joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d28d0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d2a7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x5d2a5c
mov dl, 1
mov eax, dword [0x4959a4]
call fcn.004b7d48
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.0040a310
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d2a4b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0060d978
test al, al
je 0x5d2a3e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d2a8c
lea eax, [ebp - 0x394]
call fcn.00428398
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5d2a3e
xor eax, eax
push ebp
push 0x5d2a37
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d2afc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5d2a20
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b494
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x5d2a20
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d2a3e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d2941
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004b7c84
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d2a82
lea eax, [ebp - 0x3a0]
call fcn.0040a310
ret

Function at 0x5d3634
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x997360]
cmp byte [eax + 0xb1], 0
jne 0x5d36a6
cmp dword [0x997380], 0
jne 0x5d3666
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x988554]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x997380], eax
cmp dword [0x99737c], 0
jne 0x5d3681
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x99737c], eax
cmp dword [0x997384], 0
jne 0x5d36a6
push esp
push 0
push 0
mov eax, dword [0x988550]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x997384], eax
pop edx
ret
Function at 0x5d39c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d39d7
add esp, 0xfffffff0
call fcn.00408c4c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c972c
mov eax, dword [0x9902e4]
cmp byte [eax], 0
jne 0x5d3a04
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x990b64]
cmp word [eax + 2], 0
jne 0x5d3a1e
mov eax, dword [0x990b64]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d5ba8
mov eax, dword [0x990e3c]
cmp word [eax + 2], 0
jne 0x5d3a38
mov eax, dword [0x990e3c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d5dac
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x506890]
call fcn.0050cb24
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5d6324
mov dl, 1
mov eax, dword [0x4921f0]
call fcn.00408620
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4921f0]
call fcn.00408620
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x50b3e8]
call fcn.00516750
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x5d3c1c
mov eax, dword [0x990810]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00516be0
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5d660c
mov dl, 1
mov eax, dword [0x4921f0]
call fcn.00408620
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x990810]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004280ac
test eax, eax
je 0x5d3b4c
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00427dd4
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00428090
test eax, eax
je 0x5d3b64
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b494
push ebx
push 0x5d5584
call fcn.005c9168
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x9902e4]
cmp byte [eax], 0
jne 0x5d3bb5
mov eax, ebx
call fcn.005d3ddc
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.005d6854
mov eax, ebx
call fcn.005d7480
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d3c12
call fcn.00408ca4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d4114
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x5d41c0
cmp dword [ebx + 0x98], 0
jne 0x5d41ba
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d404c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5d41ba
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d4180
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d41ba
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.004b369c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d418f
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d43e0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x997360]
cmp dword [eax + 0x178], 0
je 0x5d4545
test bl, bl
jne 0x5d4493
cmp dword [esi + 0xa0], 0
jne 0x5d4488
mov eax, esi
call fcn.005d72d0
push eax
push 0x5d42ec
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x5d4459
mov eax, dword [0x997360]
cmp byte [eax + 0xd7], 0
je 0x5d4459
mov eax, dword [esi + 0xdc]
call fcn.0040c878
mov edi, eax
cmp edi, 0
jl 0x5d4459
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d4442
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d4488
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004b369c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d4468
inc dword [esi + 0xa0]
jmp 0x5d4545
cmp dword [esi + 0xa0], 0
jle 0x5d4545
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x5d4545
cmp dword [esi + 0x48], 0
je 0x5d44f0
mov eax, dword [0x997360]
cmp byte [eax + 0xd7], 0
je 0x5d44f0
mov eax, dword [esi + 0xdc]
call fcn.0040c878
mov edi, eax
cmp edi, 0
jl 0x5d44f0
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d44d9
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d451f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004b369c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d44ff
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x5c592c]
call fcn.0040ca8c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5d51a0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x5d51fd
cmp byte [ebx + 0xd7], 0
jne 0x5d51fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a498
mov eax, dword [esi]
test eax, eax
je 0x5d51ea
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d520a
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a6f0
jmp 0x5d520a
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040a6f0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d6a3c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x5d6aaa
mov eax, esi
call fcn.00607878
test al, al
je 0x5d6aaa
mov eax, dword [ebx + 0x88]
call fcn.006074c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d6aaa
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5d6a9e
push 0
mov eax, dword [ebx + 0x88]
call fcn.006074c4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.005fe178
jmp 0x5d6aaa
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.005d6874
pop esi
pop ebx
ret
Function at 0x5e65d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040a310
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5e662a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5e6623
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040b494
jmp 0x5e662a
mov eax, esi
call fcn.0040a310
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5ebdb8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ebf17
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x9886e4], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4fe498]
call fcn.00500560
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5ebeed
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00500648
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040b494
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5ebf30
call fcn.0040b644
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.005008d4
test al, al
je 0x5ebed7
lea ecx, [ebp - 4]
mov edx, 0x5ebfa4
mov eax, dword [ebp - 0xc]
call fcn.0050115c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004303c4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5ebed7
xor edx, edx
push ebp
push 0x5ebed0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5ebfbc
mov eax, dword [ebp - 8]
push eax
call fcn.00414198
test eax, eax
je 0x5ebeb9
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5ebeb9
call fcn.005ebd44
test eax, eax
je 0x5ebea9
mov eax, dword [ebx + 0x50]
jmp 0x5ebeac
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x9886e4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ebed7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ebef4
mov eax, dword [ebp - 0xc]
call fcn.00408650
ret

Function at 0x5ec020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5ec067
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ec04a
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5ec05b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5ec067
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5ee2d8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x43f8a0]
call fcn.0040bdac
xor eax, eax
push ebp
push 0x5ee45b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x988708], 0
jne 0x5ee32c
mov ecx, dword [0x99032c]
mov dl, 1
mov eax, dword [0x41fbb4]
call fcn.0042dc4c
call fcn.00409990
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00407604
mov eax, ebx
call fcn.0040b07c
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x5ee46c
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040e260
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x5ee373
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x5ee3c8
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5ee3c1
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.0040b4d0
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.0040b494
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00425f04
test eax, eax
jne 0x5ee3c1
mov ebx, 0x15
jmp 0x5ee3cd
mov ebx, 0x10
jmp 0x5ee3cd
mov ebx, 0x15
xor eax, eax
push ebp
push 0x5ee418
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x9912b8]
movzx eax, word [eax]
or ax, 8
call fcn.00406a54
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x988708]
call fcn.005ee10c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee41f
call fcn.00406a44
ret
Function at 0x5fb7cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x997408], 0
je 0x5fb90d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x990d98]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x5fb90d
mov eax, dword [0x99740c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x997408]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5fb8dc
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x997408]
call fcn.004b369c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x5fb8d4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1fd], 0
je 0x5fb8d4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x5fb8d4
mov eax, dword [ebp - 0x14]
call fcn.006074c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5fb8d4
push ebp
call fcn.005fb788
pop ecx
test al, al
jne 0x5fb8d4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.0040899c
test al, al
je 0x5fb8d4
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0040899c
cmp byte [ebp - 1], 0
je 0x5fb8d4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.004110bc
test al, al
je 0x5fb8d4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x99740c]
call fcn.005faeec
inc edi
dec ebx
jne 0x5fb831
mov eax, dword [0x99740c]
cmp dword [eax + 8], 0
jle 0x5fb8f4
mov eax, dword [0x99740c]
call fcn.005fafa0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5fb90d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005fb5f0
pop ecx
test al, al
jne 0x5fb90d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x603ee8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004115ac
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005fdd88
test ebx, ebx
jne 0x603f3b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00603d64
mov ebx, eax
test ebx, ebx
je 0x604031
cmp esi, ebx
je 0x603f64
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x603f79
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x603fb1
add eax, 0xffffff5f
sub eax, 2
jb 0x603fc9
dec eax
sub eax, 2
jb 0x603fdd
dec eax
sub eax, 2
jb 0x603fd3
jmp 0x603fe7
add eax, 0xfffffdff
sub eax, 2
jb 0x603fc9
dec eax
sub eax, 2
jb 0x603fdd
dec eax
sub eax, 2
jb 0x603fd3
jmp 0x603fe7
mov byte [esp + 0x120], 0
jmp 0x603fef
mov byte [esp + 0x120], 2
jmp 0x603fef
mov byte [esp + 0x120], 1
jmp 0x603fef
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005c9218
mov esi, eax
call fcn.005fa87c
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.005ff788
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x604033
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x61ce54
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x61cea5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x61ce8c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x61ce7c
jmp 0x61cea5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x61ce8d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62c06c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edx, 0x62b9dc
mov eax, dword [ebx + 0xc]
call fcn.004b3c98
cmp byte [ebx + 0x314], 0
je 0x62c092
mov edi, 0xff
jmp 0x62c097
mov edi, pe_nt_image_headers32
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
mov dword [ebx + 0x310], eax
dec eax
test eax, eax
jl 0x62c0d1
inc eax
mov dword [esp + 8], eax
xor esi, esi
cmp edi, esi
jle 0x62c0c2
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b369c
cmp dword [eax], 0
jne 0x62c0ca
mov dword [ebx + 0x310], esi
jmp 0x62c0d1
inc esi
dec dword [esp + 8]
jne 0x62c0af
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x62c114
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b369c
mov dword [eax + 8], esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b369c
lea edx, [esi + esi*2]
mov cx, word [eax + 0xc]
mov word [ebx + edx + 0x10], cx
mov cl, byte [eax + 0xe]
mov byte [ebx + edx + 0x12], cl
inc esi
dec dword [esp + 8]
jne 0x62c0e3
mov esi, dword [ebx + 0x310]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
dec eax
sub eax, esi
jl 0x62c1e7
inc eax
mov dword [esp + 8], eax
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.004b369c
mov edi, eax
cmp dword [edi], 0
jne 0x62c14d
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
jmp 0x62c1dc
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x2fd
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x62c1ca
inc eax
mov dword [esp + 0xc], eax
xor ebp, ebp
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b369c
movzx eax, byte [eax + 0xc]
movzx edx, byte [edi + 0xc]
sub eax, edx
push eax
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b369c
movzx eax, byte [eax + 0xd]
movzx edx, byte [edi + 0xd]
sub eax, edx
pop edx
add edx, eax
push edx
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.004b369c
movzx eax, byte [eax + 0xe]
movzx edx, byte [edi + 0xe]
sub eax, edx
mov edx, eax
pop eax
add eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp]
jge 0x62c1c3
mov dword [esp], eax
mov dword [esp + 4], ebp
inc ebp
dec dword [esp + 0xc]
jne 0x62c16c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0xc]
call fcn.004b369c
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
inc esi
dec dword [esp + 8]
jne 0x62c12e
cmp byte [ebx + 0x314], 0
je 0x62c22d
movzx eax, byte [ebx + 0x310]
mov byte [ebx + 0x315], al
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x10], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x11], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x12], 0
inc dword [ebx + 0x310]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x62f308
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
dec esi
test si, si
jb 0x62f32e
inc esi
xor edx, edx
movzx edi, dx
mov ecx, dword [eax]
movzx ecx, byte [ecx + edi]
xor cl, dl
push ecx
mov ecx, dword [eax]
pop ebx
mov byte [ecx + edi], bl
inc edx
dec si
jne 0x62f316
pop edi
pop esi
pop ebx
ret