joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459cf0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x693be4], 0
jne 0x459d33
push 0
push 0x459e10
push str.SDL_TIMER_RESOLUTION
mov dword [0x693be4], 1
call fcn.00466c60
add esp, 0xc
push 0x693bf0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x693be8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [0x693be8]
mov eax, dword [ebp - 4]
sbb eax, dword [0x693bec]
push 0
push 0x3e8
push eax
push ecx
call fcn.004b2770
push dword [0x693bf4]
push dword [0x693bf0]
push edx
push eax
call fcn.004b2be0
mov esp, ebp
pop ebp
ret

Function at 0x45c630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov cl, byte [eax]
lea edi, [eax + 1]
cmp cl, 0x2d
mov dword [ebp - 8], esi
mov byte [ebp - 1], cl
cmovne edi, eax
mov dword [ebp - 0xc], edi
mov al, byte [edi]
cmp al, 0x2d
jne 0x45c6a6
movzx eax, byte [edi + 1]
mov dword [ebp - 8], esi
lea esi, [edi + 1]
push eax
call fcn.00459ff0
add esp, 4
test eax, eax
je 0x45c693
xor edi, edi
movsx eax, byte [esi]
lea ecx, [edi - 6]
inc esi
lea ecx, [edi + ecx*4]
lea edi, [eax + ecx*2]
movzx eax, byte [esi]
push eax
call fcn.00459ff0
add esp, 4
test eax, eax
jne 0x45c670
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0xc]
cmp esi, edi
jbe 0x45c6a2
mov eax, dword [ebp - 8]
test eax, eax
je 0x45c6a2
neg eax
jmp 0x45c6e9
xor eax, eax
jmp 0x45c6e9
movzx eax, al
push eax
call fcn.00459ff0
add esp, 4
test eax, eax
je 0x45c6e4
xor esi, esi
movsx eax, byte [edi]
lea ecx, [esi - 6]
inc edi
lea ecx, [esi + ecx*4]
lea esi, [eax + ecx*2]
movzx eax, byte [edi]
push eax
call fcn.00459ff0
add esp, 4
test eax, eax
jne 0x45c6b8
mov dword [ebp - 8], esi
xor esi, esi
cmp edi, dword [ebp - 0xc]
cmova esi, dword [ebp - 8]
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
mov esi, edi
movd xmm0, eax
xorps xmm1, xmm1
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
cmp byte [esi], 0x2e
addsd xmm0, qword [eax*8 + 0x4d3640]
addsd xmm0, xmm1
movsd qword [ebp - 0x10], xmm0
jne 0x45c777
movzx eax, byte [esi + 1]
inc esi
push eax
mov edi, 0xa
call fcn.00459ff0
add esp, 4
test eax, eax
je 0x45c76f
movsx eax, byte [esi]
inc esi
sub eax, 0x30
movd xmm0, edi
cvtdq2pd xmm0, xmm0
lea edi, [edi + edi*4]
add edi, edi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x4d3640]
movzx eax, byte [esi]
push eax
divsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x10]
addsd xmm0, xmm1
movsd qword [ebp - 0x10], xmm0
call fcn.00459ff0
add esp, 4
test eax, eax
jne 0x45c725
movsd xmm0, qword [ebp - 0x10]
xorps xmm1, xmm1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test ecx, ecx
je 0x45c7a0
cmp esi, edx
jbe 0x45c7a0
cmp byte [ebp - 1], 0x2d
jne 0x45c79c
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x45c79c
xorps xmm0, xmmword [0x54b8d0]
movsd qword [ecx], xmm0
sub esi, edx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46f9b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x46f9ce
push 0x565f68
push str.Parameter__s_is_invalid
call fcn.0045a230
add esp, 8
pop ebp
ret
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00487fb0

Function at 0x4722b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
or eax, 0xffffffff
test ecx, ecx
jne 0x4723e7
mov ecx, dword [0x694b34]
test ecx, ecx
jne 0x4722df
push str.no_gesture_touch_devices_registered
call fcn.0045a230
add esp, 4
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
push edi
test ecx, ecx
jle 0x4723d6
xor edi, edi
mov dword [ebp - 8], edi
nop dword [eax]
nop dword [eax + eax]
mov ebx, dword [0x694b30]
mov dword [ebp - 0xc], ebx
mov eax, dword [edi + ebx + 0x201c]
mov dword [ebp - 0x10], eax
imul eax, eax, 0x204
mov dword [ebp + 8], eax
add eax, 0x204
push eax
push dword [edi + ebx + 0x2020]
call fcn.0045c030
add esp, 8
test eax, eax
jne 0x472340
push eax
call fcn.0045a190
add esp, 4
jmp 0x4723b9
push 0x200
push dword [ebp + 0xc]
mov dword [edi + ebx + 0x2020], eax
add eax, dword [ebp + 8]
push eax
mov dword [ebp + 8], eax
call fcn.0045a010
mov edi, dword [ebp + 8]
add esp, 0xc
mov esi, 0x1505
xor ebx, ebx
nop dword [eax + eax]
movss xmm0, dword [edi + ebx*8]
call fcn.004b2160
movss xmm0, dword [edi + ebx*8 + 4]
mov ecx, esi
shl ecx, 5
add ecx, esi
add eax, ecx
mov esi, eax
shl esi, 5
add esi, eax
call fcn.004b2160
inc ebx
add esi, eax
cmp ebx, 0x40
jl 0x472370
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [eax + 0x200], esi
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
inc dword [edi + eax + 0x201c]
mov eax, dword [ebp - 0x10]
test eax, eax
js 0x4723dd
inc esi
add edi, 0x2028
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
cmp esi, dword [0x694b34]
jl 0x472300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push ecx
call fcn.00472400
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x472400
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx + 0x201c]
imul esi, eax, 0x204
mov dword [ebp - 8], eax
lea eax, [esi + 0x204]
push eax
push dword [ebx + 0x2020]
call fcn.0045c030
add esp, 8
test eax, eax
jne 0x472442
push eax
call fcn.0045a190
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0x200
push dword [ebp + 0xc]
mov dword [ebx + 0x2020], eax
add eax, esi
push eax
mov dword [ebp - 4], eax
call fcn.0045a010
mov ebx, dword [ebp - 4]
add esp, 0xc
mov esi, 0x1505
xor edi, edi
nop dword [eax]
movss xmm0, dword [ebx + edi*8]
call fcn.004b2160
movss xmm0, dword [ebx + edi*8 + 4]
mov ecx, eax
mov eax, esi
shl eax, 5
add eax, esi
add ecx, eax
mov esi, ecx
shl esi, 5
add esi, ecx
call fcn.004b2160
inc edi
add esi, eax
cmp edi, 0x40
jl 0x472470
mov eax, ebx
mov ebx, dword [ebp + 8]
pop edi
mov dword [eax + 0x200], esi
inc dword [ebx + 0x201c]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473d30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x473d92
cmp byte [esi], 0
je 0x473d92
push dword [0x694bfc]
push dword [0x694bf8]
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
je 0x473d92
cmp edi, dword [0x694bfc]
jbe 0x473d89
push edi
push dword [0x694bf8]
call fcn.0045c030
add esp, 8
test eax, eax
je 0x473d92
push edi
push eax
push esi
mov dword [0x694bf8], eax
mov dword [0x694bfc], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x694bf8]
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x473dd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [esi + 0x28]
mov ecx, edx
neg ecx
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
and ecx, 0x10000
test eax, eax
je 0x473e11
push edi
lea edi, [ebp + 8]
push edi
push ecx
push esi
push 0x473da0
push edx
push 0
call eax
add esp, 0x18
pop edi
jmp 0x473e25
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 0x473da0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
test eax, eax
jne 0x473e3c
push str.Not_enough_resources_to_create_thread
call fcn.0045a230
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x485d10
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x694c88], 0
je 0x485d56
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [ebp - 0xc], 0x50001
mov dword [ebp - 8], 0x2100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x485d56
push str.Couldnt_register_for_raw_input_events
call fcn.0045a230
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x485e50
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x694c88], 0
je 0x485e97
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x50001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x485e97
push str.Couldnt_unregister_for_raw_input_events
call fcn.0045a230
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x487b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x487c76
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dl, byte [esi + eax]
xor dl, bl
mov al, dl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr dl, 1
