joyce8/EMBER2024-capa huggingface dataset:
Function at 0x614eb0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
mov eax, dword [edi]
push esi
push ebp
call dword [eax + 0x18]
test eax, eax
jne 0x614ed9
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0x18
ret 8
mov edx, dword [edi]
push esi
push ebp
mov ecx, edi
call dword [edx + 0x14]
test eax, eax
jne 0x614ef2
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret 8
test byte [edi + 0x300], 8
push ebx
jne 0x614f1c
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
test ax, ax
jge 0x615090
push 0x11
call ebx
test ax, ax
jge 0x615090
mov ebx, dword [edi + 0x1d4]
mov eax, dword [edi + 0x1dc]
mov ecx, dword [edi + 0x1d8]
mov esi, dword [edi + 0x1e0]
add eax, ebx
mov edx, eax
sub edx, ebp
add esi, ecx
cmp edx, 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jg 0x614f69
mov edx, dword [esp + 0x30]
mov ecx, esi
sub ecx, edx
cmp ecx, 0xc
jg 0x614f65
pop ebx
pop edi
pop esi
mov eax, 0x11
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x10]
mov edx, ebx
add edx, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], edx
mov edx, ecx
add edx, 4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], edx
mov edx, eax
sub edx, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], edx
mov edx, esi
sub edx, 4
cmp ebp, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], edx
jl 0x61508c
cmp ebp, eax
jge 0x61508c
mov eax, dword [esp + 0x30]
cmp eax, ecx
jl 0x61508c
cmp eax, esi
jge 0x61508c
mov edx, eax
push edx
push ebp
lea ecx, [esp + 0x20]
call fcn.00426c70
test al, al
jne 0x61508c
sub ebp, ebx
cmp ebp, 3
jg 0x615018
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
cmp ecx, 3
jg 0x614ffd
pop ebx
pop edi
pop esi
mov eax, 0xd
pop ebp
add esp, 0x18
ret 8
sub esi, eax
xor eax, eax
cmp esi, 3
setg al
pop ebx
pop edi
pop esi
pop ebp
dec eax
and eax, 6
add eax, 0xa
add esp, 0x18
ret 8
cmp dword [esp + 0x14], 3
mov eax, dword [esp + 0x30]
jg 0x61505a
mov edi, dword [esp + 0x10]
mov edx, eax
sub edx, edi
cmp edx, 3
jg 0x61503f
pop ebx
pop edi
pop esi
mov eax, 0xe
pop ebp
add esp, 0x18
ret 8
sub esi, eax
xor eax, eax
cmp esi, 3
setg al
pop ebx
pop edi
pop esi
pop ebp
dec eax
and eax, 6
add eax, 0xb
add esp, 0x18
ret 8
mov ebx, dword [esp + 0x10]
mov ecx, eax
sub ecx, ebx
cmp ecx, 3
jg 0x615076
pop ebx
pop edi
pop esi
mov eax, 0xc
pop ebp
add esp, 0x18
ret 8
sub esi, eax
cmp esi, 3
jg 0x61508c
pop ebx
pop edi
pop esi
mov eax, 0xf
pop ebp
add esp, 0x18
ret 8
mov esi, dword [esp + 0x30]
mov al, byte [edi + 0x92]
test al, al
je 0x6150be
mov eax, dword [edi + 0x1e4]
test eax, eax
je 0x6150be
sub esi, dword [edi + 0x1d8]
xor edx, edx
cmp esi, eax
setl dl
pop ebx
pop edi
pop esi
pop ebp
inc edx
mov eax, edx
add esp, 0x18
ret 8
pop ebx
pop edi
pop esi
mov eax, 2
pop ebp
add esp, 0x18
ret 8
Function at 0x61d456
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f8eb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], 1
call fcn.004828f0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x61d4c6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f8eb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], al
call fcn.004828f0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6273a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push ebx
push 0
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x6274fd
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x2710
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
je 0x6274eb
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x6274e1
mov byte [ebp], 0
mov dword [esp + 0xc], 0
push edi
jmp 0x627400
mov ecx, dword [ebx + 0xd0]
test ecx, ecx
je 0x6274cc
mov eax, dword [ebx + 0xd4]
sub eax, ecx
mov ecx, dword [esp + 0x10]
sar eax, 2
cmp ecx, eax
jae 0x6274cc
xor edi, edi
jmp 0x627430
mov eax, dword [ebx + 0xd0]
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6274ba
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x6274ba
mov edx, dword [edx]
mov eax, dword [edx + 4]
mov esi, dword [eax + edi*4]
test esi, esi
lea eax, [eax + edi*4]
je 0x6274b0
mov al, byte [esi + 4]
test al, al
je 0x6274b0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
test eax, eax
je 0x6274b0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
call fcn.0065c790
push ebp
mov dword [esp + 0x20], eax
call fcn.0065c790
mov ecx, dword [esp + 0x20]
add ecx, eax
add esp, 8
cmp ecx, 0x2710
