joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4292
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x6a4], edi
je 0x4e42fc
cmp dword [ebp + 8], 0x100
jne 0x4e42eb
cmp word [ebp + 0xc], 0xd
jne 0x4e42eb
cmp byte [esi + 0x6aa], 0
je 0x4e42d2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4e42eb
cmp byte [esi + 0x6ab], 0
jne 0x4e42eb
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x4e42e7
push edi
push edi
push edi
push str.return
push esi
call fcn.004db377
xor eax, eax
jmp 0x4e42ff
mov eax, dword [esi + 0x6a4]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4e46a5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5bc324]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4e475f
movzx eax, word [esi]
test ax, ax
je 0x4e475f
push edi
mov edi, esi
mov ecx, esi
mov edx, eax
cmp dx, 0x2f
je 0x4e46e7
cmp dx, 0x5c
jne 0x4e46e9
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4e46db
cmp edi, esi
je 0x4e4732
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4e476d
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004e46a5
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy
lea eax, [ebp - 0x414]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00523a6a
leave
ret
call fcn.0052474c
int3

Function at 0x4e5051
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4e50cd
cmp dword [edi + 4], 0xffffffff
jne 0x4e50cd
push esi
lea esi, [edi + 0x140]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x5914bc
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4e509f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4e509f
mov eax, 0x2000000
jmp 0x4e50d2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e76f8
add esp, 0x10
test eax, eax
jne 0x4e50bd
mov eax, dword [ebp - 4]
jmp 0x4e50d2
push eax
call fcn.004e7f83
mov dword [edi], eax
mov eax, dword [0x5c1b38]
pop ecx
jmp 0x4e50d2
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x4e55ff
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x57a0a8]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
mov dword [edx + 8], ecx
pop ebp
ret

Function at 0x4e7805
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4e7838
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e7833
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4e7862
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x4e79f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4e79fe
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4e7abd
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
sub edi, 1
jne 0x4e7a16
pop edi
test esi, esi
je 0x4e7ad9
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x57a0a8]
inc edx
sub esi, 1
jne 0x4e7ac1
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4fbec4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x4fbef2
cmp eax, edi
jge 0x4fbee6
push esi
call fcn.004f6fee
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x4fbf15
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4fbefb
mov dword [esi + 8], edx
jmp 0x4fbf2a
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4fbf20
xor dl, dl
jmp 0x4fbf25
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4fbf15
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4fbf64
push str.zlib_corrupt
call fcn.004f6f20
add esp, 4
jmp 0x4fbfa4
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4fbf74
push str.read_past_buffer
jmp 0x4fbf5a
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4fbf8e
push edi
push ecx
push esi
call fcn.004ff760
add esp, 0xc
test eax, eax
je 0x4fbfa4
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x50036b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x500391
push 0
call fcn.004dcb5e
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 1
call fcn.004dcd65
and dword [esi + 4], 0
pop esi
ret
Function at 0x500d0f
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x1c8
mov eax, 0x56f86f
call fcn.00523ae6
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.005010c3
call fcn.004d8c70
push eax
lea ecx, [ebp - 0x98]
call fcn.004d53c2
and dword [ebp - 4], 0
call fcn.004d8c76
mov ecx, eax
call fcn.004d5ed5
test al, al
jne 0x500e4f
call fcn.004d8c76
push eax
lea ecx, [ebp - 0x98]
call fcn.004d57eb
call fcn.004d8d8f
test al, al
je 0x500d72
call fcn.004d8c7c
jmp 0x500d8a
push 2
push 0
lea ecx, [ebp - 0x98]
call fcn.004d5d57
push eax
call fcn.004e516a
add esp, 0xc
mov edi, eax
test edi, edi
je 0x500e4f
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d0]
push eax
push 1
push ebx
push edi
call fcn.004e47f7
add esp, 0x14
test eax, eax
jne 0x500e4f
mov ebx, dword [ebp - 0x9c]
test ebx, ebx
jne 0x500dc6
push ebx
jmp 0x500ed2
cmp ebx, 0x400000
jbe 0x500dd5
push 0
jmp 0x500ee2
push ebx
call fcn.00523cdd
push 3
push ebx
push eax
push dword [ebp - 0x1d0]
mov dword [ebp - 0x1c8], eax
push edi
call fcn.004e55c7
add esp, 0x18
test eax, eax
je 0x500e27
cmp eax, 0x600
je 0x500e27
push dword [ebp - 0x1c8]
call fcn.00523ce6
pop ecx
call fcn.004d8d8f
test al, al
jne 0x500e1b
push edi
call fcn.004e4647
pop ecx
push 0
push str.Could_not_unzip_file
jmp 0x500f3e
call fcn.004d8d8f
test al, al
jne 0x500e37
push edi
call fcn.004e4647
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x1c8]
mov ecx, esi
push ebx
push edi
call fcn.00500f78
push edi
jmp 0x500f5b
push ebx
lea ecx, [ebp - 0x98]
call fcn.004d586e
push 0
push 0x80
push 3
push 0
push 1
push accept
lea ecx, [ebp - 0x98]
call fcn.004d5703
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call edi
mov dword [ebp - 0x1c8], eax
cmp eax, 0xffffffff
jne 0x500ec1
push ebx
lea ecx, [ebp - 0x98]
call fcn.004d565e
push 0
push 0x80
push 3
push 0
push 1
push accept
push ebx
call edi
mov dword [ebp - 0x1c8], eax
cmp eax, 0xffffffff
jne 0x500ec1
push 0
push str.Error_opening_file
jmp 0x500f3e
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x500ed9
push ebx
push str.File_is_empty
jmp 0x500f3e
cmp edi, 0x400000
jbe 0x500ee9
push ebx
push str.File_too_large
jmp 0x500f3e
push edi
mov dword [ebp - 0x1cc], ebx
call fcn.00523cdd
pop ecx
mov ebx, eax
lea eax, [ebp - 0x1cc]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x1c8]
mov dword [ebp - 0x1d4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x1c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1cc], edi
je 0x500f49
push ebx
call fcn.00523ce6
pop ecx
mov ecx, esi
call fcn.005010c3
push 0
push str.Could_not_read_file
mov ecx, esi
call fcn.005010fb
mov bl, al
jmp 0x500f63
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.00500f78
push dword [ebp - 0x1d4]
mov bl, al
call fcn.00523ce6
pop ecx
lea ecx, [ebp - 0x98]
call fcn.004d5536
mov al, bl
call fcn.00523a90
ret 8
Function at 0x50d5e1
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x6c4
jmp method.DuiLib::CListUI.virtual_284

Function at 0x50fed6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x10
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
lea edi, [esi - 0x6c4]
mov ebx, eax
mov edx, dword [edi]
mov ecx, edi
and ebx, 0x8000
call dword [edx + 0xe4]
test al, al
je 0x50ff31
cmp byte [ebp + 0xc], 0
mov al, byte [ebp + 8]
mov byte [esi + 0xc], al
je 0x50ff28
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x50ff28
mov eax, dword [ecx]
push 0
push dword [esi + 4]
test ebx, ebx
je 0x50ff25
call dword [eax + 0x10]
jmp 0x50ff28
call dword [eax + 8]
mov ecx, edi
call fcn.0050f63c
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x510038
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, 0x8000
push edi
mov dword [ebp - 8], esi
cmp byte [esi + 4], 0
je 0x5100bc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
jne 0x5100bc
lea edi, [esi - 0x54]
xor ebx, ebx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
jle 0x5100b8
mov esi, dword [ebp + 8]
cmp ebx, esi
je 0x5100a9
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax]
test eax, eax
je 0x5100a9
mov edx, dword [eax]
mov ecx, eax
push str.ListItem
call dword [edx + 0x14]
mov dword [ebp - 4], eax
test eax, eax
je 0x5100a9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test al, al
je 0x5100a9
mov ecx, dword [ebp - 4]
push 0
push 0
mov eax, dword [ecx]
call dword [eax + 0x14]
mov eax, dword [edi]
mov ecx, edi
inc ebx
call dword [eax + 0xc]
cmp ebx, eax
jl 0x510070
mov esi, dword [ebp - 8]
or dword [esi + 0xc], 0xffffffff
mov eax, dword [esi + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp ebx, eax
je 0x51017e
test ebx, ebx
js 0x51013d
lea ecx, [esi - 0x54]
mov eax, dword [ecx]
push ebx
call dword [eax]
mov edi, eax
test edi, edi
je 0x51013d
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xd8]
test al, al
je 0x51013d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xe4]
test al, al
je 0x51013d
mov eax, dword [edi]
mov ecx, edi
push str.ListItem
call dword [eax + 0x14]
mov dword [ebp + 8], eax
test eax, eax
je 0x51013d
cmp byte [esi + 4], 0
mov dword [esi + 0xc], ebx
je 0x510141
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x510141
mov ecx, dword [ebp + 8]
push 0
push 1
mov eax, dword [ecx]
call dword [eax + 0x14]
test al, al
jne 0x510141
or dword [esi + 0xc], 0xffffffff
xor al, al
jmp 0x510180
push dword [esi + 0xc]
lea ebx, [esi - 0x6c4]
mov ecx, ebx
call fcn.0050e4e7
cmp byte [ebp + 0xc], 0
je 0x510161
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
mov ecx, dword [esi - 0x674]
test ecx, ecx
je 0x51017e
push 0
push dword [ebp - 8]
push dword [esi + 0xc]
push str.itemselect
push ebx
call fcn.004db377
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x51770a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5bc324]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
je 0x517777
cmp dword [esi + 0x18], 0
je 0x517777
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00523b90
mov ebx, esp
test ebx, ebx
je 0x517777
push edi
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x18]
push ebx
add ecx, 0x1d4
call fcn.004d565e
mov ecx, dword [esi + 0x18]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x20]
mov ecx, eax
call fcn.004db377
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00523a6a
leave
ret 0x10

Function at 0x51a024
Capabilities:
Hide graphical window

Disassembly:
push 0xa0
mov eax, 0x570aea
call fcn.00523ae6
mov edi, ecx
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x18], eax
mov dword [eax + 0x78c], ebx
cmp dword [edi + 0xc], ebx
jne 0x51a0b6
lea eax, [ebp - 0xac]
push eax
call fcn.00519d1c
mov ecx, dword [edi + 0x18]
lea esi, [ebp - 0xac]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d8c45
mov edi, dword [ebp - 0x9c]
mov ecx, edi
push eax
call fcn.004dcf2d
mov esi, dword [edi + 0x18]
mov ecx, esi
call fcn.00503c5b
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d87d2
push 1
push dword [eax]
push 0x30
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x18]
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004d5ed5
lea ecx, [ebp - 0x98]
mov bl, al
call fcn.004d5536
mov esi, 0x77c
test bl, bl
je 0x51a0f1
mov eax, dword [edi + 0x18]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x18]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x20], 1
call fcn.00523a90
ret 4
Function at 0x51ff08
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5bc324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
and dword [eax + 0x350], 0
mov dword [ebp - 0x50], eax
mov dword [eax + 0x34c], ebx
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0051f9cc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
mov esi, eax
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x68]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
add eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
test esi, esi
jle 0x51ff70
mov eax, dword [ebp - 0x14]
add eax, esi
mov dword [ebp - 0xc], eax
push 2
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d8c45
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push 1
mov dword [ebp - 0x4c], 0x28
call fcn.004dcb5e
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x24]
call fcn.004d5322
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jle 0x52001b
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
test esi, esi
jle 0x51ffe4
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x54]
sub eax, ecx
cmp eax, edx
mov dword [ebp - 8], ecx
push 2
cmovl edx, eax
mov eax, ecx
sub eax, edx
mov ecx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
push 0
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d8c45
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebx]
lea esi, [ebp - 0x14]
push 0
sub esp, 0x10
mov ecx, ebx
mov edi, esp
push 0x80
movsd dword es:[edi], dword [esi]
push accept
push 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d8c45
mov ebx, dword [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.004dcf2d
mov esi, dword [ebx + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x52005e
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x520059
push 5
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00523a6a
leave
ret 4
Function at 0x520c82
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5bc324]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x210], edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
shl esi, 0x10
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x103
push eax
cmove ecx, esi
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004d53e7
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00523a6a
leave
ret 0xc

Function at 0x520d1c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5bc324]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop esi
jne 0x520db8
cmp dword [ebp - 0x114], 5
jne 0x520d80
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jne 0x520d7c
push 2
pop eax
jmp 0x520dd4
push 3
jmp 0x520d79
cmp dword [ebp - 0x114], 6
mov eax, dword [ebp - 0x110]
jne 0x520d97
test eax, eax
jne 0x520d99
push 4
jmp 0x520d79
jb 0x520dd4
cmp eax, 1
jne 0x520da2
push 5
jmp 0x520d79
cmp eax, 2
jne 0x520dd4
call fcn.00521189
xor ecx, ecx
test al, al
setne cl
lea eax, [ecx + 6]
jmp 0x520dd4
cmp dword [ebp - 0x108], 1
jne 0x520dd4
cmp dword [ebp - 0x114], 4
jne 0x520dd4
cmp dword [ebp - 0x110], 0x5a
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00523a6a
leave
ret
Function at 0x521071
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x57118b
call fcn.00523ae6
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x18], eax
test eax, eax
je 0x521181
lea eax, [ebp - 0xa8]
push eax
call fcn.00520781
mov ecx, dword [ebx + 0x18]
lea esi, [ebp - 0xa8]
xor eax, eax
push eax
sub esp, 0x10
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d8c45
push eax
mov ecx, ebx
call fcn.004dcf2d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x521181
mov esi, dword [ebx + 0x18]
mov ecx, esi
call fcn.00503c5b
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov ecx, eax
call fcn.004d87d2
push 1
push dword [eax]
push 0x30
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x18]
movzx eax, word [ecx + 0x9aa]
push eax
movzx eax, word [ecx + 0x9a8]
mov ecx, ebx
push eax
call fcn.005216a1
lea eax, [ebp - 0x98]
mov ecx, ebx
push eax
call fcn.00520a6b
mov ecx, dword [ebx + 0x18]
and dword [ebp - 4], 0
add ecx, 0x1d4
push eax
call fcn.004d55d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004d5536
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xe4]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x20], 1
call fcn.00523a90
ret 4