joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc2a9
Capabilities:
Encode data using xor

Disassembly:
rcl byte [ebx + 0x56], 0x57
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
cmp byte [esi], 0xa0
jb 0x4dc2be
cmp byte [esi + 1], 0xa0
jae 0x4dc2c9
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
jmp 0x4dc470
mov eax, ebx
call fcn.004f870c
cmp al, 5
jne 0x4dc470
mov eax, ebx
mov dword [ebp - 0x20], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x20]
add eax, 3
test eax, eax
jns 0x4dc2f3
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x24], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
dec edx
call fcn.004f8790
mov dword [ebp - 4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x4dc470
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jge 0x4dc470
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dc470
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x18]
jge 0x4dc470
push 2
push esi
lea eax, [ebp - 6]
push eax
call fcn.0053aef0
add byte [ebp - 6], 0x60
add byte [ebp - 5], 0x60
xor edx, edx
xor eax, eax
mov dl, byte [ebp - 6]
mov al, byte [ebp - 5]
add esp, 0xc
lea ecx, [edx + edx*2]
shl ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, eax
mov eax, ecx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0xfffff718
test eax, eax
jb 0x4dc39d
cmp eax, 0x2feb0
jb 0x4dc3a8
mov edx, dword [ebp + 0x10]
add dword [edx], 0xc
jmp 0x4dc470
push 0x18
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0053aef0
add esp, 0xc
lea edx, [ebp - 0x40]
xor eax, eax
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0x18
jl 0x4dc3c1
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dc26c
pop ecx
xor edx, edx
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dc45c
cmp eax, dword [ebp - 0x18]
jge 0x4dc45c
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x20]
mov bx, word [eax]
mov cx, 1
mov eax, ebx
movzx ebx, bx
sar ebx, 8
shl eax, 8
or ax, bx
mov ebx, eax
mov eax, dword [ebp - 0x18]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x24]
add eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 0xc], eax
xor eax, eax
mov esi, 0xf
sub esi, eax
add esi, dword [ebp - 0x14]
cmp esi, dword [ebp - 0x1c]
jge 0x4dc454
cmp eax, 4
jl 0x4dc454
test cx, bx
jbe 0x4dc454
mov esi, 0xf
sub esi, eax
mov edi, dword [ebp - 0xc]
lea edi, [edi + esi*2]
mov si, word [ebp - 0xe]
mov word [edi], si
add ecx, ecx
inc eax
cmp eax, 0x10
jl 0x4dc427
inc edx
add dword [ebp - 0x28], 2
cmp edx, 0xc
jl 0x4dc3e1
mov eax, dword [ebp + 0x10]
add dword [eax], 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc478
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
cmp bl, 0x20
jb 0x4dc491
cmp bl, 0x7f
jb 0x4dc49c
mov eax, dword [ebp + 0x10]
add dword [eax], 6
jmp 0x4dc5ff
mov eax, esi
call fcn.004f870c
cmp al, 5
jne 0x4dc5ff
mov eax, esi
mov dword [ebp - 0x1c], 2
mov edx, dword [eax]
call dword [edx + 0x2c]
imul dword [ebp - 0x1c]
add eax, 3
test eax, eax
jns 0x4dc4c6
add eax, 3
sar eax, 2
shl eax, 2
mov dword [ebp - 0x20], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, esi
dec edx
call fcn.004f8790
mov dword [ebp - 4], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff4
jle 0x4dc5ff
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jge 0x4dc5ff
cmp dword [ebp + 0x14], 0xfffffff4
jle 0x4dc5ff
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x14]
jge 0x4dc5ff
xor eax, eax
mov al, bl
shl eax, 2
lea eax, [eax + eax*2]
add eax, 0xfffffe80
test eax, eax
jb 0x4dc545
cmp eax, 0x474
jb 0x4dc550
mov edx, dword [ebp + 0x10]
add dword [edx], 6
jmp 0x4dc5ff
push 0xc
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
lea eax, [ebp - 0x30]
push eax
call fcn.0053aef0
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x30]
xor byte [edx], 0x58
inc eax
inc edx
cmp eax, 0xc
jl 0x4dc569
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.004dc26c
pop ecx
xor edx, edx
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
add eax, edx
test eax, eax
jl 0x4dc5f0
cmp eax, dword [ebp - 0x14]
jge 0x4dc5f0
mov cl, 1
mov eax, dword [ebp - 0x14]
dec eax
sub eax, dword [ebp + 0x14]
sub eax, edx
imul eax, dword [ebp - 0x20]
add eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
imul ebx, dword [ebp - 0x1c]
add eax, ebx
mov dword [ebp - 8], eax
xor eax, eax
mov ebx, dword [ebp - 0x24]
mov esi, ebx
mov ebx, 8
sub ebx, eax
add ebx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 0x18]
jge 0x4dc5e8
cmp eax, 2
jl 0x4dc5e8
test byte [esi], cl
jbe 0x4dc5e8
mov ebx, 8
sub ebx, eax
mov edi, dword [ebp - 8]
lea edi, [edi + ebx*2]
mov bx, word [ebp - 0xa]
mov word [edi], bx
add ecx, ecx
inc eax
cmp eax, 8
jl 0x4dc5bc
inc edx
inc dword [ebp - 0x24]
cmp edx, 0xc
jl 0x4dc589
mov eax, dword [ebp + 0x10]
add dword [eax], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dc764
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.004dc6f0
mov eax, dword [ebp + 8]
add eax, esi
jmp 0x4dc79c
mov edx, ebx
shr edx, 0x18
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov edx, dword [ecx*4 + 0x587870]
mov cl, byte [eax]
shl ebx, 8
and ecx, 0xff
or ebx, ecx
xor ebx, edx
inc eax
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x4dc779
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4eb2f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004eaef8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00538554
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x4eb356
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x580034]
mov dl, 1
mov eax, dword [0x4eadf0]
call fcn.00533104
call fcn.00537c0c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4eb360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00538554
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4eb3b8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x580038]
mov dl, 1
mov eax, dword [0x4eadf0]
call fcn.00533104
call fcn.00537c0c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004eaf28
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ec3a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00538110
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4ec3ef
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00538340
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f2614
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4f261a
ret

Function at 0x4f4b40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4f4b91
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4f4b78
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4f4b68
jmp 0x4f4b91
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4f4b79
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fd644
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x587d3c
cmp dword [edi], 0
jne 0x4fd6c0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x587d38]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x57ae30
mov ecx, 2
call fcn.00536ef4
mov edx, 0x4fd61c
lea eax, [esi + 5]
call fcn.004fd63c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004fd63c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4fd695
mov dword [0x587d38], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4fd7dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4fd82c]
test si, 4
je 0x4fd7f0
or bl, 1
test si, 8
je 0x4fd7fa
or bl, 4
test si, 1
je 0x4fd804
or bl, 8
test si, 2
je 0x4fd80e
or bl, 0x10
test si, 0x10
je 0x4fd818
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4fd827
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4fd830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4fd868]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4fd849
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4fd858
or bl, 4
test esi, 0x20000000
je 0x4fd863
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x503db8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x503dca
add esp, 0xfffffff0
call fcn.005377b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0052a254
mov eax, ebx
call fcn.00504104
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x70], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x5008a8
push eax
push 0
push 0
mov eax, dword [0x5800f8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4f1b3c]
call fcn.004f3074
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x4f1b3c]
call fcn.004f3074
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4f1b3c]
call fcn.004f3074
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.005044e4
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x504400
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x504400
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x504400
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x503ed9
call fcn.0053780c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5041e4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50438f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x504370
mov dl, 1
mov eax, dword [0x523e00]
push edx
add al, ch
xor al, byte fs:[ebx]
add byte [ebx + 0x4289fc55], cl
invalid
mov eax, dword [ebp - 4]

Function at 0x504219
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push edx
add al, ch
xor al, byte fs:[ebx]
add byte [ebx + 0x4289fc55], cl
sub byte [ebx - 0x3f7c03bb], cl
add eax, 0x2c
call fcn.00538110

Function at 0x504229
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push edx
add al, ch
xor al, byte fs:[ebx]
add byte [ebx + 0x4289fc55], cl
sub byte [ebx - 0x3f7c03bb], cl
add eax, 0x2c
call fcn.00538110
Function at 0x504bdc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x587d2c]
cmp byte [eax + 0x95], 0
jne 0x504c4d
cmp dword [0x587d48], 0
jne 0x504c0e
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x504b98
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x587d48], eax
cmp dword [0x587d44], 0
jne 0x504c29
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x587d44], eax
cmp dword [0x587d4c], 0
jne 0x504c4d
push esp
push 0
push 0
push 0x504b3c
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x587d4c], eax
pop edx
ret

