joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41da40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x9c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
push edi
push 0x44
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.00526520
movzx esi, word [esp + 0xb8]
mov edi, dword [esp + 0xb4]
add esp, 0xc
xor ecx, ecx
mov dword [esp + 0x1c], 0x44
mov dword [esp + 0x48], 1
mov word [esp + 0x4c], cx
push esi
test edi, edi
je 0x41daa6
push str.mountvol.exe__c:__S
lea edx, [esp + 0x68]
push edx
jmp 0x41dab0
push str.mountvol.exe__c:__D
lea eax, [esp + 0x68]
push eax
call fcn.00525f70
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41db09
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41db22
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00524d83
add esp, 0x9c
ret
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
cmp dword [esp + 0xc], 0
pop ebx
jne 0x41db09
push esi
lea eax, [esp + 0x64]
push 0x55436c
push eax
call fcn.00525f70
lea ecx, [esp + 0x6c]
push 0
push ecx
call fcn.005260d0
add esp, 0x14
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x41db6d
test eax, eax
jne 0x41db71
jmp 0x41db09
test eax, eax
jne 0x41db09
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x9c
ret
Function at 0x41e130
Capabilities:
Set uefi variable

Disassembly:
sub esp, 0x48
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x44], eax
push ebp
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
xor ebp, ebp
call fcn.0041dee0
add esp, 4
test eax, eax
jne 0x41e16a
pop ebp
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00524d83
add esp, 0x48
ret
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + 8]
push edi
test esi, esi
je 0x41e1ab
lea edx, [esp + 0x14]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41e180
mov ecx, dword [esi + 0x24]
push 0x54ffac
push ecx
call fcn.00525745
add esp, 8
test eax, eax
je 0x41e1b5
mov esi, dword [esi + 0x34]
test esi, esi
jne 0x41e178
mov ebp, 1
jmp 0x41e23d
mov edx, dword [ebx]
dec edx
push 2
push edx
call fcn.00525178
mov edi, eax
add esp, 8
test edi, edi
je 0x41e23d
mov eax, dword [ebx + 8]
test eax, eax
je 0x41e1e9
mov edx, edi
movzx ecx, word [eax + 0x18]
cmp cx, word [esi + 0x18]
je 0x41e1e2
mov word [edx], cx
add edx, 2
mov eax, dword [eax + 0x34]
test eax, eax
jne 0x41e1d2
mov eax, dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
lea ecx, [eax + eax - 2]
push ecx
push edi
push str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
push str.BootOrder
call esi
test eax, eax
je 0x41e234
push 0
lea edx, [esp + 0x18]
push edx
push str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov eax, edx
push eax
call esi
test eax, eax
jne 0x41e22f
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00524d83
add esp, 0x48
ret
mov ebp, 1
push edi
call fcn.005251b8
add esp, 4
call fcn.0041dea0
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00524d83
add esp, 0x48
ret

Function at 0x41e260
Capabilities:
Get disk information

Disassembly:
sub esp, 0x84
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
xor ebx, ebx
call fcn.0041d750
movzx edi, ax
movzx esi, di
test di, di
jne 0x41e2bf
call fcn.0041da00
movzx esi, ax
test si, si
jne 0x41e2b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00524d83
add esp, 0x84
ret
push esi
push 1
call fcn.0041da40
add esp, 8
test eax, eax
je 0x41e296
movzx eax, si
push eax
lea ecx, [esp + 0x10]
push str._c:EFIJetico_
push ecx
call fcn.00525f70
lea edx, [esp + 0x18]
push 0
push edx
call fcn.005260d0
add esp, 0x14
test eax, eax
jne 0x41e2e8
lea ebx, [eax + 1]
test di, di
jne 0x41e2f8
push esi
push 0
call fcn.0041da40
add esp, 8
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x84
ret
Function at 0x41e390
Capabilities:
Copy file
Get disk information
Write file on windows

Disassembly:
sub esp, 0x39c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x398], eax
push ebx
mov ebx, dword [esp + 0x3a4]
push ebp
mov dword [esp + 0xc], 0
call fcn.0041d750
movzx eax, ax
mov dword [esp + 8], eax
movzx ebp, ax
test ax, ax
jne 0x41e3fe
call fcn.0041da00
movzx ebp, ax
test bp, bp
jne 0x41e3ef
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x398]
xor ecx, esp
call fcn.00524d83
add esp, 0x39c
ret
push ebp
push 1
call fcn.0041da40
add esp, 8
test eax, eax
je 0x41e3d6
push 0x40
lea eax, [esp + 0x31c]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e430
sub eax, edx
sar eax, 1
test eax, eax
jle 0x41e457
cmp word [esp + eax*2 + 0x10], 0x5c
je 0x41e457
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
dec eax
test eax, eax
jg 0x41e443
lea eax, [esp + 0x10]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x41e460
mov ecx, dword [str.Themes_]
mov edx, dword [0x554618]
mov dword [eax], ecx
mov ecx, dword [0x55461c]
mov dword [eax + 4], edx
mov edx, dword [0x554620]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x318]
mov edx, eax
jmp 0x41e4a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e4a0
push esi
push edi
lea edi, [esp + 0x18]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x41e4b6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x41e4e0
mov ecx, dword [str..vth]
mov edx, dword [0x55460c]
movzx esi, bp
mov dword [eax], ecx
mov cx, word [0x554610]
mov dword [eax + 4], edx
push esi
lea edx, [esp + 0x224]
push str._c:EFIJetico_theme.vth
push edx
mov word [eax + 8], cx
call fcn.00525f70
add esp, 0xc
push 0
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41e594
push esi
lea edx, [esp + 0x224]
push str._c:EFIJetico_theme_name.txt
push edx
call fcn.00525f70
lea eax, [esp + 0x22c]
push 0x554590
push eax
call fcn.00527bdc
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41e594
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e570
sub eax, edx
push esi
inc eax
push eax
push 1
push ebx
call fcn.00527898
push esi
call fcn.005276ba
add esp, 0x14
mov esi, 1
jmp 0x41e598
mov esi, dword [esp + 0x14]
cmp word [esp + 0x10], 0
jne 0x41e5ab
push ebp
push 0
call fcn.0041da40
add esp, 8
mov ecx, dword [esp + 0x3a8]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x39c
ret
Function at 0x41e5d0
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [str.SYSTEMCurrentControlSetControlSession_ManagerPower]
lea eax, [esp]
push eax
push 0xf013f
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41e5f6
xor eax, eax
pop ecx
ret
mov edx, dword [str.HiberbootEnabledJF]
mov eax, dword [esp]
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x41e620
Capabilities:
Get disk information
Read file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
push ebp
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
call fcn.0041d750
movzx edi, ax
movzx ebp, di
test di, di
jne 0x41e699
call fcn.0041da00
movzx ebp, ax
test bp, bp
jne 0x41e68a
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00524d83
add esp, 0x110
ret
push ebp
push 1
call fcn.0041da40
add esp, 8
test eax, eax
je 0x41e671
push ebx
push esi
movzx ebx, bp
push ebx
lea edx, [esp + 0x20]
push str._c:EFIJetico_theme_name.txt
push edx
call fcn.00525f70
lea eax, [esp + 0x28]
push 0x554638
push eax
call fcn.00527bdc
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41e745
mov ecx, dword [esp + 0x14]
push esi
push 0x42
push 1
push ecx
call fcn.00527fdb
add esp, 0x10
push esi
test eax, eax
jne 0x41e6e4
call fcn.005276ba
jmp 0x41e742
call fcn.005276ba
push ebx
lea edx, [esp + 0x24]
push str._c:EFIJetico_theme.vth
push edx
call fcn.00525f70
lea eax, [esp + 0x2c]
push 0x554630
push eax
call fcn.00527bdc
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41e745
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x18]
push esi
push ecx
push 1
push edx
call fcn.00527fdb
add esp, 0x10
push esi
test eax, eax
jne 0x41e735
call fcn.005276ba
jmp 0x41e742
call fcn.005276ba
mov dword [esp + 0x14], 1
add esp, 4
pop esi
pop ebx
test di, di
jne 0x41e757
push ebp
push 0
call fcn.0041da40
add esp, 8
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 8]
pop edi
pop ebp
xor ecx, esp
call fcn.00524d83
add esp, 0x110
ret

Function at 0x41e780
Capabilities:
Get uefi variable
Set uefi variable

Disassembly:
push ecx
mov dword [esp], 0xffff
call fcn.0041de10
push 4
lea eax, [esp + 4]
push eax
push str.DC3CA7CB_CDCD_4329_AFFA_A3C100E2BCBF
push 0x55463c
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
je 0x41e7cf
cmp eax, 4
jne 0x41e7d5
push eax
lea ecx, [esp + 4]
push ecx
push str.DC3CA7CB_CDCD_4329_AFFA_A3C100E2BCBF
push 0x55463c
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x41e7e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
push 0x58cf10
call fcn.00422cc0
add esp, 8
mov eax, 1
pop ecx
ret
Function at 0x41e8f0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [str..X:]
mov ecx, dword [0x5546ac]
mov edx, dword [0x5546b0]
push ebx
mov ebx, dword [esp + 0x7c]
push esi
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x60], eax
mov ax, word [0x5546b4]
mov word [esp + 0x6c], ax
movzx eax, word [esi]
mov dword [esp + 0x64], ecx
mov ecx, dword [0x5546a0]
push edi
mov dword [esp + 0x6c], edx
mov edx, dword [0x5546a4]
mov dword [esp + 0x5c], ecx
mov word [esp + 0x6c], ax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x68], edx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x6c]
xor edi, edi
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x41e9f4
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x6c]
push ecx
call fcn.0041e7f0
add esp, 0xc
test eax, eax
je 0x41e9f4
push edi
push edi
push 3
push edi
push 7
push closesocket
push esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e9f4
push edi
lea edx, [esp + 0x38]
push edx
push 0x20
lea eax, [esp + 0x48]
push eax
push 8
lea ecx, [esp + 0x34]
push ecx
push 0x90073
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41ea08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x41ea08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00524d83
add esp, 0x6c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x3c], 1
jb 0x41e9f4
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x14]
push edx
push eax
push edi
push ecx
call fcn.005269a0
mov ecx, dword [esp + 0x10]
xor esi, esi
add eax, ecx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
adc edx, esi
push edx
push eax
lea edx, [esp + 0x7c]
push edx
call fcn.0044c9e0
add esp, 0x1c
test eax, eax
je 0x41e9f4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x74]
mov dword [ebx], eax
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x6c
ret
Function at 0x41ea80
Capabilities:
Get disk information
Write file on windows

Disassembly:
sub esp, 0x94
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x90], eax
push ebp
mov ebp, dword [esp + 0xa0]
push esi
mov dword [esp + 0xc], 0
call fcn.0041d750
movzx esi, ax
movzx eax, si
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
test si, si
jne 0x41eaf6
call fcn.0041da00
movzx eax, ax
mov dword [esp + 0x10], eax
test ax, ax
jne 0x41eae7
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00524d83
add esp, 0x94
ret
push eax
push 1
call fcn.0041da40
add esp, 8
test eax, eax
je 0x41eace
push ebx
push edi
mov edi, dword [esp + 0x18]
movzx ebx, di
push ebx
lea ecx, [esp + 0x24]
push str._c:EFIJetico
push ecx
call fcn.00525f70
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.005260d0
add esp, 0x14
test eax, eax
jne 0x41ec16
push edi
call fcn.0041d8a0
add esp, 4
test eax, eax
je 0x41ec16
push ebx
lea eax, [esp + 0x24]
push str._c:EFIJeticodummy0.bin
push eax
call fcn.00525f70
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.005260d0
add esp, 0x14
test eax, eax
je 0x41ebc0
xor eax, eax
mov dword [esp + 0x10], eax
push eax
push ebx
lea edx, [esp + 0x28]
push str._c:EFIJeticodummy_d.bin
push edx
call fcn.00525f70
lea eax, [esp + 0x30]
push 0x554590
push eax
call fcn.00527bdc
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41ec12
mov edi, 0x400
push esi
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.00527898
add esp, 0x10
sub edi, 1
jne 0x41eb92
push esi
call fcn.005276ba
mov eax, dword [esp + 0x14]
inc eax
add esp, 4
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x41eb60
mov esi, dword [esp + 0xa8]
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [ecx]
push eax
push ebx
lea edx, [esp + 0x28]
push str._c:EFIJeticodummy_d.bin
push edx
call fcn.00525f70
mov eax, dword [esp + 0x20]
lea ecx, [ebp + eax*4]
push ecx
lea edx, [esp + 0x34]
push edx
push esi
call fcn.0041e8f0
add esp, 0x1c
test eax, eax
je 0x41ec12
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x41ebd0
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0x1c]
pop edi
pop ebx
test si, si
jne 0x41ec30
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.0041da40
add esp, 8
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
xor ecx, esp
call fcn.00524d83
add esp, 0x94
ret
Function at 0x41eed0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00526520
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, eax
push esi
push 0
push edi
call ebx
mov ebp, dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push edi
call ebp
push esi
push 0
push edi
call ebx
push esi
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push edi
call ebp
mov ecx, dword [esp + 0x110]
dec eax
pop esi
neg eax
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.00524d83
add esp, 0x108
ret

Function at 0x41ef60
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
push 0x100
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00526520
mov al, 0x80
add esp, 0xc
push 0
mov byte [esp + 0x2a], al
mov byte [esp + 0xbd], al
mov byte [esp + 0x29], 0x81
mov byte [esp + 0xb8], 1
mov byte [esp + 0xb9], 1
mov byte [esp + 0xba], al
mov byte [esp + 0xbb], 1
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, dword [esp + 0x11c]
mov esi, eax
push esi
push 0
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
push esi
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push eax
push ebp
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp eax, 1
jne 0x41f007
mov eax, dword [edi]
mov dword [ebx + eax*4], ebp
inc dword [edi]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x108
ret
Function at 0x41f4e0
Capabilities:
Get keyboard layout

Disassembly:
push ecx
push ebp
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x180
mov edi, eax
call fcn.005018ce
mov ebp, eax
mov eax, dword [esp + 0x18]
add esp, 4
mov dword [eax], ebp
test ebp, ebp
jne 0x41f50c
pop edi
xor eax, eax
pop ebp
pop ecx
ret
push ebx
push esi
push 0x180
push 0
push ebp
call fcn.00526520
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyExW]
xor esi, esi
add esp, 0xc
cmp dword [esp + 0x20], esi
jbe 0x41f549
lea esp, [esp]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + esi*4]
push edi
push 0
push edx
call ebx
mov word [ebp + esi*2], ax
inc esi
cmp esi, dword [esp + 0x20]
jb 0x41f530
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
sub eax, 0xffffff80
xor esi, esi
mov dword [esp + 0x10], eax
cmp dword [esp + 0x24], esi
jbe 0x41f583
mov ebp, dword [esp + 0x18]
add ebp, 0x100
mov ecx, dword [ebp]
push edi
push 0
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov word [edx + esi*2], ax
inc esi
add ebp, 4
cmp esi, dword [esp + 0x24]
jb 0x41f568
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x41f5cb
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, 0x100
xor esi, esi
mov dword [esp + 0x10], eax
test ecx, ecx
jbe 0x41f5cb
mov ebp, dword [esp + 0x18]
add ebp, 0x200
lea ebx, [ebx]
mov ecx, dword [ebp]
push edi
push 0
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov word [edx + esi*2], ax
inc esi
add ebp, 4
cmp esi, dword [esp + 0x28]
jb 0x41f5b0
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x41fbf0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x100
push 0
push esi
call fcn.00526520
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x10
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
push 0x11
mov byte [esi + 0x10], cl
call edi
movzx eax, ax
mov edx, eax
sar edx, 8
and dl, 0x80
and al, 1
or dl, al
push 0xa0
mov byte [esi + 0x11], dl
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
push 0xa1
mov byte [esi + 0xa0], cl
call edi
movzx eax, ax
mov edx, eax
sar edx, 8
and dl, 0x80
and al, 1
or dl, al
push 0xa2
mov byte [esi + 0xa1], dl
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
push 0xa3
mov byte [esi + 0xa2], cl
call edi
movzx eax, ax
mov edx, eax
sar edx, 8
and dl, 0x80
and al, 1
or dl, al
push 0x14
mov byte [esi + 0xa3], dl
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
push 0x90
mov byte [esi + 0x14], cl
call edi
movzx eax, ax
mov edx, eax
sar edx, 8
and dl, 0x80
and al, 1
or dl, al
mov byte [esi + 0x90], dl
push 0x12
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
push 0xa4
mov byte [esi + 0x12], cl
call edi
movzx eax, ax
mov edx, eax
sar edx, 8
and dl, 0x80
and al, 1
or dl, al
push 0xa5
mov byte [esi + 0xa4], dl
call edi
movzx eax, ax
mov ecx, eax
sar ecx, 8
and cl, 0x80
and al, 1
or cl, al
pop edi
mov byte [esi + 0xa5], cl
pop esi
ret
Function at 0x420430
Capabilities:
Log keystrokes via application hook

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x3c], esi
jne 0x420448
lea eax, [esi + 1]
pop esi
add esp, 0x10
ret
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x41fd30
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x44]
mov dword [0x5c5de4], eax
mov eax, dword [esp + 0x3c]
mov dword [0x5c5de0], esi
mov dword [eax], esi
mov dword [ecx], esi
lea eax, [esp + 0x48]
push eax
mov dword [edx], esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x50], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [edi], esi
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x2c]
push edx
push esi
call fcn.0041f020
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
add esp, 0x10
test eax, eax
je 0x420526
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
push eax
push ebp
push ebx
push ecx
push edx
call fcn.0041f450
add esp, 0x14
test eax, eax
je 0x420526
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi]
push eax
push ebp
push ebx
push ecx
push edx
call fcn.0041f4e0
add esp, 0x14
test eax, eax
je 0x420526
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [edx]
push ebp
push ebx
push ecx
push eax
call fcn.0041f4e0
add esp, 0x14
test eax, eax
je 0x420526
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.0041f5e0
add esp, 8
test eax, eax
jne 0x42054c
mov eax, dword [edi]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
push esi
call fcn.0041ee10
mov eax, dword [esp + 0x34]
add esp, 0x18
jmp 0x420551
mov eax, 1
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [edx], ebx
mov edx, dword [esp + 0x18]
mov dword [ecx], ebp
mov ecx, dword [esp + 0x48]
mov dword [edi], edx
mov edx, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [edx], ecx
pop esi
add esp, 0x10
ret