and eax, 0xa001
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
xor dl, cl
and dl, 1
movzx eax, dl
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr bx, 8
xor ax, cx
inc esi
movzx ecx, ax
xor bx, cx
movzx ebx, bx
cmp esi, edi
jb 0x487b76
mov ax, bx
pop ebx
pop edi
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebp
ret
Function at 0x48a870
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push esi
push edi
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
mov esi, eax
cmp dword [0x694b4c], edi
jne 0x473866
push 0x694b54
call fcn.0048a230
add esp, 4
cmp dword [0x694b4c], edi
jne 0x473859
call fcn.00471d20
nop
mov dword [0x694b4c], eax
test eax, eax
jne 0x473859
push 0x694b54
call fcn.0048a2a0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0x694b54
call fcn.0048a2a0
add esp, 4
nop
push dword [0x694b4c]
call fcn.00471de0
mov eax, dword [0x694b50]
add esp, 4
test eax, eax
je 0x4738a1
nop
cmp dword [eax], esi
je 0x47389e
mov eax, dword [eax + 8]
test eax, eax
jne 0x473880
push dword [0x694b4c]
call fcn.00471e20
add esp, 4
mov eax, edi
pop edi
pop esi
ret
mov edi, dword [eax + 4]
push dword [0x694b4c]
call fcn.00471e20
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp dword [0x589b34], 0xffffffff
jne 0x48a8cb
cmp dword [0x694dd8], 0
jne 0x48a8d4
push 0x694ddc
call fcn.0048a230
add esp, 4
cmp dword [0x589b34], 0xffffffff
jne 0x48a8be
cmp dword [0x694dd8], 0
jne 0x48a8be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x48a8b4
nop
mov dword [0x589b34], eax
jmp 0x48a8be
mov dword [0x694dd8], 1
push 0x694ddc
call fcn.0048a2a0
add esp, 4
cmp dword [0x694dd8], 0
je 0x48a8d9
jmp 0x473810
nop
push dword [0x589b34]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret

Function at 0x48a8f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x694dd8], 0
je 0x48a902
pop ebp
jmp fcn.004738c0
push dword [ebp + 8]
push dword [0x589b34]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x48a922
mov dword [ebp + 8], str.TlsSetValue___failed
pop ebp
jmp fcn.0045a230
xor eax, eax
pop ebp
ret
Function at 0x48d1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
call fcn.004703c0
add esp, 8
mov ebx, eax
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
neg edi
push 1
sbb edi, edi
neg edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
mov esi, dword [ebp + 8]
jb 0x48d25d
test edi, edi
setne al
lea edx, [eax*2 + 1]
mov eax, 1
movzx ecx, dl
dec ecx
mov dword [ebp - 8], edx
shl eax, cl
mov dword [ebp + 8], ecx
movzx ecx, byte [esi + 0x44]
mov dword [ebp - 4], eax
test ecx, eax
je 0x48d24a
mov eax, dword [ebp + 8]
btr ecx, eax
push dword [esi]
mov byte [esi + 0x44], cl
call fcn.00489ea0
push 0
push str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.00466f10
add esp, 0xc
test eax, eax
je 0x48d25d
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, eax
je 0x48d25d
push edx
push 0
push 0
push dword [esi]
call fcn.00471230
add esp, 0x10
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x48d2c4
test edi, edi
mov edi, 1
sete al
lea edx, [eax*2 + 1]
movzx eax, byte [esi + 0x44]
movzx ecx, dl
dec ecx
mov dword [ebp + 8], edx
shl edi, cl
test eax, edi
je 0x48d2b1
push dword [esi]
btr eax, ecx
mov byte [esi + 0x44], al
call fcn.00489ea0
push 0
push str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.00466f10
add esp, 0xc
test eax, eax
je 0x48d2c4
mov edx, dword [ebp + 8]
test ebx, edi
je 0x48d2c4
push edx
push 0
push 0
push dword [esi]
call fcn.00471230
add esp, 0x10
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 4
call edi
bt ax, 0xf
jb 0x48d313
movzx eax, byte [esi + 0x44]
test al, 2
je 0x48d2fe
push dword [esi]
btr eax, 1
mov byte [esi + 0x44], al
call fcn.00489ea0
push 0
push str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.00466f10
add esp, 0xc
test eax, eax
je 0x48d313
test bl, 2
je 0x48d313
push 2
push 0
push 0
push dword [esi]
call fcn.00471230
add esp, 0x10
push 5
call edi
bt ax, 0xf
jb 0x48d35c
movzx eax, byte [esi + 0x44]
test al, 8
je 0x48d347
push dword [esi]
btr eax, 3
mov byte [esi + 0x44], al
call fcn.00489ea0
push 0
push str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.00466f10
add esp, 0xc
test eax, eax
je 0x48d35c
test bl, 8
je 0x48d35c
push 4
push 0
push 0
push dword [esi]
call fcn.00471230
add esp, 0x10
push 6
call edi
bt ax, 0xf
jb 0x48d3a5
movzx eax, byte [esi + 0x44]
test al, 0x10
je 0x48d390
push dword [esi]
btr eax, 4
mov byte [esi + 0x44], al
call fcn.00489ea0
push 0
push str.SDL_MOUSE_FOCUS_CLICKTHROUGH
call fcn.00466f10
add esp, 0xc
test eax, eax
je 0x48d3a5
test bl, 0x10
je 0x48d3a5
push 5
push 0
push 0
push dword [esi]
call fcn.00471230
add esp, 0x10
pop edi
mov dword [esi + 0x28], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48dbc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x58ac5c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], esi
mov edi, dword [esi + 0xa4]
mov eax, dword [edi + 4]
mov dword [ebp - 0x20], eax
call fcn.00468530
xor ebx, ebx
cmp eax, esi
sete bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [ebp - 0x20]
sete cl
cmp ebx, ecx
je 0x48ddcb
cmp ecx, dword [ebp + 0xc]
jne 0x48ddcb
test ecx, ecx
je 0x48dd61
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
neg eax
push 1
sbb esi, esi
neg esi
call ebx
mov edx, 4
lea ecx, [edx - 3]
test ax, ax
je 0x48dc47
test esi, esi
mov eax, edx
cmove eax, ecx
or byte [edi + 0x44], al
push 2
call ebx
test ax, ax
je 0x48dc62
test esi, esi
mov eax, 1
mov ecx, 4
cmove eax, ecx
or byte [edi + 0x44], al
push 4
call ebx
test ax, ax
je 0x48dc6f
or byte [edi + 0x44], 2
push 5
call ebx
test ax, ax
je 0x48dc7c
or byte [edi + 0x44], 8
push 6
call ebx
test ax, ax
je 0x48dc89
or byte [edi + 0x44], 0x10
mov esi, dword [ebp - 0x18]
push esi
call fcn.00468e80
add esp, 4
call fcn.004703a0
cmp dword [eax + 0x54], 0
jne 0x48dce5
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
push eax
push dword [edi]
call fcn.00488ea0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
push 0
push esi
call fcn.00471250
add esp, 0x20
push edi
call fcn.0048d1c0
push esi
call fcn.00489ea0
push dword [edi + 0x7c]
call fcn.0048fcd0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.004690f0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.004690f0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.004690f0
push 1
push dword [edi]
call fcn.0048a150
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b20f1
mov esp, ebp
pop ebp
ret
push 0
mov dword [edi + 0x58], 1
call fcn.00468e80
add esp, 4
call fcn.004703a0
cmp dword [eax + 0x54], 0
je 0x48dd87
push 0
call fcn.00471580
add esp, 4
call fcn.00491d10
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x48ddc4
push 0x10
lea esi, [edi + 0x5c]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0045cc10
add esp, 0xc
test eax, eax
jne 0x48ddc4
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
push 0x10
push 0
push esi
call fcn.0045a020
add esp, 0xc
mov dword [edi + 0x58], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b20f1
mov esp, ebp
pop ebp
ret
Function at 0x490840
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, word [ebx + 0xf0]
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test esi, esi
jle 0x490890
cmp dword [ebx + 0x7c], esi
jge 0x490890
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x49087e
push eax
call fcn.0045bfc0
add esp, 4
lea eax, [esi + 2]
push eax
call fcn.0045bff0
add esp, 4
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], esi
push dword [ebx + 0x7c]
push dword [ebx + 0x78]
push dword [ebp + 0x10]
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
xor eax, eax
push eax
push eax
test esi, esi
push 0x80
cmovs esi, eax
push edi
shr esi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, ax
mov eax, dword [ebp + 8]
mov dword [ebx + 0xa0], edx
cmp eax, 0x404
je 0x4908d1
cmp eax, 0x804
jne 0x49090b
test edx, edx
je 0x49090b
mov eax, dword [ebx + 0x7c]
shr eax, 1
cmp edx, eax
jae 0x49090b
mov eax, dword [ebx + 0x78]
mov ecx, 0x3000
movzx eax, word [eax]
cmp ax, cx
je 0x4908f3
cmp eax, 0x20
jne 0x49090b
inc edx
cmp edx, esi
jae 0x49090a
mov eax, dword [ebx + 0x78]
lea ecx, [eax + edx*2]
inc edx
mov ax, word [ecx]
mov word [ecx - 2], ax
cmp edx, esi
jl 0x4908f8
dec esi
mov eax, dword [ebx + 0x78]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [ebx + 0xa0], ecx
jne 0x490994
test esi, esi
jle 0x490994
xor esi, esi
push esi
push esi
push 0x10
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x49098e
lea ecx, [edi + 2]
push ecx
call fcn.0045bff0
add esp, 4
mov esi, eax
mov dword [ebp + 8], esi
push edi
push esi
push 0x10
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
xor ecx, ecx
mov al, byte [esi + ecx]
cmp al, 1
je 0x490961
cmp al, 3
je 0x490961
inc ecx
cmp ecx, edi
jl 0x490951
mov edx, dword [ebp + 8]
mov esi, ecx
cmp ecx, edi
jge 0x490982
nop word [eax + eax]
mov al, byte [edx + esi]
cmp al, 1
je 0x49097b
cmp al, 3
jne 0x490985
inc esi
cmp esi, edi
jl 0x490970
cmp ecx, edi
cmove esi, edi
push edx
call fcn.0045bfc0
add esp, 4
mov dword [ebx + 0xa0], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x491460
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0
movzx edi, word [esi + 0xf0]
and edi, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esi + 0xf0]
cmp eax, ecx
je 0x4914b8
movzx edx, ax
mov ecx, edx
mov dword [esi + 0xf0], eax
and ecx, 0x3ff
cmp ecx, 0x12
je 0x4914ae
mov ecx, 0x804
cmp dx, cx
je 0x4914ae
mov ecx, 1
jmp 0x4914b0
xor ecx, ecx
mov dword [esi + 0xc0], ecx
mov ecx, eax
cmp dword [esi + 0x110], 0
jne 0x4914d2
xor eax, eax
cmp ecx, 0xe0060404
setne al
mov dword [esi + 0xbc], eax
push esi
call fcn.004915f0
movzx eax, word [esi + 0xf0]
add esp, 4
and eax, 0x3ff
cmp edi, eax
je 0x4914f4
push esi
call fcn.004905b0
add esp, 4
pop edi
pop esi
pop ebp
ret
Function at 0x4918e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x58ac5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x448]
push 0x42
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x7c], 0x40
call fcn.0045bff0
mov dword [esi + 0x78], eax
xor ecx, ecx
push 0x10
mov word [eax], cx
xor eax, eax
push eax
mov word [esi + 0x80], ax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc4], eax
lea eax, [esi + 0xc8]
push eax
mov dword [esi + 0xc0], 1
call fcn.0045a020
push 0x10
lea eax, [esi + 0xd8]
push 0
push eax
call fcn.0045a020
lea eax, [ebp - 0x804]
mov dword [esi + 0xe8], 0
push eax
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], 0xffffffff
mov dword [esi + 0x124], 0xffffffff
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
call fcn.00468510
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esp, 0x20
xor esi, esi
mov edi, dword [esi*4 + 0x570028]
test edi, edi
je 0x491abf
test dword [ebp + edi*4 - 0x804], 0x40000000
jne 0x491abf
push 1
push esi
call ebx
test eax, eax
je 0x491abf
push 2
push eax
call ebx
and eax, 0x7fff
je 0x491abf
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x491ab8
add eax, 0x20
mov dword [ebp + edi*4 - 0x804], eax
inc esi
cmp esi, 0x80
jb 0x491a80
push 0
push 0x200
lea eax, [ebp - 0x804]
push eax
push 0
call fcn.00468f70
push str.Menu
push 0x65
call fcn.004690d0
push str.Left_Windows
push 0xe3
call fcn.004690d0
push str.Right_Windows
push 0xe7
call fcn.004690d0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x28
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.004690f0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.004690f0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.004690f0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004b20f1
mov esp, ebp
pop ebp
ret