jge 0x6274b6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ebp, dword [esp + 0x14]
push eax
push ebp
call fcn.0065d930
add esp, 8
inc edi
jmp 0x627430
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x10], eax
jmp 0x627400
push ebp
call fcn.0065c790
add esp, 4
push esi
mov byte [eax + ebp], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x6274fc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x62f790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], 1
call fcn.004828f0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x62f800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], al
call fcn.004828f0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x62fa50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 2
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov eax, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0xc], 0x76090c
jne 0x62faba
xor edx, edx
jmp 0x62fac2
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
cmp eax, ebx
je 0x62fae3
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x62fae3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x62faf5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov edx, dword [esi + 4]
cmp edx, ebx
mov dword [esp + 0xc], 0x76090c
jne 0x62fb08
xor ecx, ecx
jmp 0x62fb10
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x62fb31
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x62fb31
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x62fb43
mov eax, dword [esi + 8]
lea edx, [esp + 0xc]
push edx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 3
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x62fb60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x7621d0
jne 0x62fbca
xor edx, edx
jmp 0x62fbd2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x62fbf3
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x62fbf3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x62fc05
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x62fc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x76090c
jne 0x62fc9a
xor edx, edx
jmp 0x62fca2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x62fcc3
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x62fcc3
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x62fcd5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x62fd00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x76124c
jne 0x62fd6a
xor edx, edx
jmp 0x62fd72
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x62fd93
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x62fd93
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x62fda5
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x632330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9589
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esi + 0x28], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x70]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push eax
mov byte [esp + 0x14], 3
mov byte [esi + 0x80], al
call fcn.004828f0
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x6323a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9589
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x76124c
jne 0x63240a
xor edx, edx
jmp 0x632412
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x632433
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x632433
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x632445
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x632470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9589
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [esp + 0x10], edi
mov dword [edi + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x50], ebx
lea esi, [edi + 0x70]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push 1
mov ecx, esi
mov byte [esp + 0x20], 3
mov byte [edi + 0x80], bl
call fcn.004828f0
mov ecx, dword [esi + 4]
cmp ecx, ebx
mov dword [esp + 0xc], 0x76090c
jne 0x6324da
xor edx, edx
jmp 0x6324e2
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x632503
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x632503
mov eax, dword [esi + 8]
mov dword [eax], vtable.type_info.0
add eax, 4
mov dword [esi + 8], eax
jmp 0x632515
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push 1
push eax
mov ecx, esi
call fcn.0048b250
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x633510
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0xa8], 1
jne 0x6335c6
mov eax, dword [esi + 0x1d4]
cmp eax, dword [esi + 0x1d8]
je 0x6335c6
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x6335c6
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x110]
lea ecx, [eax + eax + 1]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x6335b4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x6335ab
mov byte [eax], 0
mov edx, dword [esi + 0x1d4]
mov ecx, dword [esi + 0x1d8]
cmp edx, ecx
push edi
mov edi, edx
jl 0x633589
mov edi, ecx
jle 0x633589
mov ecx, edx
sub ecx, edi
test ecx, ecx
jle 0x6335a3
mov edx, dword [esi + 0x104]
push ecx
lea ecx, [edx + edi*2]
push ecx
push eax
call fcn.005a3e90
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
je 0x6335c5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop esi
ret
Function at 0x635b70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push ebp
mov ebp, ecx
test byte [ebp + 0xa8], 0x10
jne 0x635b8d
lea eax, [ebp + 0x1d4]
push eax
call fcn.00633070
test al, al
jne 0x635b92
xor al, al
pop ebp
pop ecx
ret
push ebx
push 0
xor bl, bl
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x635c7d
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
mov dword [esp + 8], eax
je 0x635c77
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x635c76
push esi
mov ecx, ebp
call fcn.00635a10
push 0xfefe
push edi
call fcn.005a3b80
push edi
call fcn.0065c790
lea eax, [eax + eax + 2]
push eax
call fcn.0065b8d9
push 0xffffffffffffffff
mov esi, eax
push edi
push esi
call fcn.005a3e10
add esp, 0x1c
cmp word [esi], 0
mov eax, esi
je 0x635c23
mov cx, word [eax]
cmp cx, 0xd
je 0x635c1e
cmp cx, 0xa
je 0x635c1e
add eax, 2
cmp word [eax], 0
jne 0x635c04
jmp 0x635c23
mov word [eax], 0
mov ecx, dword [ebp + 0x1d4]
push 0xffffffffffffffff
push 0
push esi
push ecx
lea ecx, [ebp + 0x104]
call fcn.00633a30
test al, al
je 0x635c53
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp + 0x1d4]
push eax
mov ecx, ebp
call fcn.006332a0
mov edx, dword [ebp + 0x1d4]
push esi
mov dword [ebp + 0x1d8], edx
call fcn.0065f1d2
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov bl, 1
pop esi
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop ebx
pop ebp
pop ecx
ret

Function at 0x636440
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x636456
mov ecx, dword [esi + 8]
sub ecx, eax
mov dword [esp + 4], ecx
jne 0x63645b
xor al, al
pop esi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x636488
mov eax, dword [esi + 8]
sub eax, ecx
cmp edi, eax
jae 0x636488
push 0x12
call ebx
test ax, ax
jl 0x636481
inc edi
jmp 0x636465
pop edi
pop ebx
mov al, 1
pop esi
pop ecx
ret
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret

Function at 0x636490
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x6364a6
mov ecx, dword [esi + 8]
sub ecx, eax
mov dword [esp + 4], ecx
jne 0x6364ab
xor al, al
pop esi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x6364db
mov eax, dword [esi + 8]
sub eax, ecx
cmp edi, eax
jae 0x6364db
movzx edx, byte [ecx + edi]
push edx
call ebx
test ax, ax
jge 0x6364d4
inc edi
jmp 0x6364b5
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret
pop edi
pop ebx
mov al, 1
pop esi
pop ecx
ret
Function at 0x63a7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9893
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x30]
xor eax, eax
lea edi, [esi + 0x18]
mov dword [esi], 0x7222e8
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], eax
mov dword [esp + 0x18], eax
mov byte [edi + 4], al
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
push ebx
mov byte [esp + 0x1c], 1
mov dword [esi + 0x34], edx
call fcn.0065c790
add esp, 4
push eax
push ebx
mov ecx, edi
call fcn.00404b60
mov ecx, dword [0x77ff08]
mov edx, dword [esi + 0x34]
mov eax, dword [ecx]
mov edi, dword [esi + 0x2c]
push edx
call dword [eax + 0xb4]
imul eax, edi
mov edx, dword [esi + 0x34]
mov dword [esi + 4], eax
mov ecx, dword [0x77ff08]
mov eax, dword [ecx]
push edx
call dword [eax + 0xb0]
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x63b010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f98e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, 0xff000000
push 0x20
mov dword [esp + 0x18], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], 0xb4000000
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.0063ab70
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], ebx
mov byte [esi + 0x35], bl
mov dword [esi + 0x20], 2
mov byte [esi + 0x34], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret