joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438bd0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x465123
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00458f74
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x608908
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x6079d0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4660b4]
push eax
mov ecx, edi
call fcn.0045e60a
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0045fb26
test eax, eax
je 0x438cec
mov ecx, dword [esp + 0x3c]
call fcn.0045e637
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4663c8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x438cb0
push edi
mov ecx, esi
call fcn.0045bca3
mov ecx, esi
call fcn.00438e50
cmp dword [esp + 0x38], 1
jne 0x438ce5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045bdde
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x43b710
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43b743
push esi
call fcn.0043e810
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43b73c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43b7c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43b7b2
mov eax, dword [esi + 8]
test eax, eax
je 0x43b767
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43b7ae
cmp eax, 2
je 0x43b7b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43b75a
cmp eax, 3
je 0x43b78d
cmp eax, 1
jne 0x43b75a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43b75a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43b75a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043b7f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43b7d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043b7f0
add esp, 4
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010d4
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
sub ebx, 0x3d91
and ebx, 0xa223
add ebx, 0xa63a
pop ebx
push eax
and eax, 0xb1cd
sub eax, 0x15000
and eax, 0x13baa
or eax, 0x48c
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ebx
push ebx
add esp, 4
or ebx, 0x7ae7
add ebx, 0xbe12
xor ebx, 0x13553
pop ebx
push eax
push ebx
add esp, 4
and eax, 0x10757
pop eax
push esi
or esi, 0x14ff4
sub esi, 0xe3c7
pop esi
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
sub esi, 0x15598
sub esi, 0x1dd4
pop esi
push edi
push eax
add esp, 4
and edi, 0x4736
pop edi
push esi
push edi
add esp, 4
xor esi, 0xf332
or esi, 0xb770
or esi, 0x56a6
pop esi
mov dword [ebp - 0x10], 1
push ebx
xor ebx, 0x2899
and ebx, 0x6e0d
call fcn.00401278
add byte [edx], bh
dec ecx
dec ebp
xor al, byte [ecx + 0x3a]
dec esp

Function at 0x401278
Capabilities:
Parse credit card information

Disassembly:
add esp, 4
and ebx, 0x3bb6
pop ebx
push ecx
jmp 0x401289
sub ecx, 0xeae6
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
sub ebx, 0xaf32
add ebx, 0xc7cd
or ebx, 0x134c6
xor ebx, 0xa104
pop ebx
push edi
push ebx
add esp, 4
or edi, 0x4f68
xor edi, 0x7d08
and edi, 0x6dcf
pop edi
push edx
push ecx
add esp, 4
and edx, 0x3426
xor edx, 0x7250
sub edx, 0x3240
pop edx
push ecx
add ecx, 0x1614f
or ecx, 0x16b1a
xor ecx, 0x16dcd
xor ecx, 0x83e
pop ecx
mov dword [ebp - 0x2c], 1
push edx
call 0x40132e
add byte [edi + 0x42], cl
aas
cmp dword [eax + 0x4e], eax
inc eax
dec ecx
dec eax
add esp, 4
or edx, 0x5179
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x1449d
sub ecx, 0xe622
xor ecx, 0xd9eb
pop ecx
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40150d
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov ecx, dword [ebp - 0x19c]
invalid
Function at 0x40132e
Capabilities:
Parse credit card information

Disassembly:
add esp, 4
and ebx, 0x3bb6
pop ebx
push ecx
jmp 0x401289
sub ecx, 0xeae6
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
sub ebx, 0xaf32
add ebx, 0xc7cd
or ebx, 0x134c6
xor ebx, 0xa104
pop ebx
push edi
push ebx
add esp, 4
or edi, 0x4f68
xor edi, 0x7d08
and edi, 0x6dcf
pop edi
push edx
push ecx
add esp, 4
and edx, 0x3426
xor edx, 0x7250
sub edx, 0x3240
pop edx
push ecx
add ecx, 0x1614f
or ecx, 0x16b1a
xor ecx, 0x16dcd
xor ecx, 0x83e
pop ecx
mov dword [ebp - 0x2c], 1
push edx
call 0x40132e
add byte [edi + 0x42], cl
aas
cmp dword [eax + 0x4e], eax
inc eax
dec ecx
dec eax
add esp, 4
or edx, 0x5179
pop edx
push ecx
push edi
add esp, 4
sub ecx, 0x1449d
sub ecx, 0xe622
xor ecx, 0xd9eb
pop ecx
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40150d
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov ecx, dword [ebp - 0x19c]
invalid
Function at 0x40579b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
jne 0x405775
push esi
and esi, 0x13b42
or esi, 0x4b6a
or esi, 0xc227
or esi, 0xcc1c
pop esi
push eax
push ebx
add esp, 4
jmp 0x405759
and eax, 0xdb01
and eax, 0x5012
loopne 0x405774
push eax
add byte [eax], al
pop eax
mov dword [ebp - 0x79c], 0
jmp 0x40629c
push esi
push eax
add esp, 4
and esi, 0x7d02
xor esi, 0x1570
and esi, 0x159fb
call 0x40579b
add byte [edx + ecx*2 + 0x4c], al
dec eax
dec ebp
cmp bh, byte [eax]
inc ebx
dec ebx
add esp, 4
pop esi
push eax

Function at 0x405f6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ecx, 0x2a3c
add ecx, 0x990f
jmp 0x405e85
pop ecx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x405efc
push edi
call 0x405f0c
add byte [edx], bh
dec ebx
dec esp
push eax
inc eax
cmp dword [eax], edi
dec ebp
add esp, 4
or edi, 0xb779
or edi, 0x103a5
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x12621
sub edx, 0x18173
pop edx
mov eax, dword [ebp - 0x31c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x324], ecx
push eax
and eax, 0x7e04
pop eax
push eax
push esi
add esp, 4
xor eax, 0x13cd0
call 0x405f5c
add byte [0x3a403440], bh
inc esp
add esp, 4
call 0x405f6b
add byte [eax + 0x43], cl
xor ecx, dword ds:[edx + eax*2 - 0x7d]
les eax, [eax + ebx*2]
mov dword [ebp - 0x770], 0
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x405f9f
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x406290
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x160c], edx
jne 0x405fc7
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x406290
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x160c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1610], ecx
cmp dword [ebp - 0x1610], 0
mov ebp, 0xffffe9f0
add byte [ebp + 0x11], dh
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
jmp 0x406290
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x1610]
mov dword [ebp - 0x764], eax
jne 0x40601e
mov ecx, dword [ebp - 0x770]
mov dword [ebp - 0x510], ecx
jmp 0x406290
mov edx, dword [ebp - 0x764]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1984], eax
mov ecx, dword [ebp - 0x764]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1988], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1d10], ecx
invalid
invalid
cwde
Function at 0x420ca0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xcc
mov eax, dword [0x725fec]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, edx
movzx eax, cx
mov edx, 0x8419
cmp ax, dx
je 0x420dd5
shr ecx, 0x10
mov edx, 0xf088
cmp cx, dx
je 0x420dd5
mov edx, 0xf089
cmp cx, dx
je 0x420da0
mov edx, 0x3009
cmp ax, dx
je 0x420da0
mov edx, 0xf087
cmp cx, dx
je 0x420d73
mov ecx, 0x3409
cmp ax, cx
je 0x420d73
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x420d50
push 0x46
lea eax, [esp + 0xc]
push eax
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x28
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0064cf62
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0063db0b
add esp, 0xcc
ret
push 0x28
push esi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
pop edi
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0063db0b
add esp, 0xcc
ret
movups xmm0, xmmword [str.DOS___CP866]
movups xmmword [esi], xmm0
movq xmm0, qword [0x6e2f90]
movq qword [esi + 0x10], xmm0
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0063db0b
add esp, 0xcc
ret
movups xmm0, xmmword [0x6e2f5c]
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x6e2f6c]
movups xmmword [esi + 0x10], xmm0
mov ax, word [0x6e2f7c]
mov word [esi + 0x20], ax
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0063db0b
add esp, 0xcc
ret
movq xmm0, qword [0x6e2f50]
mov ecx, dword [esp + 0xcc]
movq qword [esi], xmm0
mov eax, dword [0x6e2f58]
mov dword [esi + 8], eax
pop esi
xor ecx, esp
call fcn.0063db0b
add esp, 0xcc
ret
Function at 0x421400
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x685ed1
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x725fec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
call edi
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x260], 0x30
push ecx
push eax
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp eax, 1
jne 0x421475
mov eax, dword [ebp - 0x244]
test eax, eax
mov edi, dword [ebp - 0x254]
cmovne edi, eax
test edi, edi
jne 0x4214cf
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test bl, bl
je 0x4214bd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call edi
mov dword [ebp - 0x294], eax
cmp eax, ebx
je 0x4214b1
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push ebx
push eax
call esi
call dword [sym.imp.USER32.dll_GetFocus]
push 0
push ebx
push dword [ebp - 0x294]
mov edi, eax
call esi
jmp 0x4214b9
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
test edi, edi
jne 0x4214cf
mov edi, dword [ebp - 0x258]
test edi, edi
jne 0x4214cf
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push ecx
mov esi, esp
mov dword [ebp - 0x294], esp
mov dword [ebp - 0x298], esi
call fcn.004fc414
mov ecx, eax
test ecx, ecx
je 0x421612
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.System32ApplicationFrameHost.exe
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x421517
movzx eax, ax
push eax
call fcn.00403830
jmp 0x421523
push 0x21
push str.System32ApplicationFrameHost.exe
call fcn.00403bb0
lea edx, [ebp - 0x218]
mov dword [ebp - 4], 1
mov ecx, edi
call fcn.00475c90
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421560
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00403420
mov byte [ebp - 4], 2
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
push ecx
cmovae eax, dword [ebp - 0x230]
mov ecx, esp
push eax
call fcn.00403d10
mov byte [ebp - 4], 3
call fcn.00477020
add esp, 8
lea ecx, [ebp - 0x230]
mov bl, al
call fcn.004035b0
test bl, bl
je 0x4215f4
lea eax, [ebp - 0x290]
mov dword [ebp - 0x290], 0x30
push eax
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp eax, 1
jne 0x4215f4
mov eax, dword [ebp - 0x274]
test eax, eax
mov ecx, dword [ebp - 0x284]
cmovne ecx, eax
test ecx, ecx
cmovne edi, ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063db0b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403b60
int3
Function at 0x421b60
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov si, cx
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
movzx eax, si
push 0
push eax
mov bl, dl
movq qword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, bl
xor edx, edx
xor ecx, 1
mov word [esp + 0xe], ax
movzx eax, byte [esp + 0x28]
add ecx, ecx
or ecx, eax
mov dword [esp + 8], 1
push 0x1c
lea eax, [esp + 0xc]
mov word [esp + 0x10], si
push eax
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
or edx, ecx
movlpd qword [esp + 0x24], xmm0
push 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 0x87654321
call dword [sym.imp.USER32.dll_SendInput]
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x421bf0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x78
mov eax, dword [0x725fec]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push edi
push 0x70
lea eax, [esp + 0x14]
mov bx, cx
push 0
push eax
mov bp, dx
mov word [esp + 0x1a], bx
call fcn.006440e0
add esp, 0xc
movzx edi, bx
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dx, word [esp + 0xe]
xorps xmm0, xmm0
movups xmmword [esp + 0x48], xmm0
or dword [esp + 0x50], 2
movups xmmword [esp + 0x2c], xmm0
movzx eax, ax
mov word [esp + 0x32], ax
mov word [esp + 0x4e], ax
lea eax, [esp + 0x10]
push 0x1c
movups xmmword [esp + 0x68], xmm0
or dword [esp + 0x70], 2
movzx ecx, bx
push eax
movq qword [esp + 0x44], xmm0
movq qword [esp + 0x60], xmm0
movq qword [esp + 0x7c], xmm0
push 4
mov dword [esp + 0x24], 0
movlpd qword [esp + 0x30], xmm0
mov dword [esp + 0x1c], 1
mov word [esp + 0x20], dx
mov word [esp + 0x22], cx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x87654321
mov dword [esp + 0x50], 0
mov dword [esp + 0x38], 1
mov word [esp + 0x3c], bp
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x87654321
mov dword [esp + 0x6c], 0
mov dword [esp + 0x54], 1
mov word [esp + 0x58], bp
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0x87654321
mov dword [esp + 0x88], 0
mov dword [esp + 0x70], 1
mov word [esp + 0x74], dx
mov word [esp + 0x76], cx
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0x87654321
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [esp + 0x80]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0063db0b
add esp, 0x78
ret
Function at 0x422660
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, edx
push edi
push 0
push 0x10
mov edi, ecx
call esi
push 0
movzx eax, ax
push 0x11
mov dword [esp + 0x20], eax
call esi
push 0
movzx eax, ax
push 0x12
mov dword [esp + 0x24], eax
call esi
mov esi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.USER32.dll_VkKeyScanExW]
push esi
movzx eax, ax
push ebp
mov dword [esp + 0x2c], eax
call ebx
movzx eax, ax
or ecx, 0xffffffff
mov dword [esp + 0x14], eax
cmp cx, ax
jne 0x4226c1
push esi
push 0x3f
call ebx
movzx eax, ax
mov dword [esp + 0x14], eax
push esi
cwde
push 0
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
movzx eax, ax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
shr eax, 8
mov bl, al
mov bh, al
and eax, 0xffffff04
and bl, 1
mov dword [esp + 0x10], eax
and bh, 2
mov eax, dword [esp + 0x14]
movzx eax, al
push 0x14
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x422716
push ebp
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
je 0x422716
xor bl, 1
mov esi, dword [esp + 0x18]
test bl, bl
je 0x422730
push 0
push esi
mov edx, 0x10
mov ecx, edi
call fcn.004207e0
add esp, 8
mov ebp, dword [esp + 0x1c]
test bh, bh
je 0x42274a
push 0
push ebp
mov edx, 0x11
mov ecx, edi
call fcn.004207e0
add esp, 8
cmp byte [esp + 0x10], 0
je 0x422766
push 0
push dword [esp + 0x28]
mov edx, 0x12
mov ecx, edi
call fcn.004207e0
add esp, 8
mov edx, dword [esp + 0x14]
mov ecx, edi
push 0
push dword [esp + 0x24]
call fcn.004207e0
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 2
push dword [esp + 0x2c]
call fcn.004207e0
add esp, 0x10
cmp byte [esp + 0x10], 0
je 0x4227a7
push 2
push dword [esp + 0x28]
mov edx, 0x12
mov ecx, edi
call fcn.004207e0
add esp, 8
test bh, bh
je 0x4227bd
push 2
push ebp
mov edx, 0x11
mov ecx, edi
call fcn.004207e0
add esp, 8
test bl, bl
je 0x4227d3
push 2
push esi
mov edx, 0x10
mov ecx, edi
call fcn.004207e0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4236f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov eax, dword [ebp]
mov eax, dword [eax - 0xc]
mov dword [esp + 0x14], eax
test eax, eax
jle 0x423765
nop dword [eax]
test esi, esi
js 0x42378b
mov eax, dword [ebp]
cmp esi, dword [eax - 0xc]
jg 0x42378b
push dword [0x733fdc]
movzx eax, word [eax + esi*2]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
or ecx, 0xffffffff
cmp cx, ax
je 0x423736
inc ebx
mov eax, dword [ebp]
cmp esi, dword [eax - 0xc]
jg 0x42378b
push dword [0x733fe0]
movzx eax, word [eax + esi*2]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
or ecx, 0xffffffff
cmp cx, ax
je 0x423758
inc edi
inc esi
cmp esi, dword [esp + 0x14]
jl 0x423710
cmp ebx, edi
jl 0x423779
jg 0x423782
push 0
mov ecx, 0x733fdc
call fcn.00412b00
cmp eax, dword [0x733fe0]
jne 0x423782
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
push 0x80070057
call fcn.00403b60
int3