joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d61f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d6442
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x68f898], 0
jne 0x5d640f
mov byte [0x68f898], 1
mov eax, 0x779058
call fcn.00405684
lea eax, [ebp - 0x10]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x5d6292
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x5d6292
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
je 0x5d6292
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00405904
mov edx, dword [ebp - 0x268]
lea eax, [ebp - 8]
mov ecx, 0x5d6458
call fcn.004059c0
mov eax, dword [ebp - 8]
call fcn.0040c7fc
test al, al
je 0x5d640f
xor eax, eax
push ebp
push 0x5d6346
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x264]
call fcn.00403918
mov edx, 1
lea eax, [ebp - 0x264]
call fcn.00404074
lea eax, [ebp - 0x264]
call fcn.00403c68
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405dfc
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5d6318
sub ebx, 4
mov ebx, dword [ebx]
push 0
lea eax, [ebp - 4]
call fcn.00405bcc
mov edx, eax
mov ecx, ebx
lea eax, [ebp - 0x264]
call fcn.00403a6c
lea eax, [ebp - 0x264]
call fcn.00403a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d6350
lea eax, [ebp - 0x26c]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00405904
mov eax, dword [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00405cb8
test eax, eax
je 0x5d640f
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00405904
mov eax, dword [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00405cb8
mov ecx, eax
dec ecx
lea eax, [ebp - 4]
mov edx, 1
call fcn.00405c14
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x5d6478
call fcn.00405cb8
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405bd4
lea eax, [ebp - 4]
mov edx, 0x5d6488
call fcn.0040597c
mov eax, dword [ebp - 4]
call fcn.0040c7fc
test al, al
je 0x5d640f
lea ecx, [ebp - 0x274]
mov edx, 0x779064
mov eax, dword [ebp - 4]
call fcn.005d5b88
mov edx, dword [ebp - 0x274]
mov eax, 0x779058
call fcn.004056d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6449
lea eax, [ebp - 0x274]
mov edx, 4
call fcn.004056a8
lea eax, [ebp - 0xc]
call fcn.00407660
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5d6494
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
xor eax, eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d6642
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x68f89c], 0
jne 0x5d660f
mov byte [0x68f89c], 1
lea eax, [ebp - 0x10]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x5d651c
lea eax, [ebp - 0x119]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x5d651c
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
je 0x5d651c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5d6608
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x119]
mov ecx, 0x105
call fcn.00405904
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 4]
mov ecx, 0x5d6658
call fcn.004059c0
lea eax, [ebp - 0x124]
mov ecx, 0x5d6674
mov edx, dword [ebp - 4]
call fcn.004059c0
mov ecx, dword [ebp - 0x124]
mov dl, 1
mov eax, dword [0x429d14]
call fcn.00429dcc
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x5d668c
mov edx, 0x5d669c
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx]
cmp dword [ebp - 8], 0
jne 0x5d65a4
call fcn.004050a8
jmp 0x5d660f
push dword [ebp - 4]
push dword [ebp - 8]
push 0x5d66b0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405a34
mov eax, dword [ebp - 8]
call fcn.0040c7fc
test al, al
jne 0x5d65cf
call fcn.004050a8
jmp 0x5d660f
lea ecx, [ebp - 0x128]
mov edx, 0x779068
mov eax, dword [ebp - 8]
call fcn.005d5b88
mov edx, dword [ebp - 0x128]
mov eax, 0x77905c
call fcn.004056d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d660f
mov eax, dword [ebp - 0x14]
call fcn.00404748
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6649
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.004056a8
lea eax, [ebp - 0xc]
call fcn.00407660
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5de9c4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b64
xor eax, eax
push ebp
push 0x5deab5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5dea9f
xor edx, edx
push ebp
push 0x5dea98
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
call fcn.00405bcc
push 4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5dea32
call fcn.004050a8
jmp 0x5dea9f
xor eax, eax
push ebp
push 0x5dea7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x5dea5d
call fcn.004050a8
call fcn.004050a8
jmp 0x5dea9f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dea81
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5deabc
lea eax, [ebp - 4]
call fcn.00405684
ret

Function at 0x5deb68
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc4
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00403cb4
mov dword [esp], 0x3c
call sub.user32.dll_GetActiveWindow
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40
mov eax, 0x5debdc
mov dword [esp + 0xc], eax
mov eax, ebx
call fcn.004060b4
mov dword [esp + 0x10], eax
mov eax, esi
call fcn.004060b4
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x1c], eax
push esp
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x3c
pop esi
pop ebx
ret
Function at 0x5f909c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
xor edx, edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b64
lea eax, [ebp - 0x168]
mov edx, dword [0x40a7d8]
call fcn.00406498
xor eax, eax
push ebp
push 0x5f9246
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x170]
mov ecx, 0x5f925c
mov edx, dword [ebp - 4]
call fcn.004059c0
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040c9e8
test eax, eax
sete byte [ebp - 0x169]
jmp 0x5f91db
test byte [ebp - 0x158], 0x10
jne 0x5f9178
push dword [ebp - 4]
push 0x5f926c
push dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405a34
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040c93c
test eax, eax
jne 0x5f9168
mov eax, dword [ebp - 8]
call fcn.00405b74
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x16a], al
jmp 0x5f916f
mov byte [ebp - 0x16a], 0
movzx ebx, byte [ebp - 0x16a]
jmp 0x5f91c7
mov eax, dword [ebp - 0x154]
mov edx, 0x5f9278
call fcn.00405ac0
je 0x5f91c7
mov eax, dword [ebp - 0x154]
mov edx, 0x5f9284
call fcn.00405ac0
je 0x5f91c7
push dword [ebp - 4]
push 0x5f926c
push dword [ebp - 0x154]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00405a34
mov eax, dword [ebp - 0x174]
call fcn.005f909c
mov ebx, eax
lea eax, [ebp - 0x168]
call fcn.0040ca38
test eax, eax
sete byte [ebp - 0x169]
test byte [ebp - 0x169], bl
jne 0x5f911a
lea eax, [ebp - 0x168]
call fcn.0040ca5c
test bl, bl
je 0x5f9202
mov eax, dword [ebp - 4]
call fcn.0040cd80
test al, al
jne 0x5f9206
xor eax, eax
jmp 0x5f9208
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f924d
lea eax, [ebp - 0x174]
mov edx, 2
call fcn.004056a8
lea eax, [ebp - 0x168]
mov edx, dword [0x40a7d8]
call fcn.00406568
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056a8
ret
Function at 0x5ffc60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x18], 1
je 0x5ffc7a
mov edi, 0x8000ffff
jmp 0x5ffd2d
cmp dword [esi + 4], 0
jne 0x5ffc8a
mov edi, 0x80004003
jmp 0x5ffd2d
test ebx, ebx
jne 0x5ffc98
mov edi, 0x80070057
jmp 0x5ffd2d
cmp dword [ebx + 0x18], 0
jne 0x5ffcb4
cmp byte [esi + 0x15], 0
je 0x5ffcad
lea eax, [ebx + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov edi, 1
jmp 0x5ffd2d
cmp byte [esi + 0x15], 0
je 0x5ffcf6
push esp
call sub.kernel32.dll_QueryPerformanceCounter_1
push 0
push 0x989680
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
call fcn.00406a68
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
fild qword [esp + 8]
fild qword [esi + 8]
fdivp st(1)
call fcn.00403610
add dword [ebx + 0x10], eax
adc dword [ebx + 0x14], edx
mov eax, dword [ebx + 0x18]
push eax
push 0
push dword [ebx + 0x14]
push dword [ebx + 0x10]
movzx eax, word [ebx]
dec eax
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
mov edi, eax
lea eax, [ebx + 0x18]
call fcn.00407660
cmp byte [esi + 0x15], 0
je 0x5ffd2d
mov eax, dword [esp]
mov dword [ebx + 8], eax
mov eax, dword [esp + 4]
mov dword [ebx + 0xc], eax
mov eax, edi
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x600cc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [0x69098c]
cmp dword [eax], 0
je 0x600e76
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x68fa18]
cmp eax, 0x12c
jb 0x600e76
call sub.kernel32.dll_GetTickCount_1
mov dword [0x68fa18], eax
mov eax, dword [0x69098c]
mov eax, dword [eax]
call fcn.005cbbc8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x600e6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x69212c]
cmp dword [eax], 0
je 0x600da1
mov eax, dword [0x69212c]
mov eax, dword [eax]
call fcn.0056f1bc
dec eax
test eax, eax
jl 0x600da1
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x600d81
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0041ea90
mov esi, eax
mov eax, dword [0x69212c]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0065ea4c
cmp esi, dword [eax + 0x1b0]
jne 0x600d7d
mov byte [ebp - 9], 1
jmp 0x600d81
inc edi
dec ebx
jne 0x600d54
mov eax, dword [0x69212c]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0065ea4c
movzx edx, byte [ebp - 9]
call fcn.0056e2a8
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x600d42
call fcn.0061dad8
test al, al
je 0x600e59
call fcn.004d9cdc
cmp byte [eax + 0x1d9], 0
je 0x600dcc
call fcn.0061da94
mov eax, dword [eax + 0x3b4]
mov dword [ebp - 0x10], eax
jmp 0x600dda
call fcn.0061da94
mov eax, dword [eax + 0x2d0]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x600e59
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x600e59
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041ea90
test eax, eax
je 0x600e51
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x600e3d
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0041ea90
mov esi, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041ea90
cmp esi, dword [eax + 8]
jne 0x600e39
mov byte [ebp - 9], 1
jmp 0x600e3d
inc edi
dec ebx
jne 0x600e17
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041ea90
movzx edx, byte [ebp - 9]
call fcn.00631df4
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0x600df6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600e76
mov eax, dword [ebp - 4]
call fcn.00404748
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60a470
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, dword [ebp + 8]
test bl, bl
je 0x60a486
add eax, 0x10
mov dword [ebp - 0xc], eax
jmp 0x60a48c
add eax, 0xc
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0xc]
sub eax, dword [edx]
cmp eax, 0x78
jb 0x60a540
call fcn.0061da94
cmp byte [eax + 0x2e7], 0
je 0x60a540
call fcn.00658bb0
test eax, eax
je 0x60a536
lea eax, [ebp - 8]
push eax
call fcn.0065f310
mov edx, dword [eax]
call dword [edx + 0x108]
push eax
call fcn.00658bb0
lea ecx, [ebp - 4]
movzx edx, bl
mov edx, dword [edx*4 + 0x68fa54]
call fcn.0065c88c
xor eax, eax
push ebp
push 0x60a52f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x60a513
cmp dword [ebp - 8], 0
jle 0x60a513
movzx eax, bl
movzx eax, byte [eax + 0x68fa5c]
movzx ecx, word [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.005afb2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60a536
cmp dword [ebp - 4], 0
je 0x60a52e
mov eax, dword [ebp - 4]
call fcn.00402fe4
ret
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x610624
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
push 1
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
sete al
mov byte [ebx + 0xc], al
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
cmp byte [ebx + 0xc], 0
je 0x61066c
lea edx, [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x20]
test al, al
je 0x61066c
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x24]
jmp 0x610673
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x6175b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6176e0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004975d8
test al, al
je 0x6176ca
call fcn.004d9cdc
cmp dword [eax + 0x508], 0
je 0x6176ca
mov eax, dword [0x690930]
cmp byte [eax], 0
jne 0x617641
inc dword [0x68fac8]
cmp dword [0x68fac8], 1
jg 0x617610
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x68facc]
cmp eax, 0x7530
jae 0x617623
mov ecx, 0x6176f4
mov dl, 3
mov al, 2
call fcn.0051d8c0
jmp 0x6176ca
call sub.kernel32.dll_GetTickCount_1
mov dword [0x68facc], eax
call fcn.005df0dc
test al, al
je 0x6176ca
xor eax, eax
mov dword [0x68fac8], eax
mov eax, dword [0x690930]
cmp byte [eax], 0
je 0x6176ca
cmp byte [0x68fac4], 0
jne 0x6176ca
cmp dword [0x68fac0], 0
je 0x617677
call fcn.004d9cdc
mov edx, dword [eax + 0x380]
mov eax, dword [0x68fac0]
add eax, 0x60
call fcn.00405938
jmp 0x6176b9
call fcn.004d9cdc
mov edx, dword [eax + 0x380]
lea eax, [ebp - 4]
call fcn.00405938
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x59d150]
call fcn.0059d258
mov dword [0x68fac0], eax
mov eax, dword [0x68fac0]
mov dword [eax + 0x14], 0x32
mov eax, dword [0x68fac0]
mov dword [eax + 0x54], ebx
mov dword [eax + 0x50], 0x617738
mov eax, dword [0x68fac0]
call fcn.0059d390
mov byte [0x68fac4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6176e7
lea eax, [ebp - 4]
call fcn.00405684
ret

Function at 0x6196a4
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov eax, ebx
add al, 0xdf
sub al, 8
jb 0x6196c9
add al, 0xfc
sub al, 2
jb 0x6196c9
sub al, 0x72
je 0x6196c9
sub al, 2
je 0x6196c9
sub al, 2
jne 0x6196d0
mov eax, 1
jmp 0x6196d2
xor eax, eax
cmp byte [esp], 0
jne 0x6196dd
lea edi, [eax + 2]
jmp 0x6196df
mov edi, eax
push edi
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
mov ecx, eax
movzx edx, bl
mov eax, esi
call fcn.0061961c
movzx eax, bl
movzx edx, byte [esp]
mov byte [esi + eax + 0x3dddc], dl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x61c9c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
mov byte [ebp - 0x10d], dl
mov byte [ebp - 0x10e], 2
xor edx, edx
mov dword [ebp - 0x108], edx
mov edx, dword [eax + 0x44e86c]
imul edx, ecx
add edx, dword [ebp + 8]
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], 8
xor esi, esi
mov edx, dword [ebp - 0x118]
add edx, esi
mov ecx, dword [eax + 0x44e888]
mov ebx, dword [ecx + edx*4]
mov edx, dword [ebp - 0x108]
mov dword [ebp + edx*4 - 0x104], ebx
xor ecx, ecx
jmp 0x61ca2b
inc ecx
cmp ebx, dword [ebp + ecx*4 - 0x104]
jne 0x61ca2a
cmp ecx, dword [ebp - 0x108]
jl 0x61ca54
inc dword [ebp - 0x108]
mov edx, dword [eax + 0x40e848]
cmp edx, dword [ebp - 0x108]
jl 0x61cb39
inc esi
cmp esi, 8
jne 0x61ca08
mov edx, dword [eax + 0x44e86c]
add dword [ebp - 0x118], edx
dec dword [ebp - 0x114]
jne 0x61ca06
cmp dword [ebp - 0x108], 1
jne 0x61cab3
cmp dword [eax + 0x40e85c], 3
jl 0x61ca8c
mov byte [ebp - 0x10e], 3
jmp 0x61cb39
cmp byte [ebp - 0x10d], 0
je 0x61caa7
movzx eax, byte [ebp - 0x10d]
mov byte [ebp - 0x10e], al
jmp 0x61cb39
mov byte [ebp - 0x10e], 2
jmp 0x61cb39
emms
movq mm7, qword [0x68fae0]
lea eax, [ebp - 0x104]
movd mm0, dword [eax]
punpcklbw mm0, mm0
pxor mm0, mm7
mov ecx, dword [ebp - 0x108]
dec ecx
lea eax, [ebp + ecx*4 - 0x104]
movd mm1, dword [eax]
punpcklbw mm1, mm1
pxor mm1, mm7
psubusb mm1, mm0
paddb mm0, mm1
dec ecx
jne 0x61cad2
movq mm1, mm0
psllq mm1, 8
paddb mm0, mm1
pand mm0, mm7
psrlq mm0, 8
movq mm1, mm0
psrlq mm1, 0x10
paddw mm0, mm1
psrlq mm1, 0x10
paddw mm0, mm1
movd eax, mm0
and eax, 0xffff
add eax, 3
mov dword [ebp - 0x10c], eax
emms
cmp dword [ebp - 0x10c], 0x3b
jg 0x61cb32
mov byte [ebp - 0x10e], 2
jmp 0x61cb39
mov byte [ebp - 0x10e], 1
movzx eax, byte [ebp - 0x10e]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x625894
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
push 0
mov eax, edi
call fcn.00467e90
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, edi
call fcn.00467e90
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
test bl, bl
je 0x6258c7
or esi, 0x40000
jmp 0x6258cd
and esi, 0xfffbffff
push esi
push 0xffffffffffffffec
mov eax, edi
call fcn.00467e90
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, edi
call fcn.00467e90
push eax
call sub.user32.dll_ShowWindow
pop edi
pop esi
pop ebx
ret

Function at 0x6261c4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x626252
xor eax, eax
push ebp
push 0x62624b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
jne 0x6261fa
call fcn.004050a8
jmp 0x626252
push 0xd
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
jne 0x62620e
call fcn.004050a8
jmp 0x626252
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
mov eax, esi
call fcn.00496e20
inc eax
add eax, eax
call fcn.00402fc8
mov dword [ebp - 4], eax
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00496e14
push ebx
call sub.kernel32.dll_GlobalUnlock
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626252
call sub.user32.dll_CloseClipboard
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x62638c
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x626472
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x62645c
xor eax, eax
push ebp
push 0x626455
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x626442
mov eax, ebx
dec eax
sub ax, 0x10
jae 0x6263f5
lea eax, [ebp - 4]
movzx edx, bx
mov edx, dword [edx*4 + 0x68fb10]
call fcn.0040571c
jmp 0x62641d
push 0x200
lea eax, [ebp - 0x205]
push eax
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardFormatNameA
lea eax, [ebp - 4]
lea edx, [ebp - 0x205]
mov ecx, 0x200
call fcn.00405904
mov eax, dword [ebp - 4]
mov edx, 0x62648c
call fcn.00405ac0
jne 0x626432
mov byte [ebp - 5], 0
jmp 0x626442
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x6263d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62645c
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x626479
lea eax, [ebp - 4]
call fcn.00405684
ret