joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4757c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x47582c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404dac
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040b2d4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475833
lea eax, [ebp - 0xc]
call fcn.00404b34
ret

Function at 0x4758d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47592c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4758fb
call fcn.00410c90
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402cd4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47592c
call fcn.00410c90
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4775f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047725c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404ff4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x477656
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x8a9a70]
mov dl, 1
mov eax, dword [0x477154]
call fcn.0040f894
call fcn.004044f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404ff4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4776b8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x8aa3d8]
mov dl, 1
mov eax, dword [0x477154]
call fcn.0040f894
call fcn.004044f4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047728c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48bde8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48bec0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8ae1ac], 0
jne 0x48bea4
lea eax, [ebp - 4]
mov edx, 0x48bed8
call fcn.00404bcc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ff4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x48bea4
mov eax, ebx
call fcn.00402a70
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48be9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48be87
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x48bee8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48be87
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x8ae1ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bea4
mov eax, dword [ebp - 0xc]
call fcn.00402a90
ret
mov ebx, dword [0x8ae1ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bec7
lea eax, [ebp - 4]
call fcn.00404b34
ret
Function at 0x4a2048
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, 0x8ae1dc
xor eax, eax
call fcn.004a2004
xor eax, eax
mov dword [ebp - 9], eax
xor eax, eax
mov dword [ebp - 5], eax
call fcn.004a1dc8
mov eax, ebx
xor ecx, ecx
mov edx, 0x4c
call fcn.004034fc
mov dword [ebx], esi
mov dword [ebx + 4], edi
cmp byte [ebp - 1], 0
je 0x4a2095
cmp dword [0x8ae230], 0
jne 0x4a2099
xor eax, eax
jmp 0x4a209b
mov al, 1
mov byte [ebx + 8], al
mov al, byte [ebp + 8]
mov byte [ebx + 0x3c], al
lea eax, [ebx + 0x34]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebx + 0x1c]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClientRect
push 2
lea eax, [ebx + 0x1c]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_MapWindowPoints
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetWindowRect
push 3
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetDCEx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov dword [ebx + 0x2c], eax
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
mov dword [ebx + 0x30], esi
push esi
mov eax, dword [ebx + 0x2c]
push eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x10]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov esi, eax
mov dword [ebx + 0x14], esi
mov eax, dword [ebx + 0x18]
push eax
push esi
call sub.gdi32.dll_SelectObject
push 0x1e
mov eax, dword [ebx + 0x14]
push eax
push 0x317
mov eax, dword [ebx]
push eax
call sub.user32.dll_SendMessageA
cmp byte [ebx + 8], 0
je 0x4a218b
push 0xffffffffffffffec
mov esi, dword [ebx]
push esi
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov dword [ebx + 0xc], 0x20
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x14], 0
mov al, byte [ebx + 0xc]
mov byte [ebp - 0x12], al
push 2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 9]
push eax
mov eax, dword [ebx + 0x14]
push eax
lea eax, [ebx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [ebx]
push eax
call dword [0x8ae230]
jmp 0x4a21b4
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 0
call sub.gdi32.dll_CreateRectRgn
mov esi, eax
push 0
push esi
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowRgn
test eax, eax
jne 0x4a21b4
push esi
call sub.gdi32.dll_DeleteObject
push 0x425f
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_SetWindowPos
push 0
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4a1e14
xor edx, edx
xor eax, eax
call fcn.00404ae8
mov dword [0x8ae1d8], eax
cmp dword [0x8ae1d8], 0
jne 0x4a21f6
call fcn.004a1f7c
jmp 0x4a2207
inc dword [0x8ae228]
mov eax, dword [0x8ae1d8]
push eax
call sub.kernel32.dll_ResumeThread
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9df4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a9f78
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4a9f5d
cmp byte [ebx + 0x268], 0
je 0x4a9f5d
mov eax, dword [ebp - 4]
call fcn.004b3630
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4a9f56
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4a9e9a
dec ax
je 0x4a9e70
sub ax, 0x12
jne 0x4a9eb4
call fcn.004045a0
jmp 0x4a9f5d
cmp byte [ebx + 0x269], 0
je 0x4a9f3c
mov eax, ebx
call fcn.0043d76c
test al, al
je 0x4a9f3c
xor edx, edx
mov eax, ebx
call fcn.0043d790
jmp 0x4a9f3c
mov eax, dword [esi]
call fcn.004054d8
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004056c0
jmp 0x4a9f3c
cmp byte [ebx + 0x269], 0
je 0x4a9ed1
mov eax, ebx
call fcn.0043d76c
test al, al
jne 0x4a9ed1
mov dl, 1
mov eax, ebx
call fcn.0043d790
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4a9ee9
mov eax, esi
call fcn.00405268
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00405390
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405544
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004a9c44
test al, al
je 0x4a9f3c
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00405390
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.004054e4
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9f5d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.004b3664
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9f7f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405280
ret

Function at 0x4acc4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x8aa39c]
cmp dword [eax], 1
jne 0x4acc62
mov eax, ebx
call fcn.0047c0d8
pop ebx
ret
mov eax, ebx
call fcn.004054c8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4acc78
test al, 0x10
je 0x4acc7c
xor eax, eax
jmp 0x4acc7e
mov al, 1
pop ebx
ret

Function at 0x4b0fac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404b34
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4b0ffb
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404dac
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4f50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x4b4f77
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je GetModuleHandleA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4b50f9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4b4fc6
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je GetLastError
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x4b50de
mov edx, dword [ebp - 4]
test al, 8
je 0x4b5042
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x4b5027
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044dc04
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je SetEndOfFile
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044dc04
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.user32.dll_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0044dc04
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je reloc.kernel32.dll_GetSystemTime
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x4b4e8c
push ebx
call sub.user32.dll_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x4b50de
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x4b4e8c
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push CloseHandle
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b546c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x4b5523
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4b5534
push SetErrorMode
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b550d
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4b554c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je ReleaseMutex
test esi, esi
jne 0x4b54e4
cmp dword [ebp - 8], 1
je reloc.kernel32.dll_ReadFile
xor ebx, ebx
jmp 0x4b550d
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, 0x20
call fcn.00404dac
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
call fcn.00403560
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x4b550d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push reloc.kernel32.dll_MultiByteToWideChar
lea eax, [ebp - 0x34]
call fcn.00404b34
ret

Function at 0x4b60f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b61b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8a9644]
cmp dword [eax], 5
jl 0x4b6129
mov eax, dword [0x8aa39c]
cmp dword [eax], 2
je 0x4b612d
mov bl, 1
jmp GetDIBits
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 1
push 0
push reloc.gdi32.dll_GetCurrentPositionEx
push esi
push reloc.gdi32.dll_GetClipRgn
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404ebc
mov eax, dword [ebp - 0x14]
call fcn.00404ff4
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne GetDIBits
mov dword [ebp - 0x10], 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4b618f
cmp word [ebp - 0xc], 0
jne 0x4b6196
cmp eax, 0xea
jne 0x4b6198
mov bl, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push GetDCOrgEx
lea eax, [ebp - 0x14]
call fcn.00404b34
ret
Function at 0x4b6274
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push ExtCreatePen
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push ExcludeClipRect
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle reloc.gdi32.dll_DeleteEnhMetaFile
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00404dac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.004061e8
mov ebx, eax
cmp dword [ebp - 4], 0
jne DeleteObject
push ebx
call sub.kernel32.dll_IsValidCodePage
test eax, eax
jne 0x4b62e6
xor ebx, ebx
jmp 0x4b62e6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push CreateSolidBrush
lea eax, [ebp - 0x18]
call fcn.00404b34
ret

Function at 0x4b6a8c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x4b6acc
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextA
test eax, eax
jle 0x4b6acc
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.00404dac
jmp 0x4b6ad8
mov eax, esi
mov edx, 0x4b6aec
call fcn.00404b88
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4c5138
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
lea edi, [ebp - 0x1d]
xor edx, edx
push ebp
push 0x4c537a
push dword fs:[edx]
mov dword fs:[edx], esp
mov bl, 1
jmp 0x4c533f
test bl, bl
jne 0x4c5162
call sub.user32.dll_WaitMessage
xor ebx, ebx
jmp 0x4c531e
mov eax, dword [edi + 4]
cmp eax, 0x105
jg 0x4c5198
je 0x4c5226
sub eax, 0xa0
je 0x4c5269
dec eax
sub eax, 9
jb 0x4c5249
sub eax, 0x5a
je 0x4c51b2
jmp 0x4c52e5
sub eax, 0x200
je 0x4c5269
dec eax
sub eax, 9
jb 0x4c5249
jmp 0x4c52e5
mov eax, dword [edi + 8]
cmp eax, 0x12
je 0x4c52e5
cmp eax, 0x10
je 0x4c52e5
cmp eax, 0x19
je 0x4c52e5
mov byte [ebp - 1], 0
test byte [edi + 0xe], 0xff
je 0x4c5203
mov esi, 0x60
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
mov dx, word [edi + 0xe]
and dx, 0xff
movzx edx, dx
cmp eax, edx
jne 0x4c51fd
mov byte [ebp - 1], 1
jmp 0x4c5203
inc esi
cmp esi, 0x6a
jne 0x4c51df
cmp byte [ebp - 1], 0
jne 0x4c52e5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x4c5388]
mov byte [eax + 0x34], dl
call fcn.004045a0
jmp 0x4c5381
cmp dword [edi + 8], 0x12
jne 0x4c52e5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x4c5388]
mov byte [eax + 0x34], dl
call fcn.004045a0
jmp 0x4c5381
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00455b24
cmp eax, dword [edi]
je 0x4c52e5
call fcn.004045a0
jmp 0x4c5381
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x4c5297
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00455b24
lea edx, [edi + 0x14]
call fcn.004c50bc
test al, al
je 0x4c52c6
call sub.user32.dll_ReleaseCapture
jmp 0x4c52c6
call sub.user32.dll_GetCapture
test eax, eax
jne 0x4c52c6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00455b24
lea edx, [edi + 0x14]
call fcn.004c50bc
test al, al
jne 0x4c52c6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.user32.dll_SetCapture
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x4c52e5
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4c531e
mov eax, dword [edi + 4]
cmp eax, 0x200
jb 0x4c5312
cmp eax, 0x20a
ja 0x4c5312
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [edi]
je 0x4c531e
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004c50f0
pop ecx
test al, al
je 0x4c533f
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4c5169
push ebp
call fcn.004c50f0
pop ecx
test al, al
jne 0x4c5159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5381
mov edx, 0x103
mov eax, 0x102
call fcn.004b5344
mov edx, 0x107
mov eax, 0x106
call fcn.004b5344
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9a68
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00455e28
test al, al
je 0x4c9bbd
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00455b24
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x4c9ad4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_EqualRect
test eax, eax
je 0x4c9ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004c6dc0
jmp 0x4c9bbd
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c9bab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x14]
push edi
mov esi, dword [ebp - 0x18]
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9bb2
cmp dword [ebp - 0xc], 0
je 0x4c9b8e
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x4c9b9d
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f9694
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x4f96c4
mov eax, ebx
call fcn.004fa1b8
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x4f96bd
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x4f973c
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x4f972e
mov edx, dword [ebx + 8]
test edx, edx
je 0x4f96ea
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f96fc
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f972e
mov edx, dword [ebx + 8]
test edx, edx
je 0x4f96dc
cmp eax, 3
je 0x4f9710
dec eax
jne 0x4f96dc
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x4f96dc
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f96dc
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x4f975c
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x4f975c
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f9768
pop ebx
ret