joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cc05c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x5cc1e9
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x5cc0ad
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x5cc0be
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x5cc0d4
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x5cc0f6
mov ebx, dword [ecx]
test ebx, ebx
jg 0x5cc0ea
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x5cc0ee
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x5cc0de
test di, di
je 0x5cc1e9
mov dl, byte [eax + 9]
sub dl, 2
je 0x5cc11f
sub dl, 2
je 0x5cc13f
sub dl, 4
je 0x5cc179
sub dl, 8
je 0x5cc19d
jmp 0x5cc1e9
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x5cc1e9
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x5cc12f
jmp 0x5cc1e9
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x5cc1e9
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x5cc169
jmp 0x5cc1e9
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x5cc1e9
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x5cc189
jmp 0x5cc1e9
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x5cc1e9
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x5cc1b4
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d7868
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405774
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x5f8fe8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
mov ebx, eax
mov dx, word [0x5f9054]
mov eax, ebx
call fcn.005f7488
test al, al
je 0x5f904f
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5f904f
push 8
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5f904a
push 8
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x5f904a
cmp byte [ebx + 0x30], 0
je 0x5f9035
mov cl, 1
mov edx, 0x5f9060
mov eax, ebx
call fcn.005f7964
push 0
xor ecx, ecx
mov edx, dword [ebx + 0x58]
mov eax, esi
call fcn.005fd2d0
mov eax, ebx
call fcn.005f7394
call sub.user32.dll_CloseClipboard
pop esi
pop ebx
ret
Function at 0x6360a4
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x6360e7
cmp dword [esp + 0x10], 2
jne 0x6360d0
cmp dword [esp + 4], 5
jb 0x6360d0
mov bl, 1
jmp 0x6360e7
cmp dword [esp + 0x10], 1
jne 0x6360e7
cmp dword [esp + 4], 4
jb 0x6360e7
cmp dword [esp + 8], 0x5a
jb 0x6360e7
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x640f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x641099
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [0x7156d0]
cmp dword [eax], 0
jne 0x640fef
lea eax, [ebp - 0x10d]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 8]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405048
jmp 0x640fff
lea eax, [ebp - 8]
mov edx, dword [0x7156d0]
mov edx, dword [edx]
call fcn.00404e68
lea ecx, [ebp - 0x114]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00644f30
mov edx, dword [ebp - 0x114]
lea eax, [edi + 8]
call fcn.00404e24
xor eax, eax
push ebp
push 0x64106e
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x641043
mov ecx, dword [edi + 8]
mov dl, 1
mov eax, dword [0x62f440]
call fcn.006412f4
mov dword [edi + 4], eax
jmp 0x641052
mov dl, 1
mov eax, dword [0x41c770]
call fcn.00403f74
mov dword [edi + 4], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [edi + 4]
call fcn.00421254
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x641078
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6410a0
lea eax, [ebp - 0x114]
call fcn.00404dd0
lea eax, [ebp - 8]
call fcn.00404dd0
ret
Function at 0x64150c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x641554
cmp dword [0x71b614], 3
jle 0x641554
cmp dword [0x71b610], 0
jne 0x64153b
cmp dword [0x71b60c], 0
jbe 0x641554
jmp 0x64153d
jle 0x641554
mov eax, dword [0x71b60c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x71b610]
mov dword [ebp - 0xc], eax
jmp 0x641689
xor eax, eax
push ebp
push 0x641682
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x641698
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x6415d1
push 0x6416a8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov esi, edi
test edi, edi
je 0x6415d1
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x40
call fcn.0040376c
mov dword [ebp - 0x70], 0x40
lea eax, [ebp - 0x70]
push eax
call esi
cmp byte [ebp - 1], 0
je 0x6415b5
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc], eax
jmp 0x6415c1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
push ebx
call sub.kernel32.dll_FreeLibrary_1
call fcn.0040481c
jmp 0x641689
mov dword [ebp - 0x30], 0x20
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
cmp byte [ebp - 1], 0
je 0x6415f4
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x6415ff
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641689
cmp byte [ebp - 1], 0
jne 0x641681
cmp dword [ebp - 0xc], 0
jne 0x641620
cmp dword [ebp - 0x10], 0
jbe 0x641681
jmp 0x641622
jle 0x641681
cmp dword [ebp - 0xc], 0
jne 0x641633
cmp dword [ebp - 0x10], 0xee6b2800
jbe 0x641643
jmp 0x641635
jle 0x641643
mov dword [ebp - 0x10], 0xee6b2800
mov dword [ebp - 0xc], 0
cmp dword [0x71b614], 0
jle 0x641669
mov eax, dword [0x71b60c]
mov edx, dword [0x71b610]
cmp edx, dword [ebp - 0xc]
jne 0x641660
cmp eax, dword [ebp - 0x10]
je 0x641669
xor eax, eax
mov dword [0x71b614], eax
mov eax, dword [ebp - 0x10]
mov dword [0x71b60c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x71b610], eax
inc dword [0x71b614]
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x644ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x644f21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404dd0
mov eax, dword [0x7156d0]
cmp dword [eax], 0
jne 0x644ef1
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040bd34
jmp 0x644f01
lea eax, [ebp - 4]
mov edx, dword [0x7156d0]
mov edx, dword [edx]
call fcn.00404e68
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644f28
lea eax, [ebp - 4]
call fcn.00404dd0
ret
Function at 0x644fc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x645047
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7156d0]
cmp dword [eax], 0
jne 0x645012
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040bd34
jmp 0x645022
lea eax, [ebp - 4]
mov edx, dword [0x7156d0]
mov edx, dword [edx]
call fcn.00404e68
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, 0x64505c
call fcn.00644f30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64504e
lea eax, [ebp - 4]
call fcn.00404dd0
ret
Function at 0x646074
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x64609b
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x646224
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x64621d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x6460ea
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x6460e0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x646202
mov edx, dword [ebp - 4]
test al, 8
je 0x646166
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x64614b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044d070
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x646188
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044d070
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044d070
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x6461e0
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x645fb0
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x646202
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x645fb0
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646224
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x646610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x6466c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x6466d8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6466b1
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x6466f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x6466b1
test esi, esi
jne 0x646688
cmp dword [ebp - 8], 1
je 0x64668c
xor ebx, ebx
jmp 0x6466b1
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.00405048
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.004037d0
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x6466b1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6466ce
lea eax, [ebp - 0x34]
call fcn.00404dd0
ret

Function at 0x64729c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x64735b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x715650]
cmp dword [eax], 5
jl 0x6472cd
mov eax, dword [0x715b68]
cmp dword [eax], 2
je 0x6472d1
mov bl, 1
jmp 0x647345
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x647374
push esi
push 0x6473a0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405174
mov eax, dword [ebp - 0x14]
call fcn.004052ac
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x647345
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x647333
cmp word [ebp - 0xc], 0
jne 0x64733a
cmp eax, 0xea
jne 0x64733c
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x647362
lea eax, [ebp - 0x14]
call fcn.00404dd0
ret
Function at 0x647418
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x6474a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x647488
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00405048
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.0040642c
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x647484
push ebx
call sub.kernel32.dll_IsValidCodePage
test eax, eax
jne 0x64748a
xor ebx, ebx
jmp 0x64748a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6474a7
lea eax, [ebp - 0x18]
call fcn.00404dd0
ret

Function at 0x64b730
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004551c8
test al, al
je 0x64b885
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00454ec4
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x64b79c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_EqualRect
test eax, eax
je 0x64b79c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00648aa4
jmp 0x64b885
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x64b873
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x14]
push edi
mov esi, dword [ebp - 0x18]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b87a
cmp dword [ebp - 0xc], 0
je 0x64b856
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x64b865
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64fbc4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, 0x71baac
xor eax, eax
call fcn.0064fb80
xor eax, eax
mov dword [ebp - 9], eax
xor eax, eax
mov dword [ebp - 5], eax
call fcn.0064f944
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c
call fcn.0040376c
mov dword [ebx], esi
mov dword [ebx + 4], edi
cmp byte [ebp - 1], 0
je 0x64fc11
cmp dword [0x71bb00], 0
jne 0x64fc15
xor eax, eax
jmp 0x64fc17
mov al, 1
mov byte [ebx + 8], al
mov al, byte [ebp + 8]
mov byte [ebx + 0x3c], al
lea eax, [ebx + 0x34]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClientRect
push 2
lea eax, [ebx + 0x1c]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_MapWindowPoints
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowRect
push 3
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetDCEx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
mov dword [ebx + 0x30], esi
push esi
mov eax, dword [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov esi, eax
mov dword [ebx + 0x14], esi
mov eax, dword [ebx + 0x18]
push eax
push esi
call sub.gdi32.dll_SelectObject
push 0x1e
mov eax, dword [ebx + 0x14]
push eax
push 0x317
mov eax, dword [ebx]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebx + 8], 0
je 0x64fd07
push 0xffffffffffffffec
mov esi, dword [ebx]
push esi
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov dword [ebx + 0xc], 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x14], 0
mov al, byte [ebx + 0xc]
mov byte [ebp - 0x12], al
push 2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 9]
push eax
mov eax, dword [ebx + 0x14]
push eax
lea eax, [ebx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebx]
push eax
call dword [0x71bb00]
jmp 0x64fd30
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 0
call sub.gdi32.dll_CreateRectRgn
mov esi, eax
push 0
push esi
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowRgn
test eax, eax
jne 0x64fd30
push esi
call sub.gdi32.dll_DeleteObject
push 0x425f
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x64f990
xor edx, edx
xor eax, eax
call fcn.00404d84
mov dword [0x71baa8], eax
cmp dword [0x71baa8], 0
jne 0x64fd72
call fcn.0064faf8
jmp 0x64fd83
inc dword [0x71baf8]
mov eax, dword [0x71baa8]
push eax
call sub.kernel32.dll_ResumeThread
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x650650
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x650690
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jle 0x650690
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405048
jmp 0x65069c
mov eax, esi
mov edx, 0x6506b0
call fcn.00404e24
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x666e34
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
lea edi, [ebp - 0x1d]
xor edx, edx
push ebp
push 0x667076
push dword fs:[edx]
mov dword fs:[edx], esp
mov bl, 1
jmp 0x66703b
test bl, bl
jne 0x666e5e
call sub.user32.dll_WaitMessage
xor ebx, ebx
jmp 0x66701a
mov eax, dword [edi + 4]
cmp eax, 0x105
jg 0x666e94
je 0x666f22
sub eax, 0xa0
je 0x666f65
dec eax
sub eax, 9
jb 0x666f45
sub eax, 0x5a
je 0x666eae
jmp 0x666fe1
sub eax, 0x200
je 0x666f65
dec eax
sub eax, 9
jb 0x666f45
jmp 0x666fe1
mov eax, dword [edi + 8]
cmp eax, 0x12
je 0x666fe1
cmp eax, 0x10
je 0x666fe1
cmp eax, 0x19
je 0x666fe1
mov byte [ebp - 1], 0
test byte [edi + 0xe], 0xff
je 0x666eff
mov esi, 0x60
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
mov dx, word [edi + 0xe]
and dx, 0xff
movzx edx, dx
cmp eax, edx
jne 0x666ef9
mov byte [ebp - 1], 1
jmp 0x666eff
inc esi
cmp esi, 0x6a
jne 0x666edb
cmp byte [ebp - 1], 0
jne 0x666fe1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x667084]
mov byte [eax + 0x34], dl
call fcn.0040481c
jmp 0x66707d
cmp dword [edi + 8], 0x12
jne 0x666fe1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x667084]
mov byte [eax + 0x34], dl
call fcn.0040481c
jmp 0x66707d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00454ec4
cmp eax, dword [edi]
je 0x666fe1
call fcn.0040481c
jmp 0x66707d
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x666f93
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00454ec4
lea edx, [edi + 0x14]
call fcn.00666db8
test al, al
je 0x666fc2
call sub.user32.dll_ReleaseCapture
jmp 0x666fc2
call sub.user32.dll_GetCapture
test eax, eax
jne 0x666fc2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00454ec4
lea edx, [edi + 0x14]
call fcn.00666db8
test al, al
jne 0x666fc2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.user32.dll_SetCapture
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x666fe1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x66701a
mov eax, dword [edi + 4]
cmp eax, 0x200
jb 0x66700e
cmp eax, 0x20a
ja 0x66700e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [edi]
je 0x66701a
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.00666dec
pop ecx
test al, al
je 0x66703b
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x666e65
push ebp
call fcn.00666dec
pop ecx
test al, al
jne 0x666e55
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66707d
mov edx, 0x103
mov eax, 0x102
call fcn.006464e8
mov edx, 0x107
mov eax, 0x106
call fcn.006464e8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret