joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5575e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [0x557508]
call fcn.004078d0
xor eax, eax
push ebp
push 0x5576ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x5574bc]
call fcn.004084c4
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x557540
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x14]
call fcn.00408310
test eax, eax
jne 0x55764a
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x557692
mov eax, dword [ebp - 0x14]
call fcn.00408318
test eax, eax
jl 0x55768a
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x557682
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
jmp 0x557692
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x557661
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5576b5
lea eax, [ebp - 0x18]
mov edx, dword [0x557508]
call fcn.004079a8
ret

Function at 0x55d390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.0042b000
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
mov edx, 0x10
call fcn.0042b000
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407214
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x55d407
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x57a860
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x57a868
push ecx
xor eax, eax
push ebp
push 0x57aa52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xb8]
cmp edx, 0
jne 0x57a89d
cmp eax, 0x80000000
ja 0x57a8a3
jmp 0x57aa2a
jle 0x57aa2a
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041d9c0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x57aa6c
call fcn.00407404
lea eax, [ebp - 8]
mov edx, 0x105
call fcn.0040732c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00406ae4
push eax
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x57a96d
push 0x57aa7c
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 4
call fcn.0047a100
push dword [ebp - 0x28]
push 0x57aadc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x98]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040748c
mov edx, dword [ebp - 0x24]
mov eax, dword [0x5dfa4c]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f350
jmp 0x57aa2a
mov eax, dword [ebp - 8]
call fcn.00407214
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040726c
mov edx, 0x57ab0c
mov eax, dword [ebp - 8]
call fcn.00428210
test eax, eax
jne 0x57a9a0
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x57a9f0
mov edx, 0x57ab24
mov eax, dword [ebp - 8]
call fcn.00428210
test eax, eax
jne 0x57a9c1
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x57a9f0
mov edx, 0x57ab38
mov eax, dword [ebp - 8]
call fcn.00428210
test eax, eax
jne 0x57a9e2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
jmp 0x57a9f0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x57a9fe
cmp dword [ebp - 0x10], 0
jbe 0x57aa2a
jmp 0x57aa00
jle 0x57aa2a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xb8]
cmp edx, dword [ebp - 0xc]
jne 0x57aa1a
cmp eax, dword [ebp - 0x10]
jbe 0x57aa2a
jmp 0x57aa1c
jle 0x57aa2a
mov eax, dword [ebp + 8]
add eax, 0xffffffdc
mov edx, dword [ebp - 4]
call fcn.00406a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57aa59
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00406670
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406670
ret
Function at 0x58b3e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 9], 0
test byte [ebp - 4], 1
je 0x58b429
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b45f
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b45f
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x58b563
jmp 0x58b45f
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
test byte [ebp - 4], 2
je 0x58b495
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b4cb
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b4cb
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x58b563
jmp 0x58b4cb
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
test byte [ebp - 4], 4
je 0x58b4fd
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b527
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b527
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x58b563
jmp 0x58b527
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
test byte [ebp - 4], 8
je 0x58b547
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b55f
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x58b563
jmp 0x58b55f
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x58b563
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x58b760
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.user32.dll_GetShellWindow
cmp eax, dword [ebp - 4]
je 0x58b788
push 0
push 0x58b794
call sub.user32.dll_FindWindowW
cmp eax, dword [ebp - 4]
je 0x58b788
xor eax, eax
jmp 0x58b78a
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x594fe0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 5], 0
push 0x595248
push 0x595258
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040b470
mov dword [ebp - 4], eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x595027
push ebp
mov eax, 0x59527c
call fcn.00594ee0
pop ecx
jmp 0x595240
xor eax, eax
push ebp
push 0x595239
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 1
