joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4910f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp ebp, edi
je 0x4911c5
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 0x78
jmp 0x491110
sub dword [esp + 0x1c], 0xb4
sub edi, 0xb4
sub esi, 0xb4
test edi, edi
je 0x49112d
lea eax, [edi + 4]
jmp 0x49112f
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi - 0x74]
call fcn.00402150
mov al, byte [edi + 0x20]
mov byte [esi - 0x58], al
mov ecx, dword [edi + 0x24]
lea edx, [edi + 0x28]
mov dword [esi - 0x54], ecx
push edx
lea ecx, [esi - 0x50]
call fcn.00490a50
mov eax, dword [edi + 0x38]
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x3c]
push ecx
lea ecx, [esi - 0x3c]
mov dword [esi - 0x40], eax
call fcn.00402150
lea ebx, [edi + 0x58]
test ebx, ebx
je 0x491176
lea eax, [ebx + 4]
jmp 0x491178
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi - 0x1c]
call fcn.00402150
mov dl, byte [ebx + 0x20]
lea ecx, [ebx + 0x28]
mov byte [esi], dl
mov eax, dword [ebx + 0x24]
push ecx
lea ecx, [esi + 8]
mov dword [esi + 4], eax
call fcn.00490a50
mov edx, dword [ebx + 0x38]
push 0xffffffffffffffff
push 0
add ebx, 0x3c
push ebx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], edx
call fcn.00402150
cmp ebp, edi
mov eax, dword [edi + 0xb0]
mov dword [esi + 0x38], eax
jne 0x491110
pop esi
pop ebx
mov eax, dword [esp + 0x14]
pop edi
pop ebp
ret
Function at 0x493200
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, ecx
push edi
xor edi, edi
push eax
mov dword [esi], vtable.winSockets.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call ebx
cmp eax, edi
mov dword [esi + 4], eax
jne 0x493258
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, edi
je 0x493338
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSAStartup
push eax
call edi
mov edx, dword [esi + 4]
push str.WSACleanup
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push str.WSAGetLastError
push eax
call edi
mov ecx, dword [esi + 4]
push str.WSASetLastError
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 4]
push str.recv
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
push str.send
push eax
call edi
mov ecx, dword [esi + 4]
push str.ioctlsocket
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 4]
push str.inet_addr
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 4]
push str.gethostbyname
push eax
call edi
mov ecx, dword [esi + 4]
push str.socket
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 4]
push str.htons
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push str.connect
push eax
call edi
mov ecx, dword [esi + 4]
push str.closesocket
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 4]
push str.shutdown
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 4]
push str.gethostname
push eax
call edi
mov dword [esi + 0x40], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x494440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e4668
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
lea edi, [esi + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
mov dword [esi + 4], ecx
mov dword [esi], eax
mov dword [esi + 8], edx
push ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push ebp
mov ecx, edi
mov dword [esp + 0x30], edi
mov byte [edi + 4], bl
call fcn.00402150
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [edi + 0x1c], eax
je 0x4944b5
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov al, byte [esp + 0x34]
mov byte [esi + 0x2c], al
mov byte [esi + 0x2d], bl
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x497ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4dc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CIconList.1.0
mov dword [esi + 0x30], vtable.CIconList.0
mov dword [esp + 0x14], 0
call fcn.004973b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00497b10
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x499ce0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e50c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], eax
mov byte [esi + 8], al
mov dword [esi], vtable.CMaskWord.0
mov dword [esp + 0x14], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x1c]
push eax
mov byte [esp + 0x18], 1
mov byte [esi + 0x20], 0x20
call fcn.00499a70
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x49ab64
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebp, ebp
cmp ecx, ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
je 0x49ac7c
push edi
push ebp
push 0x80
xor eax, eax
push 3
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 3
push SysReAllocStringLen
push ecx
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x49ac7b
mov eax, dword [esi + 4]
add esi, 4
cmp eax, ebp
je 0x49abd6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi], ebp
push ebx
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x49ac6f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebp
je 0x49ac6f
push ebp
lea ecx, [esp + 0x20]
push ecx
push ebx
push eax
push edi
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ebx, ebp
je 0x49ac6f
lea edx, [esp + 0x30]
push edx
push 1
push esi
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x49ac5f
mov eax, dword [esp + 0x10]
add eax, 4
push eax
mov eax, dword [esp + 0x34]
push 0x4f32fc
push ebp
push ebp
push eax
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
test eax, eax
jl 0x49ac5f
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x49ac6f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
pop ebx
pop edi
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
mov ecx, esi
call edx
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x1c
ret 4

Function at 0x49b143
Capabilities:
Create pipe

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push edi
call edx
xor eax, eax
xor edi, edi
mov dword [esp + 0x14], eax
push edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x48]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x49b1ba
push 2
push edi
push edi
add esi, 0x4c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
mov eax, dword [esp + 0x1c]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x49b1af
mov edi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x49b2e0
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x58]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x58]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi]
mov eax, dword [esi + 0x54]
mov edx, dword [edx + 0x1c]
push eax
mov ecx, esi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
call edx
mov eax, dword [esi + 0x48]
push eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
call edi
mov ecx, dword [esi + 0x4c]
push ecx
mov dword [esi + 0x48], ebx
call edi
pop edi
mov dword [esi + 0x4c], ebx
pop esi
pop ebx
ret
Function at 0x49bad0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4e52d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
push 0x4e9a2d
lea ecx, [esi + 4]
mov dword [esi + 0x60], 0xffffffff
call fcn.00402230
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov ecx, esi
call edx
mov edx, dword [esp + 0x60]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
lea ecx, [esi + 0x50]
push ecx
mov ecx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x60]
push ecx
push edx
mov ecx, esi
call eax
test eax, eax
mov dword [esi + 0x54], eax
je 0x49bca3
lea ecx, [esi + 0x5c]
push ecx
push 0
push esi
push 0x49b500
push 0
push 0
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0x64], 0
mov dword [esi + 0x58], eax
je 0x49bca3
mov edx, dword [esi + 0x54]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esp + 0x60], eax
je 0x49bc80
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
push 1
push eax
push eax
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0
call ebx
test eax, eax
je 0x49bbd9
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [esp + 0x60]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x49bc67
cmp dword [esi + 0x28], 0
jle 0x49bb91
cmp dword [esi + 0x60], 0xffffffff
jne 0x49bbfd
call edi
mov dword [esi + 0x60], eax
jmp 0x49bb91
call edi
mov ecx, dword [esi + 0x28]
imul ecx, ecx, 0x3e8
add ecx, dword [esi + 0x60]
cmp eax, ecx
jbe 0x49bb91
cmp dword [esi + 0x40], 0
je 0x49bc67
mov ebx, 0x10
cmp dword [esi + 0x44], ebx
jb 0x49bc24
mov eax, dword [esi + 0x30]
jmp 0x49bc27
lea eax, [esi + 0x30]
mov edx, dword [esi + 0x28]
push edx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0040fde0
add esp, 0xc
cmp dword [eax + 0x18], ebx
mov dword [esp + 0x50], 0
jb 0x49bc4b
mov eax, dword [eax + 4]
jmp 0x49bc4e
add eax, 4
push eax
mov ecx, esi
call fcn.0049b750
lea ecx, [esp + 0x2c]
mov dword [esp + 0x50], 0xffffffff
call fcn.0046f4f0
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 0x4e9a2d
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
mov eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
Function at 0x49ca90
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push str.SHELL32.DLL
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x24], eax
je 0x49cb1a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DragQueryPoint
push eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x24]
push str.ExtractIconA
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.ExtractIconExA
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x24]
push str.ShellExecuteA
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x24]
push str.SHGetFileInfoA
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.DragQueryFileA
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 0x24]
push str.SHBrowseForFolderA
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
push str.SHGetPathFromIDListA
push eax
call edi
mov dword [esi + 0x20], eax
pop edi
pop esi
ret

Function at 0x49cb60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push str.COMDLG32.DLL
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x1c], eax
je 0x49cbce
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ChooseFontA
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
push str.ChooseColorA
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.GetOpenFileNameA
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x1c]
push str.GetSaveFileNameA
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x1c]
push str.GetFileTitleA
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.CommDlgExtendedError
push ecx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x18], eax
pop edi
pop esi
ret
Function at 0x49db90
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4e56c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x48]
lea edi, [esi + 0x124]
mov dword [esi], vtable.SMTP.0
mov dword [edi], vtable.SMTP.2.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x48], vtable.SMTP.1.0
mov eax, dword [edi + 8]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x20], 6
je 0x49dc2c
push 1
push eax
mov dword [edi + 4], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi]
cmp eax, 0x102
mov eax, dword [edx + 0x14]
mov ecx, edi
jne 0x49dc1a
call eax
mov ecx, dword [edi + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x49dc1c
call eax
mov ecx, dword [edi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov dword [edi + 4], ebx
cmp dword [esi + 0x238], 0x10
jb 0x49dc44
mov eax, dword [esi + 0x224]
push eax
call fcn.004b9684
add esp, 4
mov dword [esi + 0x238], 0xf
mov dword [esi + 0x234], ebx
mov byte [esi + 0x224], bl
cmp dword [esi + 0x214], 0x10
jb 0x49dc72
mov eax, dword [esi + 0x200]
push eax
call fcn.004b9684
add esp, 4
mov dword [esi + 0x214], 0xf
mov dword [esi + 0x210], ebx
mov byte [esi + 0x200], bl
cmp dword [esi + 0x1f8], 0x10
jb 0x49dca0
mov eax, dword [esi + 0x1e4]
push eax
call fcn.004b9684
add esp, 4
mov dword [esi + 0x1f8], 0xf
mov dword [esi + 0x1f4], ebx
lea ecx, [esi + 0x188]
mov byte [esi + 0x1e4], bl
call fcn.0049cdc0
lea ecx, [esi + 0x130]
call fcn.0049cdc0
mov dword [edi], vtable.thread.0
cmp dword [edi + 8], ebx
mov byte [esp + 0x20], bl
je 0x49dd07
mov dword [edi + 4], 1
mov edx, dword [edi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov dword [edi + 4], ebx
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00494bc0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4a0460
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
call edx
test eax, eax
je 0x4a04a1
cmp dword [esi + 0x3c], 0
je 0x4a04a1
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 1
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4a04a1
cmp dword [esi + 0x28], 0xfa
jle 0x4a04a1
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4a0680
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe8], 0
je 0x4a07b0
mov eax, dword [esp + 0xc]
sub eax, 0x3e8
je 0x4a0766
sub eax, 1
je 0x4a072d
sub eax, 1
jne 0x4a07b0
cmp dword [esi + 0xf0], eax
je 0x4a06cd
mov eax, dword [esi]
mov edx, dword [eax + 0x88]
call edx
test eax, eax
jne 0x4a06cd
mov dword [esi + 0xf0], eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a0718
mov edx, dword [esi]
mov eax, dword [edx + 0x84]
mov ecx, esi
call eax
neg eax
sbb eax, eax
inc eax
jne 0x4a070f
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x4a06ff
push esi
call eax
test eax, eax
je 0x4a070f
mov edx, dword [esi]
mov eax, dword [edx + 0x88]
mov ecx, esi
call eax
test eax, eax
jne 0x4a0718
mov edx, dword [esi]
mov eax, dword [edx + 0x50]
mov ecx, esi
call eax
mov ecx, dword [esi + 4]
push 0x3ea
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.USER32.dll_GetMessagePos]
cmp eax, dword [esi + 0x104]
jne 0x4a0747
mov edx, dword [esi]
mov eax, dword [edx + 0xa4]
mov ecx, esi
call eax
mov ecx, dword [esi + 4]
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x104], 0
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esi + 4]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4a079d
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 4]
push 0
push eax
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esi]
mov eax, dword [edx + 0x50]
mov ecx, esi
call eax
mov dword [esi + 0xf0], 1
xor eax, eax
pop esi
ret 0x10
Function at 0x4a81f5
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x98]
push edi
call edx
and eax, 1
sub al, 1
neg al
mov ecx, esi
sbb eax, eax
add eax, 1
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x98]
call edx
and eax, 4
xor ebp, ebp
cmp al, 4
jne 0x4a82cf
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4a82cf
mov edx, dword [esp + 0x28]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [eax + 0xa8]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], vtable.CWindowHostCube::HitTestFace.0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call edx
test eax, eax
je 0x4a8328
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
mov edi, ecx
je 0x4a82cf
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebp, dword [ecx]
push edx
push eax
mov eax, dword [ebp + 0x98]
call eax
test eax, eax
je 0x4a82cf
mov edx, dword [edi]
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
test eax, eax
je 0x4a82cf
mov esi, dword [edi]
push 0x11
add esi, 0x9c
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
test ax, ax
mov eax, dword [esi]
setl cl
push ecx
push edx
mov ecx, edi
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
test ebx, ebx
je 0x4a8328
movsx eax, word [esp + 0x2c]
mov dword [esp + 0x24], eax
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
mov edx, dword [esi]
mov ecx, esi
jge 0x4a82f2
mov eax, dword [edx + 0x230]
jmp 0x4a82f8
mov eax, dword [edx + 0x22c]
call eax
fstp dword [esp + 0x2c]
fld dword [esi + 0x1f18]
mov edx, dword [esi]
fild dword [esp + 0x24]
mov eax, dword [edx + 0x214]
push 1
push ecx
fmul dword [esp + 0x34]
mov ecx, esi
fsubp st(1)
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fstp dword [esp]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x4a9f80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x10], 0x204
jne 0x4a9fd7
push esi
mov eax, 0x11
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x10], 0
lea esi, [esp + 8]
push eax
call edi
test ax, ax
jge 0x4a9fcf
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x4a9fb2
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x4b4130
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4e6f41
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0xcc]
mov dword [esi], vtable.CWindowUIProvider.0
mov dword [esi + 0x30], vtable.CWindowUIProvider.2.0
mov dword [ecx], vtable.CWindowUIProvider.1.0
mov dword [esp + 0x18], 1
call fcn.004b4040
mov ecx, esi
mov byte [esp + 0x18], 0
call fcn.00497ca0
lea ecx, [esi + 0x190]
mov dword [esp + 0x18], 0xffffffff
call fcn.004b3fe0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x4b41c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4e6f84
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x521a70]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x190]
call fcn.004b3f40
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.00497bf0
lea edi, [esi + 0xcc]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.0048ba30
mov eax, 0x10
mov ecx, eax
mov dword [esi + 0x2d0], ecx
mov dword [esi + 0x2d8], ecx
mov ecx, esi
mov byte [esp + 0x18], 2
mov dword [esi], vtable.CWindowUIProvider.0
mov dword [esi + 0x30], vtable.CWindowUIProvider.2.0
mov dword [edi], vtable.CWindowUIProvider.1.0
mov dword [esi + 0x2c8], 0xffffffff
mov dword [esi + 0x2cc], eax
mov dword [esi + 0x2d4], eax
call fcn.00497330
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret