joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef10
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 8
mov eax, dword [0x62271c]
push ebx
push ebp
push esi
push edi
mov edi, dword fs:[0x24]
lea ebx, [eax*4]
mov eax, dword fs:[0x2c]
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x10], edi
mov eax, dword [ebx + eax]
cmp byte [eax + 0x2198], 0
jne 0x42ef49
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp dword [eax + 0x250], edi
mov edi, dword [esp + 0x24]
jne 0x42ef81
test edi, edi
je 0x42efdd
cmp byte [eax + 0x2198], 0
jne 0x42ef70
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp edi, dword [eax + 0x250]
je 0x42efdd
test edi, edi
je 0x42efc9
xor ecx, ecx
mov eax, 0x52b6d4
nop dword [eax]
cmp dword [eax], edi
je 0x42efaa
add eax, 0x1c
inc ecx
cmp eax, 0x5326d4
jl 0x42ef90
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov esi, dword fs:[0x18]
lea eax, [ecx*8]
sub eax, ecx
mov edi, dword [esi + 0x2c]
mov eax, dword [eax*4 + 0x52b6d8]
mov dword [esi + 0x2c], eax
jmp 0x42efdf
mov esi, dword fs:[0x18]
mov eax, dword [0x52b6d8]
mov edi, dword [esi + 0x2c]
mov dword [esi + 0x2c], eax
jmp 0x42efdf
xor edi, edi
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp byte [eax + 0x2198], 0
jne 0x42eff6
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [ebx + eax]
cmp dword [eax + 0x298], ebp
je 0x42f0f1
cmp byte [eax + 0x2198], 0
jne 0x42f019
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [ebx + eax]
mov eax, dword [ecx + 0x298]
cmp byte [eax + 0x6d4], 0
je 0x42f0f1
cmp byte [ecx + 0x2198], 0
jne 0x42f043
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + eax]
cmp dword [eax + 0x250], ecx
je 0x42f06f
push ecx
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ebx + ecx]
cmp byte [ecx + 0x2198], 0
jne 0x42f087
call fcn.004ebad3
lea eax, [esp + 0x14]
push eax
mov eax, dword fs:[0x2c]
push dword [esp + 0x20]
mov eax, dword [ebx + eax]
mov ecx, dword [eax + 0x298]
add ecx, 0x38
call fcn.0045c9b0
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x42f0c6
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
push 0
push 0
push 0
mov ecx, dword [eax + 0x298]
push 1
push 0
push dword [esp + 0x30]
call fcn.0045d0e0
test eax, eax
jne 0x42f103
test ebp, ebp
je 0x42f0f1
push ebp
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test esi, esi
je 0x42f0f8
mov dword [esi + 0x2c], edi
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
push 0
push 0xffffffffffffffff
push dword [esp + 0x28]
mov ecx, eax
call fcn.004e6f40
test ebp, ebp
je 0x42f11d
push ebp
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test esi, esi
je 0x42f124
mov dword [esi + 0x2c], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x437db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3a20
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x526b24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x62271c]
mov ecx, dword fs:[0x2c]
lea esi, [eax*4]
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x437e00
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov ecx, dword [esi + ecx]
mov eax, dword [sym.AutoHotkey.exe_g_FirstThreadID]
cmp eax, dword [ecx + 0x250]
jne 0x437e19
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
call fcn.0042f570
mov eax, dword fs:[0x2c]
add esp, 8
mov eax, dword [esi + eax]
cmp byte [eax + 0x2198], 0
jne 0x437e3c
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
cmp dword [eax + 0x1ec], 0
je 0x437e71
cmp byte [eax + 0x2198], 0
jne 0x437e5c
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
push dword [eax + 0x1ec]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ebx, ebx
nop dword [eax]
nop word [eax + eax]
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
cmp byte [eax + 0x2198], 0
jne 0x437e97
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
mov eax, dword [ecx + 0x884]
movzx eax, word [eax]
cmp ebx, eax
jge 0x437f07
mov eax, dword [ecx + 0x84c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x437f01
cmp byte [edi + 0x18], 0
je 0x437ec7
mov ecx, edi
call fcn.0043c230
mov eax, dword fs:[0x2c]
mov dword [ebp - 4], 0
mov eax, dword [esi + eax]
cmp byte [eax + 0x2198], 0
jne 0x437ee5
call fcn.004ebad3
mov eax, dword fs:[0x2c]
push edi
mov eax, dword [esi + eax]
mov ecx, dword [eax + 0x260]
call fcn.004df8c0
mov dword [ebp - 4], 0xffffffff
inc ebx
jmp 0x437e80
cmp byte [ecx + 0x2198], 0
jne 0x437f15
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
mov eax, dword [ecx + 0x884]
cmp word [eax], 0
je 0x437f39
push dword [ecx + 0x84c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
cmp byte [eax + 0x2198], 0
jne 0x437f50
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
mov ecx, dword [ecx + 0x260]
call fcn.004df900
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x437f83
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
mov edi, dword [eax + 0x260]
test edi, edi
je 0x437fa9
mov ecx, edi
call fcn.00419190
push 0x24
push edi
call fcn.004ebb73
mov ecx, dword fs:[0x2c]
add esp, 8
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x437fc1
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov ecx, dword [esi + ecx]
mov eax, dword [sym.AutoHotkey.exe_g_FirstThreadID]
cmp eax, dword [ecx + 0x250]
jne 0x437fda
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ccc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3a8a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x526b24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x398
call fcn.004ebb43
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x43ce24
mov dword [esi + 4], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x52763c
mov byte [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0x20], 3
mov dword [esi], vtable.InputObject.0
lea eax, [esi + 0x84]
push 0x300
push 0
push eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0x3ff
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov byte [esi + 0x6c], 0
mov dword [esi + 0x6e], 1
mov dword [esi + 0x72], 1
mov byte [esi + 0x7e], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [0x62271c]
mov dword [esi + 0x384], 0
mov dword [esi + 0x388], 0
mov dword [esi + 0x38c], 0
mov dword [esi + 0x390], 0
mov dword [esi + 0x38], esi
mov eax, dword fs:[0x2c]
mov byte [ebp - 4], 2
mov eax, dword [eax + ecx*4]
mov edi, dword [eax + 0x890]
test edi, edi
je 0x43ce01
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43ce0e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0xc], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43cef0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp si, 0xa
jne 0x43ceff
mov al, 0xd
pop esi
ret
push ebx
push edi
push dword [esp + 0x18]
push esi
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx ebx, ax
mov edx, ebx
shr edx, 8
cmp dl, 0xff
jne 0x43cf55
cmp bl, 0xff
jne 0x43cf55
cmp byte [esp + 0x1c], 0
je 0x43cf5a
movzx edi, si
test edi, 0xffffff80
jne 0x43cf5a
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
add esp, 4
test eax, eax
je 0x43cf5a
push esi
call fcn.0043c2a0
push edi
mov bl, al
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
add esp, 8
test eax, eax
setne dl
test dl, 0x38
je 0x43cf60
pop edi
pop ebx
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x43cfa2
mov al, dl
and al, 6
cmp al, 6
jne 0x43cf75
or byte [ecx], 8
jmp 0x43cf93
test dl, 2
je 0x43cf84
mov al, byte [ecx]
test al, 3
jne 0x43cf84
or al, 1
mov byte [ecx], al
test dl, 4
je 0x43cf93
mov al, byte [ecx]
test al, 0xc
jne 0x43cf93
or al, 4
mov byte [ecx], al
test dl, 1
je 0x43cfa2
mov al, byte [ecx]
test al, 0x30
jne 0x43cfa2
or al, 0x10
mov byte [ecx], al
pop edi
mov al, bl
pop ebx
pop esi
ret
Function at 0x43d670
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x34
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
xor esi, esi
test eax, eax
je 0x43d6be
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [esp + 4], 0x30
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x43d6be
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43d6be
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.004ebadf
add esp, 0x34
ret
Function at 0x43e410
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x28c
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword fs:[0x2c]
xor edx, edx
mov ecx, dword [0x62271c]
push ebp
mov ebp, dword [esp + 0x294]
push esi
mov esi, dword [eax + ecx*4]
lea eax, [esi + 0x8a0]
mov ecx, dword [eax]
test ecx, ecx
je 0x43e45b
cmp ecx, ebp
je 0x43e4e8
inc edx
add eax, 8
cmp edx, 0xa
jl 0x43e444
cmp edx, 0xa
mov eax, 9
push ebx
cmovl eax, edx
xor ebx, ebx
push ebx
push ebp
lea eax, [eax*8 + 0x8a0]
add eax, esi
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov dword [esp + 0xc], eax
test eax, eax
je 0x43e551
push edi
mov ecx, 0x19
lea edi, [esp + 0x18]
mov esi, str.SYSTEMCurrentControlSetControlKeyboard_Layouts_
lea eax, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
pop edi
test eax, eax
je 0x43e506
push ebx
push 0x104
lea eax, [esp + 0x94]
push eax
push str.Layout_File
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e5340
add esp, 0x18
test eax, eax
je 0x43e506
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
jmp 0x43e508
mov eax, dword [esi + edx*8 + 0x8a4]
pop esi
pop ebp
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.004ebadf
add esp, 0x28c
ret
xor esi, esi
mov eax, dword [esp + 0xc]
cmp ebp, eax
je 0x43e519
push 0
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
test esi, esi
je 0x43e551
push str.KbdLayerDescriptor
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43e54a
call eax
mov ebx, eax
call fcn.004e4a00
test eax, eax
je 0x43e53f
mov ebx, dword [ebx + 0x50]
jmp 0x43e542
mov ebx, dword [ebx + 0x28]
not ebx
and ebx, 1
add ebx, 3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x294]
mov dword [eax + 4], ebx
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.004ebadf
add esp, 0x28c
ret
Function at 0x4407f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x44
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [0x62271c]
push ebx
push esi
push edi
lea esi, [eax*4]
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x8f0]
mov dword [esp + 0xc], eax
cmp eax, 2
jne 0x440857
mov eax, dword [esp + 0x54]
movzx edx, ax
mov ecx, edx
and ecx, 0xffffff80
je 0x44083d
mov eax, 0x30
mov word [esp + 0x2c], ax
test ecx, ecx
lea eax, [esp + 0x2c]
lea edi, [esp + 0x2e]
push 0xa
cmovne eax, edi
push eax
push edx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
add esp, 0xc
mov ebx, dword [esp + 0x58]
test ebx, ebx
jle 0x440a25
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop word [eax + eax]
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
cmp dword [eax + 0x8f0], 0
jne 0x440998
call ebp
mov edx, dword fs:[0x2c]
mov edi, eax
mov ecx, dword [esi + edx]
cmp byte [ecx + 0x2198], 0
jne 0x4408a9
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov ecx, dword [esi + edx]
mov eax, dword [ecx + 0x298]
sub edi, dword [eax + 0x6f0]
cmp byte [ecx + 0x2198], 0
jne 0x4408cd
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [esi + edx]
mov eax, dword [eax + 0x29c]
cmp edi, dword [eax + 0x5c]
jbe 0x440998
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x440968
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x440915
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
mov dword [eax + 0x1d8], 0
jne 0x440930
call fcn.004ebad3
push 1
push 0xffffffffffffffff
call fcn.00415b90
mov ecx, dword fs:[0x2c]
add esp, 8
mov eax, dword [esi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x44095b
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [esi + ecx]
mov dword [eax + 0x1d8], 1
call ebp
mov edi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
cmp byte [ecx + 0x2198], 0
jne 0x440989
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x298]
mov dword [eax + 0x6f0], edi
cmp dword [esp + 0x10], 2
jne 0x4409ae
lea eax, [esp + 0x30]
push eax
call fcn.0043ffc0
add esp, 4
jmp 0x4409be
push dword [esp + 0x60]
push dword [esp + 0x5c]
call fcn.00442620
add esp, 8
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
cmp dword [ecx + 0x8f0], 2
jne 0x4409f2
cmp byte [ecx + 0x2198], 0
jne 0x4409e4
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x70]
jmp 0x440a12
cmp byte [ecx + 0x2198], 0
jne 0x440a06
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x6c]
push eax
call fcn.0043d2b0
add esp, 4
sub ebx, 1
jne 0x440870
pop ebp
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x44
ret
Function at 0x443470
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
movzx eax, word [edi]
test ax, ax
je 0x443580
cmp word [edi + 2], 0
jne 0x4434a1
push 1
push dword [esp + 0x24]
push dword [esp + 0x1c]
push eax
call fcn.0043cef0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
cmp byte [esp + 0x1c], 0
je 0x4434f3
push eax
call fcn.0043c2a0
add esp, 4
cmp ax, 0x56
jne 0x4434f3
movzx eax, word [edi + 2]
push eax
call fcn.0043c2a0
add esp, 4
cmp ax, 0x4b
jne 0x4434f3
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor ebx, ebx
movzx edx, al
cmp word [ecx], bx
pop edi
cmove ebx, edx
pop esi
mov al, bl
pop ebx
ret
xor esi, esi
cmp dword [0x5230c8], esi
jle 0x44351d
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
push edi
push dword [esi*8 + 0x523200]
call ebx
add esp, 8
test eax, eax
je 0x44356f
inc esi
cmp esi, dword [0x5230c8]
jl 0x443503
cmp byte [esp + 0x18], 0
jne 0x443580
push 0
push edi
call fcn.00443130
movzx edx, ax
add esp, 8
test dx, dx
je 0x443580
mov ecx, edx
mov eax, edx
sub ecx, 0x45
je 0x44357a
sub ecx, 0xf1
je 0x44354d
sub ecx, 0xf
jne 0x443550
movzx eax, dl
test eax, 0x100
je 0x44355f
movzx eax, al
or eax, 0xe000
push 3
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
pop edi
pop esi
pop ebx
ret
mov al, byte [esi*8 + 0x523204]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov al, 0x13
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x443700
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, al
push ebp
call edi
mov ebx, dword [esp + 0x18]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp ebx, 1
je 0x443730
cmp ebx, 2
jne 0x4438dc
cmp esi, ebx
je 0x4438dc
push ebp
call edi
bt ax, 0xf
jae 0x44375b
push 0xffc3d44d
push 0
push 0
push 0
push dword [esp + 0x24]
push 1
call fcn.0043db20
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push dword [esp + 0x24]
push 2
call fcn.0043db20
mov eax, dword [0x62271c]
add esp, 0x18
lea edi, [eax*4]
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
cmp byte [eax + 0x2198], 0
jne 0x443797
call fcn.004ebad3
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword fs:[0x2c]
mov ecx, dword [edi + edx]
mov ecx, dword [ecx + 0x250]
cmp eax, ecx
sete byte [esp + 0x18]
jne 0x44382a
mov eax, dword [edi + edx]
cmp byte [eax + 0x2198], 0
jne 0x4437d7
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
cmp byte [eax + 0x2198], 0
mov dword [eax + 0x1d8], 0
jne 0x4437f2
call fcn.004ebad3
push 1
push 0xffffffffffffffff
call fcn.00415b90
mov ecx, dword fs:[0x2c]
add esp, 8
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x44381d
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov dword [eax + 0x1d8], 1
cmp byte [esp + 0x14], 0x14
jne 0x4438dc
cmp ebx, 2
jne 0x4438dc
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4438dc
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push ebx
call fcn.0043db20
add esp, 0x18
cmp byte [esp + 0x18], 0
je 0x4438dc
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x443889
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
mov dword [eax + 0x1d8], 0
jne 0x4438a4
call fcn.004ebad3
push 1
push 0xffffffffffffffff
call fcn.00415b90
mov ecx, dword fs:[0x2c]
add esp, 8
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4438cf
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov dword [eax + 0x1d8], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x443d60
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x118
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x114], eax
mov ecx, dword [0x5230c8]
xor eax, eax
push ebx
mov bl, byte [esp + 0x120]
push esi
mov esi, dword [esp + 0x128]
test ecx, ecx
jle 0x443da2
cmp byte [eax*8 + 0x523204], bl
je 0x443e90
inc eax
cmp eax, ecx
jl 0x443d90
push ebp
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [ebx - 0x41]
mov edi, eax
cmp cl, 0x19
ja 0x443ead
push 0x100
lea eax, [esp + 0x28]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov dword [esp + 0x10], eax
push edi
push eax
push 2
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 2
jne 0x443dfa
movzx eax, word [esp + 0x1c]
mov dword [esp + 0x10], eax
push edi
push 0
push 2
lea eax, [esp + 0x28]
movzx ebp, bl
push eax
lea eax, [esp + 0x34]
push eax
push 0
push ebp
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [esp + 0x18], eax
test eax, eax
jns 0x443e36
push edi
push 0
push 2
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov eax, dword [esp + 0x10]
test ax, ax
je 0x443e82
push 1
push edi
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.0043cef0
mov bh, al
add esp, 0x10
test bh, bh
je 0x443e82
push dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
call fcn.0043ce40
add esp, 8
lea eax, [esp + 0x14]
push edi
push 0
push 2
push eax
lea eax, [esp + 0x34]
push eax
push 0
movzx eax, bh
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp dword [esp + 0x18], 0
je 0x443ea9
movzx eax, word [esp + 0x1c]
jmp 0x443ebd
push dword [esp + 0x12c]
push dword [eax*8 + 0x523200]
push esi
call fcn.004e6a80
add esp, 0xc
jmp 0x443efa
xor eax, eax
jmp 0x443ebd
push edi
push 2
movzx ebp, bl
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
movzx eax, ax
mov word [esi], ax
test ax, ax
je 0x443ecd
xor eax, eax
mov word [esi + 2], ax
jmp 0x443ef8
cmp byte [esp + 0x138], 0
je 0x443ef3
test bl, bl
je 0x443ef3
push ebp
push str.vk_02X
push dword [esp + 0x13c]
push esi
call fcn.004e6440
add esp, 0x10
jmp 0x443ef8
xor eax, eax
mov word [esi], ax
pop edi
pop ebp
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x118
ret
Function at 0x443f60
Capabilities:
Log keystrokes

Disassembly:
push esi
movzx esi, byte [esp + 8]
mov eax, esi
sub eax, 0x13
je 0x44400d
sub eax, 0x19
je 0x443ffa
sub eax, 0x64
je 0x443fe7
push 4
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
test cx, cx
jne 0x443f94
xor eax, eax
pop esi
ret
test ecx, 0xe000
je 0x443fa5
movzx ecx, cl
or ecx, 0x100
add esi, 0xfffffff3
cmp esi, 0x94
ja case.0x443fb7.14
movzx eax, byte [esi + 0x44402c]
jmp dword [eax*4 + 0x444020]
movzx eax, cx
mov ecx, eax
or ecx, 0x100
cmp byte [esp + 0xc], 0
pop esi
cmovne eax, ecx
ret
xor eax, eax
or ecx, 0x100
cmp byte [esp + 0xc], al
movzx ecx, cx
cmove eax, ecx
pop esi
ret
xor eax, eax
mov ecx, 0x145
cmp byte [esp + 0xc], al
movzx ecx, cx
cmove eax, ecx
pop esi
ret
xor eax, eax
mov ecx, 0x137
cmp byte [esp + 0xc], al
movzx ecx, cx
cmove eax, ecx
pop esi
ret
mov ecx, 0x45
xor eax, eax
movzx ecx, cx
cmp byte [esp + 0xc], al
pop esi
cmove eax, ecx
ret