joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503f1c
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5040da
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5040a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
test edi, edi
jge 0x503f71
call fcn.004041ac
jmp 0x5040af
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jl 0x503f87
call fcn.004041ac
jmp 0x5040af
push 0x5040f8
lea eax, [ebp - 8]
call fcn.00406534
mov ecx, eax
mov eax, 0x56fbe0
mov edx, 0x504108
call fcn.004ffbd4
test al, al
jne 0x503fb3
call fcn.004041ac
jmp 0x5040af
push 0
lea eax, [ebp - 0xc]
call fcn.00406534
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00418368
test al, al
je 0x503fde
call fcn.004041ac
jmp 0x5040af
cmp dword [ebp - 0xc], 0
jne 0x503fee
call fcn.004041ac
jmp 0x5040af
mov eax, dword [ebx + 0x30]
mov edx, edi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [eax + 8]
lea eax, [ebp - 0x18]
call fcn.004047bc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor ebx, ebx
jmp 0x50407a
push 0
mov eax, esi
call fcn.00406534
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x504078
cmp dword [esi], 0
je 0x50407a
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [esi]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
test eax, eax
jne 0x504069
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404944
mov eax, dword [ebp - 0x10]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404b3c
jne 0x504069
mov byte [ebp - 1], 1
mov bl, 1
cmp byte [ebp - 1], 0
jne 0x50407a
mov eax, esi
call fcn.00406534
jmp 0x50407a
mov bl, 1
test bl, bl
je 0x504010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5040af
cmp dword [ebp - 0xc], 0
je 0x504099
lea eax, [ebp - 0xc]
call fcn.00406534
cmp dword [ebp - 8], 0
je 0x5040a7
lea eax, [ebp - 8]
call fcn.00406534
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5040e1
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404748
lea eax, [ebp - 0xc]
call fcn.00406534
lea eax, [ebp - 8]
call fcn.00406534
ret
Function at 0x504118
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x50412b
add esp, 0xfffffff0
call fcn.00403c98
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x24]
call fcn.00404be0
mov eax, dword [ebp + 0x1c]
call fcn.00404be0
mov eax, dword [ebp + 0x14]
call fcn.00404be0
xor eax, eax
push ebp
push 0x504263
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [edi + 0x44], 0
mov dl, 1
mov eax, dword [0x41907c]
call fcn.00403904
mov dword [edi + 0x30], eax
mov al, byte [ebp + 0x18]
mov byte [edi + 4], al
mov eax, dword [ebp + 0x28]
mov dword [edi + 8], eax
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x24]
call fcn.00404778
lea eax, [edi + 0x40]
mov edx, dword [ebp + 0x1c]
call fcn.00404778
push esi
push edi
add edi, 0x20
mov esi, 0x570150
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 4]
push eax
push 0x56fb10
call sub.ole32.dll_StringFromCLSID
lea eax, [edi + 0x34]
mov edx, dword [ebp - 4]
call fcn.00404944
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
lea eax, [ebp - 4]
push eax
push 0x56fb00
call sub.ole32.dll_StringFromCLSID
lea eax, [edi + 0x38]
mov edx, dword [ebp - 4]
call fcn.00404944
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, dword [ebp + 0x20]
push esi
push edi
mov esi, eax
add edi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov al, byte [ebp + 0x10]
mov byte [edi + 0x3c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x48], eax
mov al, byte [ebp + 8]
mov byte [edi + 0x4c], al
mov dword [edi + 0x50], esi
mov eax, dword [ebp + 0x2c]
mov dword [edi + 0x54], eax
mov eax, dword [edi + 8]
sub eax, 3
je 0x504218
dec eax
je 0x504226
jmp 0x504234
mov edx, 0x56fa54
mov eax, edi
call fcn.00505d88
jmp 0x50423d
mov edx, 0x56fa64
mov eax, edi
call fcn.00505d88
jmp 0x50423d
xor edx, edx
mov eax, edi
call fcn.00505288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50426a
lea eax, [ebp + 0x14]
call fcn.00404724
lea eax, [ebp + 0x1c]
call fcn.00404724
lea eax, [ebp + 0x24]
call fcn.00404724
ret
Function at 0x504f30
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x504f38
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x5050c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41907c]
call fcn.00403904
mov edi, eax
push 0x5050dc
lea eax, [ebp - 4]
call fcn.00406534
mov ecx, eax
mov eax, 0x56fbe0
mov edx, 0x5050f0
call fcn.004ffbd4
test al, al
je 0x505084
push 0
lea eax, [ebp - 8]
call fcn.00406534
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x50507c
jmp 0x505056
cmp dword [ebp - 0xc], 0
je 0x505056
lea eax, [ebp - 0x10]
call fcn.00406534
push eax
push 0x505100
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
test eax, eax
jne 0x50504e
lea eax, [ebp - 0x38]
push eax
call sub.oleaut32.dll_VariantInit_1
push 0
lea eax, [ebp - 0x38]
push eax
push 0x505110
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x50504e
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x38]
call fcn.004056e0
lea eax, [ebp - 0x38]
call fcn.004056a0
mov edx, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
test bl, bl
je 0x505046
mov edx, dword [ebp - 0x14]
mov eax, 0x505134
call fcn.00404d34
mov esi, eax
test esi, esi
jle 0x505046
lea eax, [ebp - 0x14]
push eax
lea edx, [esi + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 0x14]
call fcn.00404c50
lea eax, [ebp - 0x10]
call fcn.00406534
lea eax, [ebp - 0xc]
call fcn.00406534
push 0
lea eax, [ebp - 0xc]
call fcn.00406534
push eax
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x504fb4
lea eax, [ebp - 8]
call fcn.00406534
lea eax, [ebp - 4]
call fcn.00406534
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5050cb
lea eax, [ebp - 0x38]
call fcn.00405780
lea eax, [ebp - 0x14]
call fcn.00404724
lea eax, [ebp - 0x10]
call fcn.00406534
lea eax, [ebp - 0xc]
call fcn.00406534
lea eax, [ebp - 8]
call fcn.00406534
lea eax, [ebp - 4]
call fcn.00406534
ret
Function at 0x509784
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
test cl, cl
je 0x50979c
mov eax, 8
dec eax
jne 0x509794
jmp 0x50986b
xor eax, eax
test dl, dl
lea ecx, [eax + eax*4]
xor esi, esi
mov dword [ebx + ecx*8 + 0x6c], esi
inc eax
cmp eax, 8
jne 0x50979e
lea esi, [ebx + 0x68]
mov dword [esi + 4], 2
mov eax, esi
mov edx, 0x50987c
call fcn.00404778
lea eax, [esi + 0xc]
call fcn.00404724
lea esi, [ebx + 0x90]
mov dword [esi + 4], 2
mov eax, esi
mov edx, 0x50989c
call fcn.00404778
lea eax, [esi + 0xc]
call fcn.00404724
lea esi, [ebx + 0x108]
mov dword [esi + 4], 1
mov eax, esi
mov edx, 0x5098b4
call fcn.00404778
xor eax, eax
mov dword [esi + 8], eax
lea esi, [ebx + 0x130]
mov dword [esi + 4], 1
mov eax, esi
mov edx, 0x5098cc
call fcn.00404778
xor eax, eax
mov dword [esi + 8], eax
lea esi, [ebx + 0x158]
mov dword [esi + 4], 1
mov eax, esi
mov edx, 0x5098e8
call fcn.00404778
xor eax, eax
mov dword [esi + 8], eax
lea eax, [ebx + 0x180]
mov ebx, eax
mov dword [ebx + 4], 2
mov eax, ebx
mov edx, 0x509904
call fcn.00404778
lea eax, [ebx + 0xc]
call fcn.00404724
pop esi
pop ebx
pop ebp
ret 8

