joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61fbb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 7], cx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61fde0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6737ec], 0
je 0x61fbed
mov word [ebp - 0xa], 2
jmp 0x61fdc5
call fcn.0048c8fc
test eax, eax
je 0x61fc3c
mov eax, dword [0x66f994]
cmp dword [eax], 0
je 0x61fc3c
mov eax, dword [0x66e8a8]
mov ax, word [eax + 0xa9]
mov word [ebp - 0xc], ax
call fcn.0052fdcc
and byte [eax + 0x14], 0xfb
test byte [ebp - 0xc], 0x80
je 0x61fc28
call fcn.0052fdcc
or byte [eax + 0x14], 4
mov eax, dword [0x66e8a8]
and word [eax + 0xa9], 0xff7f
mov byte [ebp - 0xe], 1
jmp 0x61fc40
mov byte [ebp - 0xe], 0
mov ebx, dword [0x66fd78]
mov bl, byte [ebx + 0x10]
cmp bl, 0xff
je 0x61fc62
mov eax, dword [0x66fd78]
mov eax, ebx
call fcn.006316c8
test al, al
jne 0x61fc62
xor eax, eax
jmp 0x61fc64
mov al, 1
mov ebx, eax
mov eax, dword [0x66ea7c]
mov eax, dword [eax]
mov al, byte [eax + 0x16d]
xor al, 1
test al, bl
je 0x61fc85
mov eax, dword [0x66ea7c]
mov eax, dword [eax]
call fcn.0063d224
mov eax, dword [0x66ea7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_IsWindowVisible
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
test bl, bl
je 0x61fcbb
mov al, byte [ebp - 5]
sub al, 4
jae 0x61fcbb
xor eax, eax
mov al, byte [ebp - 5]
add eax, 0x3e8
call fcn.004ab0f8
mov word [ebp - 0xa], 2
mov eax, dword [0x66ea7c]
mov eax, dword [eax]
cmp byte [eax + 0x16d], 0
je 0x61fce6
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x14]
call fcn.006569f8
jmp 0x61fd5f
xor eax, eax
push ebp
push 0x61fd42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00403438
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0061c6bc
mov edx, dword [ebp - 0x14]
mov eax, dword [0x66fd78]
call fcn.004032c8
mov eax, dword [0x66fd78]
mov dl, byte [ebp - 5]
mov byte [eax + 4], dl
mov eax, dword [0x66fd78]
mov dx, word [ebp - 7]
mov word [eax + 5], dx
call fcn.00631070
mov word [ebp - 0xa], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61fd5f
cmp byte [ebp - 0xd], 0
jne 0x61fd7a
push 0
mov eax, dword [0x66ea7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x150]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 0xe], 0
je 0x61fd99
mov eax, dword [0x66e8a8]
mov dx, word [ebp - 0xc]
mov word [eax + 0xa9], dx
call fcn.0052fdcc
and byte [eax + 0x14], 0xfb
call fcn.00506a54
test eax, eax
je 0x61fdc5
call fcn.00506b9c
call fcn.00539564
test eax, eax
je 0x61fdc5
call fcn.00539564
cmp byte [eax + 0x464], 0
je 0x61fdc5
mov byte [eax + 0x46a], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fde7
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00403298
ret

Function at 0x621554
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
push eax
push 0x621568
push 0
call sub.shell32.dll_ShellExecuteW
ret
Function at 0x621574
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x62167c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00654ea8
test al, al
je 0x621654
mov eax, dword [0x66eecc]
cmp byte [eax], 0
je 0x6215f1
mov eax, dword [0x66ec38]
cmp dword [eax], 0
jne 0x6215ca
push 0x621688
push 0x62169c
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x66ec38]
mov dword [edx], eax
mov eax, dword [0x66e9b4]
cmp dword [eax], 0
jne 0x6215f1
push 0x6216b4
push 0x62169c
call sub.kernel32.dll_LoadLibraryW
push eax
call sub.kernel32.dll_GetProcAddress
mov edx, dword [0x66e9b4]
mov dword [edx], eax
mov eax, dword [0x66ec38]
cmp dword [eax], 0
je 0x62162d
mov eax, dword [0x66e9b4]
cmp dword [eax], 0
je 0x62162d
push ebx
mov eax, dword [0x66ec38]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x621666
push 0
push 0
push 0
push ebx
mov eax, dword [0x66e9b4]
mov eax, dword [eax]
call eax
push ebx
call sub.ole32.dll_CoTaskMemFree
jmp 0x621666
push 5
push 0
lea ecx, [ebp - 4]
mov eax, 0x6216d0
mov edx, ebx
call fcn.00655bbc
mov eax, dword [ebp - 4]
push eax
push 0x6216e0
push 0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x621666
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00655234
mov eax, dword [ebp - 4]
call fcn.00621554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621683
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x6219e4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x621a61
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x621a46
mov eax, ebx
call fcn.0062195c
test al, al
jne 0x621a46
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00621b68
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00655234
mov eax, dword [ebp - 4]
call fcn.00403aa8
mov esi, eax
mov eax, ebx
call fcn.00403aa8
cmp esi, eax
jge 0x621a3e
mov eax, dword [ebp - 4]
call fcn.006219e4
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621a68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x621c2c
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
call fcn.0061bd74
mov eax, ebx
call fcn.00658f18
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_GetDiskFreeSpaceW
call fcn.0061bdd0
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x10
pop ebx
ret
Function at 0x621f8c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e18
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403e38
xor eax, eax
push ebp
push 0x62207f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621b3c
lea eax, [ebp - 0x270]
mov ecx, 0x622090
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x39
call fcn.00654fa0
test eax, eax
jne 0x62203d
test byte [ebp - 0x268], 0x10
je 0x62202e
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 8]
call fcn.00621a70
test al, al
je 0x62202e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
lea eax, [ebp - 0x26c]
call fcn.00655044
test eax, eax
je 0x621fff
lea eax, [ebp - 0x26c]
call fcn.00655068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622086
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403f00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x622098
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x622121
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x66e7e0]
cmp byte [eax], 0
jne 0x6220c9
mov eax, dword [0x66e8a8]
test byte [eax + 0xd], 0x80
je 0x6220d1
push ebx
call sub.kernel32.dll_DeleteFileW
jmp 0x62210b
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
lea eax, [ebp - 4]
mov ecx, 0x622134
mov edx, ebx
call fcn.00403b14
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x54
xor eax, eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
push eax
call sub.shell32.dll_SHFileOperationW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622128
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x622138
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
xor ecx, ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e18
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403e38
xor eax, eax
push ebp
push 0x622245
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621b3c
lea eax, [ebp - 0x270]
mov ecx, 0x622258
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x39
call fcn.00654fa0
test eax, eax
jne 0x6221fa
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b14
test byte [ebp - 0x268], 0x10
jne 0x6221e1
test bl, bl
je 0x6221d6
mov eax, dword [ebp - 8]
call fcn.00622098
jmp 0x6221eb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x6221eb
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00622138
lea eax, [ebp - 0x26c]
call fcn.00655044
test eax, eax
je 0x6221ae
lea eax, [ebp - 0x26c]
call fcn.00655068
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62224c
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403f00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x622370
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
xor ecx, ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e18
lea eax, [ebp - 8]
call fcn.00403e18
lea eax, [ebp - 0x274]
mov edx, dword [0x653000]
call fcn.00403e38
xor eax, eax
push ebp
push 0x6224f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621b3c
lea eax, [ebp - 8]
call fcn.00621b3c
lea eax, [ebp - 0x278]
mov ecx, 0x622500
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x274]
mov edx, 0x39
call fcn.00654fa0
jmp 0x62249d
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b14
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ebp - 8]
call fcn.00403b14
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x622492
test byte [ebp - 0x270], 0x10
je 0x622453
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00622370
pop ecx
jmp 0x622492
mov eax, dword [ebp + 8]
cmp byte [eax - 6], 0
jne 0x622468
mov eax, dword [ebp - 0x10]
call fcn.00654ea8
test al, al
jne 0x622492
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x622492
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0062016c
cmp ax, 2
jne 0x622468
mov eax, dword [ebp + 8]
mov byte [eax - 5], 0
lea eax, [ebp - 0x274]
call fcn.00655044
test eax, eax
jne 0x6224ae
mov eax, dword [ebp + 8]
cmp byte [eax - 5], 0
jne 0x6223fa
lea eax, [ebp - 0x274]
call fcn.00655068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6224f7
lea eax, [ebp - 0x278]
call fcn.00403880
lea eax, [ebp - 0x274]
mov edx, dword [0x653000]
call fcn.00403f00
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403898
ret
Function at 0x622508
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e18
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403e38
xor eax, eax
push ebp
push 0x622618
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00621b3c
lea eax, [ebp - 0x270]
mov ecx, 0x622628
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x270]
lea ecx, [ebp - 0x26c]
mov edx, 0x39
call fcn.00654fa0
test eax, eax
jne 0x6225d6
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc eax
je 0x6225c7
test byte [ebp - 0x268], 0x10
je 0x6225be
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00622508
pop ecx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x6225c7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x26c]
call fcn.00655044
test eax, eax
je 0x62257b
lea eax, [ebp - 0x26c]
call fcn.00655068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62261f
lea eax, [ebp - 0x270]
call fcn.00403880
lea eax, [ebp - 0x26c]
mov edx, dword [0x653000]
call fcn.00403f00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x622898
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x6228e0]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6228ae
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6228bd
or bl, 4
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6228cc
or bl, 8
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x6228db
or bl, 0x10
mov eax, ebx
pop ebx
ret

Function at 0x626328
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov word [ebp - 2], dx
push ecx
push edx
call sub.user32.dll_VkKeyScanExW
mov ebx, eax
movzx esi, bx
cmp esi, 0xffff
je 0x6263a9
lea eax, [ebp - 0x104]
mov edx, pe_nt_image_headers32
call fcn.00658ea4
mov eax, esi
shr eax, 8
test al, 1
je 0x62636c
mov byte [ebp - 0xf4], 0xff
mov edi, dword [ebp + 8]
push edi
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call sub.user32.dll_ToAsciiEx
mov ebx, eax
test bx, bx
jbe 0x6263a9
push 1
lea eax, [ebp - 2]
push eax
movzx eax, bx
push eax
lea eax, [ebp - 4]
push eax
push 1
mov eax, edi
call fcn.0065378c
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov ax, word [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6263c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x626586
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0064d630
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov edi, 1
cmp edi, 0x7f
je 0x626486
xor eax, eax
mov dword [ebp - 0xc], eax
inc dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
shl esi, 0xa
add esi, edi
push 0
push 0
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403dd4
test ebx, ebx
jle 0x626438
push ebx
mov eax, dword [ebp - 8]
push eax
push 2
push esi
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 8]
call fcn.00654ad4
cmp dword [ebp - 8], 0
je 0x626450
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.0064f61c
jmp 0x6263fc
cmp esi, 0x476
jne 0x62647c
lea edx, [ebp - 0x10]
mov eax, dword [0x66fa80]
mov eax, dword [eax]
call fcn.00654d58
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, 0x476
call fcn.0064f61c
jmp 0x626486
cmp dword [ebp - 0xc], 1
jle 0x6263fc
inc edi
cmp edi, 0x93
jne 0x6263ee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00650f38
call fcn.0048c8fc
call fcn.0048dacc
mov esi, eax
call fcn.0064e740
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov edx, 0x62659c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 8
push 0xffffffffffffffff
xor ecx, ecx
mov edx, 0x6265b0
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
test eax, eax
jge 0x626529
mov edx, dword [0x67036c]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00626800
call fcn.0052fdcc
mov esi, eax
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x18]
dec ebx
cmp ebx, 0
jl 0x626560
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
cmp byte [edi + 0x14], 0
jne 0x626510
mov eax, edi
call fcn.00522b28
cmp byte [edi + 0x14], 0
je 0x626521
mov edx, dword [edi + 0x18]
mov eax, dword [ebp - 4]
call fcn.00626800
dec ebx
cmp ebx, 0xffffffff
jne 0x6264fa
jmp 0x626560
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x626560
lea eax, [ebp - 0x14]
mov edx, ebx
add dl, 0x41
call fcn.00403418
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x67036c]
mov ecx, dword [ecx]
mov eax, esi
call fcn.00617880
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00626800
dec ebx
cmp ebx, 0xffffffff
jne 0x626531
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62658d
lea eax, [ebp - 0x14]
call fcn.00403274
lea eax, [ebp - 0x10]
call fcn.00403880
lea eax, [ebp - 8]
call fcn.00403880
ret

Function at 0x626d08
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
xor edx, edx
mov dword [esp + 4], edx
mov byte [esp], al
mov eax, esp
push eax
push 0x626cb0
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x6338cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
lea edi, [ebp - 0x14]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x633ae0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00639b3c
mov ebx, eax
mov al, byte [0x633af0]
cmp al, bl
je 0x63391c
cmp word [ebp - 0x10], 0xc
jne 0x63391c
mov word [ebp - 0x10], 0x65
cmp byte [esi + 0x138], 0
jne 0x633aa4
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jae 0x633990
