joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439aac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x439afe
test eax, edx
je 0x439b01
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x439ac1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x439ae7
add ecx, 4
js 0x439ad7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x439ae4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x439b0d
test edx, edx
jne 0x439ab4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4bc748
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bc7e6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4bc7aa
cmp byte [ebx + 0x11], 0
jne 0x4bc7aa
cmp byte [ebx + 0x3c], 0
jne 0x4bc7aa
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4bc7cb
lea edx, [ebp - 4]
mov eax, dword [0x5d4e58]
call fcn.0040d42c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x490c7c]
call fcn.004286a0
call fcn.00408d80
jmp 0x4bc7cb
lea edx, [ebp - 8]
mov eax, dword [0x5d4e58]
call fcn.0040d42c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x490c7c]
call fcn.004286a0
call fcn.00408d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc7ed
lea eax, [ebp - 8]
mov edx, 2
call fcn.004096e4
ret

Function at 0x4bd184
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bd1d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004bc5c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bd1eb
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bd1f4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004bc5c8
dec esi
jne 0x4bd216
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4bfd9c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x5db3ec
cmp dword [edi], 0
jne 0x4bfe18
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x5db3e8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x5d3794
mov ecx, 2
call fcn.00406be8
mov edx, 0x4bfd74
lea eax, [esi + 5]
call fcn.004bfd94
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004bfd94
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4bfded
mov dword [0x5db3e8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4ea180
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ea33b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409aac
mov eax, dword [ebp - 4]
call fcn.004e9ad0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4ea1d2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a5d0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004eadc8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ea2b1
xor eax, eax
push ebp
push 0x4ea2aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004e9d70
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004ea370
test al, al
je 0x4ea288
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040980c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4ea288
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040a1c4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004e9cd0
test al, al
je 0x4ea282
mov eax, dword [ebp - 8]
call fcn.0040a1c4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040a22c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004ea180
dec ebx
cmp ebx, 0xffffffff
jne 0x4ea231
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea2b1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004e9d70
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x5db440], 0
je 0x4ea2f1
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040a1c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004e9d5c
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004e9cd0
mov ebx, eax
jmp 0x4ea318
mov eax, dword [ebp - 4]
call fcn.0040a1c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004e9d5c
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004e9cd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea342
lea eax, [ebp - 0x3c]
call fcn.00409684
lea eax, [ebp - 8]
mov edx, 2
call fcn.004096e4
ret
Function at 0x4eaca4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004e9ae8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040a1c4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004e9cd0
test al, al
jne 0x4ead0c
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5d4d6c]
mov dl, 1
mov eax, dword [0x4e88b4]
call fcn.004288a4
call fcn.00408d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ead18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040a1c4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004e9cd0
test al, al
jne 0x4ead79
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5d50bc]
mov dl, 1
mov eax, dword [0x4e88b4]
call fcn.004288a4
call fcn.00408d80
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e9b18
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4eb378
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4eb4a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004e9d70
xor eax, eax
push ebp
push 0x4eb47b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ea370
test al, al
je 0x4eb45f
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004eb258
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040980c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4eb45f
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a1c4
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e9cd0
test al, al
je 0x4eb45b
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a1c4
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040a22c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004eb258
pop ecx
inc edi
dec ebx
jne 0x4eb403
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb482
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004e9d70
ret
Function at 0x4eb4b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4eb6fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004e9d70
xor eax, eax
push ebp
push 0x4eb6d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004ea370
test al, al
je 0x4eb6b8
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040980c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4eb6b8
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a1c4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e9cd0
test al, al
je 0x4eb6ac
mov eax, dword [ebp - 4]
call fcn.0040a1c4
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040a22c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004eadc8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4eb6ac
xor eax, eax
push ebp
push 0x4eb6a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004e9d70
xor eax, eax
push ebp
push 0x4eb687
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a1c4
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040a22c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004e9d74
mov eax, dword [ebp - 4]
call fcn.0040a1c4
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040a22c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004eadc8
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4eb664
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004eb378
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004eb4b0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb66b
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4eb53b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb6db
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004e9d70
ret
Function at 0x4f3f08
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4f3f0e
ret
Function at 0x514380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5db620], 0
je 0x5144c1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5d4e2c]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x5144c1
mov eax, dword [0x5db624]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5db620]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x514490
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5db620]
call fcn.004a848c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x514488
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x205], 0
je 0x514488
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x6c]
test al, al
je 0x514488
mov eax, dword [ebp - 0x14]
call fcn.0052019c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x514488
push ebp
call fcn.0051433c
pop ecx
test al, al
jne 0x514488
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00407cc0
test al, al
je 0x514488
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 9]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407cc0
cmp byte [ebp - 9], 0
je 0x514488
lea edx, [ebp - 8]
lea eax, [ebp - 0x28]
call fcn.00410394
test al, al
je 0x514488
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5db624]
call fcn.00513a84
inc edi
dec ebx
jne 0x5143e5
mov eax, dword [0x5db624]
cmp dword [eax + 8], 0
jle 0x5144a8
mov eax, dword [0x5db624]
call fcn.00513b38
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5144c1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005141a4
pop ecx
test al, al
jne 0x5144c1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51cc58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00410884
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005169c4
test ebx, ebx
jne 0x51ccab
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0051cad0
mov ebx, eax
test ebx, ebx
je 0x51cda1
cmp esi, ebx
je 0x51ccd4
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x51cce9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x51cd21
add eax, 0xffffff5f
sub eax, 2
jb 0x51cd39
dec eax
sub eax, 2
jb 0x51cd4d
dec eax
sub eax, 2
jb 0x51cd43
jmp 0x51cd57
add eax, 0xfffffdff
sub eax, 2
jb 0x51cd39
dec eax
sub eax, 2
jb 0x51cd4d
dec eax
sub eax, 2
jb 0x51cd43
jmp 0x51cd57
mov byte [esp + 0x120], 0
jmp 0x51cd5f
mov byte [esp + 0x120], 2
jmp 0x51cd5f
mov byte [esp + 0x120], 1
jmp 0x51cd5f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005b1c60
mov esi, eax
call fcn.00513430
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00518408
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x51cda3
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x5423b4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409768
xor eax, eax
push ebp
push 0x5424f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5424c4
xor edx, edx
push ebp
push 0x5424bd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x542401
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x542492
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x542481
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x542444
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040a1c4
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00406be8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542488
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x5d4a8c]
mov dl, 1
mov eax, dword [0x41b864]
call fcn.004287d4
call fcn.00408d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5424f8
lea eax, [ebp - 4]
call fcn.00409684
ret

Function at 0x546de8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x546e24]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x546e00
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x546e10
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x546e20
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x5656f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
push 0x101
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040980c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x56de48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0056def8
test eax, eax
je 0x56de83
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0056def8
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040980c
jmp 0x56de91
mov ecx, esi
mov edx, 0x56deb0
mov eax, ebx
call fcn.0056ddd0
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.00409a64
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x5a15d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409684
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5a162a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5a1623
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a268
jmp 0x5a162a
mov eax, esi
call fcn.00409684
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a6e58
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a6fb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5d4880], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4e8ad8]
call fcn.004e9c24
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5a6f8d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004e9d0c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a268
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5a6fd0
call fcn.0040a418
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004e9f98
test al, al
je 0x5a6f77
lea ecx, [ebp - 4]
mov edx, 0x5a7044
mov eax, dword [ebp - 0xc]
call fcn.004ea824
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042b21c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5a6f77
xor edx, edx
push ebp
push 0x5a6f70
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5a705c
mov eax, dword [ebp - 8]
push eax
call fcn.00412790
test eax, eax
je 0x5a6f59
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5a6f59
call fcn.005a6de4
test eax, eax
je 0x5a6f49
mov eax, dword [ebx + 0x50]
jmp 0x5a6f4c
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5d4880]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6f77
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6f94
mov eax, dword [ebp - 0xc]
call fcn.00407904
ret

Function at 0x5a70c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5a7107
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5a70ea
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5a70fb
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5a7107
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret