joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423184
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408610]
call fcn.00405f08
xor eax, eax
push ebp
push 0x423325
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a1b64], 0
jne 0x4231df
mov ecx, dword [0x4a4bac]
mov dl, 1
mov eax, dword [0x408a90]
call fcn.0040dab4
call fcn.00404eb4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ae4
mov eax, ebx
call fcn.00405dd8
mov dword [ebp - 0x24], eax
mov esi, 0x423334
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406f3c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405de8
test eax, eax
jle 0x4232c8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4232b4
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004056dc
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x42325a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004056f4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x423270
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004056f4
mov eax, dword [ebp - 0x54]
call fcn.004058fc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004056dc
mov eax, dword [ebp - 0x58]
call fcn.004058fc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4232b6
xor eax, eax
test al, al
je 0x4232c1
mov ebx, 0x15
jmp 0x4232cd
mov ebx, 0x10
jmp 0x4232cd
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4a1b64]
call fcn.00422fa8
mov eax, dword [ebp - 4]
call fcn.00422fa8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406f54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42332c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405490
lea eax, [ebp - 0xc]
mov edx, dword [0x408610]
call fcn.00405fd8
ret

Function at 0x426df4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x426dfa
ret
Function at 0x43159c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
call fcn.0040a168
test al, al
je 0x4316da
lea eax, [ebp - 0x68]
call fcn.00430ae8
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.004058fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4316c3
xor eax, eax
push ebp
push 0x4316bc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4316a5
xor eax, eax
push ebp
push 0x43169e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x431687
xor eax, eax
push ebp
push 0x431680
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x68]
call fcn.00430b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431687
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4316a5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4316c3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x68]
call fcn.00430ba0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x78]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434564
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x434592
mov eax, ebx
call fcn.00435018
cmp dword [ebx + 0x40], 0
je 0x43458b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x434603
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4345f5
cmp dword [ebx + 8], 0
je 0x4345b4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4345c6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4345f5
cmp dword [ebx + 8], 0
je 0x4345a7
cmp eax, 3
je 0x4345d9
dec eax
jne 0x4345a7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4345a7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4345a7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x434621
cmp dword [ebx + 0x14], 0xcc
je 0x434621
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0043462c
pop ebx
ret

Function at 0x445098
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4450ad
or edx, 0x200
test eax, 0x20000000
je 0x4450e0
test eax, 0x40000000
je 0x4450cc
test eax, 0x80000000
je 0x4450c7
or edx, 0x40
jmp 0x445107
or edx, 0x20
jmp 0x445107
test eax, 0x80000000
je 0x4450db
or edx, 0x80
jmp 0x445107
or edx, 0x10
jmp 0x445107
test eax, 0x40000000
je 0x4450f8
test eax, 0x80000000
je 0x4450f3
or edx, 4
jmp 0x445107
or edx, 2
jmp 0x445107
test eax, 0x80000000
je 0x445104
or edx, 8
jmp 0x445107
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x4459d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
movzx eax, bl
cmp eax, 0x5b
jge 0x445a10
cmp eax, 0x2e
jge 0x4459f8
sub eax, 0x23
je 0x445a5e
sub eax, 2
je 0x445a3f
sub eax, 6
je 0x445a3f
jmp 0x445a79
add eax, 0xffffffd2
sub eax, 0xc
jb 0x445a3f
sub eax, 5
je 0x445a3f
dec eax
je 0x445a5e
dec eax
sub eax, 0x1a
jb 0x445a3f
jmp 0x445a79
cmp eax, 0xa3
jg 0x445a2e
je 0x445a3f
add eax, 0xffffffa5
sub eax, 4
jb 0x445a5e
dec eax
je 0x445a5e
add eax, 0xffffffe5
sub eax, 4
jb 0x445a5e
jmp 0x445a79
sub eax, 0xa7
je 0x445a3f
sub eax, 9
je 0x445a3f
sub eax, 5
jne 0x445a79
mov dl, 1
mov al, 0x10
call fcn.00445980
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.004459b4
xor edx, edx
mov al, 0x10
call fcn.00445980
pop ebx
ret
mov al, 1
call fcn.0044599c
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.004459b4
xor eax, eax
call fcn.0044599c
pop ebx
ret
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.004459b4
pop ebx
ret

Function at 0x447950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x38]
sub edi, dword [ebx + 0x70]
sub edi, dword [ebx + 0x68]
jmp 0x44797f
mov eax, dword [ebx + 0x28]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x68]
ja 0x4479fe
push esi
mov eax, dword [ebx + 0x34]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004465c0
add esp, 0xc
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x58], ebp
mov eax, dword [ebx + 0x48]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4479cc
mov cx, word [esp]
sub cx, si
jmp 0x4479ce
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4479b5
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4479f4
mov cx, word [esp]
sub cx, si
jmp 0x4479f6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4479dd
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x447a5b
mov edx, dword [ebx + 0x34]
mov ecx, edi
add edx, dword [ebx + 0x68]
mov eax, ebp
add edx, dword [ebx + 0x70]
call fcn.00447640
add dword [ebx + 0x70], eax
cmp dword [ebx + 0x70], 3
jb 0x447a46
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x68]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x44], eax
mov ecx, dword [ebx + 0x54]
shl eax, cl
mov edx, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x68]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x44], eax
cmp dword [ebx + 0x70], 0x106
jae 0x447a5b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x44795a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44d018
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x44d0c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405b8c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44d04a
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405b8c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44d06f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405964
mov eax, dword [ebp - 8]
mov edx, 0x44d0dc
call fcn.00405894
je 0x44d0a2
mov eax, esi
mov ecx, 0x44d0dc
mov edx, dword [ebp - 4]
call fcn.00405784
jmp 0x44d0ac
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004054c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d0ce
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret

Function at 0x44d0e0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x44d116
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004056dc
jmp 0x44d11d
mov eax, ebx
call fcn.0040546c
add esp, 0x108
pop ebx
ret

Function at 0x44d3a8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x44d44a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x44d434
push 0
push edi
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push esi
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x44cfe8]
call fcn.00406858
add esp, 4
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
cmp esi, dword [ebp - 0xc]
jne 0x44d434
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d451
lea eax, [ebp - 4]
call fcn.0040546c
ret
Function at 0x44d8a8
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
mov eax, dword [ebp - 0xc]
call fcn.004058ec
mov eax, dword [ebp + 8]
call fcn.004058ec
xor eax, eax
push ebp
push 0x44d982
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x44d994
call sub.wininet.dll_InternetOpenA
mov dword [0x4aae44], eax
cmp dword [0x4aae44], 0
je 0x44d94b
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
mov eax, dword [ebp + 8]
call fcn.00409dd8
push eax
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
mov eax, dword [0x4aae44]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [0x4aae40], eax
cmp dword [0x4aae40], 0
je 0x44d94b
jmp 0x44d956
xor ebx, ebx
mov byte [0x4a4164], 0
jmp 0x44d95f
mov bl, 1
mov byte [0x4a4164], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d989
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405490
lea eax, [ebp + 8]
call fcn.0040546c
ret

Function at 0x44d9bc
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
xor eax, eax
push ebp
push 0x44da34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4a4164], 0
je 0x44da19
xor ebx, ebx
push 0
push 2
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
mov eax, dword [0x4aae40]
push eax
call sub.wininet.dll_FtpPutFileA
test eax, eax
je 0x44da19
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44da3b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret

Function at 0x453914
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040546c
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x453962
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004056dc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4579e4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457b17
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x420a38]
call fcn.00420b38
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x457aed
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00420c14
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004056dc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x457b2c
call fcn.00405784
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00420e7c
lea ecx, [ebp - 4]
mov edx, 0x457b68
mov eax, dword [ebp - 0xc]
call fcn.004214dc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040f90c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x457ad0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x457b74
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4a4778]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457ad7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x457bc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x457c0b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457bee
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457bff
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x457c0b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x45c6fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4ab030], 0
je 0x45c845
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4a4f48]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x45c845
mov eax, dword [0x4ab034]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4ab030]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x45c814
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4ab030]
call fcn.00419610
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x45c80c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x45c80c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x45c80c
mov eax, dword [ebp - 0x14]
call fcn.00466ca8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c80c
push ebp
call fcn.0045c6b8
pop ecx
test al, al
jne 0x45c80c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0040483c
test al, al
je 0x45c80c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.0040483c
cmp byte [ebp - 1], 0
je 0x45c80c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x45c80c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4ab034]
call fcn.0045be28
inc edi
dec ebx
jne 0x45c761
mov eax, dword [0x4ab034]
cmp dword [eax + 8], 0
jle 0x45c82c
mov eax, dword [0x4ab034]
call fcn.0045bee0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x45c845
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0045c51c
pop ecx
test al, al
jne 0x45c845
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463ba4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040766c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0045ea84
test ebx, ebx
jne 0x463bf7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00463ae0
mov ebx, eax
test ebx, ebx
je 0x463ce2
cmp esi, ebx
je 0x463c20
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x463c35
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x463c6d
add eax, 0xffffff5f
sub eax, 2
jb 0x463c85
dec eax
sub eax, 2
jb 0x463c99
dec eax
sub eax, 2
jb 0x463c8f
jmp 0x463ca3
add eax, 0xfffffdff
sub eax, 2
jb 0x463c85
dec eax
sub eax, 2
jb 0x463c99
dec eax
sub eax, 2
jb 0x463c8f
jmp 0x463ca3
mov byte [esp + 0x120], 0
jmp 0x463cab
mov byte [esp + 0x120], 2
jmp 0x463cab
mov byte [esp + 0x120], 1
jmp 0x463cab
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00471868
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004601fc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x463ce4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x46bd98
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4a5178]
cmp byte [eax + 0xc], 0
je 0x46bf05
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46befe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ab040], 0
jne 0x46bdec
push 0x46bf0c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x46bf14
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab040], eax
cmp dword [0x4a48bc], 0
jne 0x46bee7
push 0x46bf24
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a48bc], eax
cmp dword [0x4a48bc], 0
je 0x46bee7
push 0x46bf30
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab044], eax
push 0x46bf40
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab048], eax
push 0x46bf54
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab04c], eax
push 0x46bf6c
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab050], eax
push 0x46bf84
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab054], eax
push 0x46bf98
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab058], eax
push 0x46bfb0
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab05c], eax
push 0x46bfc8
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab060], eax
push 0x46bfe4
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab064], eax
push 0x46bff0
mov eax, dword [0x4a48bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ab068], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf05
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret