joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404dac
xor eax, eax
push ebp
push 0x4d3d24
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004048ec
mov al, byte [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.BS_COMMON_ICCARD.DLL_CheckCoaCardType
cmp eax, 2
jne 0x4d3ce1
dec ebx
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x1d80
mov dword [ebp - 0xc], eax
xor esi, esi
lea edi, [ebp - 0x1a]
lea eax, [ebp - 0x20]
push eax
lea edx, [esi + 1]
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.00404e1c
mov eax, dword [ebp - 0x20]
mov bl, byte [eax]
xor bl, byte [ebp + 8]
mov byte [edi], bl
lea ecx, [ebp - 0x24]
xor eax, eax
mov al, bl
mov edx, 2
call fcn.00409da8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00404bc4
inc esi
inc edi
cmp esi, 0xa
jne 0x4d3c85
mov eax, dword [ebp - 0x10]
call fcn.00404dbc
push eax
push 0xa
mov ax, word [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.DCIC32.DLL_IC_Write64_Hex
jmp 0x4d3cf9
push 0x10
mov ecx, 0x4d3d34
mov edx, 0x4d3d3c
mov eax, dword [0x73e390]
mov eax, dword [eax]
call fcn.004909d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3d2b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x10]
call fcn.004048ec
lea eax, [ebp - 8]
call fcn.004048ec
ret

Function at 0x4d3d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404dac
xor eax, eax
push ebp
push 0x4d3e25
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.BS_COMMON_ICCARD.DLL_CheckStCardType
dec eax
jne 0x4d3def
mov eax, dword [ebp + 0xc]
dec eax
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x1d80
mov dword [ebp - 8], eax
xor esi, esi
lea edi, [ebp - 0x12]
lea eax, [ebp - 0x18]
push eax
lea edx, [esi + 1]
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.00404e1c
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
xor al, bl
mov byte [edi], al
inc esi
inc edi
cmp esi, 0xa
jne 0x4d3dad
lea eax, [ebp - 0x12]
push eax
push 0xa
mov ax, word [ebp - 8]
push eax
mov eax, dword [0x7444dc]
push eax
call sub.GENFUNCTION.DLL_swr_24c64
mov word [0x7444d8], ax
jmp 0x4d3e07
push 0x10
mov ecx, 0x4d3e38
mov edx, 0x4d3e40
mov eax, dword [0x73e390]
mov eax, dword [eax]
call fcn.004909d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3e2c
lea eax, [ebp - 0x18]
call fcn.004048ec
lea eax, [ebp - 4]
call fcn.004048ec
ret
Function at 0x4df060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4df11a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405008
mov eax, dword [0x73db64]
cmp byte [eax], 0
je 0x4df0cf
push esi
call sub.USER32.DLL_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405398
mov eax, dword [ebx]
call fcn.004051c4
push eax
mov eax, dword [ebx]
call fcn.004051b4
push eax
push esi
call sub.USER32.DLL_GetWindowTextW
mov eax, dword [ebx]
call fcn.004051c4
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405398
jmp 0x4df101
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a724
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004051a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df121
lea eax, [ebp - 0x3f0]
call fcn.004048ec
ret

Function at 0x4e231c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4e2376
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004e2380
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e237d
ret

Function at 0x4eb084
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.00470304
pop ebx
ret
Function at 0x4f13b8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f1472
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405008
mov eax, dword [0x73db64]
cmp byte [eax], 0
je 0x4f1427
push esi
call sub.USER32.DLL_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405398
mov eax, dword [ebx]
call fcn.004051c4
push eax
mov eax, dword [ebx]
call fcn.004051b4
push eax
push esi
call sub.USER32.DLL_GetWindowTextW
mov eax, dword [ebx]
call fcn.004051c4
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405398
jmp 0x4f1459
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a724
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004051a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1479
lea eax, [ebp - 0x3f0]
call fcn.004048ec
ret

Function at 0x4f1480
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.USER32.DLL_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040a724
add esp, 0x3ec
pop ebx
ret

Function at 0x4f7764
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x73e6fc]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x4f780a
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4f77a9
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4f77e5
jmp 0x4f77ad
pop edx
pop eax
jge 0x4f77e5
mov eax, dword [0x73e6fc]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004f242c
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x4f780a
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4f780a
cmp dword [ebx + 0x11c], 0
je 0x4f780a
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00440194
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.USER32.DLL_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x50235c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5024cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x5024b2
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040a724
mov dl, 1
mov eax, dword [0x4d90d0]
call fcn.004d9128
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x41d278]
call fcn.0040396c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004d91a4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x5024af
mov dl, 1
mov eax, dword [0x4da6d4]
call fcn.004da73c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x5024e4
call fcn.004d9838
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404c08
xor eax, eax
push ebp
push 0x5024a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004daa3c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005024ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5024af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0040399c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0040399c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0040399c
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5024d4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404910
ret

Function at 0x51f6f8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x51f71d
cmp dword [esp + 4], 5
jb 0x51f71d
mov al, 1
jmp 0x51f71f
xor eax, eax
add esp, 0x94
ret
Function at 0x52ff08
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe20
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1e0], edx
xor eax, eax
push ebp
push 0x530018
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x52ffd0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1dc]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
mov dl, 1
mov eax, dword [0x41cf88]
call fcn.0040396c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x40
lea eax, [ebp - 0x4c]
push eax
call sub.WSOCK32.DLL_gethostname
lea eax, [ebp - 0x4c]
push eax
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52ff87
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ffff
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
xor ebx, ebx
jmp 0x52ffb7
push dword [esi]
call sub.WSOCK32.DLL_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1e0]
call fcn.00404af4
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x52ff94
call sub.WSOCK32.DLL_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53001f
lea eax, [ebp - 0x1e0]
call fcn.004048ec
ret

Function at 0x5373a0
Capabilities:
Hash data with md5

Disassembly:
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
xor eax, eax
mov dword [edx + 0x10], eax
xor eax, eax
mov dword [edx + 0x14], eax
lea eax, [edx + 0x18]
mov edx, 0x40
call fcn.004081d8
ret
Function at 0x537564
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404dac
xor eax, eax
push ebp
push 0x5376bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.005373a0
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 8]
call fcn.00404dbc
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x537699
xor eax, eax
push ebp
push 0x537692
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x53767b
xor eax, eax
push ebp
push 0x537674
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x53765d
xor eax, eax
push ebp
push 0x537656
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
push eax
lea edx, [ebp - 0x70]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005373d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53765d
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53767b
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537699
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.0053746c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5376c4
lea eax, [ebp - 8]
call fcn.004048ec
ret

Function at 0x55232c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.USER32.DLL_GetKeyboardState
mov eax, esp
call fcn.00487838
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x556894
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x744bec]
call fcn.0041f62c
inc eax
je 0x556938
mov edx, ebx
mov eax, dword [0x744bec]
call fcn.0041f76c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x120]
mov byte [0x73aa24], 1
mov dword [0x744be0], ebx
xor eax, eax
push ebp
push 0x556931
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, ebx
call fcn.00476d64
call fcn.00552644
push eax
call sub.USER32.DLL_ShowWindow
mov eax, ebx
call fcn.0048d120
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x11c]
call sub.USER32.DLL_GetCapture
mov edx, eax
mov eax, ebx
call fcn.00552168
test al, al
je 0x55691c
xor eax, eax
call fcn.0046d5b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556938
mov byte [0x73aa24], 0
ret
pop ebx
pop ebp
ret
Function at 0x5b46e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [edx + 0x18]
test al, 0x40
je 0x5b46ff
push 5
mov eax, ebx
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
pop ebx
ret
test al, 0x80
je 0x5b4712
push 0
mov eax, ebx
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
pop ebx
ret

Function at 0x5bf78c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edi, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
test esi, esi
je 0x5bf8b8
test edi, edi
je 0x5bf8b8
test eax, eax
je 0x5bf8b8
test edx, edx
je 0x5bf8b8
mov eax, dword [ebp - 0x4c]
cdq
idiv esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x44]
dec eax
cdq
idiv esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
idiv edi
mov ebx, eax
mov eax, dword [ebp - 0x40]
dec eax
cdq
idiv edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005bf66c
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_IntersectClipRect
mov eax, dword [ebp - 0x18]
sub eax, ebx
jl 0x5bf8aa
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
sub ebx, eax
jl 0x5bf8a2
inc ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
imul edi
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
imul esi
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x3c]
sub eax, edx
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.00434b70
call fcn.0042fc60
push eax
push edi
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_BitBlt
inc dword [ebp - 8]
dec ebx
jne 0x5bf852
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x5bf844
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005bf644
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5bfa44
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.USER32.DLL_GetSystemMetrics
test eax, eax
jne 0x5bfa5d
push 1
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
setl al
ret
push 2
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
setl al
ret
Function at 0x5bfa6c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.USER32.DLL_GetSystemMetrics
test eax, eax
jne 0x5bfa85
push 2
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
setl al
ret
push 1
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x5c4578
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x100]
test byte [eax], 0x80
setne cl
test cl, cl
jne 0x5c45a6
inc eax
dec edx
jne 0x5c4598
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x5c46f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0xc]
mov word [ebp - 4], ax
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5c471f
add word [ebp - 4], 0x2000
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5c4731
add word [ebp - 4], 0x4000
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5c4743
add word [ebp - 4], 0x8000
lea eax, [ebp - 8]
call fcn.005c4544
mov ebx, eax
test ebx, ebx
je 0x5c4769
mov cx, word [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005c4200
test al, al
je 0x5c4769
mov byte [ebp - 1], 1
jmp 0x5c47a3
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.005c4608
pop ecx
cmp byte [ebp - 1], 0
jne 0x5c47a3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
cmp eax, dword [edx - 4]
je 0x5c47a3
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
call fcn.005c4608
pop ecx
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5c4860
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push ebp
call fcn.005c46f8
pop ecx
test al, al
je 0x5c4880
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
jmp 0x5c495f
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5c495f
call fcn.005c45ac
mov dl, byte [0x5c4964]
not edx
and dl, al
mov byte [ebp - 1], dl
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.005c47ac
pop ecx
mov esi, eax
test esi, esi
jne 0x5c48d2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
je 0x5c48d2
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005c47ac
pop ecx
mov esi, eax
test esi, esi
je 0x5c495f
mov eax, dword [esi + 0x18]
call fcn.005e3870
test al, al
je 0x5c495f
push esi
mov eax, esi
call fcn.005d1bfc
mov edx, dword [ebp + 8]
mov dx, word [edx + 0xc]
mov cl, byte [ebp - 1]
call fcn.005d30b8
cmp esi, eax
sete bl
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
test al, al
je 0x5c4915
test bl, bl
jne 0x5c4927
mov eax, esi
call fcn.005d1acc
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x190]
test bl, bl
je 0x5c4955
mov eax, dword [esi + 0x10]
mov edx, dword [0x5bc550]
call fcn.00403b34
test al, al
je 0x5c494b
mov eax, esi
call fcn.005d1acc
mov byte [eax + 0x2a0], 1
xor edx, edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c598c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x744d24]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041f62c
test eax, eax
jge 0x5c59b1
mov eax, dword [0x744d24]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041f424
cmp byte [ebx + 0x4d], 0
jne 0x5c59d1
cmp dword [0x744da0], 0
jne 0x5c59d1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x73ae1c]
call dword [eax + 0x2c]
mov dword [0x744da0], eax
cmp dword [0x744d7c], 0
jne 0x5c59f3
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
push fcn.005c4968
push 2
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x744d7c], eax
cmp dword [0x744d80], 0
jne 0x5c5a15
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
push 0x5c501c
push 7
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x744d80], eax
cmp dword [0x744d84], 0
jne 0x5c5a37
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
push 0x5c5734
push 4
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x744d84], eax
pop ebx
ret
Function at 0x5c969c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.005c61d0
test al, al
jne 0x5c97be
cmp byte [esi + 0x123], 0
je 0x5c97be
test bl, bl
jne 0x5c96d3
cmp byte [0x744dc4], 0
je 0x5c97be
mov byte [0x744dc4], bl
mov eax, 0x744db0
mov edx, edi
call fcn.00404940
mov byte [0x744da4], 0
mov byte [esp], bl
test bl, bl
je 0x5c9712
mov edi, dword [esi + 0x11c]
test edi, edi
je 0x5c9709
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x234], 0
je 0x5c9716
cmp dword [0x744db0], 0
jne 0x5c9716
xor eax, eax
jmp 0x5c9718
mov al, 1
mov ebx, eax
test bl, bl
je 0x5c9769
call fcn.005c44fc
mov eax, dword [0x744da0]
call fcn.00476d64
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x5c9760
cmp byte [0x744db4], 0
jne 0x5c9760
mov dword [0x744dc0], esi
push 0x5c9414
push 0x3e8
push 0
push 0
call sub.USER32.DLL_SetTimer
mov dword [0x744da8], eax
jmp 0x5c97be
mov eax, esi
call fcn.005c9484
jmp 0x5c97be
call fcn.005c44fc
mov eax, dword [0x744da0]
call fcn.00476d64
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5c97be
push 0
mov eax, dword [0x744da0]
call fcn.00476d64
push eax
call sub.USER32.DLL_ShowWindow
cmp byte [esp], 0
je 0x5c97be
call fcn.005c451c
mov byte [0x744db4], 1
push 0x5c9478
push 0x190
push 0
push 0
call sub.USER32.DLL_SetTimer
mov dword [0x744dac], eax
pop edx
pop edi
pop esi
pop ebx
ret