joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507878
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x507ad8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x5078db
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00507340
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ee70
cmp al, 1
jne 0x5078db
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00507658
test al, al
je 0x507a67
cmp dword [ebp - 8], 0
jge 0x5078f9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00507340
mov eax, dword [ebp - 0x210]
call fcn.00404f70
cmp ebx, eax
jge 0x507943
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00507340
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x6c02bc]
and eax, 0xff
bt dword [edx], eax
jae 0x507943
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x507957
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00507854
cmp ebx, dword [ebp - 8]
je 0x507a59
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x507983
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fa8
and eax, 0x7f
movzx eax, word [eax*2 + 0x6bcd3c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x507a46
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fa8
and eax, 0x7f
movzx eax, word [eax*2 + 0x6bcd3c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046fb3c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fa8
and eax, 0x7f
movzx eax, word [eax*2 + 0x6bcd3c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046fb3c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507a4d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x507aba
cmp dword [ebp - 8], 0
jge 0x507a72
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00507340
mov eax, dword [ebp - 0x218]
call fcn.00404f70
cmp eax, dword [ebp - 8]
jg 0x507aac
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00507340
mov eax, dword [ebp - 0x21c]
call fcn.00404f70
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00507854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507adf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404cc4
ret
Function at 0x51dfa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51e15e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0051edec
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040ee70
cmp al, 2
jne 0x51dffe
dec esi
mov eax, ebx
call fcn.0051ee00
test al, al
je 0x51e0f9
test esi, esi
jge 0x51e013
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x208]
mov eax, ebx
call fcn.0051edec
mov eax, dword [ebp - 0x208]
call fcn.00404f70
cmp edi, eax
jge 0x51e05a
lea edx, [ebp - 0x20c]
mov eax, ebx
call fcn.0051edec
mov eax, dword [ebp - 0x20c]
mov al, byte [eax + edi - 1]
mov edx, dword [0x6c02bc]
and eax, 0xff
bt dword [edx], eax
jae 0x51e05a
inc edi
mov eax, dword [ebx + 0x2b8]
cmp esi, eax
jl 0x51e068
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.0051e278
cmp edi, esi
je 0x51e0f1
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
push esi
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
mov byte [ebp - 0x1ef], 0
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x2ac], esi
jmp 0x51e140
test esi, esi
jge 0x51e0ff
xor esi, esi
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.0051edec
mov eax, dword [ebp - 0x210]
call fcn.00404f70
cmp esi, eax
jl 0x51e135
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.0051edec
mov eax, dword [ebp - 0x214]
call fcn.00404f70
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.0051e278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e165
lea eax, [ebp - 0x214]
mov edx, 5
call fcn.00404cc4
ret

Function at 0x535da0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x314], 0
je 0x535df3
cmp byte [ebx + 0x31c], 0
jne 0x535df3
push 0
push 1
push 0x86
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_SendMessageA
push 4
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_ShowWindow
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_SetWindowPos
pop ebx
ret
Function at 0x58e1cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe94
mov edi, eax
mov eax, edi
call fcn.005871ac
mov edx, eax
mov eax, edi
call fcn.0058d8e0
mov ebp, eax
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov byte [esp + 0xd], 0
mov eax, edi
call fcn.0058daf8
xor al, 1
mov byte [esp + 0xc], al
lea edx, [esp + 0x30]
mov eax, edi
call fcn.00543f74
push edi
lea esi, [esp + 0x34]
lea edi, [esp + 0x12]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 0xe0]
push eax
call sub.user32.dll_IsRectEmpty
test eax, eax
jne 0x58e23a
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x1a], eax
mov dword [esp + 4], 0xffffffff
mov al, byte [esp + 0xc]
xor al, 1
test al, al
je 0x58e250
neg dword [esp + 4]
push edi
lea esi, [esp + 0x12]
lea edi, [esp + 0x22]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
test al, al
je 0x58e28e
push 0
lea eax, [esp + 0x160]
push eax
mov ecx, dword [esp + 0x2e]
xor edx, edx
mov eax, dword [esp + 0x26]
call fcn.0041e780
push edi
lea esi, [esp + 0x160]
lea edi, [esp + 0x22]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
jmp 0x58e296
mov eax, dword [esp + 0x2a]
mov dword [esp + 0x22], eax
xor ebx, ebx
mov eax, dword [esp + 0x1a]
sub eax, dword [esp + 0x12]
test eax, eax
jns 0x58e2a9
add eax, 0xff
sar eax, 8
mov dword [esp], eax
cmp dword [esp], 0
jne 0x58e3a0
mov dword [esp], 1
jmp 0x58e3a0
cmp ebx, 0x14
jg 0x58e2d4
mov esi, dword [esp + 4]
imul esi, dword [esp]
jmp 0x58e2df
inc dword [esp]
mov esi, dword [esp + 4]
imul esi, dword [esp]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, ecx
add eax, ebx
cmp ebp, eax
jl 0x58e306
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov eax, ebp
sub eax, ebx
sar eax, 1
jns 0x58e302
adc eax, 0
cmp ecx, eax
jle 0x58e30f
mov esi, ebp
sub esi, ebx
imul esi, dword [esp + 4]
push 2
push 0
push 0
lea eax, [esp + 0x1a]
push eax
lea eax, [esp + 0x1e]
push eax
push esi
push 0
mov eax, edi
call fcn.0046fb3c
push eax
call sub.user32.dll_ScrollWindowEx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add ebx, eax
cmp byte [esp + 0xc], 0
jne 0x58e358
mov dword [esp + 0x2a], ebx
mov eax, dword [edi + 0x208]
mov eax, dword [eax + 0x14]
mov edx, 0xff000010
call fcn.0042fa0c
jmp 0x58e373
mov eax, dword [esp + 0x2a]
sub eax, ebx
mov dword [esp + 0x22], eax
mov edx, dword [edi + 0x70]
mov eax, dword [edi + 0x208]
mov eax, dword [eax + 0x14]
call fcn.0042fa0c
lea edx, [esp + 0x1e]
mov eax, dword [edi + 0x208]
call fcn.004300a4
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0x190
jg 0x58e39a
cmp ebp, ebx
jle 0x58e39a
xor eax, eax
jmp 0x58e39c
mov al, 1
mov byte [esp + 0xd], al
cmp byte [esp + 0xd], 0
je 0x58e2c5
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ad0ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x5ad0fb
add esp, 0xfffffff0
call fcn.00404110
mov esi, ecx
mov ebx, edx
mov edi, eax
mov dword [edi + 4], esi
push esi
call sub.user32.dll_GetKeyState
and ax, 0xff
movzx eax, ax
mov dword [edi + 8], eax
mov eax, edi
test bl, bl
je 0x5ad129
call fcn.00404168
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x5b1d28
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b1e99
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b1e74
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00404e88
lea eax, [ebp - 0x118]
mov edx, 0x5b1eb0
call fcn.00404f78
mov eax, dword [ebp - 0x118]
call fcn.00405170
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x5b1de6
lea eax, [ebp - 0x111]
call fcn.0040aacc
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00404d90
jmp 0x5b1ded
mov eax, esi
call fcn.00404ca0
cmp bl, 0x61
jae 0x5b1e0e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f33c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404cf4
jmp 0x5b1e28
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f2b0
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404cf4
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x5b1ebc
call fcn.0040b1c4
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1e7b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x5bf3c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [edx + 0x18]
test al, 0x40
je 0x5bf3e3
push 5
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
test al, 0x80
je 0x5bf3f6
push 0
mov eax, ebx
call fcn.0046fb3c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x5ca274
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edi, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
test esi, esi
je 0x5ca3a0
test edi, edi
je 0x5ca3a0
test eax, eax
je 0x5ca3a0
test edx, edx
je 0x5ca3a0
mov eax, dword [ebp - 0x4c]
cdq
idiv esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x44]
dec eax
cdq
idiv esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
idiv edi
mov ebx, eax
mov eax, dword [ebp - 0x40]
dec eax
cdq
idiv edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005ca154
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_IntersectClipRect
mov eax, dword [ebp - 0x18]
sub eax, ebx
jl 0x5ca392
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
sub ebx, eax
jl 0x5ca38a
inc ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
imul edi
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
imul esi
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x3c]
sub eax, edx
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.0043553c
call fcn.00430660
push eax
push edi
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_BitBlt
inc dword [ebp - 8]
dec ebx
jne 0x5ca33a
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x5ca32c
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005ca12c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5ca52c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5ca545
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
Function at 0x5ca554
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5ca56d
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x5ced00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x100]
test byte [eax], 0x80
setne cl
test cl, cl
jne 0x5ced2e
inc eax
dec edx
jne 0x5ced20
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x5cee80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0xc]
mov word [ebp - 4], ax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ceea7
add word [ebp - 4], 0x2000
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ceeb9
add word [ebp - 4], 0x4000
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5ceecb
add word [ebp - 4], 0x8000
lea eax, [ebp - 8]
call fcn.005ceccc
mov ebx, eax
test ebx, ebx
je 0x5ceef1
mov cx, word [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005ce988
test al, al
je 0x5ceef1
mov byte [ebp - 1], 1
jmp 0x5cef2b
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.005ced90
pop ecx
cmp byte [ebp - 1], 0
jne 0x5cef2b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
cmp eax, dword [edx - 4]
je 0x5cef2b
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
call fcn.005ced90
pop ecx
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5cefe8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push ebp
call fcn.005cee80
pop ecx
test al, al
je 0x5cf008
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
jmp 0x5cf0e7
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5cf0e7
call fcn.005ced34
mov dl, byte [0x5cf0ec]
not edx
and dl, al
mov byte [ebp - 1], dl
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.005cef34
pop ecx
mov esi, eax
test esi, esi
jne 0x5cf05a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
je 0x5cf05a
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005cef34
pop ecx
mov esi, eax
test esi, esi
je 0x5cf0e7
mov eax, dword [esi + 0x18]
call fcn.005ed9d4
test al, al
je 0x5cf0e7
push esi
mov eax, esi
call fcn.005dbfd4
mov edx, dword [ebp + 8]
mov dx, word [edx + 0xc]
mov cl, byte [ebp - 1]
call fcn.005dd3f0
cmp esi, eax
sete bl
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
test al, al
je 0x5cf09d
test bl, bl
jne 0x5cf0af
mov eax, esi
call fcn.005dbea4
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x190]
test bl, bl
je 0x5cf0dd
mov eax, dword [esi + 0x10]
mov edx, dword [0x5c7198]
call fcn.00403f38
test al, al
je 0x5cf0d3
mov eax, esi
call fcn.005dbea4
mov byte [eax + 0x2a0], 1
xor edx, edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5cfffc
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x6c25fc]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041ff98
test eax, eax
jge 0x5d0021
mov eax, dword [0x6c25fc]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041fd90
cmp byte [ebx + 0x4d], 0
jne 0x5d0041
cmp dword [0x6c2678], 0
jne 0x5d0041
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6bdacc]
call dword [eax + 0x2c]
mov dword [0x6c2678], eax
cmp dword [0x6c2654], 0
jne 0x5d0063
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push fcn.005cf0f0
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x6c2654], eax
cmp dword [0x6c2658], 0
jne 0x5d0085
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5cf768
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x6c2658], eax
cmp dword [0x6c265c], 0
jne 0x5d00a7
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5cfdec
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [0x6c265c], eax
pop ebx
ret
Function at 0x5d3b34
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.005d0828
test al, al
jne 0x5d3c56
cmp byte [esi + 0x123], 0
je 0x5d3c56
test bl, bl
jne 0x5d3b6b
cmp byte [0x6c269c], 0
je 0x5d3c56
mov byte [0x6c269c], bl
mov eax, 0x6c2688
mov edx, edi
call fcn.00404cf4
mov byte [0x6c267c], 0
mov byte [esp], bl
test bl, bl
je 0x5d3baa
mov edi, dword [esi + 0x11c]
test edi, edi
je 0x5d3ba1
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x234], 0
je 0x5d3bae
cmp dword [0x6c2688], 0
jne 0x5d3bae
xor eax, eax
jmp 0x5d3bb0
mov al, 1
mov ebx, eax
test bl, bl
je 0x5d3c01
call fcn.005cec84
mov eax, dword [0x6c2678]
call fcn.0046fb3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5d3bf8
cmp byte [0x6c268c], 0
jne 0x5d3bf8
mov dword [0x6c2698], esi
push 0x5d38ac
push 0x3e8
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x6c2680], eax
jmp 0x5d3c56
mov eax, esi
call fcn.005d391c
jmp 0x5d3c56
call fcn.005cec84
mov eax, dword [0x6c2678]
call fcn.0046fb3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d3c56
push 0
mov eax, dword [0x6c2678]
call fcn.0046fb3c
push eax
call sub.user32.dll_ShowWindow
cmp byte [esp], 0
je 0x5d3c56
call fcn.005ceca4
mov byte [0x6c268c], 1
push 0x5d3910
push 0x190
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x6c2684], eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5db6cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5db705
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5db786
push ebp
mov al, 1
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 3
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 2
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 4
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5db754
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 3
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 2
call fcn.005db5dc
pop ecx
test al, al
jne 0x5db786
push ebp
mov al, 4
call fcn.005db5dc
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5dc6c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5dc785
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.005dbf8c
mov eax, dword [ebp - 8]
call fcn.005dc618
pop ecx
mov ebx, eax
test bl, bl
jne 0x5dc709
xor ebx, ebx
jmp 0x5dc76f
mov eax, ebx
add al, 0xd0
sub al, 0xa
jae 0x5dc728
xor eax, eax
mov al, bl
cmp di, ax
jne 0x5dc728
mov al, byte [0x5dc798]
cmp al, byte [ebp - 1]
jne 0x5dc728
mov bl, 1
jmp 0x5dc76f
push ebx
call sub.user32.dll_VkKeyScanA
mov esi, eax
mov eax, esi
and ax, 0xff
cmp di, ax
jne 0x5dc76d
shr si, 8
mov bl, byte [0x5dc798]
mov eax, esi
and ax, 1
cmp ax, 1
jne 0x5dc754
or bl, 1
and si, 2
cmp si, 2
jne 0x5dc761
or bl, 4
mov al, byte [ebp - 1]
cmp al, bl
sete al
mov ebx, eax
jmp 0x5dc76f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc78c
lea eax, [ebp - 8]
call fcn.00404ca0
ret

Function at 0x5f1714
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x20]
call fcn.005e3178
push esp
call sub.user32.dll_GetCursorPos
push esp
mov eax, dword [ebx + 0x20]
call fcn.0046fb3c
push eax
call sub.user32.dll_ScreenToClient
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x5f175e
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x5f1762
xor eax, eax
jmp 0x5f1764
mov al, 1
test al, al
je 0x5f1785
cmp byte [0x6c2668], 0
je 0x5f1778
call fcn.005ca52c
jmp 0x5f1785
push 1
call sub.user32.dll_GetKeyState
test ax, ax
setl al
add esp, 0x18
pop ebx
ret
Function at 0x602928
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
sete byte [0x6c260d]
cmp byte [0x6c260d], 0
je 0x602957
cmp dword [esp + 8], 0
je 0x60295b
xor eax, eax
jmp 0x60295d
mov al, 1
mov byte [0x6c260c], al
cmp dword [esp + 0x10], 1
jne 0x602970
cmp dword [esp + 8], 0
jne 0x602982
cmp dword [esp + 0x10], 2
jne 0x60297e
cmp dword [esp + 4], 5
je 0x602982
xor eax, eax
jmp 0x602984
mov al, 1
mov byte [0x6c260e], al
add esp, 0x94
ret