052630c
test eax, eax
je 0x63cec9
int3
cmp dword [ebp + 0xc], 0
jne 0x63ced3
xor eax, eax
jmp 0x63cf4e
cmp dword [ebp + 8], 0
jne 0x63ceed
push 0x10f
push 0x7d36f4
call fcn.0052630c
test eax, eax
je 0x63ceed
int3
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0052b2e9
test eax, eax
jne 0x63cf14
push 0x110
push 0x7d372c
call fcn.0052630c
test eax, eax
je 0x63cf14
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x63cf4b
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00521578
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00525862
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x63cf60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x11b
push 0x7d3764
mov eax, dword [ebp - 8]
push eax
call fcn.0052b988
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x63cf99
push 0x11c
push 0x7d379c
call fcn.0052630c
test eax, eax
je 0x63cf99
int3
cmp dword [ebp + 0xc], 0
jne 0x63cfa4
jmp 0x63d039
cmp dword [ebp + 8], 0
jne 0x63cfbe
push 0x121
push 0x7d37d4
call fcn.0052630c
test eax, eax
je 0x63cfbe
int3
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0052b2e9
test eax, eax
jne 0x63cfe5
push 0x122
push 0x7d380c
call fcn.0052630c
test eax, eax
je 0x63cfe5
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x63d01c
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00521578
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00525862
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x63d039
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.00521578
push eax
push 0xffffffffffffffff
push 0xd
call fcn.00528044
mov esp, ebp
pop ebp
ret 8
Function at 0x63d420
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x19a
push 0x7d3b1c
mov eax, dword [ebp - 4]
push eax
call fcn.0052b988
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x63d457
push 0x19b
push 0x7d3b54
call fcn.0052630c
test eax, eax
je 0x63d457
int3
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x30]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x63d497
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.00521578
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00525862
mov esp, ebp
pop ebp
ret 8

Function at 0x63d4a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x1a5
push 0x7d3b8c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0052b988
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x63d4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x63d4f8
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.00521578
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00525862
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x676270
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.00521578
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
je 0x6762e1
push 1
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x6762df
push str.Warning:_File_save_with_new_name_failed._n
push 0
mov ecx, 0x8729f4
call fcn.00528427
push eax
push 0x110
push 0x7e9594
lea ecx, [ebp - 0xc]
call fcn.0052ae3e
push eax
call fcn.0052c1ad
add esp, 0x10
xor eax, eax
jmp 0x676339
jmp 0x676334
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.00521578
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x676334
push str.Warning:_File_save_failed._n
push 0
mov ecx, 0x8729f4
call fcn.00528427
push eax
push 0x118
push 0x7e95f8
lea ecx, [ebp - 0x14]
call fcn.0052ae3e
push eax
call fcn.0052c1ad
add esp, 0x10
xor eax, eax
jmp 0x676339
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x6a3990
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x86dc84]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00528067
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x6a39d5
push 0x66
push 0x8048c0
call fcn.0052630c
test eax, eax
je 0x6a39d5
int3
mov dword [ebp - 0x8c], 0x40
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x6a3a4a
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx - 4]
mov dword [ebp - 0x94], eax
push 0x40
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40
lea edx, [ebp - 0x88]
push edx
call fcn.00522176
add esp, 0x10
cmp eax, 1
je 0x6a3a48
push 0xffffffffffffffff
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.00526951
mov ecx, dword [ebp + 8]
call fcn.00521352
jmp 0x6a3abd
call fcn.0052b186
mov ecx, dword [eax]
mov dword [ebp - 0x98], ecx
call fcn.0052b186
mov dword [eax], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x3f
push 0x40
lea ecx, [ebp - 0x88]
push ecx
call fcn.0052a97f
add esp, 0x14
call fcn.0052b186
cmp dword [eax], 0
je 0x6a3a99
call fcn.0052b186
mov edx, dword [eax]
push edx
call fcn.00528201
add esp, 4
jmp 0x6a3aa6
call fcn.0052b186
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
xor edx, edx
jne 0x6a3a4a
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.00529133
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005287fb
mov esp, ebp
pop ebp
ret

Function at 0x6a42d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.005212bc
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.0052ca18
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x6a4359
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x6a4330
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00527ce3
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x6a434d
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.0052b5af
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00524633
jmp 0x6a438a
mov ecx, dword [ebp + 0x10]
call fcn.00521578
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x6a438a
mov ecx, dword [ebp + 0x10]
call fcn.00521578
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00529133
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6c69a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x4e
push 0x820a5c
mov eax, dword [ebp - 0x24]
push eax
call fcn.0052b988
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x3c], 0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x6c6a06
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x3c]
or eax, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or eax, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
jmp 0x6c6a33
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x6c6a33
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x3c]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.00525899
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x34], 0
jne 0x6c6b0f
call fcn.0052cc48
cmp eax, dword [ebp + 8]
je 0x6c6a60
jmp 0x6c6b0f
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x6c6a98
push 1
push 0x109
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x6c6aef
cmp dword [ebp - 0x1c], 0x202
je 0x6c6abc
cmp dword [ebp - 0x1c], 0x205
je 0x6c6abc
cmp dword [ebp - 0x1c], 0x201
je 0x6c6abc
cmp dword [ebp - 0x1c], 0x204
jne 0x6c6abe
jmp 0x6c6b0f
cmp dword [ebp - 0x1c], 0x100
jne 0x6c6acf
cmp dword [ebp - 0x18], 0x1b
jne 0x6c6acf
jmp 0x6c6b0f
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
call fcn.005289db
neg eax
sbb eax, eax
add eax, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x872fdc]
jbe 0x6c6b0a
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], 1
jmp 0x6c6a44
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x34]
mov esp, ebp
pop ebp
ret 4

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret
Function at 0x11486058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.114861a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1148607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1148606a
add dl, dl
jne 0x11486089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x114860dc
xor eax, eax
add dl, dl
jne 0x11486096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1148617d
add dl, dl
jne 0x114860a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114860b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114860bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114860c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x114860d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11486075
mov eax, 1
add dl, dl
jne 0x114860ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x114860f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x114860e1
sub eax, ebx
mov ebx, 1
jne 0x11486128
mov ecx, 1
add dl, dl
jne 0x1148610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11486119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11486105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11486075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1148613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1148614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11486136
cmp eax, 0x7d00
jae 0x1148616d
cmp eax, 0x500
jb 0x11486168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11486075
cmp eax, 0x7f
ja 0x11486170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11486075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1148619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11486075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10