cmp dword [esi + 0x13c], 0
je 0x633947
xor eax, eax
mov dword [esi + 0x13c], eax
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.0063375c
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.0063fadc
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fa54
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x633ac7
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
push 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
movzx eax, word [ebp - 0x10]
push eax
call sub.user32.dll_ToAscii
mov edi, eax
dec edi
jne 0x6339dd
cmp byte [ebp - 1], 0x20
jb 0x6339dd
test bl, 2
jne 0x6339dd
cmp word [ebp - 0x10], 0x20
jne 0x633ac7
mov al, byte [0x633af4]
cmp al, bl
jne 0x633ac7
mov byte [esi + 0x13c], bl
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13d], al
mov byte [esi + 0x13e], 0
call fcn.00465e68
mov edx, dword [esi + 0x13c]
call fcn.00466988
test al, al
je 0x633a95
cmp byte [esi + 0x140], 0
je 0x633a7e
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006337fc
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fa54
lea eax, [ebp - 0x118]
mov edx, 0x633b00
call fcn.00403524
mov edx, dword [ebp - 0x118]
mov eax, esi
call fcn.0063fadc
mov byte [esi + 0x138], 1
lea edx, [ebp - 0x118]
mov eax, esi
call fcn.0063fa54
mov eax, dword [ebp - 0x118]
call fcn.0040351c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x3c]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x633ac7
xor eax, eax
mov dword [esi + 0x13c], eax
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006337fc
jmp 0x633ac7
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006337fc
jmp 0x633ac7
mov ax, word [ebp - 0x10]
add eax, 0xfffffff0
sub ax, 3
jb 0x633ac7
mov al, byte [ebp - 0x10]
mov byte [esi + 0x13e], al
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006337fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x633ae7
lea eax, [ebp - 0x118]
call fcn.00403274
ret
Function at 0x63692c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x636bbe
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [edx + 6]
cmp eax, 0xa
ja case.0x636950.0
jmp dword [eax*4 + 0x636957]
mov eax, esi
mov bx, 0xfff6
call fcn.00403254
jmp case.0x636950.0
mov eax, esi
mov bx, 0xffd6
call fcn.00403254
jmp case.0x636950.0
mov byte [esi + 0x135], 0
mov eax, esi
mov bx, 0xffd5
call fcn.00403254
mov eax, dword [esi + 0x120]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x130]
cmp ebx, eax
jle 0x6369ce
mov ebx, eax
cmp ebx, 1
jge 0x6369d8
mov ebx, 1
mov eax, dword [0x66f99c]
cmp byte [eax], 0
je 0x6369f4
push 0
mov ecx, ebx
mov edx, 0x1701
mov eax, esi
call fcn.00641784
jmp 0x636a39
push 0x9e
mov eax, esi
call fcn.006362e0
imul ebx
add eax, dword [esi + 0x34]
add eax, 2
push eax
mov eax, dword [esi + 0x30]
push eax
push 0
push 0
push 0
mov eax, esi
call fcn.00643864
push eax
call sub.user32.dll_SetWindowPos
push 0x5f
push 0
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00643864
push eax
call sub.user32.dll_SetWindowPos
cmp byte [esi + 0x135], 0
je 0x636a74
push 0
push 0
push 0x1f
mov eax, esi
call fcn.00643864
push eax
call sub.user32.dll_PostMessageW
cmp byte [esi + 0x134], 0
jne 0x636a74
push 0
push 0
push 0x14f
mov eax, esi
call fcn.00643864
push eax
call sub.user32.dll_PostMessageW
mov byte [esi + 0x136], 0
jmp case.0x636950.0
cmp byte [0x676cd0], 0
jne case.0x636950.0
mov eax, esi
call fcn.006361b8
test eax, eax
jl case.0x636950.0
lea edx, [ebp - 4]
mov eax, esi
call fcn.0063610c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0063fadc
mov eax, esi
mov bx, 0xfff7
call fcn.00403254
mov eax, esi
mov bx, 0xffd6
call fcn.00403254
jmp case.0x636950.0
mov eax, esi
call fcn.00636188
test al, al
je case.0x636950.0
push 0x28
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636b26
push 0x26
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636b26
push 0x24
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636b26
push 0x23
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636b26
push 0x21
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x636b26
push 0x22
call sub.user32.dll_GetKeyState
test ax, ax
jge case.0x636950.0
mov byte [esi + 0x136], 1
mov eax, esi
call fcn.006361b8
mov dword [esi + 0x13c], eax
jmp case.0x636950.0
cmp byte [esi + 0x136], 0
je case.0x636950.0
mov eax, esi
call fcn.00636188
test al, al
je case.0x636950.0
mov byte [esi + 0x136], 0
mov byte [0x676cd0], 1
mov edx, dword [esi + 0x13c]
mov eax, esi
call fcn.006361c8
mov eax, esi
mov bx, 0xfff7
call fcn.00403254
mov eax, esi
mov bx, 0xffd6
call fcn.00403254
mov byte [0x676cd0], 0
jmp case.0x636950.0
mov byte [esi + 0x134], 1
mov byte [esi + 0x135], 1
jmp case.0x636950.0
mov byte [esi + 0x134], 0
mov byte [esi + 0x135], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636bc5
lea eax, [ebp - 4]
call fcn.00403274
ret