joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eab0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, 0x5bd568
mov dword [esp], 0x40ea40
call fcn.00441bc0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.msvcrt.dll_setlocale
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, 2
mov esi, eax
mov edi, eax
mov dword [esp + 0x18], ecx
movzx eax, byte [eax]
test al, al
je 0x40eb2b
mov cl, al
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
je 0x40eb23
inc dword [esp + 0x18]
inc edi
movzx ecx, byte [edi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40eb09
test cl, cl
je 0x40eb2b
inc edi
movzx ecx, byte [edi]
test cl, cl
jne 0x40eaf3
mov dword [esp], esi
mov ebx, dword [esp + 0x18]
mov edi, esi
call sub.msvcrt.dll_strlen
shl ebx, 2
lea eax, [ebx + eax + 1]
mov dword [esp], eax
call fcn.0043ce60
dec dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x20], eax
add eax, ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x18]
cmp dword [esp + 0x1c], edx
jge 0x40ec31
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [edx + eax*4], esi
jmp 0x40eb76
inc edi
movzx ecx, byte [edi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40eb75
test cl, cl
je 0x40ec31
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x14], eax
nop
lea esi, [esi]
cmp cl, 0x5c
mov ebp, 1
jne 0x40ebba
lea esi, [esi]
inc edi
inc ebx
movzx ecx, byte [edi]
cmp cl, 0x5c
je 0x40ebb0
cmp cl, 0x22
je 0x40ec00
test ebx, ebx
jmp 0x40ebc8
mov byte [esi], 0x5c
inc esi
dec ebx
jne 0x40ebc3
movzx ecx, byte [edi]
test cl, cl
je 0x40ec7d
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40ebf3
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ec7d
test ebp, ebp
je 0x40ebfa
mov byte [esi], cl
inc esi
inc edi
movzx ecx, byte [edi]
jmp 0x40eba0
test bl, 1
jne 0x40ec23
mov eax, dword [esp + 0x14]
xor ebp, ebp
test eax, eax
je 0x40ec15
cmp byte [edi + 1], 0x22
je 0x40ec27
xor eax, eax
cmp dword [esp + 0x14], 0
sete al
mov dword [esp + 0x14], eax
sar ebx, 1
jmp 0x40ebbf
inc edi
mov ebp, 1
sar ebx, 1
jmp 0x40ebbf
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], edx
mov dword [edx + eax*4], 0
mov dword [esp + 0x28], eax
call fcn.0041bb10
mov dword [esp + 0xc], eax
mov eax, 0x40e460
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0049d740
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov byte [esi], 0
lea eax, [esi + 1]
inc dword [esp + 0x1c]
jmp 0x40eb58
Function at 0x412a10
Capabilities:
Create process on windows

Disassembly:
push ebx
mov eax, 0x44
sub esp, 0x98
mov dword [esp + 8], eax
lea ebx, [esp + 0x30]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x80]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, 0x200
xor edx, edx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
jne 0x412ab0
xor eax, eax
mov ebx, 0x5bd97b
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00411cd0
add esp, 0x98
mov eax, 1
pop ebx
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov ecx, 0xffffffff
mov eax, dword [esp + 0x80]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [esp + 0xa8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
sub esp, 8
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor eax, eax
add esp, 0x98
pop ebx
ret
Function at 0x44d420
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], esi
call fcn.0044d200
mov esi, dword [ebx]
test esi, esi
je 0x44d450
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
add esp, 0xc
jmp fcn.0044d270
mov dword [esp], 4
call fcn.0043ce60
mov esi, eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x44d484
mov dword [esi], eax
mov dword [ebx], esi
mov dword [esp], ebx
call fcn.004618d0
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
add esp, 0xc
jmp fcn.0044d270
mov dword [esp], 0x5c2610
call fcn.00441ce0
jmp 0x44d46a

Function at 0x44d4a0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
xor edx, edx
sub esp, 8
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x44d4c5
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x44d4cc
mov edx, ebx
add esp, 8
mov eax, edx
pop ebx
ret
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x44d4c3
mov dword [esp], 0x5c263c
call fcn.00441ce0
jmp 0x44d4c3

Function at 0x44d4f0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [edx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x44d516
add esp, 0xc
ret
mov eax, 0x5c266c
mov dword [esp + 0x10], eax
add esp, 0xc
jmp fcn.00441ce0

Function at 0x44d930
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [0x5ecb18]
test ecx, ecx
je 0x44d960
mov eax, dword [0x5ecb28]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
mov ebx, eax
je 0x44d988
add esp, 8
mov eax, ebx
pop ebx
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x5ecb28], eax
mov edx, 1
cmp eax, 0xffffffff
mov dword [0x5ecb18], edx
jne 0x44d943
mov dword [esp], 0x5c26e4
call fcn.00441ce0
jmp 0x44d93e
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x44d954
mov dword [esp], 0x5c270c
call fcn.00441ce0
jmp 0x44d954

Function at 0x44d9a0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [0x5ecb28]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x44d9c3
add esp, 0xc
ret
mov eax, 0x5c2738
mov dword [esp + 0x10], eax
add esp, 0xc
jmp fcn.00441ce0
Function at 0x460140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x6c]
test ebx, ebx
je 0x460258
mov edx, dword [ebp + 0x34]
test edx, edx
je 0x460258
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + 0x64]
xor ecx, ecx
mov dword [esp + 0x2c], ecx
test eax, eax
je 0x46017c
mov eax, dword [eax + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
mov ecx, dword [esp + 0x60]
xor esi, esi
test edx, edx
lea ebx, [esp + 0x30]
mov eax, dword [ecx + 0x1ec]
mov ecx, edx
mov dword [esp + 0x34], eax
je 0x4602a0
mov eax, dword [esp + 0x60]
mov dword [eax + 0x1ec], ebx
nop
lea esi, [esi]
test byte [esp + 0x74], 2
je 0x460262
xor eax, eax
mov edx, 1
mov dword [esp + 0x38], eax
mov ecx, dword [ebp + 0x34]
mov dword [esp + 0x3c], edx
jmp 0x4601d7
mov dword [esp + 0x38], ecx
mov ecx, dword [ecx + 0xc]
cmp dword [ecx + 0xc], esi
jne 0x4601d0
cmp dword [ecx], 0x45f720
jne 0x46027b
mov ebx, dword [ecx + 4]
mov eax, dword [ebx]
test eax, eax
je 0x46027b
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x7c]
or eax, 0x20
mov dword [ebx + 0x14], eax
mov edx, dword [esp + 0x70]
inc dword [ebx + 0x1c]
mov dword [ebx + 0x18], edx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0045fcb0
mov edi, eax
mov eax, dword [ebx + 0x1c]
dec eax
mov dword [ebx + 0x1c], eax
test eax, eax
js 0x4602b4
test eax, eax
jne 0x46027b
mov dword [esp], ebx
call fcn.0043d060
jmp 0x46027b
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
cmp dword [ecx], 0x45f720
mov dword [esp + 0x3c], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x38], eax
je 0x4601e8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x460286
mov esi, dword [eax + 0xc]
test edi, edi
mov ecx, eax
sete al
xor edx, edx
test ecx, ecx
setne dl
test edx, eax
jne 0x4601b0
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x60]
mov dword [edx + 0x1ec], eax
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x5c4044
call fcn.00441ce0
mov eax, dword [ebx + 0x1c]
jmp 0x46024a
Function at 0x460d70
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
lea edx, [esp]
mov eax, dword fs:[0]
mov dword [edx], eax
lea eax, [0x460dcd]
mov dword [edx + 4], eax
mov dword [edx + 8], ebp
mov dword [edx + 0xc], esp
mov dword [edx + 0x10], 1
mov dword fs:[0], edx
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cpuid
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edx, dword fs:[0]
mov eax, 0
mov dword [edx + 0x10], eax
jmp 0x460dd7
mov esp, dword [edx + 0xc]
mov ebp, dword [edx + 8]
mov eax, dword [edx]
mov dword fs:[0], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
Function at 0x48aae0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
test eax, eax
mov ebx, edx
mov edx, dword [esp + 0x20]
je 0x48ab05
mov dword [esp], edx
mov edx, ebx
call fcn.0048a7c0
mov dword [esp + 0x20], ebx
add esp, 0x18
pop ebx
jmp sub.msvcrt.dll_fflush
mov dword [esp + 0xc], ebx
mov edx, 0xa
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x5c8d30
call sub.msvcrt.dll_fwrite
mov dword [esp + 0x20], ebx
add esp, 0x18
pop ebx
jmp sub.msvcrt.dll_fflush
Function at 0x4d2fa0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x5ee0a8]
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], esi
test eax, eax
mov dword [esp + 0x1a8], edi
je 0x4d2fe0
mov ebx, dword [esp + 0x1a0]
mov esi, dword [esp + 0x1a4]
mov edi, dword [esp + 0x1a8]
add esp, 0x1ac
ret
mov eax, 0x94
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
mov eax, dword [esp + 0x110]
cmp eax, 2
mov dword [0x5ee0a8], eax
je 0x4d3036
mov ebx, dword [esp + 0x1a0]
mov edx, 1
mov dword [0x5ee098], edx
mov esi, dword [esp + 0x1a4]
mov edi, dword [esp + 0x1a8]
add esp, 0x1ac
ret
cmp dword [esp + 0x104], 5
jne 0x4d300f
cmp dword [esp + 0x108], 1
jne 0x4d300f
cld
mov eax, 0xc8
lea ebx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov ecx, 0x32
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp], 0x80000001
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, 0x20019
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x5d2afa
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4d30ab
mov ecx, 2
mov dword [0x5ee098], ecx
mov eax, dword [0x5ee0a8]
jmp 0x4d2fc4
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x28]
xor edi, edi
mov dword [esp + 0x14], eax
xor eax, eax
mov esi, 0x5d2b13
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov edi, 0x5d2b1b
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
cld
mov ecx, 0x11
sub esp, 4
repe cmpsb byte [esi], byte es:[edi]
jne 0x4d3096
mov ebx, 1
mov dword [0x5ee098], ebx
jmp 0x4d30a1
Function at 0x4d3630
Capabilities:
Open clipboard

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5ecbec]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], esi
mov esi, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov ebp, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp], 0x5ee118
call dword [eax + 0x4cc]
mov esi, dword [eax]
mov edi, eax
cmp esi, ebx
je 0x4d3692
mov eax, dword [0x5ecbec]
mov ebx, 0x5d2b2c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], ebx
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x18]
add esp, 0x1c
jmp ecx
mov eax, dword [esi + 0x510]
test eax, eax
jne 0x4d3700
mov dword [edi], 0
mov eax, dword [ebp + 0x7c]
test eax, eax
jne 0x4d3741
mov eax, dword [ebp + 0x88]
test eax, eax
je 0x4d36df
mov edx, dword [eax + 0x28]
test edx, edx
jne 0x4d377e
mov edx, dword [eax + 8]
test edx, edx
jne 0x4d3768
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x4d3751
mov dword [esp], eax
mov eax, dword [0x5ecbec]
call dword [eax + 0x18]
mov dword [esp + 0x20], ebp
mov eax, dword [0x5ecbec]
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov ecx, dword [eax + 0x18]
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
add esp, 0x1c
jmp ecx
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call fcn.004bc5e0
mov ebx, eax
call sub.USER32.dll_GetClipboardOwner
cmp eax, ebx
jne 0x4d369c
mov dword [esp], eax
call sub.USER32.dll_OpenClipboard
sub esp, 4
call sub.USER32.dll_EmptyClipboard
mov dword [esp], esi
mov ecx, 1
mov dword [esp + 4], ecx
call fcn.00517860
call sub.USER32.dll_CloseClipboard
jmp 0x4d369c
mov dword [esp], eax
mov eax, dword [0x5ecbec]
call dword [eax + 0x18]
jmp 0x4d36ad
mov dword [esp + 4], edx
mov dword [esp], ebp
call fcn.00509850
mov eax, dword [ebp + 0x88]
jmp 0x4d36d4
mov dword [esp], edx
mov eax, dword [0x5ecbec]
call dword [eax + 0x18]
mov eax, dword [ebp + 0x88]
jmp 0x4d36cd
mov dword [esp], edx
mov eax, dword [0x5ecbec]
call dword [eax + 0x18]
mov eax, dword [ebp + 0x88]
jmp 0x4d36c2
Function at 0x4d37a0
Capabilities:
Open clipboard

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov eax, dword [esi + 0x510]
test eax, eax
jne 0x4d37c5
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
mov eax, dword [eax + 0x14]
mov dword [esp], eax
call fcn.004bc5e0
mov ebx, eax
call sub.USER32.dll_GetClipboardOwner
cmp eax, ebx
je 0x4d3855
mov eax, dword [esi + 0x500]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x508]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x510]
mov dword [esp], eax
call fcn.004cc1a0
mov eax, dword [esi + 0x504]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x508]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x510]
mov dword [esp], eax
call fcn.004cc1a0
mov eax, dword [esi + 0x510]
mov dword [esp], eax
call fcn.0049b300
mov eax, dword [esi + 0x510]
mov dword [esp], eax
mov eax, dword [0x5ecbec]
call dword [eax + 0x368]
xor eax, eax
mov dword [esi + 0x510], eax
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp], eax
call sub.USER32.dll_OpenClipboard
sub esp, 4
call sub.USER32.dll_EmptyClipboard
mov dword [esp], esi
mov eax, 1
mov dword [esp + 4], eax
call fcn.00517860
call sub.USER32.dll_CloseClipboard
jmp 0x4d37db

Function at 0x4d3950
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebx
sub esp, 0x48
mov edx, dword [0x5ee0d8]
mov ebx, dword [esp + 0x50]
test edx, edx
je 0x4d3967
add esp, 0x48
pop ebx
ret
mov eax, 1
mov dword [0x5ee0d8], eax
call fcn.004d2fa0
cmp eax, 2
je 0x4d3a7d
mov eax, 0x5ab508
mov dword [0x5ef9b0], eax
mov eax, 3
xor ecx, ecx
mov dword [0x5ee0e8], eax
xor eax, eax
xor edx, edx
mov dword [0x5ee104], eax
xor eax, eax
mov dword [0x5ee108], eax
mov eax, 0x5d2af2
mov dword [0x5ee10c], eax
mov eax, 0x4d4770
mov dword [0x5ee0ec], eax
xor eax, eax
mov dword [0x5ee0fc], eax
xor eax, eax
mov dword [0x5ee0f0], ecx
mov dword [0x5ee0f4], edx
mov dword [0x5ee0f8], ebx
mov dword [0x5ee100], eax
mov dword [esp], 0x5ee0e8
call sub.USER32.dll_RegisterClassA
sub esp, 4
test ax, ax
je 0x4d3a3d
mov dword [esp], 0
call sub.USER32.dll_GetKeyboardLayout
sub esp, 4
movzx eax, ax
lea edx, [esp + 0x14]
mov dword [esp + 8], edx
mov ecx, 4
mov edx, 0x20001004
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
jne 0x4d3a4e
mov dword [esp + 4], ebx
mov dword [esp], 0x4d2f20
call fcn.00510910
add esp, 0x48
pop ebx
ret
mov dword [esp], 0x5d2b74
mov eax, dword [0x5ecbec]
call dword [eax + 0x10]
jmp 0x4d39ed
mov eax, 2
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
test eax, eax
je 0x4d3a28
mov eax, dword [esp + 0x20]
call fcn.004d38a0
jmp 0x4d3a28
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.COMCTL32.DLL_InitCommonControlsEx
sub esp, 4
mov eax, 0x5ab524
jmp 0x4d3984
Function at 0x513bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, pe_nt_image_headers32
push edi
push esi
xor esi, esi
push ebx
sub esp, 0xac
mov dword [esp + 0x7c], eax
mov eax, dword [0x5ecbec]
mov dword [esp + 0x78], edx
mov dword [esp], pe_nt_image_headers32
call dword [eax + 0x14]
mov ecx, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov edx, dword [ecx]
mov dword [edx + edi*4], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x7c]
mov ebx, dword [eax + 8]
mov ebp, dword [ebx + 0xc]
call fcn.004d3ac0
cmp dword [ebx + 0xc], eax
je 0x513cfe
mov ebx, dword [ebx + 0x10]
test ebx, ebx
je 0x513cbe
mov edi, dword [esp + 0x78]
mov esi, dword [esp + 0x78]
inc edi
shl edi, 0xa
shl esi, 0xa
cmp esi, edi
mov dword [esp + 0x3c], edi
jge 0x513cbe
lea esi, [esi]
lea edi, [edi]
mov dword [esp], esi
lea eax, [esp + 0x90]
xor edi, edi
mov dword [esp + 4], eax
mov eax, dword [0x5ecbec]
mov ebx, 0x10
call dword [eax + 0x518]
mov dword [esp + 0x20], edi
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [0x5ecbec]
mov dword [esp + 0x18], edx
mov edx, 4
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
mov dword [esp], 0
call dword [eax + 0x538]
test eax, eax
je 0x513cd0
inc esi
cmp esi, dword [esp + 0x3c]
jl 0x513c40
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x7c]
mov edx, esi
mov ecx, dword [esp + 0x78]
and edx, 0x3ff
mov eax, dword [edi]
sar edx, 3
mov ebx, dword [eax + ecx*4]
mov ecx, esi
mov eax, 1
and ecx, 7
inc esi
shl eax, cl
or byte [edx + ebx], al
cmp esi, dword [esp + 0x3c]
jmp 0x513cbc
mov esi, dword [esp + 0x78]
inc edi
mov edx, dword [ebx + 0x124]
mov ebp, dword [ebx + 0x120]
shl edi, 0xa
mov ebx, dword [ebx + 0x128]
mov dword [esp + 0x74], edx
shl esi, 0xa
xor edx, edx
mov dword [esp + 0x3c], edi
cmp esi, edi
mov esi, esi
lea edi, [edi]
jge 0x513cbe
cmp edx, ebp
jge 0x513d6d
mov ecx, esi
mov edi, 1
and ecx, 0x3ff
mov dword [esp + 0x70], ecx
mov ecx, esi
and ecx, 7
shl edi, cl
mov dword [esp + 0x4c], edi
lea esi, [esi]
lea edi, [edi]
movzx eax, word [ebx + edx*2]
cmp eax, esi
jge 0x513d74
inc edx
cmp edx, ebp
jl 0x513d60
inc esi
cmp esi, dword [esp + 0x3c]
jmp 0x513d30
mov eax, dword [esp + 0x74]
movzx eax, word [eax + edx*2]
cmp eax, esi
jg 0x513d6d
shr dword [esp + 0x70], 3
inc esi
mov ecx, dword [esp + 0x7c]
movzx eax, byte [esp + 0x4c]
mov edi, dword [esp + 0x78]
mov ecx, dword [ecx]
mov dword [esp + 0x5c], ecx
mov edi, dword [ecx + edi*4]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x6c], edi
or byte [ecx + edi], al
cmp esi, dword [esp + 0x3c]
jmp 0x513d30
Function at 0x516ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 8
xor ebx, ebx
mov dword [esp], 0x10
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x516fb0
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x516fd0
mov dword [esp], 0x12
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x516ff0
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
sub esp, 4
test al, 1
je 0x516f34
or ebx, 2
mov dword [esp], 0x90
call sub.USER32.dll_GetKeyState
sub esp, 4
test al, 1
je 0x516f4a
or ebx, 8
mov dword [esp], 0x91
call sub.USER32.dll_GetKeyState
sub esp, 4
test al, 1
je 0x516f60
or ebx, 0x20
mov dword [esp], 1
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x517020
mov dword [esp], 4
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x517010
mov dword [esp], 2
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
js 0x517000
add esp, 8
mov eax, ebx
pop ebx
ret
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
sub esp, 4
test ax, ax
mov ebx, 1
jns 0x516f06
lea esi, [esi]
mov dword [esp], 0x12
call sub.USER32.dll_GetKeyState
or ebx, 4
sub esp, 4
test ax, ax
jns 0x516f1e
nop
lea esi, [esi]
or ebx, 0x20000
jmp 0x516f1e
or ebx, 0x400
add esp, 8
mov eax, ebx
pop ebx
ret
or ebx, 0x200
jmp 0x516f90
or ebx, 0x100
jmp 0x516f78