joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043570
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.FileInStream.0
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], ebx
push eax
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x10043621
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], ebx
call edi
mov edx, dword [esp + 0xc]
xor ecx, ecx
xor ebp, ebp
or ecx, eax
or edx, ebp
mov dword [esp + 0x10], edx
jl 0x100435f7
jg 0x100435dd
cmp ecx, 0x7fffffff
jbe 0x100435f7
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x10]
push ebx
push ecx
call edi
cmp eax, 1
jb 0x1004361f
cmp eax, 0xffffffff
mov byte [esi + 0xc], 1
jbe 0x1004360f
or eax, 0xffffffff
mov edx, dword [esi + 0x10]
push ebx
push ebx
push ebx
push edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop ebp
mov eax, esi
pop ebx
add esp, 8
ret

Function at 0x10043710
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10043747
mov eax, dword [esi + 8]
test eax, eax
je 0x10043747
mov edx, dword [esp + 0xc]
push 0
push edx
push eax
mov eax, dword [esi + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10043747
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 8]
mov dword [edx], ecx
mov al, 1
pop esi
ret 8
xor al, al
pop esi
ret 8

Function at 0x10043750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100494c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.100441e0
mov esi, dword [esp + 0x2c]
push eax
add esi, 0x10
mov dword [esp + 0x28], 0
call fcn.10044660
lea esi, [esp + 8]
call fcn.10042820
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x10043c50
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
push edi
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
je 0x10043d3d
mov esi, dword [ebp + 0x14]
cmp esi, dword [ebp + 0x18]
lea ebx, [ebp + 0x10]
jbe 0x10043c80
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea ebx, [ebx]
mov edi, dword [ebp + 0x18]
cmp dword [ebp + 0x14], edi
jbe 0x10043c8e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test ebx, ebx
je 0x10043c99
lea eax, [ebp + 0x10]
cmp ebx, eax
je 0x10043c9f
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, edi
je 0x10043d3d
test ebx, ebx
mov edi, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
jne 0x10043cb3
call edi
cmp esi, dword [ebx + 8]
jb 0x10043cba
call edi
cmp dword [esi], 1
jne 0x10043d25
cmp esi, dword [ebx + 8]
jb 0x10043cc6
call edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10043d34
cmp esi, dword [ebx + 8]
jb 0x10043cdb
call edi
mov eax, dword [esi + 8]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10043d34
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
xor edx, edx
xor edi, edi
or edx, eax
or ecx, edi
add dword [ebp + 0x30], edx
mov edi, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
adc dword [ebp + 0x34], ecx
cmp esi, dword [ebx + 8]
jb 0x10043d2c
call edi
add esi, 0x14
jmp 0x10043c80
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
Function at 0x100441e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1004911c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
mov esi, dword [esp + 0x2c]
lea eax, [esi + 4]
push eax
mov ecx, edi
mov dword [esi], 0
call fcn.10044470
lea ecx, [esi + 8]
push ecx
mov ecx, ebx
mov dword [esp + 0x28], 0
call fcn.10044470
mov byte [esp + 0x24], 1
mov edx, dword [0x10056f24]
mov eax, dword [edx + 0xc]
mov ecx, 0x10056f24
lea ebp, [esi + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x24], 2
mov edx, dword [0x10056f24]
mov eax, dword [edx + 0xc]
mov ecx, 0x10056f24
call eax
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov byte [ecx], 1
mov edx, dword [0x10056f24]
mov eax, dword [edx + 0xc]
mov ecx, 0x10056f24
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x24], 4
mov edx, dword [0x10056f24]
mov eax, dword [edx + 0xc]
mov ecx, 0x10056f24
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.10042a30
mov edx, dword [esp + 0x18]
push edx
push str.Content_Disposition:_form_data__name__s_
lea edi, [esp + 0x3c]
call fcn.100457c0
lea eax, [esp + 0x24]
push eax
mov eax, ebp
mov ecx, ebx
call fcn.10042a30
add esp, 0x10
push 4
push str._r_n_r_n
mov ecx, edi
push ecx
call fcn.10044380
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x100442ff
xor eax, eax
jmp 0x1004430f
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10044304
sub eax, edx
mov edi, eax
push ebx
lea eax, [esi + 0x10]
call fcn.100450f0
mov byte [esp + 0x24], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1004433f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x24], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10044360
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8

Function at 0x10045f6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10056024]
jne 0x10045f76
repz ret
jmp fcn.10046433
Function at 0x10046f7f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10056024]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.10046ebe
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10046fce
cmp dword [ebp - 0x1c], 5
jb 0x10046fe6
jmp 0x10046fe2
cmp dword [ebp - 0x10], 1
jne 0x10046fe6
cmp dword [ebp - 0x1c], 4
ja 0x10046fe2
jne 0x10046fe6
cmp dword [ebp - 0x18], 0
jbe 0x10046fe6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1004a7f4
call fcn.10046d54
test eax, eax
jge 0x10047007
mov byte [0x100570cc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10045f6c
add ebp, 0x78
leave
ret
Function at 0x40ceb3
Capabilities:
Set current directory

Disassembly:
sub esp, 0x140
push ebx
xor ebx, ebx
cmp byte [0x46334c], bl
push ebp
push esi
je 0x40d01c
cmp byte [0x461069], bl
je 0x40d01c
cmp dword [0x4634c8], ebx
jne 0x40d01c
cmp dword [0x4634b8], ebx
jg 0x40d01c
cmp byte [0x4634bc], bl
jne 0x40d01c
cmp byte [0x46334d], bl
je 0x40d01c
mov eax, dword [0x4634b4]
cmp eax, dword [0x461078]
jge 0x40d01c
mov esi, dword [0x46424c]
xor ebp, ebp
cmp esi, ebx
je 0x40d01c
push edi
cmp byte [esi + 0x14], bl
je 0x40cffb
cmp byte [esi + 0xc], 1
jae 0x40cffb
mov eax, dword [esi + 8]
cmp eax, dword [0x463244]
jl 0x40cffb
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
sub eax, dword [esi + 0x10]
cmp eax, dword [esi + 4]
jb 0x40cffb
cmp ebp, ebx
jne 0x40cf9a
mov ecx, dword [0x463c78]
inc dword [0x4634b4]
push 0x80
call fcn.00401c84
push eax
push 0x4632ac
call fcn.00438c34
push 0x140
lea eax, [esp + 0x20]
push 0x463218
push eax
call fcn.00453500
add esp, 0x18
mov dword [esi + 0x10], edi
inc ebp
cmp dword [0x4634d4], ebx
je 0x40cfb1
push 0x463c80
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov eax, dword [esi]
mov eax, dword [eax + 4]
movzx eax, byte [eax]
push eax
push ebx
push ebx
push dword [esi + 8]
call fcn.0040bc93
mov eax, dword [esi]
add esp, 0x10
inc byte [esi + 0xc]
mov ecx, dword [eax + 4]
push ebx
push ebx
push 1
call fcn.004057b1
dec byte [esi + 0xc]
cmp byte [0x4634a9], bl
je 0x40cffb
push 0xa
push dword [0x463360]
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40cffb
mov byte [0x4634a9], bl
mov esi, dword [esi + 0x18]
cmp esi, ebx
jne 0x40cf28
cmp ebp, ebx
pop edi
je 0x40d01c
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.0040bbb0
pop ecx
pop ecx
mov al, 1
jmp 0x40d01e
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x40eff8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
push edi
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
lea eax, [esi + 0x14]
jne 0x40f01d
lea eax, [ebp + 0x17]
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
jne 0x40f05f
push 0x457bf0
push edi
call fcn.00438ef0
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x40f05f
push 0x456858
push ebx
call fcn.00401a9c
pop ecx
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
jne 0x40f05f
test esi, esi
je 0x40f05c
mov byte [esi + 0x18], 1
mov byte [ebx], 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
push edi
call fcn.00413b50
mov bl, al
add esp, 0x14
test bl, bl
mov byte [ebp + 0x14], bl
je 0x40f169
cmp byte [ebp + 0x10], 0
je 0x40f11b
cmp bl, 0x9e
je 0x40f09e
cmp bl, 0x9f
jne 0x40f138
cmp byte [ebp + 0x18], 0
je 0x40f0bf
push 1
push 0
push 0xffffffffffffffff
push 0x457bec
mov ecx, dword [0x463c78]
call fcn.00401525
jmp 0x40f1d9
push edi
push str.__s__is_not_allowed_as_a_prefix_key.
mov esi, 0x200
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040a9c1
add esp, 0x10
cmp byte [0x46428c], 0
lea eax, [ebp - 0x210]
je 0x40f0fd
push str.__The_current_thread_will_exit.
push esi
push eax
call fcn.0040aa5c
add esp, 0xc
jmp 0x40f1c3
push 0
fldz
push ecx
push ecx
fstp qword [esp]
push 0
push 0x10000
push eax
call fcn.0043b595
add esp, 0x18
jmp 0x40f1d9
test esi, esi
je 0x40f138
push 2
push 0x457ba0
push edi
call fcn.0044188c
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [esi + 0x19], al
push dword [ebp + 0x14]
call fcn.004444da
test byte [ebp - 1], 0x30
pop ecx
mov byte [ebp - 2], al
je 0x40f1f5
cmp bl, 0x41
jb 0x40f1f5
cmp bl, 0x5a
ja 0x40f1f5
and byte [ebp - 1], 0xcf
jmp 0x40f1f5
push edi
call fcn.004138f8
test ax, ax
pop ecx
jne 0x40f204
push 1
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.0042287b
add esp, 0xc
test ax, ax
mov dword [ebp - 0xc], eax
jne 0x40f1dd
cmp byte [ebp + 0x18], al
je 0x40f1a5
push 1
push 0
push 0xffffffffffffffff
push 0x457b9c
jmp 0x40f0af
test esi, esi
je 0x40f1d9
push edi
push str.__s__is_not_a_valid_key_name.__The_current_thread_will_exit.
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.0040a9c1
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x4565d8
mov ecx, 0x463de0
push eax
call fcn.0044a877
xor eax, eax
jmp 0x40f23f
mov eax, dword [ebp - 8]
inc dword [0x46502c]
mov byte [eax], 4
mov eax, dword [ebp - 0x10]
mov bl, al
mov byte [eax + 0x46501c], 1
cmp byte [ebp - 2], 0
je 0x40f201
mov eax, dword [ebp - 8]
mov byte [eax], 2
mov eax, dword [ebp - 0xc]
cmp byte [ebp + 0x10], 0
je 0x40f217
test esi, esi
je 0x40f23c
mov byte [esi + 0x13], bl
mov word [esi + 0xa], ax
jmp 0x40f23c
test esi, esi
je 0x40f23c
mov word [esi + 8], ax
xor eax, eax
mov al, byte [ebp - 1]
mov byte [esi + 0x12], bl
and eax, 0xffffffd5
push eax
call fcn.00410431
or dword [esi + 0xc], eax
mov al, byte [ebp - 1]
and al, 0x2a
or byte [esi + 0x10], al
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fdcc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
xor ebx, ebx
cmp byte [0x465044], bl
mov dword [ebp - 8], ecx
jne 0x40ff3b
cmp dword [0x46451c], ebx
jne 0x40fdfa
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x46451c], eax
inc dword [0x465040]
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x465040]
mov esi, dword [0x461080]
mov edx, eax
sub edx, dword [0x46451c]
cmp ecx, dword [0x46107c]
mov dword [0x464520], eax
jbe 0x40fe9d
cmp edx, esi
jae 0x40fe9d
push edx
push ecx
push str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea eax, [ebp - 0x808]
push 0x800
xor edi, edi
push eax
inc edi
call fcn.0040a9c1
add esp, 0x14
call fcn.0040fbc1
fldz
push ebx
push ecx
push ecx
fstp qword [esp]
push ebx
lea eax, [ebp - 0x808]
push 4
push eax
mov byte [0x465044], 1
mov byte [0x461069], bl
call fcn.0043b595
add esp, 0x18
cmp eax, 7
jne 0x40fe89
push ebx
push ebx
push edi
mov ecx, 0x463de0
call fcn.00415d8b
mov eax, dword [0x464520]
mov byte [0x461069], 1
mov byte [0x465044], bl
jmp 0x40fea3
xor edi, edi
cmp edx, esi
jbe 0x40feb6
cmp edi, ebx
mov dword [0x465040], ebx
mov dword [0x46451c], eax
jne 0x40ff39
mov ecx, dword [ebp - 8]
mov al, byte [ecx + 0x11]
mov byte [0x464271], al
cmp byte [ecx + 0x1a], bl
je 0x40ff03
cmp byte [ecx + 0x1b], bl
je 0x40ff03
mov byte [ebp - 1], 1
call fcn.0040f656
mov esi, dword [ebp + 8]
mov eax, dword [esi]
inc byte [esi + 0x19]
mov ecx, dword [eax + 4]
push ebx
push ebx
push 1
call fcn.004057b1
dec byte [esi + 0x19]
cmp byte [ebp - 1], bl
mov edi, eax
je 0x40fefa
mov ecx, dword [ebp - 8]
call fcn.0040fb55
cmp edi, ebx
jne 0x40ff08
mov byte [esi + 0x1d], bl
jmp 0x40ff39
mov byte [ebp - 1], bl
jmp 0x40fed4
cmp byte [esi + 0x1d], bl
je 0x40ff39
mov byte [esi + 0x1d], bl
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [esi + 4]
cmp eax, 0x3e8
ja 0x40ff39
mov eax, dword [ebp - 8]
movzx eax, word [eax]
push ebx
push eax
push 0x312
push dword [0x463360]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41038e
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0xa
jne 0x410398
mov al, 0xd
ret
push ebx
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ebx, eax
shr ebx, 8
cmp bl, 0xff
jne 0x4103b9
cmp al, 0xff
jne 0x4103b9
xor al, al
pop ebx
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x41040c
mov dl, bl
and dl, 6
cmp dl, 6
jne 0x4103d9
cmp byte [0x4644a1], 0
je 0x4103d9
or byte [ecx], 8
jmp 0x4103fb
test bl, 2
je 0x4103ea
mov dl, byte [ecx]
test dl, 3
jne 0x4103ea
or dl, 1
mov byte [ecx], dl
test bl, 4
je 0x4103fb
mov dl, byte [ecx]
test dl, 0xc
jne 0x4103fb
or dl, 4
mov byte [ecx], dl
test bl, 1
je 0x41040c
mov dl, byte [ecx]
test dl, 0x30
jne 0x41040c
or dl, 0x10
mov byte [ecx], dl
pop ebx
ret
Function at 0x4106b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 3
jge 0x4106cc
mov eax, dword [ebp + 0x10]
jmp 0x41077d
push ebx
mov bl, byte [ebp + 8]
test bl, bl
push esi
mov esi, dword [ebp + 0x10]
mov byte [esi], 0
jne 0x4106f2
cmp word [ebp + 0xc], 0
je 0x410779
push dword [ebp + 0xc]
call fcn.00411fa2
mov bl, al
jmp 0x410707
cmp word [ebp + 0xc], 0
jne 0x41070f
push 0
push dword [ebp + 8]
call fcn.00412065
pop ecx
mov dword [ebp + 0xc], eax
cmp word [ebp + 0xc], 0
pop ecx
je 0x41072d
cmp bl, 0x9e
je 0x41072d
cmp bl, 0x9f
je 0x41072d
movzx eax, word [ebp + 0xc]
push edi
push esi
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x410779
mov eax, dword [0x4621c8]
xor ecx, ecx
test eax, eax
jle 0x410754
cmp byte [ecx*8 + 0x461e0c], bl
je 0x410746
inc ecx
cmp ecx, eax
jl 0x410738
cmp ecx, eax
jge 0x410754
push edi
push dword [ecx*8 + 0x461e08]
jmp 0x410770
movzx eax, bl
push eax
call fcn.0043bfeb
test eax, eax
pop ecx
je 0x41076a
mov byte [esi], bl
mov byte [esi + 1], 0
jmp 0x410779
push edi
push str.not_found
push esi
call fcn.00438c34
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x410780
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x463490], 0
je 0x410796
cmp byte [esp + 4], 0
jne 0x410796
mov al, byte [0x46337c]
ret
push ebx
xor bl, bl
cmp byte [0x464499], bl
push esi
push edi
jne 0x410836
cmp byte [0x46449a], bl
jne 0x410836
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov esi, 0x8000
test si, ax
je 0x4107cd
add bl, 0x10
push 0xa1
call edi
test si, ax
je 0x4107dc
or bl, 0x20
push 0xa2
call edi
test si, ax
je 0x4107eb
or bl, 1
push 0xa3
call edi
test si, ax
je 0x4107fa
or bl, 2
push 0xa4
call edi
test si, ax
je 0x410809
or bl, 4
push 0xa5
call edi
test si, ax
je 0x410818
or bl, 8
push 0x5b
call edi
test si, ax
je 0x410824
or bl, 0x40
push 0x5c
call edi
test si, ax
je 0x4108b1
or bl, 0x80
jmp 0x4108b1
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebp
push 0x10
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x41085a
push 0x10
call ebp
test si, ax
je 0x41085c
mov bl, 0x10
push 0x11
call edi
test si, ax
jne 0x41086e
push 0x11
call ebp
test si, ax
je 0x410871
or bl, 1
push 0x12
call edi
test si, ax
jne 0x410883
push 0x12
call ebp
test si, ax
je 0x410886
or bl, 4
push 0x5b
call edi
test si, ax
jne 0x410898
push 0x5b
call ebp
test si, ax
je 0x41089b
or bl, 0x40
push 0x5c
call edi
test si, ax
jne 0x4108ad
push 0x5c
call ebp
test si, ax
je 0x4108b0
or bl, 0x80
pop ebp
cmp dword [0x463490], 0
je 0x4108ee
mov al, bl
not al
and al, byte [0x46337c]
je 0x4108ee
not al
and byte [0x46337e], al
and byte [0x46337c], al
and byte [0x46337d], al
xor eax, eax
mov al, byte [0x46337e]
push eax
push 0x463380
call fcn.004102d0
pop ecx
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x4114fa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor ecx, ecx
mov eax, dword [ecx*8 + 0x465080]
test eax, eax
je 0x411516
cmp eax, ebx
je 0x411533
inc ecx
cmp ecx, 0xa
jl 0x411501
cmp ecx, 0xa
jl 0x41151e
push 9
pop ecx
mov eax, dword [esp + 0xc]
test eax, eax
push esi
lea esi, [ecx*8 + 0x465080]
je 0x411552
mov dword [esi + 4], eax
jmp 0x411588
mov edx, dword [esp + 0xc]
test edx, edx
je 0x411549
lea eax, [ecx*8 + 0x465084]
cmp dword [eax], 0
jne 0x411549
mov dword [eax], edx
mov eax, dword [ecx*8 + 0x465084]
pop ebx
ret
and dword [esi + 4], 0
push edi
push 0x20
pop edi
push ebx
push edi
call dword [sym.imp.USER32.dll_VkKeyScanExA]
cmp ax, 0xffff
je 0x411572
and ax, 0x600
cmp ax, 0x600
je 0x41157d
inc edi
cmp edi, 0x100
jl 0x41155a
jmp 0x411584
mov dword [esi + 4], 3
mov eax, dword [esi + 4]
pop edi
mov dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x411a2e
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov ebx, 0x80000000
cmp ecx, ebx
je 0x411b96
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, ebx
je 0x411b95
mov edx, dword [0x4650d0]
cmp edx, 2
jne 0x411a92
push eax
mov al, byte [ebp + 0x18]
neg al
push ecx
push 0
sbb eax, eax
and eax, ebx
or eax, 1
push eax
call fcn.0041014b
add esp, 0x10
call fcn.00410650
cmp byte [ebp + 0x18], 0
je 0x411b95
mov dword [esi], ebx
mov dword [edi], ebx
jmp 0x411b95
mov eax, dword [ebp + 0x10]
or word [eax], 0x8001
cmp byte [ebp + 0x18], 0
je 0x411adc
cmp edx, 1
jne 0x411ac8
cmp dword [0x465050], ebx
jne 0x411ab8
push 0x465050
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x465050]
add dword [esi], eax
mov eax, dword [0x465054]
add dword [edi], eax
jmp 0x411aee
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
add dword [esi], eax
mov eax, dword [ebp - 8]
jmp 0x411ac4
test byte [0x463350], 2
jne 0x411aee
push edi
push esi
call fcn.00438ff1
pop ecx
pop ecx
cmp dword [0x4650d0], 1
jne 0x411b05
mov eax, dword [esi]
mov dword [0x465050], eax
mov eax, dword [edi]
mov dword [0x465054], eax
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 8], eax
mov eax, dword [esi]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
inc eax
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
inc eax
test ebx, ebx
mov dword [edi], eax
jl 0x411b7e
cmp ebx, 0x64
jle 0x411b40
push 0x64
pop ebx
test ebx, ebx
je 0x411b7e
cmp dword [0x4650d0], 1
je 0x411b7e
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
shl eax, 0x10
cdq
idiv dword [ebp + 8]
push ebx
push dword [edi]
push dword [esi]
inc eax
push eax
mov eax, dword [ebp - 0xc]
shl eax, 0x10
cdq
idiv dword [ebp - 4]
inc eax
push eax
call fcn.0042ad93
add esp, 0x14
jmp 0x411b95
push eax
push dword [esi]
push 0
push 0x8001
call fcn.004119ea
add esp, 0x10
call fcn.00410650
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412065
Capabilities:
Log keystrokes

Disassembly:
push esi
movzx esi, byte [esp + 8]
mov ecx, esi
mov eax, 0x90
cmp ecx, eax
jg 0x4120eb
je 0x4120e1
sub ecx, 0x5b
cmp ecx, 0x14
ja case.0x412084.93
jmp dword [ecx*4 + 0x412191]
mov eax, 0x15b
jmp 0x41217d
mov eax, 0x15c
jmp 0x41217d
push 0x52
jmp 0x412121
push 0x4f
jmp 0x412121
push 0x50
jmp 0x412121
push 0x51
jmp 0x412121
push 0x4b
jmp 0x412121
push 0x4c
jmp 0x412121
push 0x4d
jmp 0x412121
push 0x47
jmp 0x412121
push 0x48
jmp 0x412121
push 0x49
jmp 0x412121
push 0x53
jmp 0x412121
mov eax, 0x135
jmp 0x41217d
push 0x37
jmp 0x412121
push 0x4a
jmp 0x412121
push 0x4e
jmp 0x412121
mov eax, 0x145
jmp 0x41217d
sub ecx, 0xa0
je 0x41211f
dec ecx
je 0x412118
dec ecx
je 0x412114
dec ecx
je 0x41210d
dec ecx
je 0x412109
dec ecx
jne case.0x412084.93
mov eax, 0x138
jmp 0x41217d
push 0x38
jmp 0x412121
mov eax, 0x11d
jmp 0x41217d
push 0x1d
jmp 0x412121
mov eax, 0x136
jmp 0x41217d
push 0x2a
pop eax
jmp 0x41217d
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ax, ax
jne 0x412134
pop esi
ret
cmp esi, 0x2e
jg 0x412169
cmp esi, 0x2d
jge 0x412159
cmp esi, 3
je 0x412178
cmp esi, 0xd
je 0x412159
cmp esi, 0x20
jle 0x41217d
cmp esi, 0x28
jle 0x412159
cmp esi, 0x2c
je 0x412178
jmp 0x41217d
cmp byte [esp + 0xc], 0
movzx eax, ax
je 0x41218f
or ax, 0x100
pop esi
ret
sub esi, 0x5d
je 0x412178
sub esi, 0x12
je 0x412178
sub esi, 0x21
jne 0x41217d
or eax, 0x100
mov cl, byte [esp + 0xc]
neg cl
movzx eax, ax
sbb ecx, ecx
not ecx
and ecx, eax
mov ax, cx
pop esi
ret