joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d0a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call esi
mov edi, 0x8000
mov ecx, edi
test cx, ax
je 0x440d2d
inc ebx
push 0x11
call esi
mov ecx, edi
test cx, ax
je 0x440d3b
or ebx, 2
push 0x12
call esi
mov ecx, edi
test cx, ax
je 0x440d49
or ebx, 4
push 0x5b
call esi
mov ecx, edi
test cx, ax
je 0x440d57
or ebx, 8
push 0x5c
call esi
movzx eax, ax
test edi, eax
je 0x440d65
or ebx, 8
mov ecx, dword [ebp + 8]
push ebx
call fcn.0045ecdf
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x440d76
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
push 0x14
mov dword [ebp - 4], edi
call esi
test al, 1
je 0x440d90
inc edi
push 0x90
call esi
movzx eax, ax
test al, 1
je 0x440da1
or edi, 2
mov ecx, dword [ebp + 8]
push edi
call fcn.0045eda0
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret

Function at 0x440e2a
Capabilities:
Log keystrokes

Disassembly:
push 2
push dword [esp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
ret

Function at 0x440e37
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [ecx - 0x60]
cmp eax, 9
ja 0x440e47
push 3
pop eax
ret
mov al, byte [esp + 8]
push esi
push edi
test al, 1
je 0x440e76
cmp ecx, 0x10
jne 0x440e76
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call edi
mov esi, 0x8000
mov ecx, esi
test cx, ax
jne 0x440ee3
push 0xa1
jmp 0x440eed
test al, 2
je 0x440e9f
cmp ecx, 0x11
jne 0x440e9f
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call edi
mov esi, 0x8000
mov ecx, esi
test cx, ax
jne 0x440ee3
push 0xa3
jmp 0x440eed
test al, 8
je 0x440ec1
cmp ecx, 0x5b
jne 0x440ec1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ecx
call edi
mov esi, 0x8000
mov ecx, esi
test cx, ax
jne 0x440ee3
push 0x5c
jmp 0x440eed
test al, 4
je 0x440ef9
cmp ecx, 0x12
jne 0x440ef9
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call edi
mov esi, 0x8000
mov ecx, esi
test cx, ax
je 0x440ee8
xor eax, eax
inc eax
jmp 0x440efb
push 0xa5
call edi
test si, ax
je 0x440ef9
push 2
pop eax
jmp 0x440efb
xor eax, eax
pop edi
pop esi
ret

Function at 0x4417b9
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x17
mov dword [esp + 0x14], ebp
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
push 1
setne bl
call esi
mov edi, 0x8000
mov ecx, edi
test cx, ax
je 0x4417f1
xor eax, eax
test bl, bl
setne al
inc eax
mov ebp, eax
push 2
call esi
mov ecx, edi
test cx, ax
je 0x441806
xor eax, eax
test bl, bl
sete al
inc eax
or ebp, eax
push 4
call esi
mov ecx, edi
test cx, ax
je 0x441814
or ebp, 4
push 5
call esi
mov ecx, edi
test cx, ax
je 0x441822
or ebp, 8
push 6
call esi
movzx eax, ax
test edi, eax
je 0x441830
or ebp, 0x10
mov ecx, dword [esp + 0x18]
push ebp
call fcn.0047c6a3
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x441872
Capabilities:
Log keystrokes

Disassembly:
push 0x28
mov eax, 0x4ef770
call fcn.00495410
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [esi + 0xc]
xor edi, edi
add eax, 0xffffff00
mov ecx, 0xff
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
cmp eax, 7
ja case.default.0x4418ab
movzx eax, byte [eax + 0x4419aa]
jmp dword [eax*4 + 0x4419a2]
mov eax, dword [esi + 0x10]
push 2
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
mov dword [ebp - 0x14], eax
jmp case.default.0x4418ab
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
shr eax, 0x10
and eax, ecx
push edi
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
mov esi, dword [esi + 0xc]
sub esi, 0x100
je 0x441904
dec esi
je 0x4418ff
sub esi, 3
je 0x441904
dec esi
je 0x4418ff
or dword [ebp + 0xc], 0xffffffff
jmp 0x441907
mov dword [ebp + 0xc], edi
jmp 0x441907
mov dword [ebp + 0xc], ebx
lea eax, [ebp - 0x24]
push eax
call fcn.00440d0a
pop ecx
mov edx, dword [eax]
mov ecx, eax
mov dword [ebp - 4], edi
call dword [edx + 4]
push eax
push dword [ebp - 0x10]
call fcn.00440e37
pop ecx
pop ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
call fcn.0045ecf1
lea eax, [ebp - 0x34]
push eax
call fcn.00440d76
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], 2
call fcn.00440d0a
pop ecx
pop ecx
mov ebx, eax
push dword [ebp - 0x18]
mov eax, dword [esi]
push dword [ebp + 0xc]
mov ecx, esi
mov byte [ebp - 4], 3
call dword [eax + 4]
push eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0045f9ec
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
call fcn.0045ecf1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.0045edb2
mov eax, dword [ebp + 8]
call fcn.004954af
ret

Function at 0x44260f
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
xor edi, edi
mov byte [ebp - 1], 0
mov dword [ebp + 8], eax
xor ebx, ebx
cmp ebx, dword [ebp + 0x10]
jge 0x442678
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + ebx*4]
movzx eax, word [esi + 4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x442656
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
seta byte [ebp - 1]
jmp 0x442671
cmp edi, dword [0x56092c]
jne 0x442671
movzx eax, word [esi + 4]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
setne byte [ebp - 1]
inc ebx
cmp byte [ebp - 1], 0
je 0x442626
cmp byte [ebp - 1], 0
jne 0x442680
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x442689
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [eax]
push dword [ebp + 0xc]
movzx eax, word [eax + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4426f8
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
test eax, eax
jle 0x4426f7
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4426f7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4426f0
push dword [edi]
call fcn.00494f5c
push dword [edi]
mov dword [ebp - 4], eax
push esi
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x445556
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x4ef1f9
call fcn.00495410
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
push dword [esi + 0x48]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
jle 0x4455e4
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
push edi
push eax
push dword [esi + 0x48]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.00440bf1
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_class_ScCore::String_const__]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push dword [ebp - 0x10]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp + 8]
call fcn.004954af
ret 4

Function at 0x4473c2
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 1
call dword [eax + 0x148]
mov ecx, esi
pop esi
jmp method.ScriptUI::Win32OS_PanelWidget.virtual_40
Function at 0x4558d6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov esi, ecx
push 0xb0
push dword [esi + 0x48]
call edi
mov eax, dword [esi]
xor ebx, ebx
push 0xe
mov ecx, esi
mov dword [ebp - 4], ebx
call dword [eax + 0x1bc]
test eax, eax
jle 0x455996
lea ebx, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
push eax
push ebx
push 0xd
push dword [esi + 0x48]
mov dword [ebp - 8], eax
call edi
mov edx, dword [ebp - 0xc]
xor eax, eax
test edx, edx
jbe 0x455962
lea esi, [edx - 1]
cmp eax, esi
ja 0x45595d
mov ecx, dword [ebp - 8]
cmp word [ecx + eax*2], 0xd
jne 0x45595d
cmp word [ecx + eax*2 + 2], 0xa
jne 0x45595d
inc dword [ebp - 4]
inc eax
cmp eax, edx
jb 0x455944
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
mov ecx, edx
cmp edx, esi
jae 0x45598d
lea edx, [esi - 1]
cmp ecx, edx
ja 0x455988
mov eax, dword [ebp - 8]
cmp word [eax + ecx*2], 0xd
jne 0x455988
cmp word [eax + ecx*2 + 2], 0xa
jne 0x455988
inc ebx
inc ecx
cmp ecx, esi
jb 0x455971
push dword [ebp - 8]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
pop edi
sub eax, ebx
pop esi
mov dword [ecx], eax
pop ebx
leave
ret 8

Function at 0x4559b2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
push 0xe
mov dword [ebp - 4], edi
call dword [eax + 0x1bc]
cmp eax, edi
jle 0x455a52
push ebx
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
mov ebx, eax
push ebx
push edi
push 0xd
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 8]
xor eax, eax
test ecx, ecx
jbe 0x455a22
lea edx, [ecx - 1]
cmp eax, edx
ja 0x455a1d
cmp word [ebx + eax*2], 0xd
jne 0x455a1d
cmp word [ebx + eax*2 + 2], 0xa
jne 0x455a1d
inc dword [ebp - 4]
inc eax
cmp eax, ecx
jb 0x455a07
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, edx
jae 0x455a4a
lea ecx, [edx - 1]
cmp eax, ecx
ja 0x455a45
cmp word [ebx + eax*2], 0xd
jne 0x455a45
cmp word [ebx + eax*2 + 2], 0xa
jne 0x455a45
inc edi
inc eax
cmp eax, edx
jb 0x455a31
push ebx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
pop ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [esi]
add edi, ecx
mov ecx, dword [ebp + 8]
push 0
push edi
add edx, ecx
push edx
push 0xb1
mov ecx, esi
call dword [eax + 0x1c4]
pop edi
pop esi
leave
ret 8
Function at 0x455a78
Capabilities:
Get graphical window text

Disassembly:
push 8
mov eax, 0x4f2f94
call fcn.00495410
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
mov eax, dword [edi]
push 0xe
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
call dword [eax + 0x1bc]
cmp eax, esi
jle 0x455b11
lea ebx, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
mov esi, eax
push esi
push ebx
push 0xd
push dword [edi + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00440bf1
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_class_ScCore::String_const__]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp + 8]
call fcn.004954af
ret 4
Function at 0x494f67
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5636c8]
jne 0x494f71
repz ret
jmp fcn.004958ee

Function at 0x4981f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x54], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov byte [edx + 0x1a], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x498288
push 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x14]
mov dx, word [ebp - 0x10]
mov word [ecx + 0x10], dx
mov eax, dword [ebp - 0x14]
mov cx, word [ebp - 0xc]
mov word [eax + 0x12], cx
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
cmp dword [eax + 0xc], 0
je 0x498288
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esp, ebp
pop ebp
ret

Function at 0x498330
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4983a4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [edx + 0xc], eax
push 5
push 0
push 0
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 0x12]
push ecx
mov edx, dword [ebp - 4]
movsx eax, word [edx + 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov byte [edx + 0x1a], 1
mov esp, ebp
pop ebp
ret
Function at 0x498910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
push 1
push 0
push 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, 1
jne 0x498ab8
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
movzx eax, byte [edx + 0x1a]
test eax, eax
je 0x498a81
cmp dword [ebp - 0x18], 0x102
jne 0x49898a
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0x1d], cl
movsx edx, byte [ebp - 0x1d]
cmp edx, 0x20
jge 0x498985
movsx ax, byte [ebp - 0x1d]
movzx ecx, ax
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x498985
mov dword [ebp - 0x18], 0
jmp 0x498a81
cmp dword [ebp - 0x18], 0x104
jne 0x4989bd
mov eax, dword [ebp - 0x10]
and eax, 0x20000000
jne 0x4989bd
movzx ecx, word [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x4989b8
mov dword [ebp - 0x18], 0
jmp 0x498a81
cmp dword [ebp - 0x18], 0x100
jne 0x498a81
mov ax, word [ebp - 0x14]
mov word [ebp - 0x24], ax
movsx ecx, word [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xd
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xe
ja case.0x4989f2.1
mov eax, dword [ebp - 0x2c]
movzx ecx, byte [eax + 0x498acc]
jmp dword [ecx*4 + 0x498abc]
mov edx, dword [ebp - 0x28]
movsx eax, word [edx + 0x14]
test eax, eax
je 0x498a20
mov ecx, dword [ebp - 0x28]
movzx edx, word [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x18], 0
jmp 0x498a81
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 0x20]
call eax
movzx ecx, al
test ecx, ecx
je 0x498a3e
mov ecx, dword [ebp - 0x28]
call fcn.004981f0
mov dword [ebp - 0x18], 0
jmp 0x498a81
jmp 0x498a81
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x498a66
movsx eax, word [ebp - 0x24]
neg eax
mov word [ebp - 0x24], ax
movzx ecx, word [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x498a81
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x498ab3
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x498ab3
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x498919
mov esp, ebp
pop ebp
ret
Function at 0x4989f9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], ecx
push 1
push 0
push 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, 1
jne 0x498ab8
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
movzx eax, byte [edx + 0x1a]
test eax, eax
je 0x498a81
cmp dword [ebp - 0x18], 0x102
jne 0x49898a
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0x1d], cl
movsx edx, byte [ebp - 0x1d]
cmp edx, 0x20
jge 0x498985
movsx ax, byte [ebp - 0x1d]
movzx ecx, ax
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x498985
mov dword [ebp - 0x18], 0
jmp 0x498a81
cmp dword [ebp - 0x18], 0x104
jne 0x4989bd
mov eax, dword [ebp - 0x10]
and eax, 0x20000000
jne 0x4989bd
movzx ecx, word [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x4989b8
mov dword [ebp - 0x18], 0
jmp 0x498a81
cmp dword [ebp - 0x18], 0x100
jne 0x498a81
mov ax, word [ebp - 0x14]
mov word [ebp - 0x24], ax
movsx ecx, word [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xd
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xe
ja case.0x4989f2.1
mov eax, dword [ebp - 0x2c]
movzx ecx, byte [eax + 0x498acc]
jmp dword [ecx*4 + 0x498abc]
mov edx, dword [ebp - 0x28]
movsx eax, word [edx + 0x14]
test eax, eax
je 0x498a20
mov ecx, dword [ebp - 0x28]
movzx edx, word [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x18], 0
jmp 0x498a81
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 0x20]
call eax
movzx ecx, al
test ecx, ecx
je 0x498a3e
mov ecx, dword [ebp - 0x28]
call fcn.004981f0
mov dword [ebp - 0x18], 0
jmp 0x498a81
jmp 0x498a81
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x498a66
movsx eax, word [ebp - 0x24]
neg eax
mov word [ebp - 0x24], ax
movzx ecx, word [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00498400
movzx edx, al
test edx, edx
je 0x498a81
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x498ab3
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x498ab3
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x498919
mov esp, ebp
pop ebp
ret
Function at 0x498ae0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5636c8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x98], ecx
movsx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x98]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x498b80
push 0x80
lea ecx, [ebp - 0x90]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x90], 0
push 0
push 0x10
push 0x10
push 1
lea ecx, [ebp - 0x90]
push ecx
call fcn.004988f0
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x498b80
mov edx, dword [ebp - 0x94]
push edx
push 1
push 0xf7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00494f67
mov esp, ebp
pop ebp
ret 4

Function at 0x499c00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa5ee
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5636c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Root::constructor_void_]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.SAF::TextView.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00407b10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Rect::constructor_void_]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x40], edx
mov eax, dword [ebp - 0x10]
mov cx, word [ebp + 8]
mov word [eax + 0x54], cx
mov edx, dword [ebp - 0x10]
mov al, byte [ebp + 0x10]
mov byte [edx + 0x58], al
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x10]
fldz
fstp qword [edx + 0x38]
mov eax, dword [ebp - 0x10]
fldz
fstp qword [eax + 0x30]
mov ecx, dword [ebp - 0x10]
fldz
fstp qword [ecx + 0x28]
mov edx, dword [ebp - 0x10]
fldz
fstp qword [edx + 0x20]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x50], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x44], 0xff
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x45], 0xff
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x46], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x47], 0xff
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x48], 0x80
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x49], 0x80
mov eax, 4
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x56], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc