joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527218
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [esi + 0x20], 0
je 0x52733b
push ebx
mov ebx, dword [esi + 0x10]
sub ebx, dword [esi + 8]
push edi
mov edi, dword [esi + 0xc]
push dword [esi + 0x14]
sub edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [esi + 0x7c], eax
je 0x52728f
mov ecx, dword [esi + 0x80]
cmp ecx, eax
je 0x52728f
push 0xcc0020
push eax
push eax
push ecx
push ebx
push edi
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
xor eax, eax
mov edx, dword [esi]
push eax
push eax
push dword [ebp - 4]
mov ecx, esi
call dword [edx + 0x20]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x5272cc
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_OffsetRgn]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
push ebx
mov ebx, dword [ebp - 8]
push edi
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0x10], 1
jne 0x527301
push dword [ebp - 0xc]
jmp 0x527303
push 0
push ebx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push dword [ebp - 0xc]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x18]
call edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
leave
ret 4
Function at 0x529233
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
test esi, esi
je 0x52937d
cmp dword [esi + 0x4c], 0
je 0x52937d
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 4]
mov dword [ebp - 8], eax
sub ebx, eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
push 0
push 0
push dword [ebp - 4]
call fcn.005298b5
mov eax, dword [ebp + 8]
push dword [eax + 0x6c]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 8]
neg ecx
push ecx
mov ecx, dword [ebp - 0xc]
neg ecx
push ecx
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
push eax
push eax
push eax
push eax
call esi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + ecx]
push eax
mov eax, dword [ebp - 0xc]
lea edx, [edi + eax]
push edx
push ecx
push eax
call esi
mov esi, dword [sym.imp.GDI32.dll_SelectClipRgn]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
call esi
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
push ebx
mov ebx, dword [ebp - 0x10]
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
cmp dword [ebp - 0x1c], 1
jne 0x529356
push dword [ebp - 0x14]
jmp 0x529358
push 0
push ebx
call esi
push dword [ebp - 0x14]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x529b0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, eax
push dword [ebx + 0x28]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [ebx + 0x2c], 1
mov dword [0x63bd0c], eax
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebx + 0x28]
jne 0x529c9e
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x529c9e
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [ebp - 0x20]
mov ecx, 0x200
cmp eax, ecx
ja 0x529c13
je 0x529c05
mov ecx, 0xa9
cmp eax, ecx
ja 0x529bcf
je 0x529bb7
cmp eax, 0x1f
je 0x529bca
cmp eax, 0x86
je 0x529bbf
cmp eax, 0xa1
je 0x529bb7
cmp eax, 0xa2
jbe case.default.0x529c28
cmp eax, 0xa4
jbe 0x529bb7
cmp eax, 0xa5
jbe case.default.0x529c28
cmp eax, 0xa7
ja case.default.0x529c28
mov dword [ebx + 0x2c], esi
jmp 0x529c95
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebx + 0x28]
je case.default.0x529c28
mov dword [ebx + 0x2c], esi
jmp case.default.0x529c28
sub eax, 0x100
je 0x529bf6
dec eax
je 0x529c95
dec eax
je case.default.0x529c28
dec eax
dec eax
je 0x529bf6
dec eax
je 0x529c95
lea eax, [ebp - 0x24]
push eax
call edi
jmp 0x529c95
lea ecx, [ebp - 0x24]
mov eax, ebx
call fcn.005298ea
jmp 0x529c95
push ebx
lea eax, [ebp - 0x24]
call fcn.00529fdf
jmp 0x529c95
mov ecx, 0x9d99
cmp eax, ecx
ja case.default.0x529c28
je 0x529bca
add eax, 0xfffffdff
cmp eax, 8
ja case.default.0x529c28
jmp dword [eax*4 + 0x529d12]
push ebx
lea eax, [ebp - 0x24]
call fcn.0052992b
jmp 0x529c95
lea eax, [ebp - 0x24]
call fcn.00531f67
jmp 0x529c95
push ebx
lea eax, [ebp - 0x24]
call fcn.005299ab
jmp 0x529c95
lea eax, [ebp - 0x24]
call fcn.00532018
jmp 0x529c95
mov eax, dword [ebp - 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
call fcn.005294bd
test eax, eax
jne 0x529c93
lea eax, [ebp - 0x24]
push eax
call edi
xor esi, esi
cmp dword [ebx + 0x2c], esi
jne 0x529b37
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebx + 0x28]
jne 0x529caf
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [ebx + 8]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
call esi
test eax, eax
je 0x529cc9
push 0
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [ebx + 0x80]
push dword [edi]
call esi
test eax, eax
je 0x529ce1
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
lea eax, [ebp - 0x24]
call fcn.00529e4e
lea edi, [ebx + 0xe0]
push dword [edi]
call esi
test eax, eax
je 0x529cff
mov esi, edi
call fcn.004863e5
mov esi, ebx
call fcn.0052943c
and dword [0x63bd0c], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x52a21c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
movsx ecx, ax
shr eax, 0x10
push esi
cwde
push edi
push eax
mov dword [ebp - 8], eax
push ecx
mov eax, ebx
mov dword [ebp - 0xc], ecx
call fcn.00528ee5
mov ecx, ebx
mov edi, eax
call fcn.00528f5d
test eax, eax
je 0x52a2fa
lea esi, [ebx + 0x34]
call fcn.004750c1
mov ecx, dword [ebx + 0x30]
mov esi, dword [eax]
mov dword [ebp - 4], esi
test ecx, ecx
je 0x52a271
mov eax, dword [ecx]
push 0
push dword [esi + 0x84]
push 0
call dword [eax + 4]
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x52a280
mov eax, dword [ecx]
push esi
push 0
call dword [eax + 0xc]
push dword [ebp - 8]
mov eax, dword [esi]
push dword [ebp - 0xc]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x52a2c6
cmp dword [ebx + 0x60], edi
jne 0x52a2a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x64]
cmp eax, 0xc8
jbe 0x52a2fa
push 1
push edi
push dword [ebx + 0x50]
mov esi, ebx
call fcn.00528f89
mov esi, dword [ebp - 4]
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], edi
call fcn.0052a301
mov dword [ebx + 0x60], edi
jmp 0x52a2fa
cmp dword [ebx + 0x60], edi
jne 0x52a2d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x64]
cmp eax, 0x32
jbe 0x52a2fa
push 1
push edi
push dword [ebx + 0x50]
mov esi, ebx
call fcn.00528f89
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push dword [ebp - 0xc]
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], edi
mov eax, dword [ecx]
call dword [eax + 0x34]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x52ba1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
neg ecx
add dword [ebp + 0xc], ecx
push edi
push dword [ebp + 0xc]
neg eax
add dword [ebp + 8], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov edi, eax
cmp edi, 0xffffffff
je 0x52bba0
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x4c]
test eax, eax
je 0x52bba0
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x44]
mov ecx, dword [esi + 0x28]
mov ebx, eax
mov eax, dword [ebx + 0x84]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x52ba8a
mov edx, dword [ecx]
push 0
push eax
push esi
call dword [edx + 4]
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x52ba98
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push dword [ebp + 8]
mov ecx, ebx
call dword [eax + 0x10]
test eax, eax
je 0x52bae2
cmp dword [esi + 0x6c], edi
jne 0x52bac2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x70]
cmp eax, 0xc8
jbe 0x52bba0
push 1
push edi
push dword [esi + 0x64]
call fcn.0052b5a7
push 0
push edi
mov ecx, esi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call fcn.0052c1be
jmp 0x52bba0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x9c], 1
cmp dword [esi + 0x6c], edi
jne 0x52bb05
call ebx
sub eax, dword [esi + 0x70]
cmp eax, 0x32
jbe 0x52bb99
push 1
push edi
push dword [esi + 0x64]
call fcn.0052b5a7
push dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
push dword [ebp + 8]
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov eax, dword [ecx]
call dword [eax + 0x34]
test eax, eax
jne 0x52bb42
or dword [esi + 0x68], 0xffffffff
or dword [esi + 0x60], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [esi + 0x64]
call fcn.0052b5a7
or dword [esi + 0x64], 0xffffffff
jmp 0x52bb61
cmp eax, 1
jne 0x52bb4c
push dword [esi + 0x14]
jmp 0x52bb8d
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x52bb6b
push dword [esp + 0x14]
mov eax, dword [ecx]
push esi
call dword [eax + 8]
test eax, eax
je 0x52bb6b
mov dword [esi + 0x6c], edi
call ebx
mov dword [esi + 0x70], eax
jmp 0x52bb99
mov dword [0x63bce0], esi
call ebx
push 0
push 0x32
push 0x12345678
push dword [esi + 0x14]
mov dword [0x63bcdc], eax
call dword [sym.imp.USER32.dll_SetTimer]
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [0x63bcd4], esi
and dword [esi + 0x9c], 0
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52c525
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x20], 0
push esi
push edi
je 0x52c6a2
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp eax, 0x104
je 0x52c55c
cmp eax, 0x105
je 0x52c55c
cmp eax, 0x100
jne 0x52c6a2
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
cwde
test eax, eax
js 0x52c590
push 0x10
call esi
cwde
test eax, eax
js 0x52c590
mov cx, word [edi + 0xe]
mov eax, 0x2000
mov edx, eax
and cx, dx
cmp cx, ax
jne 0x52c590
xor esi, esi
inc esi
mov dword [esp + 0x10], esi
jmp 0x52c598
and dword [esp + 0x10], 0
xor esi, esi
inc esi
movzx ecx, word [edi + 8]
mov edi, dword [edi + 4]
cmp edi, 0x104
je 0x52c5b3
cmp edi, 0x100
jne 0x52c6a2
cmp dword [ebx + 0x9c], esi
jne 0x52c5e2
movzx eax, cx
sub eax, 0x1b
je 0x52c662
sub eax, 5
je 0x52c65c
sub eax, 5
je 0x52c624
dec eax
je 0x52c65c
dec eax
je 0x52c624
dec eax
je 0x52c65c
movzx eax, cx
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [esp + 0x10], 0
mov edi, eax
jne 0x52c603
cmp dword [ebx + 0x9c], esi
jne 0x52c686
push edi
call fcn.005940bb
pop ecx
test eax, eax
je 0x52c686
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0052c785
test eax, eax
je 0x52c677
push esi
push dword [esp + 0x18]
jmp 0x52c651
mov eax, dword [ebx]
xor edx, edx
cmp cx, 0x25
sete dl
mov ecx, ebx
push edx
push dword [ebx + 0x60]
call dword [eax + 0xb0]
mov edi, eax
push 2
mov eax, ebx
call fcn.0052c860
cmp dword [ebx + 0xa0], 0xffffffff
je 0x52c658
push esi
push edi
mov ecx, ebx
call fcn.0052c1be
mov eax, esi
jmp 0x52c6a4
push esi
push dword [ebx + 0x60]
jmp 0x52c651
push 2
or edi, 0xffffffff
mov eax, ebx
call fcn.0052c860
and dword [ebx + 0x9c], 0
jmp 0x52c658
cmp dword [ebx + 0x9c], esi
jne 0x52c686
cmp dword [esp + 0x10], 0
je 0x52c658
cmp dword [ebx + 0x9c], 0
jle 0x52c6a2
push 2
or edi, 0xffffffff
mov eax, ebx
call fcn.0052c860
and dword [ebx + 0x9c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52e54a
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x208]
push edi
test ecx, ecx
je 0x52e55f
call fcn.0052e54a
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
lea edi, [esi + 0x29c]
push dword [edi]
call ebp
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x52e57f
push 0
push dword [edi]
call ebx
push dword [esi + 8]
call ebp
test eax, eax
je 0x52e58f
push 0
push dword [esi + 8]
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x53095f
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], eax
je 0x5309f6
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov ecx, dword [esi + 8]
sub ecx, dword [esi]
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [edi + 0x24c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push 0xcc0020
push eax
push ecx
push dword [ebp - 8]
sub edx, eax
mov eax, dword [esi + 8]
push edx
sub eax, ecx
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [edi + 0xe4]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_FillRect]
push dword [ebp + 8]
call ebx
jmp 0x530a50
mov eax, dword [edi + 0x24c]
test eax, eax
je 0x530a50
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [edi + 0x24c]
call ebx
and dword [edi + 0x24c], 0
push dword [ebp - 4]
call ebx
push dword [ebp - 8]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
leave
ret 4
Function at 0x5332a4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
test esi, esi
je 0x5333f1
cmp dword [esi + 0x4c], 0
je 0x5333f1
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 4]
mov dword [ebp - 8], eax
sub ebx, eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
push 0
push 0
push dword [ebp - 4]
call fcn.0053218f
mov eax, dword [ebp + 8]
push dword [eax + 0xe4]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 8]
neg ecx
push ecx
mov ecx, dword [ebp - 0xc]
neg ecx
push ecx
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
push eax
push eax
push eax
push eax
call esi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + ecx]
push eax
mov eax, dword [ebp - 0xc]
lea edx, [edi + eax]
push edx
push ecx
push eax
call esi
mov esi, dword [sym.imp.GDI32.dll_SelectClipRgn]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
call esi
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
push ebx
mov ebx, dword [ebp - 0x10]
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
cmp dword [ebp - 0x1c], 1
jne 0x5333ca
push dword [ebp - 0x14]
jmp 0x5333cc
push 0
push ebx
call esi
push dword [ebp - 0x14]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x534598
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
push esi
push edi
neg ecx
add dword [ebp + 0xc], ecx
push dword [ebp + 0xc]
neg eax
add dword [ebp + 8], eax
push dword [ebp + 8]
lea esi, [ebx + 0x90]
push esi
mov dword [esp + 0x18], ebx
call fcn.00443782
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x534615
call fcn.005358e9
mov dword [ebx + 0xc8], eax
test eax, eax
je 0x53479a
cmp eax, 4
je 0x53479a
push 0
mov esi, ebx
call fcn.00527218
push 0
push 0xc8
push 0x4d3
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x53479a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x54]
mov esi, eax
push esi
mov eax, ebx
call fcn.00527989
test eax, eax
je 0x53479a
mov eax, dword [ebx]
push esi
mov ecx, ebx
mov dword [ebx + 0x68], esi
call dword [eax + 0x44]
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x18], edi
call dword [eax + 0x34]
cmp eax, 0xffffffff
jne 0x534787
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x53470e
push dword [ebx + 0x64]
mov eax, ebx
call fcn.00527989
test eax, eax
je 0x53471d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x534694
lea edi, [ebx + 0xe4]
call fcn.004404b9
mov eax, dword [ebx + 0x64]
cmp esi, eax
jle 0x5346d6
mov edi, eax
jmp 0x5346d0
mov eax, dword [ebx]
push edi
mov ecx, ebx
call dword [eax + 0x44]
test eax, eax
je 0x5346cf
mov eax, dword [eax + 0x84]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
add ebx, 0xe4
call fcn.00497712
mov ebx, dword [esp + 0xc]
mov dword [eax], 1
inc edi
cmp edi, esi
jle 0x53469f
jmp 0x53472d
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x44]
test eax, eax
je 0x534706
mov eax, dword [eax + 0x84]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
add ebx, 0xe4
call fcn.00497712
mov ebx, dword [esp + 0xc]
mov dword [eax], 1
inc esi
cmp esi, dword [ebx + 0x64]
jle 0x5346d6
jmp 0x53472d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x534738
mov dword [ebx + 0x64], esi
push dword [edi + 0x84]
mov eax, ebx
call fcn.00534ca3
push 0
mov esi, ebx
call fcn.00527218
jmp 0x53479a
mov eax, dword [ebx + 0x64]
lea edi, [ebx + 0xe4]
mov dword [esp + 0x14], eax
mov dword [ebx + 0x64], esi
call fcn.004404b9
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x84]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov ebx, edi
call fcn.00497712
mov ecx, dword [esp + 0x14]
mov dword [eax], 1
mov eax, dword [esp + 0xc]
cmp ecx, dword [eax + 0x64]
je 0x534798
push 0
mov esi, eax
call fcn.00527218
mov ebx, esi
jmp 0x53479a
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, edi
mov esi, ebx
call fcn.0052774b
jmp 0x53479a
mov ebx, eax
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
pop edi
xor eax, eax
pop esi
mov dword [0x63bcd4], ebx
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53c91b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
neg ecx
add dword [ebp + 0xc], ecx
push edi
push dword [ebp + 0xc]
neg eax
add dword [ebp + 8], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
mov edi, eax
cmp edi, 0xffffffff
je 0x53ca27
push edi
mov eax, esi
call fcn.00527989
test eax, eax
je 0x53c9a2
cmp dword [esi + 0x6c], edi
jne 0x53c972
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x70]
cmp eax, 0x32
jbe 0x53ca27
xor ebx, ebx
inc ebx
push ebx
push edi
push dword [esi + 0x64]
call fcn.0052b5a7
mov eax, dword [ebp + 8]
mov dword [esi + 0x59c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x5a0], eax
mov dword [esi + 0x598], ebx
mov dword [esi + 0x5cc], edi
mov dword [esi + 0x68], edi
jmp 0x53ca15
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x4c]
test eax, eax
je 0x53ca27
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x44]
mov ecx, dword [esi + 0x28]
mov ebx, eax
test ecx, ecx
je 0x53c9c6
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push dword [ebp + 8]
mov ecx, ebx
call dword [eax + 0x10]
test eax, eax
je 0x53ca07
cmp dword [esi + 0x6c], edi
jne 0x53c9ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x70]
cmp eax, 0x32
jbe 0x53ca27
push 1
push edi
push dword [esi + 0x64]
call fcn.0052b5a7
push 1
push edi
mov ecx, esi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call fcn.0052c1be
jmp 0x53ca27
push 1
push edi
push dword [esi + 0x64]
mov dword [esi + 0x68], edi
call fcn.0052b5a7
push dword [esi + 0x14]
mov dword [esi + 0x64], edi
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [0x63bcd4], esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8