joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef8a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a90ff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x14
call fcn.00550175
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x18]
call fcn.0046b290
mov ecx, dword [esi + 0x1c]
mov edx, 1
mov dword [ebp - 0x14], ecx
mov esi, dword [eax]
test esi, esi
je 0x4ef903
mov eax, edx
lock xadd dword [esi], eax
mov ecx, dword [ebp - 0x10]
or edi, 0xffffffff
test ecx, ecx
je 0x4ef92a
mov eax, edi
lock xadd dword [ecx], eax
sub eax, 1
jne 0x4ef92a
test ecx, ecx
je 0x4ef92a
push 8
push ecx
call fcn.0055053d
add esp, 8
lea edx, [edi + 2]
mov dword [ebx], vtable.._AV__RunnableMethod_P8SimpleMenuModel_ui__AEXXZUTuple0_____ScopedRunnableMethodFactory_VSimpleMenuModel_ui____.0
mov dword [ebx + 4], esi
test esi, esi
je 0x4ef93b
lock xadd dword [esi], edx
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x4ef9a0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4ef967
lock xadd dword [esi], edi
sub edi, 1
jne 0x4ef967
push 8
push esi
call fcn.0055053d
add esp, 8
call fcn.0046fec0
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.0046e090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9514
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp eax, 0x71
jne 0x4f3199
cmp dword [edi + 0xc4], ebx
jne 0x4f3183
call fcn.004f2110
test eax, eax
je 0x4f3183
push eax
mov ecx, edi
call fcn.004f1e80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xd
jne 0x4f327c
cmp byte [edi + 0xca], bl
jne 0x4f327c
mov eax, dword [edi]
call dword [eax + 0x10]
cmp dword [0x61a268], 1
jne 0x4f31fc
cmp dword [0x61a250], 3
jg 0x4f31fc
test eax, eax
jne 0x4f31fc
push 3
push 0x244
push str.f:my_lab_tabexplorerextab_masterlibrary_viewcontrols_tree_tree_view.cpp
lea ecx, [ebp - 0xcc]
call fcn.0046c100
mov dword [ebp - 4], 0
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_widget.
mov dword [ebp - 0x10], ebx
call fcn.00403840
test bl, 1
je 0x4f320c
lea ecx, [ebp - 0xcc]
call fcn.0046c520
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [ebp + 8], eax
call esi
shr eax, 0xf
mov bl, al
push 0x10
and ebx, 0xffffff01
call esi
push dword [ebp + 8]
shr eax, 0xf
lea ecx, [ebp - 0x1c]
push ebx
and eax, 0xffffff01
push eax
push 0xd
call fcn.004023d0
mov eax, ecx
mov dword [ebp - 4], 1
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xb0]
mov ecx, eax
call fcn.004e2dd0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f7720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9b5f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movss dword [ebp - 0x10], xmm3
mov edi, ecx
push 0x40
call fcn.00550175
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
movss xmm1, dword [ebp - 0x10]
mov ecx, ebx
mov dword [ebp - 4], 0
mov esi, dword [edi + 8]
sub esi, dword [edi + 4]
sar esi, 2
call fcn.004f7200
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0x1c]
mov dword [ebx], vtable.view::Column.0
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x28], esi
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x3c], 0
mov eax, dword [edi + 8]
mov dword [ebp + 0x1c], ebx
cmp dword [edi + 0xc], eax
je 0x4f77f6
mov dword [eax], ebx
add dword [edi + 8], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 0x1c]
push ecx
push eax
lea ecx, [edi + 4]
call fcn.004172e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4f8080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9c85
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
push ebx
push esi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.view::GridLayout.0
mov dword [esi + 4], eax
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov byte [ebp - 4], 3
cmp dword [0x61a268], 1
jne 0x4f814a
cmp dword [0x61a250], 3
jg 0x4f814a
test eax, eax
jne 0x4f814a
push 3
push 0x304
push str.f:my_lab_tabexplorerextab_masterlibrary_viewlayoutgrid_layout.cpp
lea ecx, [ebp - 0xcc]
call fcn.0046c100
mov byte [ebp - 4], 4
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_host.
mov dword [ebp - 0x14], ebx
call fcn.00403840
test bl, 1
je 0x4f815a
lea ecx, [ebp - 0xcc]
call fcn.0046c520
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fba40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp esi, eax
je 0x4fba80
mov edi, dword [ebp + 0xc]
mov edx, dword [esi]
movzx ebx, word [edi]
movzx ecx, word [edx]
cmp cx, bx
mov dword [ebp + 0xc], ecx
mov ebx, dword [ebp + 8]
jne 0x4fba79
mov ecx, dword [edx + 0xc]
cmp ecx, dword [edi + 0xc]
jne 0x4fba79
mov ecx, dword [edx + 0x10]
test dword [edi + 0x10], ecx
jne 0x4fba8c
add esi, 4
cmp esi, eax
jne 0x4fba56
pop edi
pop esi
mov eax, 0x80040064
pop ebx
pop ebp
ret 0xc
mov edx, dword [edx + 0x14]
test edx, edx
je 0x4fbaaa
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.004fb860
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov eax, dword [esi]
mov cl, byte [eax + 0x19]
je 0x4fbae3
test cl, cl
jne 0x4fba80
mov byte [eax + 0x19], 1
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov eax, 0x80040064
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov eax, dword [ebx]
push edi
push ebx
call dword [eax + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4fc9f0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599e3c
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp byte [eax], bl
je 0x4fca90
cmp dword [0x61a268], 1
jne 0x4fca6a
cmp dword [0x61a250], 3
jg 0x4fca6a
push 3
push 0x100
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc4]
call fcn.0046c100
mov dword [ebp - 4], ebx
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_false.
mov dword [ebp - 0x10], ebx
call fcn.00403840
test bl, 1
je 0x4fca7a
lea ecx, [ebp - 0xc4]
call fcn.0046c520
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
test esi, esi
je 0x4fcaa8
push 5
call edi
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4fcacf
inc esi
cmp esi, 5
jl 0x4fcaa0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x14]
mov byte [eax], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4fcb30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, ecx
mov byte [esi + 4], 0
call fcn.0046fec0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 4], 1
jne 0x4fcb97
push 0x30
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0056f6e0
add esp, 0xc
mov dword [esp + 8], 0x30
mov dword [esp + 0x10], 0x4fd8c0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x34], str.ClipboardOwnerWindowClass
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov byte [esi + 4], 1
mov eax, esi
mov dword [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fd1b0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5994b8
mov eax, dword fs:[0]
push eax
sub esp, 0x164
push ebx
push esi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x61a268], 1
jne 0x4fd224
cmp dword [0x61a250], 3
jg 0x4fd224
cmp dword [ecx], ebx
jne 0x4fd224
push 3
push 0x231
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc0]
call fcn.0046c100
mov dword [ebp - 4], ebx
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_clipboard_owner_.
mov dword [ebp - 0x10], ebx
call fcn.00403840
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x4fd23e
lea ecx, [ebp - 0xc0]
and ebx, 0xfffffffe
call fcn.0046c520
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4fd2e1
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4fd2e1
cmp dword [0x61a268], 1
jne 0x4fd2ab
cmp dword [0x61a250], 3
jg 0x4fd2ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58a
jne 0x4fd2ab
push 3
push 0x234
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0x170]
call fcn.0046c100
or ebx, 2
mov dword [ebp - 4], 1
lea ecx, [eax + 8]
mov dword [ebp - 0x10], ebx
mov edx, str.Check_failed:_ERROR_CLIPBOARD_NOT_OPEN___GetLastError__.
call fcn.00403840
test bl, 2
je 0x4fd2bb
lea ecx, [ebp - 0x170]
call fcn.0046c520
cmp dword [ebp + 8], 2
push esi
jne 0x4fd2db
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fd4a0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa474
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x61a268], 1
mov dword [ebp - 0x10], ebx
jne 0x4fd51f
cmp dword [0x61a250], 3
jg 0x4fd51f
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
call fcn.004fd960
add esp, 4
test eax, eax
je 0x4fd51f
push eax
push ecx
push 0x26c
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc4]
call fcn.0046bff0
lea ecx, [ebp - 0xc4]
call fcn.0046c520
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4fd58f
cmp dword [0x61a268], 1
jne 0x4fd567
cmp dword [0x61a250], 3
jg 0x4fd567
push 3
push 0x26f
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc4]
call fcn.0046c100
mov dword [ebp - 4], esi
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_false.
mov dword [ebp - 0x10], ebx
call fcn.00403840
test bl, 1
je 0x4fd62b
lea ecx, [ebp - 0xc4]
call fcn.0046c520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], ebx
jb 0x4fd59c
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp + 0xf], cl
mov dword [ebp - 4], 1
mov eax, dword [edi]
test eax, eax
jne 0x4fd5d3
cmp byte [edi + 4], al
je 0x4fd5d3
push eax
push eax
push eax
push 0xfffffffffffffffd
push eax
push eax
push eax
push eax
push eax
push str.ClipboardOwnerWindow
push str.ClipboardOwnerWindowClass
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
push eax
lea ecx, [ebp + 0xf]
call fcn.004fc9f0
test al, al
je 0x4fd61f
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x4fd61f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea ebx, [edx + 2]
nop word [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4fd600
sub edx, ebx
mov ecx, esi
sar edx, 1
push edx
push eax
call fcn.00405c70
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp + 0xf], 0
je 0x4fd62b
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5063d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x60f074]
xor eax, esp
mov dword [esp + 0x24], eax
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x40], 0
je 0x50644d
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x48]
call fcn.004d6670
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x48], xmm0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x506414
mov eax, dword [eax]
cmp eax, 1
jne 0x50647c
call fcn.0046fec0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0x5093a0
lea ecx, [edi + 0x58]
mov esi, eax
call fcn.0050a130
push eax
mov ecx, esi
call fcn.0046e090
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00550156
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edx]
mov eax, dword [edx + 8]
add eax, ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0xc]
add eax, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0
push eax
push dword [edi - 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.00550156
mov esp, ebp
pop ebp
ret 4
Function at 0x508940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab228
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea edi, [eax + 0x1c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
cmp dword [eax + 0x38], 0
je 0x508b0b
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xf0]
call eax
mov ebx, dword [ebp + 8]
mov esi, ebx
and esi, 0xfff0
test al, al
je 0x5089c0
cmp esi, 0xf000
je 0x508b0b
cmp esi, 0xf010
je 0x508b0b
cmp esi, 0xf030
je 0x508b0b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x5089d6
cmp ecx, 2
sete al
jmp 0x5089e0
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test al, al
jne 0x508a50
cmp esi, 0xf020
je 0x508a38
cmp esi, 0xf030
je 0x508a38
cmp esi, 0xf120
je 0x508a38
cmp esi, 0xf010
je 0x508a0c
cmp esi, 0xf000
jne 0x508a50
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xc4]
call eax
test al, al
jne 0x508a50
mov ecx, dword [ebp - 0x10]
push 0xfffffffffffffff0
call fcn.00503b90
mov ecx, dword [ebp - 0x10]
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
call fcn.00503c60
jmp 0x508a50
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [eax + 0x38]
mov ecx, dword [eax + 0x88]
mov eax, dword [ecx]
call dword [eax + 0x1a4]
cmp esi, 0xf100
jne 0x508ad7
cmp dword [ebp + 0xc], 0
jne 0x508ad7
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
movzx ebx, ax
push 0x10
shr ebx, 0xf
call esi
shr eax, 0xf
mov ecx, 2
and al, 1
mov dword [ebp - 0x1c], vtable.view::Accelerator.0
mov eax, 0
mov dword [ebp - 0x18], 0x12
cmovne eax, ecx
mov dword [ebp - 0x14], eax
and bl, 1
je 0x508aa0
or eax, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x98]
mov ecx, eax
call fcn.004e2dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
push ebx
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
jne 0x508b0b
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0xc]
shl ecx, 0x10
or ecx, eax
mov eax, dword [edi]
push ecx
push ebx
push 0x112
mov ecx, edi
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50ad60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a90ff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xb8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x50ada2
cmp dword [eax], 1
je 0x50ada2
mov al, 1
jmp 0x50ada4
xor al, al
test al, al
jne 0x50ae5e
push 0x14
call fcn.00550175
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x10]
call fcn.0046b290
mov ecx, dword [esi + 0x14]
mov edx, 1
mov dword [ebp - 0x14], ecx
mov esi, dword [eax]
test esi, esi
je 0x50ade5
mov eax, edx
lock xadd dword [esi], eax
mov ecx, dword [ebp - 0x10]
or edi, 0xffffffff
test ecx, ecx
je 0x50ae0c
mov eax, edi
lock xadd dword [ecx], eax
sub eax, 1
jne 0x50ae0c
test ecx, ecx
je 0x50ae0c
push 8
push ecx
call fcn.0055053d
add esp, 8
lea edx, [edi + 2]
mov dword [ebx], vtable.._AV__RunnableMethod_P8NativeWidgetViews_view__AEXXZUTuple0_____ScopedRunnableMethodFactory_VNativeWidgetViews_view____.0
mov dword [ebx + 4], esi
test esi, esi
je 0x50ae1d
lock xadd dword [esi], edx
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x50a20a
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x50ae49
lock xadd dword [esi], edi
sub edi, 1
jne 0x50ae49
push 8
push esi
call fcn.0055053d
add esp, 8
call fcn.0046fec0
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.0046e090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50c790
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x12
call esi
movzx edi, ax
and edi, 0x80
push 0x10
shr edi, 4
call esi
and eax, 0x80
shr eax, 6
push 0x11
or edi, eax
call esi
movups xmm0, xmmword [ebp + 8]
mov esi, dword [ebp + 0x20]
and eax, 0x80
shr eax, 5
sub esp, 0x1c
or edi, eax
mov eax, esp
movups xmmword [eax], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], esi
call fcn.0050c4a0
add esp, 0x1c
mov dword [ebx + 0x1c], eax
lea ecx, [ebx + 0x20]
call fcn.004729c0
movups xmm1, xmmword [ebp + 8]
mov dword [ebx + 0x28], edi
movq xmm0, qword [ebp + 0x18]
movups xmmword [ebx], xmm1
pop edi
psrldq xmm1, 8
movd eax, xmm1
movq qword [ebx + 0x10], xmm0
mov dword [ebx + 0x18], esi
movzx eax, ax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x50cf30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab4e2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ecx]
cmp byte [esi + 0x14], 0
jne 0x50cf6f
mov ecx, dword [0x61a748]
test ecx, ecx
je 0x50cf86
push 1
call fcn.005189a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0x12
mov byte [esi + 0x14], 1
mov byte [esi + 0x16], 0
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 4]
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 1
call fcn.004ed9d0
push 0xcc
mov dword [ebp - 0x10], 0
mov byte [esi + 0x1c], 0
call fcn.00550175
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp byte [esi + 0x16], 0
push esi
sete cl
movzx ecx, cl
push ecx
mov ecx, eax
call fcn.00519f00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 4]
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], eax
mov dword [ecx + 0x88], eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x10]
mov ecx, eax
push dword [esi + 4]
push 0
push dword [ebp + 8]
call fcn.00518480
cmp byte [esi + 0x16], 0
jne 0x50cf6f
push dword [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0050cdf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x510be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab8b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [esi], vtable.view::NativeMenuWin.0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
call fcn.005283b0
mov ecx, dword [ebp + 0xc]
test al, al
je 0x510c3b
test ecx, ecx
jne 0x510c3b
mov al, 1
jmp 0x510c3d
xor al, al
mov byte [esi + 0xc], al
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], esi
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8