Function at 0x509ab8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x509ba9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor esi, esi
xor ebx, ebx
jmp 0x509b86
cmp esi, 5
jne 0x509b02
mov bl, 1
jmp 0x509b86
inc esi
inc dword [ebp + 8]
push edi
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x509b20
mov bl, 1
jmp 0x509b86
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404914
mov eax, dword [ebp - 0x14]
mov dx, 0xffff
call fcn.00509a38
test eax, eax
je 0x509b6c
call fcn.00403934
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00404914
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov edx, edi
call fcn.00404914
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
pop ecx
call fcn.005099c0
mov byte [ebp - 0xd], 1
mov bl, 1
jmp 0x509b86
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.00404914
mov edx, dword [ebp - 0x20]
mov ecx, 0x509bc4
mov eax, dword [ebp - 4]
call fcn.005099c0
test bl, bl
je 0x509af6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509bb0
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404748
ret
Function at 0x50ab78
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x298], edx
mov esi, eax
xor eax, eax
push ebp
push 0x50ac6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404724
mov dl, 1
mov eax, dword [0x41907c]
call fcn.00403904
mov ebx, eax
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x50ac3b
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x50ac36
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x50ac36
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
xor edi, edi
jmp 0x50ac1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + edi*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x298]
call fcn.00404914
mov edx, dword [ebp - 0x298]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
mov eax, dword [ebp - 4]
cmp dword [eax + edi*4], 0
jne 0x50abf5
test edi, edi
jne 0x50ac36
mov edx, 0x50ac84
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
call sub.wsock32.dll_WSACleanup
mov eax, ebx
call fcn.0050a988
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, ebx
call fcn.00403934
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ac72
lea eax, [ebp - 0x298]
call fcn.00404724
ret

Function at 0x50c4c8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov al, byte [eax + 2]
ret

Function at 0x50cdd4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be0
xor eax, eax
push ebp
push 0x50ce76
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp dword [ebp - 4], 0
je 0x50ce60
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0050cd28
test al, al
je 0x50ce60
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x50ce60
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405790
call fcn.00405790
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x50ce5c
cmp dword [ebp - 0x20], 0x17d7840
jae 0x50ce60
jmp 0x50ce5e
jge 0x50ce60
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ce7d
lea eax, [ebp - 4]
call fcn.00404724
ret
Function at 0x50ce84
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404be0
xor eax, eax
push ebp
push 0x50ceea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0050cd28
test al, al
je 0x50ced4
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub eax, 4
je 0x50cec8
dec eax
je 0x50cecf
jmp 0x50ced4
mov ebx, 1
jmp 0x50ced4
mov ebx, 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cef1
lea eax, [ebp - 4]
call fcn.00404724
ret

Function at 0x50db40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404bf0
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x50db59
test al, 0x10
jne 0x50db5d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x516a18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x516a32
add esp, 0xfffffff0
call fcn.00403c98
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x516bc4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403904
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0xffffff
mov dl, 1
mov eax, dword [0x425554]
call fcn.00426c68
mov esi, eax
mov dword [ebx + 0x10], esi
mov eax, esi
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx + 0x10]
mov edx, 0xffff00
call fcn.00426e3c
mov eax, dword [ebx + 0x10]
mov edx, 0xc
call fcn.004270dc
mov byte [ebx + 0xc], 0
xor eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x140
mov byte [ebx + 0x1c], 1
xor eax, eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], 7
xor eax, eax
mov dword [ebx + 0x2c], eax
mov byte [ebx + 0x30], 1
xor esi, esi
lea eax, [ebx + esi*4 + 0x34]
call fcn.00404724
inc esi
cmp esi, 0xa
jne 0x516ac0
mov byte [ebx + 0x1a8], 0
mov byte [ebx + 0x1a9], 0
mov byte [ebx + 0x2f8], 0
mov byte [ebx + 0x2f9], 0
xor eax, eax
mov dword [ebx + 0x2fc], eax
test edi, edi
jne 0x516b06
lea eax, [ebx + 0x28]
mov edx, 0x516bf8
call fcn.00404778
jmp 0x516b5f
mov dword [ebx + 0x14], 0xc8
mov eax, edi
shl eax, 3
lea eax, [eax + eax*4]
mov dword [ebx + 0x2c], eax
cmp edi, 1
jne 0x516b2c
lea eax, [ebx + 0x28]
mov edx, 0x516c6c
call fcn.00404778
jmp 0x516b5f
push 0x516d9c
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00408f9c
push dword [ebp - 0xc]
push 0x516db4
push 0x516dc0
push 0x516db4
push 0x516de4
lea eax, [ebx + 0x28]
mov edx, 6
call fcn.00404ab8
sub edi, 2
je 0x516b6c
dec edi
je 0x516b7b
dec edi
je 0x516b9a
jmp 0x516bae
mov eax, dword [ebx + 0x10]
mov edx, 0xff00
call fcn.00426e3c
jmp 0x516bae
mov byte [ebx + 0x30], 0
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], 1
mov eax, dword [ebx + 0x10]
mov edx, 0xffffff
call fcn.00426e3c
jmp 0x516bae
mov eax, dword [ebx + 0x10]
mov edx, 0xffff
call fcn.00426e3c
mov dword [ebx + 4], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516bcb
lea eax, [ebp - 0xc]
call fcn.00404724
ret
Function at 0x525588
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
test esi, esi
je 0x525607
xor edx, edx
push ebp
push 0x5255fd
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5255c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525607
call sub.user32.dll_EmptyClipboard
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [ebp - 1]
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525607
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x540c9c
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x540e17
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x44]
movzx edx, word [eax + 0x3e]
mov ecx, dword [ebp + 8]
add eax, 0x30
mov ecx, ebx
call fcn.0050b0b4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x6a4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x540dfc
cmp ebx, 0x3e7
jle 0x540d31
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00408f9c
push dword [ebp - 4]
push 0x540e2c
lea edx, [ebp - 8]
mov eax, esi
call fcn.00408f9c
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
mov edx, 3
call fcn.00404ab8
jmp 0x540da0
cmp ebx, 0x64
jge 0x540d6c
push 0x540e38
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f9c
push dword [ebp - 0xc]
push 0x540e2c
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00408f9c
push dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
mov edx, 4
call fcn.00404ab8
jmp 0x540da0
push 0x540e44
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00408f9c
push dword [ebp - 0x14]
push 0x540e2c
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00408f9c
push dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
mov edx, 4
call fcn.00404ab8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x5c30]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x540dfc
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x5c30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x68
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
lea eax, [ebp - 0x1c]
mov edx, 0x540e50
call fcn.00404a44
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, 1
mov dl, 1
call fcn.0053f2d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540e1e
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404748
ret
Function at 0x564538
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x564670
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x564563
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x564575
mov byte [ebp - 1], 1
jmp 0x564666
mov eax, dword [0x5707b4]
cmp dword [eax], 2
jne 0x564589
mov eax, dword [0x570494]
cmp dword [eax], 4
jg 0x5645bd
mov eax, dword [0x5707b4]
cmp dword [eax], 1
jne 0x56464f
mov eax, dword [0x570494]
cmp dword [eax], 4
jg 0x5645bd
mov eax, dword [0x570494]
cmp dword [eax], 4
jne 0x56464f
mov eax, dword [0x570664]
cmp dword [eax], 0
jle 0x56464f
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x564607
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x56465b
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x56465b
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56467a
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x564758
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
xor ecx, ecx
push ebp
push 0x564884
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x564873
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
dec ecx
je 0x564819
dec ecx
jne 0x56486a
cmp eax, 4
jg 0x5647c4
mov dword [ebp - 4], 4
jmp 0x56487a
cmp eax, 5
jne 0x5647d9
test edx, edx
jne 0x5647d9
mov dword [ebp - 4], 5
jmp 0x56487a
cmp eax, 5
jne 0x5647ef
cmp edx, 1
jne 0x5647ef
mov dword [ebp - 4], 6
jmp 0x56487a
cmp eax, 5
jne 0x564802
cmp edx, 2
jne 0x564802
mov dword [ebp - 4], 6
jmp 0x56487a
cmp eax, 6
jne 0x564810
mov dword [ebp - 4], 7
jmp 0x56487a
mov dword [ebp - 4], 0xffffffff
jmp 0x56487a
cmp eax, 4
jne 0x564829
test edx, edx
jne 0x564829
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x56487a
cmp eax, 4
jne 0x56484e
cmp edx, 0xa
jne 0x56484e
cmp byte [ebp - 0x83], 0x41
jne 0x564845
mov dword [ebp - 4], 2
jmp 0x56487a
mov dword [ebp - 4], 1
jmp 0x56487a
cmp eax, 4
jne 0x564861
cmp edx, 0x5a
jne 0x564861
mov dword [ebp - 4], 3
jmp 0x56487a
mov dword [ebp - 4], 0xffffffff
jmp 0x56487a
mov dword [ebp - 4], 0xffffffff
jmp 0x56487a
mov dword [ebp - 4], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56488e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x564a38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x564aac
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x564ac0]
mov byte [ebp - 1], al
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf0], 0x80
je 0x564a7a
mov al, byte [0x564ac4]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xf1], 0x80
je 0x564a8e
mov al, byte [0x564ac8]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xef], 0x80
je 0x564aa2
mov al, byte [0x564acc]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x564ab6
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x564e98
Capabilities:
Find taskbar

Disassembly:
push ebx
mov ebx, eax
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00419cd8
push 0
push 0x564ec8
call sub.user32.dll_FindWindowA
test eax, eax
je 0x564ec3
push ebx
push eax
call sub.user32.dll_GetWindowRect
pop ebx
ret

Function at 0x564eac
Capabilities:
Find taskbar

Disassembly:
push ebx
mov ebx, eax
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.00419cd8
push 0
push 0x564ec8
call sub.user32.dll_FindWindowA
test eax, eax
je 0x564ec3
push ebx
push eax
call sub.user32.dll_GetWindowRect
pop ebx
ret