Function at 0x504d44
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x504d5b
add esp, 0xfffffff0
call fcn.005377b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0052a254
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x523ac4]
call fcn.00537484
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x4f24cc]
call fcn.004f9af8
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x504ed0
mov eax, dword [0x580294]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004f9ec8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5068f4
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x580294]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00533b60
test eax, eax
je 0x504e4e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00531d5c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00533b88
test eax, eax
je 0x504e62
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00538340
mov eax, dword [0x58029c]
cmp byte [eax], 0
jne 0x504e93
mov eax, ebx
call fcn.00504fbc
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
mov es, word [eax]
add byte [eax], al
add dword [ebx], esi
ror byte [ecx + 0x9083], 0

Function at 0x505cdc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x505d11
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.005381f8
jmp 0x505d1b
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00538164
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x506c68
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x506ca0
mov eax, esi
call fcn.005163d4
test al, al
je 0x506ca0
mov eax, dword [ebx + 0x74]
call fcn.005160d8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x506ca0
push 0
mov eax, dword [ebx + 0x74]
call fcn.005160d8
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x50dd9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x587dc8], 0
sete dl
or al, dl
jne 0x50dedc
mov eax, dword [0x587dcc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x587dc8]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x50deab
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x587dc8]
call fcn.005251f8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x50dea3
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x50dea3
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x50dea3
mov eax, dword [ebp - 0x14]
call fcn.005160d8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x50dea3
push ebp
call fcn.0050dd58
pop ecx
test al, al
jne 0x50dea3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x50de5f
mov eax, dword [ebp - 0x14]
call fcn.00514a64
dec eax
jle 0x50dea3
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00537690
cmp byte [ebp - 1], 0
je 0x50dea3
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x50dea3
mov edx, dword [ebp - 0x14]
mov eax, dword [0x587dcc]
call fcn.0050d5a4
inc edi
dec esi
jne 0x50ddf2
mov eax, dword [0x587dcc]
cmp dword [eax + 8], 0
jle 0x50dec3
mov eax, dword [0x587dcc]
call fcn.0050d634
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50dedc
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0050dbc0
pop ecx
test al, al
jne 0x50dedc
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x513a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x513aa1
je 0x513afb
sub eax, 7
je 0x513ac2
dec eax
je 0x513aec
sub eax, 0x17
je 0x513ba0
jmp 0x513bde
add eax, 0xffffff00
sub eax, 9
jb 0x513b8c
add eax, 0xffffff09
sub eax, 0xb
jb 0x513b54
jmp 0x513bde
mov eax, ebx
call fcn.004fd928
mov edi, eax
test edi, edi
je 0x513c3e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x513c47
jmp 0x513c3e
test byte [ebx + 0x44], 0x20
jne 0x513c47
jmp 0x513c3e
mov edx, esi
mov eax, ebx
call fcn.00511070
cmp dword [esi + 0xc], 0xffffffff
jne 0x513c47
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.0052e060
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0050fba4
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00513948
test eax, eax
je 0x513c47
mov dword [esi + 0xc], 1
jmp 0x513c47
mov edx, esi
mov eax, ebx
call fcn.005139dc
test al, al
je 0x513c3e
cmp dword [esi + 0xc], 0
jne 0x513c47
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.005160d8
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x513c47
mov eax, ebx
call fcn.0051070c
test al, al
jne 0x513c47
jmp 0x513c3e
mov eax, ebx
call fcn.005160d8
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x513c3e
cmp dword [0x57b12c], 0
je 0x513c3e
mov eax, dword [0x57b12c]
cmp ebx, dword [eax + 0x24]
mov eax, dword [0x587d90]
cmp byte [eax + 0x20], 0
je 0x513c3e
mov eax, dword [0x587d90]
cmp dword [eax + 0x1c], 0
je 0x513c3e
mov eax, dword [esi]
mov edx, dword [0x587d90]
cmp eax, dword [edx + 0x1c]
jne 0x513c3e
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.004fd86c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
mov bh, 0xff
Function at 0x514108
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x514124
cmp dword [esi + 4], 0
je 0x514151
test byte [ebx + 0x45], 1
jne 0x514143
mov eax, ebx
call fcn.00513040
test eax, eax
jne 0x514143
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x514261
mov edx, esi
mov eax, ebx
call fcn.00513d80
jmp 0x514261
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51425a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.005160d8
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00510fa4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00514108
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.005160d8
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514261
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret