joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478a9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478cfc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x478aff
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00478564
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e94c
cmp al, 1
jne 0x478aff
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047887c
test al, al
je 0x478c8b
cmp dword [ebp - 8], 0
jge 0x478b1d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00478564
mov eax, dword [ebp - 0x210]
call fcn.00404f70
cmp ebx, eax
jge 0x478b67
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00478564
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x57ee38]
and eax, 0xff
bt dword [edx], eax
jae 0x478b67
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x478b7b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00478a78
cmp ebx, dword [ebp - 8]
je 0x478c7d
lea eax, [ebp - 0x108]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x478ba7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x57a4b0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.DLL_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x478c6a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x57a4b0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004568a4
push eax
call sub.USER32.DLL_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040a8
and eax, 0x7f
movzx eax, word [eax*2 + 0x57a4b0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004568a4
push eax
call sub.USER32.DLL_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478c71
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x478cde
cmp dword [ebp - 8], 0
jge 0x478c96
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00478564
mov eax, dword [ebp - 0x218]
call fcn.00404f70
cmp eax, dword [ebp - 8]
jg 0x478cd0
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00478564
mov eax, dword [ebp - 0x21c]
call fcn.00404f70
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00478a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478d03
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404cd4
ret
Function at 0x47d3e4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47d412
mov eax, ebx
call fcn.0047de98
cmp dword [ebx + 0x40], 0
je 0x47d40b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47d483
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47d475
cmp dword [ebx + 8], 0
je 0x47d434
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47d446
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47d475
cmp dword [ebx + 8], 0
je 0x47d427
cmp eax, 3
je 0x47d459
dec eax
jne 0x47d427
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47d427
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47d427
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47d4a1
cmp dword [ebx + 0x14], 0xcc
je 0x47d4a1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047d4ac
pop ebx
ret
Function at 0x49a504
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov ebx, dword [ebp + 0xc]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
cmp esi, dword [ebp - 4]
jge 0x49a539
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
call fcn.0049a414
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x15], al
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov eax, edi
call fcn.0050009c
test al, al
je 0x49a629
mov edx, dword [ebp - 0xc]
xor eax, eax
call fcn.0042e200
push eax
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0042e13c
dec eax
pop edx
sub eax, edx
jl 0x49a629
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x24]
imul dword [ebp - 0x30]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x10]
xor eax, eax
call fcn.0042e200
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
call fcn.0042e13c
mov edi, eax
dec edi
pop eax
sub edi, eax
jl 0x49a61d
inc edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
lea ecx, [eax + edx*4]
xor eax, eax
mov al, byte [ecx + 2]
xor edx, edx
mov dl, byte [ebp - 0x16]
sub eax, edx
mov esi, ebx
and esi, 0xff
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 2], al
xor eax, eax
mov al, byte [ecx + 1]
xor edx, edx
mov dl, byte [ebp - 0x17]
sub eax, edx
imul esi
push ecx
mov ecx, 0x64
cdq
idiv ecx
pop ecx
sub byte [ecx + 1], al
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov dl, byte [ebp - 0x18]
sub eax, edx
imul esi
mov esi, 0x64
cdq
idiv esi
sub byte [ecx], al
mov al, byte [ebp + 8]
mov byte [ecx + 3], al
inc dword [ebp - 0x2c]
dec edi
jne 0x49a5b3
inc dword [ebp - 0x30]
dec dword [ebp - 0x34]
jne 0x49a585
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a9340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x57fdac
test esi, esi
jne 0x4a935a
xor eax, eax
jmp 0x4a945c
cmp dword [ebp], 0
jne 0x4a9365
call fcn.004a92d0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4a9435
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4a9371
test edi, edi
jbe 0x4a9457
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4a9439
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ba4e8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ba5a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004053bc
mov eax, dword [0x57ee4c]
cmp dword [eax], 2
jne 0x4ba557
push esi
call sub.USER32.DLL_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405664
mov eax, dword [ebx]
call fcn.00405528
push eax
mov eax, dword [ebx]
call fcn.00405518
push eax
push esi
call sub.USER32.DLL_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405528
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405664
jmp 0x4ba589
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a778
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba5a9
lea eax, [ebp - 0x3f0]
call fcn.00404cb0
ret

Function at 0x4c7790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c7801
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x57dc40]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4c77eb
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004c7780
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c7588]
call fcn.004c7828
mov dword [0x57dca4], eax
mov eax, dword [ebp - 4]
call fcn.004c7730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7808
lea eax, [ebp - 8]
call fcn.00406998
ret

Function at 0x4c82e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 6]
lea eax, [ebp - 4]
call fcn.0040b8cc
push 2
lea eax, [ebp - 0x12]
push eax
push 0x100d
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor eax, eax
mov al, byte [ebp - 0x12]
sub eax, 0x30
jne 0x4c8369
mov cx, 1
mov dx, 1
mov ax, word [ebp - 4]
call fcn.0040b74c
fstp qword [ebp - 0x10]
wait
push 0
push 7
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0040b8ec
movzx eax, ax
dec eax
cdq
push edx
push eax
fld qword [ebp + 8]
fsub qword [ebp - 0x10]
call fcn.0040304c
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
call fcn.00405cb4
inc eax
mov word [ebp - 2], ax
jmp 0x4c837d
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 2]
lea eax, [ebp - 4]
call fcn.0047347c
cmp word [ebp - 2], 0
je 0x4c8388
dec word [ebp - 2]
mov ax, word [ebp - 2]
mov esp, ebp
pop ebp
ret 8

Function at 0x4c92d0
Capabilities:
Get geographical location

Disassembly:
push ecx
mov dl, byte [eax + 0x290]
cmp dl, 7
jne 0x4c92fc
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor eax, eax
mov al, byte [esp]
sub eax, 0x30
pop edx
ret
xor eax, eax
mov al, dl
pop edx
ret
Function at 0x4d6444
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x60], 0
jne 0x4d645c
mov eax, ebx
call fcn.004d6224
cmp dword [ebx + 0x54], 0
jne 0x4d6469
mov eax, ebx
call fcn.004d6184
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x4d65f5
cmp dword [ebx + 0x54], 0
je 0x4d65f5
mov edx, esp
mov eax, esi
call fcn.00557454
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004d6108
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x4d64cf
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x4d64b8
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x4d64c4
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.USER32.DLL_InflateRect
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x4d64e5
call fcn.004568a4
mov esi, eax
jmp 0x4d64e8
mov esi, dword [ebx + 0x64]
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4d64f9
or esi, 0xffffffff
jmp 0x4d6503
push 3
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x54]
call fcn.0044f7b4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x54]
call fcn.0044f7d8
mov edx, dword [esp]
mov eax, dword [ebx + 0x54]
call fcn.0044f800
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x54]
call fcn.0044f824
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.005574a0
mov edx, ebp
lea eax, [esp + 0x10]
call fcn.00557b64
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.004568a4
push eax
call sub.USER32.DLL_SetWindowPos
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.004568a4
push eax
call sub.USER32.DLL_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.004568a4
push eax
call sub.USER32.DLL_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x60]
call fcn.0042bf5c
call fcn.0042794c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.004568a4
push eax
mov eax, dword [0x57e864]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x54]
call fcn.004568a4
push eax
call sub.USER32.DLL_ShowWindow
push esi
push 0
call sub.USER32.DLL_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4dcd20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004da22c
mov ebx, eax
lea eax, [ebp - 0x28]
xor edx, edx
call fcn.00557504
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp - 0x24]
jl 0x4dce60
cmp edi, dword [ebp - 0x1c]
jge 0x4dce60
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004da630
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x4dcd9c
mov ebx, esi
sar ebx, 1
jns 0x4dcd9c
adc ebx, 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jg 0x4dcdb5
add eax, ebx
cmp eax, dword [ebp - 8]
jle 0x4dcdb5
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4dce60
mov eax, dword [ebp - 0x20]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp - 8]
jg 0x4dcdd2
cmp eax, dword [ebp - 8]
jle 0x4dcdd2
mov dword [ebp - 0xc], 1
jmp 0x4dce60
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x4dcde3
mov dword [ebp - 0xc], 0xffffffff
jmp 0x4dce60
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x4dcdff
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x4dcdff
mov dword [ebp - 0xc], 5
jmp 0x4dce60
mov eax, dword [ebp - 0x28]
add eax, ebx
cmp eax, dword [ebp - 8]
jg 0x4dce2f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x4dce2f
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x4dce26
mov dword [ebp - 0xc], 4
jmp 0x4dce60
mov dword [ebp - 0xc], 2
jmp 0x4dce60
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jg 0x4dce60
mov eax, dword [ebp - 0x20]
sub eax, ebx
cmp eax, dword [ebp - 8]
jle 0x4dce60
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x4dce59
mov dword [ebp - 0xc], 4
jmp 0x4dce60
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4dce6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004da22c
mov ebx, eax
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00557518
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], edx
cmp edi, dword [ebp - 0x24]
jl 0x4dcfa8
cmp edi, dword [ebp - 0x1c]
jge 0x4dcfa8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004da630
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x4dcee4
mov ebx, esi
sar ebx, 1
jns 0x4dcee4
adc ebx, 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jg 0x4dcefd
add eax, ebx
cmp eax, dword [ebp + 8]
jle 0x4dcefd
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4dcfa8
mov eax, dword [ebp - 0x18]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp + 8]
jg 0x4dcf1a
cmp eax, dword [ebp + 8]
jle 0x4dcf1a
mov dword [ebp - 8], 1
jmp 0x4dcfa8
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4dcf2b
mov dword [ebp - 8], 0xffffffff
jmp 0x4dcfa8
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x4dcf47
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jle 0x4dcf47
mov dword [ebp - 8], 5
jmp 0x4dcfa8
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp eax, dword [ebp + 8]
jg 0x4dcf77
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jge 0x4dcf77
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x4dcf6e
mov dword [ebp - 8], 4
jmp 0x4dcfa8
mov dword [ebp - 8], 2
jmp 0x4dcfa8
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jg 0x4dcfa8
mov eax, dword [ebp - 0x18]
sub eax, ebx
cmp eax, dword [ebp + 8]
jle 0x4dcfa8
push 0x10
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x4dcfa1
mov dword [ebp - 8], 4
jmp 0x4dcfa8
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50f288
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x50f327
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x4c], edx
lea eax, [ebx + 8]
mov edx, esi
call fcn.00404d04
lea esi, [ebp - 0x10]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 8]
call fcn.00409584
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xc]
call fcn.00404d04
mov eax, dword [ebx + 0xc]
call fcn.00404f70
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x24], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f32e
lea eax, [ebp - 0x14]
call fcn.00404cb0
ret

Function at 0x51127c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x511320
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
lea edx, [esi + esi*4]
mov ecx, dword [ebx + 0x1c4]
mov edx, dword [ecx + edx*4 + 0x10]
call fcn.00404d48
cmp word [ebx + 0x1d2], 0
je 0x5112d3
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1d4]
call dword [ebx + 0x1d0]
cmp dword [ebp - 8], 0
setne al
and al, byte [ebp - 1]
je 0x51130a
xor eax, eax
mov al, byte [ebx + 0x1c8]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405170
push eax
push 0x511330
mov eax, dword [0x57ebe0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.SHELL32.DLL_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511327
lea eax, [ebp - 8]
call fcn.00404cb0
ret
Function at 0x535ed4
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x535ee4
call sub.USER32.DLL_FindWindowA
ret
Function at 0x553f20
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x553f37
mov eax, ebx
call fcn.0055389c
cmp dword [ebx + 0x68], 0
jne 0x553f44
mov eax, ebx
call fcn.00553820
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x5540d5
cmp dword [ebx + 0x68], 0
je 0x5540d5
mov edx, esp
mov eax, esi
call fcn.00557454
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.005536ec
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00557504
cmp eax, dword [esp]
je 0x553fb9
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00557518
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x553f95
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00557504
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x553fae
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.USER32.DLL_InflateRect
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x553fcc
mov eax, dword [eax + 0x28]
call fcn.004568a4
mov esi, eax
jmp 0x553fcf
mov esi, dword [ebx + 0x5c]
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x553fe0
or esi, 0xffffffff
jmp 0x553fea
push 3
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0044f7b4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.0044f7d8
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0044f800
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0044f824
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.005574a0
mov edx, edi
lea eax, [esp + 0x10]
call fcn.00557b64
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004568a4
push eax
call sub.USER32.DLL_SetWindowPos
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004568a4
push eax
call sub.USER32.DLL_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004568a4
push eax
call sub.USER32.DLL_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042bf5c
call fcn.0042794c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004568a4
push eax
mov eax, dword [0x57e864]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.004568a4
push eax
call sub.USER32.DLL_ShowWindow
push esi
push 0
call sub.USER32.DLL_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret