joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x123127b4
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x47535cdf
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100023f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x100023b0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
push 0x1388
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5012313e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
jmp 0x50123164
push dword [esi + 0x30]
call fcn.501231a3
imul eax, eax, 3
pop ecx
cmp dword [esp + 0xc], eax
je 0x5012316d
mov esi, dword [esi]
cmp esi, edi
jne 0x50123150
xor eax, eax
pop edi
pop esi
mov eax, dword [esi + 0x18]
jmp 0x5012316a

Function at 0x50125848
Capabilities:
Encode data using xor

Disassembly:
pop es
add eax, 0x6f634954
outsb dx, byte [esi]
mov al, 0x56
adc dl, byte [eax - 0x14]
dec esi
adc dl, byte [eax]
add byte [eax], cl
inc edi
jb 0x501257a2
jo 0x501257ab
imul esp, dword [ebx + 0x73], 0xc0850000
nop
mov ah, 0x57
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx*2 + 0x57bc5012], dh
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [eax], dl
jl 0x501257ab
push eax
loopne 0x5012579a
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
adc dl, byte [eax + 0x38]
adc dword [edx], edx
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cwde
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
push esp
pop edx
adc dl, byte [eax + 0x10]
push esp
push edx
jae 0x50125831
jne 0x50125836
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x5012575b
inc eax
add byte [eax], ch
pop eax
adc dl, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
pop eax
adc dl, byte [eax + 0x30]
pop eax
adc dl, byte [eax + 0x28]
add byte [eax], al
add byte [edi + edx*2 + 0x12], bl
push eax
loopne 0x5012580e
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x98501210
pop eax
adc dl, byte [eax + 1]
add bh, bh
jmp dword [ebx + ebx*2 + 0x12]
push esp
inc edx
jb 0x501258aa
jae 0x5012589f
push 0x6f736552
push edx
jae 0x501258aa
jne 0x501258af
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x501257d2
ror byte [ecx + 0x31c289d1], 0xc0
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x5012584e
ret
mov ebx, edx
mov esi, eax
lea eax, [esi + 8]
push eax
call sub.kernel32.dll_DeleteCriticalSection
test bl, bl
jle 0x501258b7
invalid
pop es
mov eax, esi
call sub.rtl120.bpl__System__ClassDestroy_qqrp14System_TObject
pop esi
pop ebx
ret
Function at 0x5012c63c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, eax
push 0xe
call sub.user32.dll_GetClipboardData
mov edi, eax
test edi, edi
jne 0x5012c65e
mov eax, dword [0x50243fb4]
call fcn.50128bbc
mov eax, ebx
call sym.vcl120.bpl__Graphics_TMetafile_NewImage_qqrv
mov esi, dword [ebx + 0x28]
push 0
push edi
call sub.gdi32.dll_CopyEnhMetaFileW
mov dword [esi + 8], eax
lea eax, [ebp - 0x64]
push eax
push 0x64
mov eax, dword [esi + 8]
push eax
call sub.gdi32.dll_GetEnhMetaFileHeader
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x48]
mov dword [esi + 0x10], eax
mov word [esi + 0x18], 0
mov byte [ebx + 0x2c], 1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
test eax, eax
setne al
mov byte [ebx + 0x22], al
mov edx, ebx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50152ad8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x50152c39
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 0xc4]
test esi, esi
je 0x50152b19
mov eax, esi
call sym.vcl120.bpl__Controls_TWinControl_HandleAllocated_qqrv
test al, al
je 0x50152b15
mov eax, dword [ebx + 0xc4]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
mov esi, eax
jmp 0x50152b33
xor esi, esi
jmp 0x50152b33
mov eax, dword [ebx + 0xb0]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x50152b31
mov esi, dword [ebx + 0xb0]
jmp 0x50152b33
xor esi, esi
cmp byte [ebx + 0xa0], 0
je 0x50152ba7
mov eax, dword [ebx + 0xc0]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x50152c1b
movzx eax, byte [ebx + 0xbc]
mov eax, dword [eax*4 + 0x50242bcc]
push eax
mov eax, dword [ebx + 0xa4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0xb4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
lea edx, [ebp - 4]
mov eax, dword [ebx + 0xc0]
call sym.vcl120.bpl__Dialogs_TOpenDialog_GetFileName_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0xb8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.shell32.dll_ShellExecuteW
mov dword [ebx + 0xac], eax
jmp 0x50152bf2
movzx eax, byte [ebx + 0xbc]
mov eax, dword [eax*4 + 0x50242bcc]
push eax
mov eax, dword [ebx + 0xa4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0xb4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0xa8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebx + 0xb8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.shell32.dll_ShellExecuteW
mov dword [ebx + 0xac], eax
mov esi, dword [ebx + 0xac]
cmp esi, 0x20
ja 0x50152c1b
lea edx, [ebp - 8]
mov eax, esi
call fcn.5012335c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Exception_]
call fcn.50123374
call sub.rtl120.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50152c40
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x501b73cc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x501b7561
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x501b752f
xor edx, edx
push ebp
push 0x501b7528
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 8]
test eax, eax
je 0x501b743b
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x501b743b
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__InternalUStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test eax, eax
je 0x501b7444
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x501b74fd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x501b74ec
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x501b74a6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x501b74a6
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__InternalUStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test eax, eax
je 0x501b74af
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
lea ecx, [esi + 2]
mov edx, ebx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501b74f3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [sym.vcl120.bpl__Consts__SCannotOpenClipboard]
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Exception_]
call fcn.50123384
call sub.rtl120.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501b7568
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x501bd818
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x501bd884
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TCommonDialogAction_ExecuteTarget_qqrp14System_TObject
cmp byte [ebx + 0xa0], 0
je 0x501bd86e
cmp byte [ebx + 0xc8], 0
je 0x501bd86e
push 5
push 0
push 0
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileAction_GetDialog_qqrv
lea edx, [ebp - 4]
call sym.vcl120.bpl__Dialogs_TOpenDialog_GetFileName_qqrv
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501bd88b
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x501bd898
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x501bd98e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xd0]
test eax, eax
je 0x501bd8c9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x501bd8d1
mov al, 1
jmp 0x501bd8de
mov eax, dword [ebx + 0xd0]
call fcn.50123254
xor al, 1
test al, al
je 0x501bd90a
mov edx, esi
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileOpen_ExecuteTarget_qqrp14System_TObject
mov eax, ebx
call sym.vcl120.bpl__Stdactns_TFileAction_GetDialog_qqrv
lea edx, [ebp - 4]
call sym.vcl120.bpl__Dialogs_TOpenDialog_GetFileName_qqrv
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xd0]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x501bd911
mov byte [ebx + 0xa0], 1
cmp byte [ebx + 0xa0], 0
je 0x501bd958
push 5
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0xd0]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x501bd9a8
call fcn.5012331c
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x501bd9e4
push 0x501bda00
push 0
call sub.shell32.dll_ShellExecuteW
cmp word [ebx + 0xda], 0
je 0x501bd970
mov edx, ebx
mov eax, dword [ebx + 0xdc]
call dword [ebx + 0xd8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501bd995
lea eax, [ebp - 8]
call sub.rtl120.bpl__System__UStrClr_qqrpv
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x501bfb98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x501bfbdf
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x501c5414
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x501c554d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Registry_TRegistry_]
call sub.rtl120.bpl__Registry_TRegistry__bctr_qqrv
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x501c5523
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Registry_TRegistry_SetRootKey_qqrp6HKEY__
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x501c5568
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Registry_TRegistry_OpenKeyReadOnly_qqrx20System_UnicodeString
test al, al
je 0x501c550d
lea ecx, [ebp - 4]
mov edx, 0x501c55dc
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Registry_TRegistry_ReadString_qqrx20System_UnicodeString
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.5012343c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x501c5506
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x501c55f4
mov eax, dword [ebp - 8]
push eax
call fcn.501221c8
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x50243648]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501c550d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501c552a
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System_TObject_Free_qqrv
ret

Function at 0x501c5658
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x501c569f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x501c5682
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x501c5693
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x501c569f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x501c7c2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc dword [esp + eax*2 + 0x72], edx
popal
inc esp
outsd dx, dword [esi]
arpl word [ebx + 0x4f], bp
bound ebp, qword [edx + 0x65]
arpl word [ebp + eax*2 + 0x78], si
aam 0x7b
sbb al, 0x50
push eax
jnp 0x501c7c62
push eax
add byte [eax], al
or byte [ebx + 0x6f], al
outsb dx, byte [esi]
je 0x501c7cc1
outsd dx, dword [esi]
insb byte es:[edi], dx
jae 0x501c7c53
add byte [esp + edi*2 + 0x501c], ch
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
fstp dword [eax + edx*2]
Function at 0x501cc9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x502451e4], 0
je 0x501ccae1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x50243f9c]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x501ccae1
mov eax, dword [0x502451e8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x502451e4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x501ccab0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x502451e4]
call sub.rtl120.bpl__Classes_TList_Get_qqri
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x501ccaa8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x501ccaa8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x501ccaa8
mov eax, dword [ebp - 0x14]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x501ccaa8
push ebp
call fcn.501cc95c
pop ecx
test al, al
jne 0x501ccaa8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call sub.rtl120.bpl__System__CallDynaInst_qqrv
test al, al
je 0x501ccaa8
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call sub.rtl120.bpl__System__CallDynaInst_qqrv
cmp byte [ebp - 1], 0
je 0x501ccaa8
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.501230d8
test al, al
je 0x501ccaa8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x502451e8]
call fcn.501cc040
inc edi
dec ebx
jne 0x501cca05
mov eax, dword [0x502451e8]
cmp dword [eax + 8], 0
jle 0x501ccac8
mov eax, dword [0x502451e8]
call fcn.501cc0f8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x501ccae1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.501cc7c0
pop ecx
test al, al
jne 0x501ccae1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501d4c28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.501230d0
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call sym.vcl120.bpl__Controls_TControl_ScreenToClient_qqrrx12Types_TPoint
test ebx, ebx
jne 0x501d4c7b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call sym.vcl120.bpl__Controls_TWinControl_ControlAtPos_qqrrx12Types_TPointooo
mov ebx, eax
test ebx, ebx
je 0x501d4d66
cmp esi, ebx
je 0x501d4ca4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x501d4cb9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x501d4cf1
add eax, 0xffffff5f
sub eax, 2
jb 0x501d4d09
dec eax
sub eax, 2
jb 0x501d4d1d
dec eax
sub eax, 2
jb 0x501d4d13
jmp 0x501d4d27
add eax, 0xfffffdff
sub eax, 2
jb 0x501d4d09
dec eax
sub eax, 2
jb 0x501d4d1d
dec eax
sub eax, 2
jb 0x501d4d13
jmp 0x501d4d27
mov byte [esp + 0x120], 0
jmp 0x501d4d2f
mov byte [esp + 0x120], 2
jmp 0x501d4d2f
mov byte [esp + 0x120], 1
jmp 0x501d4d2f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call sym.vcl120.bpl__Forms_KeyboardStateToShiftState_qqrpxuc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call sym.vcl120.bpl__Controls_TControl_Perform_qqruiii
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x501d4d68
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret