joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453f00
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x45411d
cmp eax, 0x7c
je 0x45411d
cmp eax, 0x29
jne 0x453f41
cmp dword [esi + 0x10], 0
jne 0x45411d
cmp eax, eax
jne 0x453f41
test dword [esi + 0x50], 0x10000000
je 0x45412a
jmp 0x4540d6
cmp eax, 0x2e
jne 0x453f52
push 5
lea ecx, [esi + 0x24]
call fcn.00454180
jmp 0x453fce
cmp eax, 0x5c
jne 0x453fb1
mov ecx, esi
call fcn.00453eb0
test byte [esi + 0x50], 0x80
je 0x453fa5
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x453f83
push 4
lea ecx, [esi + 0x24]
call fcn.00454180
mov ecx, esi
call fcn.00453eb0
jmp 0x45410f
cmp eax, 0x42
jne 0x453fa5
push 4
lea ecx, [esi + 0x24]
call fcn.00454180
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00453eb0
jmp 0x45410f
mov ecx, esi
call fcn.004555f0
jmp 0x454108
cmp eax, 0x5b
jne 0x45401e
mov ecx, esi
call fcn.00453eb0
mov ecx, esi
call fcn.00455500
cmp dword [esi + 0x4c], 0x5d
jne 0x454138
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x454012
cmp word [eax], 0x5c
jne 0x45400d
lea ecx, [eax + 2]
cmp ecx, edx
je 0x45400d
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x453ff9
movzx edi, word [ecx]
cmp edi, 0x28
je 0x45400b
cmp edi, 0x29
je 0x45400b
test dl, 0x10
jne 0x45400d
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x45400b
cmp edx, 0x7d
jne 0x45400d
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.00452d70
jmp 0x454108
cmp eax, 0x28
jne 0x454092
mov ecx, esi
call fcn.00453eb0
mov ecx, esi
call fcn.00455790
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x45412a
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x454081
cmp word [eax], 0x5c
jne 0x45407c
lea ecx, [eax + 2]
cmp ecx, edx
je 0x45407c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x454068
movzx edi, word [ecx]
cmp edi, 0x28
je 0x45407a
cmp edi, 0x29
je 0x45407a
test dl, 0x10
jne 0x45407c
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x45407a
cmp edx, 0x7d
jne 0x45407c
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.00452d70
test bl, bl
je 0x45410f
jmp 0x454108
cmp eax, 0x5e
jne 0x4540aa
push 2
lea ecx, [esi + 0x24]
call fcn.00454180
mov ecx, esi
call fcn.00453eb0
jmp 0x45410f
cmp eax, 0x24
jne 0x4540c2
push 3
lea ecx, [esi + 0x24]
call fcn.00454180
mov ecx, esi
call fcn.00453eb0
jmp 0x45410f
cmp eax, 0x2a
je 0x454123
cmp eax, 0x2b
je 0x454123
cmp eax, 0x3f
je 0x454123
cmp eax, 0x7b
je 0x454123
cmp eax, 0x7d
jne 0x4540e6
test dword [esi + 0x50], 0x10000000
je 0x454131
jmp 0x4540f4
cmp eax, 0x5d
jne 0x4540f4
test dword [esi + 0x50], 0x10000000
je 0x454138
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00455a50
mov ecx, esi
call fcn.00453eb0
mov ecx, esi
call fcn.004558a0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x453f13
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.00452d60
push 5
call fcn.00452d60
push 6
call fcn.00452d60
push 4
call fcn.00452d60
int3
Function at 0x4595b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555520
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ac3e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
call fcn.0045fb61
mov eax, dword [esi + 8]
add esp, 4
or eax, dword [esi + 0xc]
je 0x45960b
push 1
push dword [esi + 0x18]
push str.NT_Kernel_Logger
push dword [esi + 0x14]
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_ControlTraceW]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edx, dword [esi + 0x10]
mov eax, edx
mov ecx, dword [esi + 0x14]
or eax, ecx
je 0x45962d
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [esi + 0x1c8]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x459656
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push esi
call fcn.0045fb7d
mov edi, dword [esi + 0x1c0]
add esp, 4
mov dword [esi + 0x1c0], 0
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45968b
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45ad50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4
Function at 0x45b5a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5ac3e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx eax, byte [edx]
mov edi, ecx
xor eax, 0x811c9dc5
mov ebx, dword [ebp + 8]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov esi, dword [edi + 0x18]
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], edx
xor ecx, eax
mov dword [ebp - 0x18], ebx
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 4]
and esi, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], esi
lea esi, [eax + esi*8]
mov eax, dword [esi]
cmp eax, ecx
jne 0x45b611
mov esi, ecx
jmp 0x45b616
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x45b62f
mov ecx, dword [edx]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x45b691
cmp esi, eax
jne 0x45b620
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x14], ecx
call fcn.00431aa0
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [edx]
mov dword [eax + 8], ecx
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
movups xmm0, xmmword [edx + 4]
movups xmmword [eax + 0xc], xmm0
movq xmm0, qword [edx + 0x14]
movq qword [eax + 0x1c], xmm0
xor eax, eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 7
mov word [edx + 4], ax
mov eax, 0x71c71c6
mov ecx, dword [edi + 8]
sub eax, ecx
cmp eax, 1
jb 0x45b70c
jmp 0x45b699
mov dword [ebx], esi
mov byte [ebx + 4], 0
jmp 0x45b6f7
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x45b6dc
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ebx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov dword [edi + 4], ebx
mov ebx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push esi
push edi
call fcn.00434a90
mov ecx, dword [ebp - 0x20]
call fcn.004349f0
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e037c
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.0045e7c4
int3
Function at 0x463550
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b0da
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ac3e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00414840
mov ecx, eax
test ecx, ecx
je 0x463714
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00414840
mov ecx, eax
test ecx, ecx
je 0x46371e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00414840
mov ecx, eax
test ecx, ecx
je 0x463728
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x463632
xor ecx, ecx
jmp 0x463650
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463640
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00427330
push edi
mov ecx, ebx
call fcn.00427070
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x46366c
xor ecx, ecx
jmp 0x463684
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463674
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00427330
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004640e0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00427070
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4636c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4636fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4636fe
cmp dword [esi + 0x10], 0
je 0x4636f5
push dword [edi]
call fcn.0052e294
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00413a40
push 0x80004005
call fcn.00413a40
push 0x80004005
call fcn.00413a40
int3
Function at 0x463ee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b1f8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5ac3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x4640b4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x463f35
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x4640b4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x463f53
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x4640b4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x463f71
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x4640b4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x463f8f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x4640b4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4640b4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x463fb4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x463fe7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x463fff
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x46403d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00429940
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.0051ce90
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x569adc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004376f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46406b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x4640a4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4640a4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.004277a0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.00414630
lea ecx, [ebp - 0x28]
call fcn.00414630
lea ecx, [ebp - 0x34]
call fcn.004637e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e037c
mov esp, ebp
pop ebp
ret 4
Function at 0x464450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b2b7
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5ac3e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x46449a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4644a6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.004295e0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x464513
push 0x48
call fcn.004e0596
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x464507
push 0x48
push 0
push ebx
call fcn.0051d990
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00463550
jmp 0x464509
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464540
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004295e0
push 3
push 0x569adc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00437720
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46458f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x4645de
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4645de
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.004295e0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.00414630
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x464614
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46460a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464651
push edx
push ecx
call fcn.004e0941
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x464633
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e037c
mov esp, ebp
pop ebp
ret 0x14
call fcn.0052511b
int3
Function at 0x46a050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46a095
cmp byte [ebp + 8], 0
je 0x46a089
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x4789f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x478a15
or esi, 1
push 1
call edi
test ax, ax
jns 0x478a21
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x478a2d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x478a39
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x47b9f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0xe0]
call fcn.00469960
mov edi, dword [ebp + 8]
test eax, eax
jle 0x47ba4b
nop
push esi
lea ecx, [ebx + 0xe0]
mov byte [ebp + 0xb], 0
call fcn.00485720
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x47bb7c
lea ecx, [ebx + 0xe0]
inc esi
call fcn.00469960
cmp esi, eax
jl 0x47ba10
sub edi, 0x100
je 0x47bb11
sub edi, 4
je 0x47bab2
sub edi, 2
jne 0x47bb06
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.00525ff1
mov ecx, dword [ebx + 0x58]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x8000000a
push edx
push 0x47d910
call dword [eax + 0x14c]
mov esi, eax
test esi, esi
je 0x47bb06
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x13c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], 0
je 0x47bb06
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.004789f0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x47bb06
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x47bb63
mov eax, dword [ecx]
mov eax, dword [eax + 0x110]
call eax
test al, al
je 0x47bb63
mov ecx, dword [ebx + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
call eax
test al, al
je 0x47bb63
mov ecx, dword [ebx + 0x5c]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.0051c6da
add esp, 8
test eax, eax
je 0x47bb63
mov ecx, dword [ebx + 0x5c]
call fcn.0049a8a0
test al, al
jne 0x47bb06
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.0047d000
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4981c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
movzx eax, word [edi + 0xc]
sub eax, 0x41
je 0x498222
sub eax, 2
je 0x498203
sub eax, 0x15
jne 0x498272
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x498272
push 0
push edi
push dword [ebp + 0xc]
push str.cutkey
jmp 0x498267
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x498272
push 0
push edi
push dword [ebp + 0xc]
push str.copykey
jmp 0x498267
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x498272
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 2
push eax
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push 0x102b
mov dword [ebp - 0x30], 2
push dword [eax + 0x558]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [ebp + 0xc]
push str.selectallkey
push dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
call fcn.0047c2d0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x498d60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, ecx
call fcn.00484b70
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x498dae
mov ecx, dword [ebx + 0x55c]
mov eax, 5
push edi
xor edi, edi
cmp byte [ebp + 8], 0
cmovne edi, eax
push edi
call fcn.00469960
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x49c330
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x49c39d
cmp dword [ebp + 8], 0x100
jne 0x49c38d
cmp word [ebp + 0xc], 0xd
jne 0x49c38d
cmp byte [esi + 0x59a], 0
je 0x49c36e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x49c38d
cmp byte [esi + 0x59b], 0
jne 0x49c38d
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x49c386
push 0
push 0
push 0
push str.return
push esi
call fcn.0047c2d0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10