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0xffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x595061
push ebp
mov eax, 0x5952d0
call fcn.00594ee0
pop ecx
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
call fcn.0042b000
mov word [ebp - 0x2c], 2
push 0x595310
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x5950b0
push ebp
mov eax, 0x595328
call fcn.00594ee0
pop ecx
call fcn.00405dfc
jmp 0x595240
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_getsockname
inc eax
jne 0x5950da
push ebp
mov eax, 0x595364
call fcn.00594ee0
pop ecx
call fcn.00405dfc
jmp 0x595240
push 0x595310
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
push 0x7fffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_listen
inc eax
jne 0x59510e
push ebp
mov eax, 0x5953b0
call fcn.00594ee0
pop ecx
call fcn.00405dfc
jmp 0x595240
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x595138
push ebp
mov eax, 0x595400
call fcn.00594ee0
pop ecx
call fcn.00405dfc
jmp 0x595240
xor eax, eax
push ebp
push 0x59520c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x595175
push ebp
mov eax, 0x595450
call fcn.00594ee0
pop ecx
call fcn.00405dfc
call fcn.00405dfc
jmp 0x595240
push ebp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00594ea0
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x5951a7
push ebp
mov eax, 0x595490
call fcn.00594ee0
pop ecx
call fcn.00405dfc
call fcn.00405dfc
jmp 0x595240
xor eax, eax
push ebp
push 0x5951df
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5951e6
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_closesocket
inc eax
jne 0x5951de
push ebp
mov eax, 0x5954cc
call fcn.00594ee0
pop ecx
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x5955c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59573e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 1
mov eax, dword [ebp - 8]
call fcn.0042c290
mov dl, 1
mov eax, dword [0x427200]
call fcn.00405008
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x595714
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59575c
mov cl, byte [0x595760]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0042adc0
mov eax, dword [ebp - 0x14]
call fcn.0042cca0
dec eax
test eax, eax
jl 0x5956fe
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042ca50
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00406ae4
mov edx, eax
inc edx
mov ecx, 0x7fffffff
pop eax
call fcn.004075d4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00407404
push 1
mov eax, dword [ebp - 0x18]
call fcn.00407214
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042ca50
mov eax, dword [ebp - 0x28]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
jne 0x5956f2
mov byte [ebp - 0xa], 0
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042ca50
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x595770
call fcn.00407404
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x5dfa4c]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f350
cmp byte [ebp - 9], 0
je 0x5956f2
call fcn.00405dfc
jmp 0x59571b
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x59564d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59571b
mov eax, dword [ebp - 0x14]
call fcn.00405038
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x595745
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00406670
lea eax, [ebp - 0x18]
call fcn.00406610
ret
Function at 0x599890
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x599949
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0042ca50
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.0042bfa0
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041d1b8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
lea eax, [ebp - 8]
call fcn.00407404
push 1
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x59991c
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x59992e
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599950
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406670
ret
Function at 0x5a1370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5a1388
add esp, 0xfffffff0
call fcn.004052fc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a1435
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x24
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a70
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x7c
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a70
mov eax, dword [ebp - 4]
add eax, 0x78
mov edx, dword [ebp + 8]
call fcn.00406a70
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047acc0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059e2b0
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a143c
lea eax, [ebp - 0x10]
call fcn.00406634
ret

Function at 0x5a19f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5a1a08
add esp, 0xfffffff0
call fcn.004052fc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a1ac5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x24
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a70
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x80
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a70
mov eax, dword [ebp - 4]
lea edx, [eax + 0x7c]
mov eax, dword [ebp + 8]
call fcn.00409d78
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
call fcn.005a1e80
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047acc0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059e2b0
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a1acc
lea eax, [ebp - 0x10]
call fcn.00406634
ret
Function at 0x5a1ef0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a2055
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5a203a
test byte [ebp - 0x10], 1
je 0x5a203a
push 0x5a2070
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041d1b8
push dword [ebp - 0x18]
push 0x5a20cc
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040748c
mov eax, dword [ebp - 0x14]
push eax
call fcn.005bcc20
xor ecx, ecx
pop edx
call fcn.0043f350
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
test byte [ebp - 0x10], 1
jne 0x5a1ff1
cmp byte [0x5df2e9], 0
jne 0x5a1fce
mov byte [0x5df2e9], 1
push 0
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x5e0088]
mov eax, dword [eax]
mov edx, 0x7d
call fcn.0055a0e0
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x5a20e8
call fcn.00407404
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005bcc20
xor ecx, ecx
pop edx
call fcn.0043f8a0
jmp 0x5a203a
cmp byte [0x5df2e8], 0
jne 0x5a2019
mov byte [0x5df2e8], 1
push 0
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x5e0088]
mov eax, dword [eax]
mov edx, 0x7e
call fcn.0055a0e0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x5a2144
call fcn.00407404
mov eax, dword [ebp - 0x20]
push eax
call fcn.005bcc20
xor ecx, ecx
pop edx
call fcn.0043f350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a205c
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406670
ret
Function at 0x5a86f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a87fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004288c0
mov eax, dword [0x5df3b0]
call fcn.0042cca0
dec eax
cmp eax, 0
jl 0x5a87e2
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5df3b0]
call fcn.0042ca50
mov byte [ebp - 0x19], 0
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0x14]
call fcn.00407740
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jl 0x5a87d5
cmp byte [ebp - 0x19], 0
jne 0x5a87ad
mov byte [ebp - 0x19], 1
lea eax, [ebp - 0x18]
mov edx, 0x105
call fcn.0040732c
mov eax, dword [ebp - 0x18]
call fcn.00407214
push eax
push 0
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5df3b0]
call fcn.0042cb00
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x5a87a5
lea eax, [ebp - 0x18]
call fcn.0042b480
jmp 0x5a87ad
lea eax, [ebp - 0x18]
call fcn.00406610
mov eax, dword [ebp - 0x14]
call fcn.00406ae4
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.0040761c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.00407680
jmp 0x5a8748
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5a8734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8804
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406670
ret
Function at 0x5b7910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b7a3b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
add eax, 0xf8
mov ecx, 1
mov edx, dword [0x5a4fdc]
call fcn.004084c4
add esp, 4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x128]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0xf8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
add eax, 0x190
mov edx, dword [ebp - 8]
mov ecx, dword [0x4eb238]
call fcn.00407c3c
mov eax, dword [ebp - 4]
mov dx, word [0x5b7a48]
mov word [eax + 0xfc], dx
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
call fcn.00406a70
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x18]
call fcn.004069d4
mov eax, dword [ebp - 4]
add eax, 0x14
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1c]
call fcn.004069d4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
mov dword [edx + 0x134], eax
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x34]
mov edx, dword [ebp - 4]
mov byte [edx + 0x12d], al
mov eax, dword [ebp - 8]
push dword [eax + 0x2c]
push dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xbc]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x14]
call fcn.004f3d60
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x138
call fcn.00406a70
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, 0x5b7a58
call fcn.004069d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7a42
lea eax, [ebp - 0xc]
call fcn.00406634
ret

Function at 0x5bcca0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2c
jne 0x5bccc7
mov eax, dword [ebp - 8]
mov edx, 0x5bcd60
call fcn.004069d4
jmp 0x5bcd50
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetKeyboardLayout
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyExW
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0x21
jbe 0x5bccf7
cmp dword [ebp - 4], 0x2f
jae 0x5bccf7
or dword [ebp - 0xc], 0x1000000
cmp dword [ebp - 4], 0x90
jne 0x5bcd07
mov dword [ebp - 0xc], 0xc1450001
cmp dword [ebp - 4], 0x13
jne 0x5bcd14
mov dword [ebp - 0xc], 0xc0450001
cmp dword [ebp - 0xc], 0
je 0x5bcd50
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5bcd48
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.004072c0
jmp 0x5bcd50
mov eax, dword [ebp - 8]
call fcn.00406610
mov esp, ebp
pop ebp
ret