joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b680
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x48b6eb
cmp byte [ebx + 0xcf], 0
jne 0x48b6eb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004059b8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x48b6d8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x48b6f8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040587c
jmp 0x48b6f8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040587c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x48cce4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x48cd52
mov eax, esi
call fcn.0047308c
test al, al
je 0x48cd52
mov eax, dword [ebx + 0x80]
call fcn.00472ce0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48cd52
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x48cd46
push 0
mov eax, dword [ebx + 0x80]
call fcn.00472ce0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0046a324
jmp 0x48cd52
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.0048cb30
pop esi
pop ebx
ret
Function at 0x4909f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x490a1e
mov eax, ebx
call fcn.004914a4
cmp dword [ebx + 0x40], 0
je 0x490a17
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x490a8f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x490a81
cmp dword [ebx + 8], 0
je 0x490a40
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x490a52
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x490a81
cmp dword [ebx + 8], 0
je 0x490a33
cmp eax, 3
je 0x490a65
dec eax
jne 0x490a33
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x490a33
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x490a33
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x490aad
cmp dword [ebx + 0x14], 0xcc
je 0x490aad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00490ab8
pop ebx
ret
Function at 0x4b3b38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5712b4
test esi, esi
jne 0x4b3b52
xor eax, eax
jmp 0x4b3c43
cmp dword [ebp], 0
jne 0x4b3b5d
call fcn.004b3ac8
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4b3c1d
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4b3b69
test edi, edi
jbe 0x4b3c3e
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4b3c21
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cac78
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7dc], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4cad59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004054e0
mov eax, dword [0x56b41c]
cmp dword [eax], 2
jne 0x4cad0e
push edi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004057c8
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov esi, dword [ebp - 0x7d8]
test esi, esi
je 0x4cacda
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.004056ac
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x4cad02
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.004057c8
jmp 0x4cad40
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7dc]
lea eax, [ebp - 0x7d2]
call fcn.0040ce4c
mov edx, dword [ebp - 0x7dc]
mov eax, ebx
call fcn.00405af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cad60
lea eax, [ebp - 0x7dc]
call fcn.0040586c
ret
Function at 0x4d3258
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d32c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x56a220]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4d32b3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004d3248
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d3038]
call fcn.004d32f0
mov dword [0x56a284], eax
mov eax, dword [ebp - 4]
call fcn.004d31f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d32d0
lea eax, [ebp - 8]
call fcn.00407760
ret

Function at 0x4d49d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x571348
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4d49f2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4d49f4
shr eax, 1
dec edx
jne 0x4d49e0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4d49d9
mov byte [0x571748], 1
pop esi
pop ebx

Function at 0x4d4a10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x571748], 0
jne 0x4d4a27
call fcn.004d49d0
mov eax, edi
dec eax
test eax, eax
jl 0x4d4a4f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x571348]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d4a31
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4d74c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4d755a.0
jmp dword [ecx*4 + 0x4d74f3]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d7525
sub dl, 8
je 0x4d7534
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d7168
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d71c0
jmp case.0x4d755a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4d755a.0
movzx ecx, byte [ecx + 0x4d7561]
jmp dword [ecx*4 + 0x4d7572]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d726c
jmp case.0x4d755a.0
cmp dl, 3
jne 0x4d759f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d72c4
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d7280
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d7308
jmp case.0x4d755a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d75ca
sub dl, 8
je 0x4d75d6
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d7334
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d73a0
jmp case.0x4d755a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4d75f5
sub dl, 8
je 0x4d7601
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d745c
jmp case.0x4d755a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4d7484
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x4d76a3
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004d666c
test eax, eax
je 0x4d76a3
mov eax, ebx
call fcn.004d76ac
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4d763c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d76ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4d76dd
dec al
je 0x4d7718
dec al
je 0x4d775d
dec al
je 0x4d77c6
jmp 0x4d7850
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4d7850
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d76ed
jmp 0x4d7850
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d7850
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4d7728
jmp 0x4d7850
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d7850
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4d778c
xor ebp, ebp
jmp 0x4d779c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4d77a5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d776d
jmp 0x4d7850
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4d7850
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4d781f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004d4a58
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4d77da
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4dd7cc
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x4dd7dc
call sub.user32.dll_FindWindowW
ret
Function at 0x4fc6a8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4fc6bf
mov eax, ebx
call fcn.004fbff4
cmp dword [ebx + 0x68], 0
jne 0x4fc6cc
mov eax, ebx
call fcn.004fbf78
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4fc867
cmp dword [ebx + 0x68], 0
je 0x4fc867
mov edx, esp
mov eax, esi
call fcn.00555e4c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004fbe44
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00555efc
cmp eax, dword [esp]
je 0x4fc741
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00555f10
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fc71d
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00555efc
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4fc736
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x4fc754
mov eax, dword [eax + 0x28]
call fcn.00472ce0
mov esi, eax
jmp 0x4fc757
mov esi, dword [ebx + 0x5c]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4fc768
or esi, 0xffffffff
jmp 0x4fc772
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00488268
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.004882a4
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00469a6c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00469aa0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00555e98
mov eax, edi
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00472ce0
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00472ce0
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00472ce0
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.004361d4
call fcn.00431778
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00472ce0
push eax
mov eax, dword [0x56addc]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00472ce0
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x501fb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x60], 0
jne 0x501fcc
mov eax, ebx
call fcn.00501d44
cmp dword [ebx + 0x54], 0
jne 0x501fd9
mov eax, ebx
call fcn.00501ca4
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x50216f
cmp dword [ebx + 0x54], 0
je 0x50216f
mov edx, esp
mov eax, esi
call fcn.00555e4c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00501c28
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x50203f
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x502028
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x502034
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x502055
call fcn.00472ce0
mov esi, eax
jmp 0x502058
mov esi, dword [ebx + 0x64]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x502069
or esi, 0xffffffff
jmp 0x502073
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x54]
call fcn.00488268
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x54]
call fcn.004882a4
mov edx, dword [esp]
mov eax, dword [ebx + 0x54]
call fcn.00469a6c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x54]
call fcn.00469aa0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00555e98
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.00472ce0
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.00472ce0
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.00472ce0
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x60]
call fcn.004361d4
call fcn.00431778
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.00472ce0
push eax
mov eax, dword [0x56addc]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x54]
call fcn.00472ce0
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x514a98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00511fa4
mov ebx, eax
lea eax, [ebp - 0x28]
xor edx, edx
call fcn.00555efc
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp - 0x24]
jl 0x514bd8
cmp edi, dword [ebp - 0x1c]
jge 0x514bd8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.005123a0
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x514b14
mov ebx, esi
sar ebx, 1
jns 0x514b14
adc ebx, 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jg 0x514b2d
add eax, ebx
cmp eax, dword [ebp - 8]
jle 0x514b2d
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x514bd8
mov eax, dword [ebp - 0x20]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp - 8]
jg 0x514b4a
cmp eax, dword [ebp - 8]
jle 0x514b4a
mov dword [ebp - 0xc], 1
jmp 0x514bd8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x514b5b
mov dword [ebp - 0xc], 0xffffffff
jmp 0x514bd8
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x514b77
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x514b77
mov dword [ebp - 0xc], 5
jmp 0x514bd8
mov eax, dword [ebp - 0x28]
add eax, ebx
cmp eax, dword [ebp - 8]
jg 0x514ba7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x514ba7
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x514b9e
mov dword [ebp - 0xc], 4
jmp 0x514bd8
mov dword [ebp - 0xc], 2
jmp 0x514bd8
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jg 0x514bd8
mov eax, dword [ebp - 0x20]
sub eax, ebx
cmp eax, dword [ebp - 8]
jle 0x514bd8
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x514bd1
mov dword [ebp - 0xc], 4
jmp 0x514bd8
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x514be4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00511fa4
mov ebx, eax
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00555f10
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], edx
cmp edi, dword [ebp - 0x24]
jl 0x514d20
cmp edi, dword [ebp - 0x1c]
jge 0x514d20
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005123a0
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x514c5c
mov ebx, esi
sar ebx, 1
jns 0x514c5c
adc ebx, 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jg 0x514c75
add eax, ebx
cmp eax, dword [ebp + 8]
jle 0x514c75
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x514d20
mov eax, dword [ebp - 0x18]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp + 8]
jg 0x514c92
cmp eax, dword [ebp + 8]
jle 0x514c92
mov dword [ebp - 8], 1
jmp 0x514d20
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x514ca3
mov dword [ebp - 8], 0xffffffff
jmp 0x514d20
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x514cbf
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jle 0x514cbf
mov dword [ebp - 8], 5
jmp 0x514d20
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp eax, dword [ebp + 8]
jg 0x514cef
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jge 0x514cef
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x514ce6
mov dword [ebp - 8], 4
jmp 0x514d20
mov dword [ebp - 8], 2
jmp 0x514d20
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jg 0x514d20
mov eax, dword [ebp - 0x18]
sub eax, ebx
cmp eax, dword [ebp + 8]
jle 0x514d20
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x514d19
mov dword [ebp - 8], 4
jmp 0x514d20
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4