joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c810
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
mov dword [ebp - 0x11c], 0x114
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x42c853
mov eax, dword [ebp - 0x10c]
mov dword [0x67f8fc], eax
mov eax, 0x67f900
lea edx, [ebp - 0x108]
mov ecx, 0x80
call fcn.0040a918
mov eax, 0x67f904
call fcn.00409ce4
xor eax, eax
mov dword [0x67f908], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [0x67f7c0], 0xa
jl 0x42c9a9
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x42c9b4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x42c9a9
xor eax, eax
push ebp
push 0x42c9a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42ca10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42c902
cmp dword [ebp - 8], 2
jle 0x42c902
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42c8d5
adc edx, 0
mov eax, 0x67f904
call fcn.0040a9f0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x67f904]
call fcn.0040a87c
push eax
push 0
push 0
push 0x42ca10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
jmp 0x42c95c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x42ca30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x42c95c
cmp dword [ebp - 8], 2
jle 0x42c95c
mov edx, dword [ebp - 8]
sub edx, 2
sar edx, 1
jns 0x42c931
adc edx, 0
mov eax, 0x67f904
call fcn.0040a9f0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x67f904]
call fcn.0040a87c
push eax
push 0
push 0
push 0x42ca30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push 0x67f908
push 0
push 0
push 0x42ca44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x42c989
xor eax, eax
mov dword [0x67f908], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c9a9
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
mov byte [0x674740], 1
mov esp, ebp
pop ebp
ret
Function at 0x42caec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42cbc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a11c
lea eax, [ebp - 4]
call fcn.0040a2b0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a87c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x42cbae
mov eax, ebx
call fcn.00406e94
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42cba7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a87c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x42cb8f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42cbd8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x42cb8f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cbae
mov eax, dword [ebp - 0x10]
call fcn.00406eb0
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cbcd
lea eax, [ebp - 4]
call fcn.00409ce4
pop eax
jmp eax

Function at 0x42db30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a1f0
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0041037c
mov edi, eax
cmp edi, 0x104
jbe 0x42dadb
mov eax, edi
add eax, eax
call fcn.00406e94
mov esi, eax
jmp 0x42dadd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0041037c
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42db16
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42db00
mov eax, esp
cmp esi, eax
je 0x42db23
mov eax, esi
call fcn.00406eb0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42db5c
cmp bl, 0
je 0x42db58
cmp bl, 0x41
jl 0x42db53
cmp bl, 0x5a
jg 0x42db53
or bl, 0x20
xor al, bl
inc esi
jmp 0x42db37
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42da9c

Function at 0x42e5b4
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a918
add esp, 0x800
pop ebx
ret
Function at 0x42f3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f3ce
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42f3e6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f3e1
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x42f3eb
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42f459
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42f4a2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42f417
inc dword [ebp - 0xc]
jmp 0x42f42f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42f42f
cmp dword [ebp - 0xc], 0
jle 0x42f42f
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42f451
xor eax, eax
jmp 0x42f44d
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42f44c
mov eax, esi
jmp 0x42f4a5
inc eax
cmp eax, ecx
jle 0x42f439
inc esi
cmp esi, dword [ebp - 8]
jl 0x42f403
jmp 0x42f4a2
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42f4a2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42f47a
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42f49c
xor eax, eax
jmp 0x42f498
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42f497
mov eax, esi
jmp 0x42f4a5
inc eax
cmp eax, ecx
jle 0x42f484
inc esi
cmp esi, dword [ebp - 8]
jl 0x42f462
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42f880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42f89d
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42f8ab
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42f9cd
test ebx, ebx
jl 0x42f9cd
test esi, esi
jle 0x42f9cd
mov eax, dword [ebp - 8]
call fcn.0040a87c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040a87c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42f96a
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42f9cd
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f94f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f91e
inc dword [ebp - 0x14]
jmp 0x42f92e
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42f92e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42f939
or eax, 0xffffffff
jmp 0x42f94f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f94c
inc eax
jmp 0x42f94f
or eax, 0xffffffff
test eax, eax
jl 0x42f957
cmp esi, eax
jg 0x42f90c
cmp esi, eax
jg 0x42f962
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f9d0
inc edx
dec dword [ebp - 0x1c]
jne 0x42f908
jmp 0x42f9cd
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42f9cd
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42f9b4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42f993
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42f99e
or eax, 0xffffffff
jmp 0x42f9b4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42f9b1
inc eax
jmp 0x42f9b4
or eax, 0xffffffff
test eax, eax
jl 0x42f9bc
cmp esi, eax
jg 0x42f97c
cmp esi, eax
jg 0x42f9c7
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f9d0
inc edx
dec dword [ebp - 0x1c]
jne 0x42f978
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x440c58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x440c60
mov eax, edx
pop esi
pop ebx
ret
Function at 0x453d38
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x453d4c
add esp, 0xfffffff0
call fcn.0040845c
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44dc60]
call fcn.0046fa38
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x452d08]
call fcn.00471154
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x452d08]
call fcn.00471154
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x453da1
call fcn.004084b4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b46d4
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4b4717
cmp byte [ebx + 0x11], 0
jne 0x4b4717
cmp byte [ebx + 0x24], 0
jne 0x4b4717
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b472e
mov ecx, dword [0x67bbc0]
mov dl, 1
mov eax, dword [0x482580]
call fcn.0042b880
call fcn.004093cc
pop ebx
ret
mov ecx, dword [0x67bbc0]
mov dl, 1
mov eax, dword [0x482580]
call fcn.0042b880
call fcn.004093cc
pop ebx
ret

Function at 0x4b4d90
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b4dde
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b4580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4df7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b4e00
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b4580
dec esi
jne 0x4b4e22
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4b78cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x6828c4
cmp dword [edi], 0
jne 0x4b7948
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x6828c0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x675a8c
mov ecx, 2
call fcn.004072a0
mov edx, 0x4b78a4
lea eax, [esi + 5]
call fcn.004b78c4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004b78c4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4b791d
mov dword [0x6828c0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4c17a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4c17b7
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4c17a7
mov eax, ecx
pop ebx
ret

Function at 0x4e1aa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040a87c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004e1540
test al, al
jne 0x4e1b05
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x67becc]
mov dl, 1
mov eax, dword [0x4e004c]
call fcn.0042b8bc
call fcn.004093cc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e143c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ec7f8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ec7fe
ret
Function at 0x500884
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x677b98]
cmp edx, 4
mov eax, ecx
jl 0x50088c
pop ebp
ret

Function at 0x5008a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x677f98]
cmp edx, 4
mov eax, ecx
jl 0x5008b0
pop ebp
ret
Function at 0x511348
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x682ae0], 0
je 0x51148c
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x67bb7c]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x51148c
mov eax, dword [0x682ae4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x682ae0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x51145b
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x682ae0]
call fcn.004a2708
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x511453
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x225], 0
je 0x511453
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x80]
test al, al
je 0x511453
mov eax, dword [ebp - 0x14]
call fcn.0051df3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x511453
push ebp
call fcn.00511304
pop ecx
test al, al
jne 0x511453
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00408254
test al, al
je 0x511453
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00408254
cmp byte [ebp - 1], 0
je 0x511453
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.004126c0
test al, al
je 0x511453
mov edx, dword [ebp - 0x14]
mov eax, dword [0x682ae4]
call fcn.00510a84
inc edi
dec ebx
jne 0x5113ad
mov eax, dword [0x682ae4]
cmp dword [eax + 8], 0
jle 0x511473
mov eax, dword [0x682ae4]
call fcn.00510b38
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x51148c
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0051116c
pop ecx
test al, al
jne 0x51148c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51a5b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004128a4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00513a90
test ebx, ebx
jne 0x51a607
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0051a464
mov ebx, eax
test ebx, ebx
je 0x51a6fd
cmp esi, ebx
je 0x51a630
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x51a645
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x51a67d
add eax, 0xffffff5f
sub eax, 2
jb 0x51a695
dec eax
sub eax, 2
jb 0x51a6a9
dec eax
sub eax, 2
jb 0x51a69f
jmp 0x51a6b3
add eax, 0xfffffdff
sub eax, 2
jb 0x51a695
dec eax
sub eax, 2
jb 0x51a6a9
dec eax
sub eax, 2
jb 0x51a69f
jmp 0x51a6b3
mov byte [esp + 0x120], 0
jmp 0x51a6bb
mov byte [esp + 0x120], 2
jmp 0x51a6bb
mov byte [esp + 0x120], 1
jmp 0x51a6bb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0058c79c
mov esi, eax
call fcn.00510150
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0051565c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x51a6ff
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x53fdc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53fdde
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53fdee
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53fdfe
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x5620d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.00409e7c
test ebx, ebx
je 0x56212a
mov eax, dword [esi]
call fcn.0040a87c
push eax
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageW
sub ebx, eax
test ebx, ebx
jle 0x56212a
mov eax, dword [esi]
test eax, eax
je 0x56211f
mov eax, dword [eax - 4]
mov edx, eax
sub edx, ebx
mov eax, esi
call fcn.0040a9f0
pop edi
pop esi
pop ebx
ret
Function at 0x569ff4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0056a0bc
test eax, eax
je 0x56a046
mov edi, dword [ebx + 8]
test edi, edi
je 0x56a022
test edi, edi
je 0x56a022
mov edx, esi
mov eax, edi
call fcn.005142e8
jmp 0x56a054
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0056a0bc
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e7c
jmp 0x56a054
mov ecx, esi
mov edx, 0x56a074
mov eax, ebx
call fcn.00569f7c
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a0d4
add esp, 0x200
pop edi
pop esi
pop ebx
ret

Function at 0x579228
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409ce4
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x57927a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x579273
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a918
jmp 0x57927a
mov eax, esi
call fcn.00409ce4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x57ed50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57eeb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x67aa70], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4e0298]
call fcn.004e1494
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x57ee89
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004e157c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a918
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x57eed0
call fcn.0040aacc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004e15e0
test al, al
je 0x57ee71
lea ecx, [ebp - 4]
mov edx, 0x57ef44
mov eax, dword [ebp - 0xc]
call fcn.004e19f0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042e8bc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57ee71
xor edx, edx
push ebp
push 0x57ee6a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x57ef5c
mov eax, dword [ebp - 8]
push eax
call fcn.00413ec8
test eax, eax
je 0x57ee51
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x57ee51
call fcn.0057ecdc
test eax, eax
je 0x57ee41
mov eax, dword [ebx + 0x50]
jmp 0x57ee44
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x67aa70]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ee71
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ee90
mov eax, dword [ebp - 0xc]
call fcn.00407f38
pop eax
jmp eax