joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.004988e0
mov eax, dword [0x5521f4]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [0x51cd34]
mov esi, eax
test esi, esi
jne 0x42da57
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x42d9e4
cmp word [esp + 0x10], ax
jne 0x42d9a8
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0040e4f0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d9b0
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040e4f0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x42da52
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x42da37
cmp eax, 0x400
ja 0x42da37
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.0040e020
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8

Function at 0x42e550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
je 0x42e56e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x42e571
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x42e5a5
cmp byte [ebp + 0xc], 0
je 0x42e5a5
cmp byte [esi], 0
je 0x42e596
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x42e599
mov eax, dword [esi + 4]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42ef60
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov ecx, dword [esi]
test ecx, ecx
je 0x42f009
cmp ecx, 0xffffffff
je 0x42f009
cmp byte [esi + 0x34], 0
mov edx, 0x1000002
push 0
push 0
push 0
mov eax, 2
cmovne eax, edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [esi + 0x30]
call fcn.00424dd0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x42f009
cmp eax, 0xffffffff
je 0x42f009
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0xc], xmm0
call fcn.00430d20
mov ecx, eax
add ecx, 0xffffffff
adc edx, 0xffffffff
test edx, edx
ja 0x42f009
jb 0x42efdf
cmp ecx, 0x7ffffffe
ja 0x42f009
push 0
push dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
push dword [ebp - 8]
push 4
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x28], eax
test eax, eax
je 0x42f009
mov dword [esi + 0x28], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432e90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ecx
push edi
mov eax, ecx
mov dword [ebp - 8], ebx
mov edi, 8
or ecx, 0xffffffff
mov esi, edi
cmp edi, ecx
mov dword [ebp - 8], ecx
cmova esi, ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x432ecd
cmp byte [0x568704], al
jne 0x432ef3
int3
test bl, 1
je 0x432ee0
lea ecx, [ebp - 0xb8]
and ebx, 0xfffffffe
call fcn.0042a2f0
mov eax, dword [ebp - 4]
add eax, esi
mov dword [ebp - 4], eax
sub edi, esi
jne 0x432eab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call fcn.004bacd0
int3
Function at 0x439c30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
jb 0x439c4b
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x64], eax
call fcn.0042e1a0
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x70]
call fcn.0042e2c0
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call fcn.00439b90
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret

Function at 0x43a540
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x5521f4]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x552e1c]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0
push edi
mov ecx, 0x100
mov dword [esp + 0xc], eax
mov esi, ebx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0049816f
add esp, 4
mov edi, 0x100
nop word [eax + eax]
mov esi, dword [0x568714]
xor dl, dl
test esi, esi
jle 0x43a5d8
nop dword [eax]
mov ecx, dword [esp + esi*4 + 0x10]
test ecx, ecx
je 0x43a5d3
mov eax, dword [esi*4 + 0x567f28]
test eax, eax
je 0x43a5d3
push ecx
mov dword [esp + esi*4 + 0x14], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x43a5b0
dec edi
test edi, edi
jle 0x43a5e1
test dl, dl
jne 0x43a5a0
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x43ad90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a275
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x5521f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0xc]
push 0x1c
call fcn.00497eca
mov edi, eax
add esp, 4
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 4], esi
mov dword [edi + 0xc], ecx
mov dword [edi + 0x18], eax
mov dword [ebp - 4], 0xffffffff
cmp byte [esi], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x43ae29
xor ecx, ecx
jmp 0x43ae39
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ae30
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00405b30
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push dword [ebp - 0x44]
push eax
push ecx
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.0043b750
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x43ae83
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004023a0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x44], 0
jne 0x43af8c
cmp byte [esi], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
jne 0x43aecf
xor ecx, ecx
jmp 0x43aedd
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43aed4
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.00405b30
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x40]
push 0x2e
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push str.more_than_one_flags_defined_with_the_same_name
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00405b30
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.0043ac20
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x43af45
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.004023a0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x43af73
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.004023a0
push 0
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004bad1e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x43bcd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
sub esp, 8
mov dword [ebp - 0x38], esi
mov edx, esp
mov dword [edx], edi
test edi, edi
jne 0x43bcff
xor ecx, ecx
jmp 0x43bd1c
cmp byte [edi], 0
jne 0x43bd08
xor ecx, ecx
jmp 0x43bd1c
mov ecx, edi
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bd10
sub ecx, esi
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x1c]
mov dword [edx + 4], ecx
push eax
call fcn.0042c830
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x43bd33
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x1c]
mov ebx, eax
call fcn.00405820
test ebx, ebx
jne 0x43bd5d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x43be06
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00497f33
add esp, 4
mov esi, eax
push ebx
push esi
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
je 0x43bda9
cmp byte [edi], 0
jne 0x43bd98
xor edi, edi
jmp 0x43bda9
lea ecx, [edi + 1]
nop dword [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x43bda0
sub edi, ecx
lea eax, [ebp - 0x1c]
mov dword [edx + 4], edi
push eax
call fcn.0042c830
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x43bdc0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x1c]
call fcn.00405820
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040e070
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.0042c730
mov ecx, dword [ebp - 0x38]
push eax
call fcn.00405910
lea ecx, [ebp - 0x34]
call fcn.00402210
lea ecx, [ebp - 0x1c]
call fcn.00405820
test esi, esi
je 0x43be06
push esi
call fcn.00422010
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 8
Function at 0x4547ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x5225d8
push dword [ebp + 8]
call fcn.004b7098
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x454817
push ebx
push edi
push esi
call fcn.004b8a34
push eax
call fcn.004c54cd
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x4547f6
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x45480c
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.004b7393
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.004b7147
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x45c2c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
xor eax, eax
cmp ax, bx
jge 0x45c369
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
inc edx
mov eax, dword [edi]
push 0
push ecx
push edx
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x45c331
mov ecx, edi
call fcn.0045d9ab
mov ecx, dword [ebp - 4]
inc esi
push 1
pop edx
cmp si, bx
jl 0x45c30c
cmp si, bx
jge 0x45c369
push dword [ebp + 0x14]
or eax, 0xffffffff
mov ecx, ebx
push dword [ebp + 0x10]
sub ecx, esi
cmp word [ebp + 0xc], 0
push 1
pop edx
cmovg eax, edx
movsx ecx, cx
cwde
imul ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.0044c43c
test bx, bx
je 0x45c3a8
mov ecx, edi
call fcn.004ad10e
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45fdbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x45fde2
call fcn.0044cdd8
jmp 0x45fe0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044c2b4
mov eax, dword [esi + 0x180]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x45fe0e
push 1
push ecx
push ecx
push eax
push 0x524870
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc
Function at 0x461d32
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004b0ce0
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x461d8d
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x461da1
cmp byte [ebp - 6], 1
jne 0x461da1
cmp dword [ebp - 0x11c], 6
jne 0x461da1
xor eax, eax
inc eax
jmp 0x461da3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x46d9f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x5c]
push edi
push esi
call fcn.00448f50
mov eax, dword [esi]
lea ecx, [ebp - 0x5c]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 0x34], 0
push ecx
mov ecx, esi
mov dword [ebp - 0x5c], 0x524c18
mov dword [ebp - 0x54], 0x526308
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edi
call dword [eax + 0x94]
cmp dword [ebp - 0x34], 0
jne 0x46dbe5
cmp dword [ebp + 0x10], 0
jne 0x46da63
cmp dword [esi + 0x264], 0
jne 0x46da56
cmp dword [esi + 0x260], 0
je 0x46da93
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46da93
cmp edi, 0xffffffff
je 0x46dbba
imul ecx, edi, 0xc
xor eax, eax
push edi
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], eax
sete al
mov dword [ecx + 8], eax
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.0046e093
jmp 0x46dbba
cmp dword [esi + 0x264], 0
jne 0x46daa9
cmp dword [esi + 0x260], 0
je 0x46db3f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46db3f
cmp edi, 0xffffffff
je 0x46dbba
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
mov ebx, eax
mov eax, edi
cmp ebx, edi
mov ecx, ebx
cmovg eax, ebx
cmp eax, ebx
mov dword [ebp - 8], eax
cmove ecx, edi
and dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
mov ecx, esi
call fcn.0046d67a
test eax, eax
jle 0x46dbba
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
xor ebx, ebx
mov eax, dword [esi + 0x26c]
add eax, ebx
mov ecx, dword [eax + 8]
cmp edi, dword [ebp - 4]
jl 0x46db1a
cmp edi, dword [ebp - 8]
jg 0x46db1a
mov dword [eax + 8], 1
jmp 0x46db1e
and dword [eax + 8], 0
cmp ecx, dword [eax + 8]
je 0x46db2b
push edi
mov ecx, esi
call fcn.0046e093
mov ecx, esi
inc edi
add ebx, 0xc
call fcn.0046d67a
cmp edi, eax
jl 0x46dafc
mov edi, dword [ebp + 0xc]
jmp 0x46dbb7
or dword [esi + 0x220], 0xffffffff
mov ecx, esi
xor ebx, ebx
call fcn.0046d67a
test eax, eax
jle 0x46db93
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + 0x26c]
cmp ebx, edi
je 0x46db7e
mov edx, dword [eax + ecx + 8]
test edx, edx
je 0x46db7e
and dword [eax + ecx + 8], 0
test edx, edx
je 0x46db7e
push ebx
mov ecx, esi
call fcn.0046e093
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
inc ebx
mov dword [ebp + 0xc], ecx
mov ecx, esi
call fcn.0046d67a
mov ecx, dword [ebp + 0xc]
cmp ebx, eax
jl 0x46db58
cmp edi, 0xffffffff
je 0x46dbb7
mov eax, dword [esi + 0x26c]
imul ecx, edi, 0xc
push edi
mov dword [eax + ecx + 8], 1
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.0046e093
mov ebx, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x30]
call fcn.00448f50
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
mov dword [ebp - 0x30], 0x524c18
mov dword [ebp - 0x28], 0x526374
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
call dword [eax + 0x94]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x470ffb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x47105c
sub eax, 1
je 0x47103e
sub eax, 3
je 0x47103e
test dword [edi + 0x370], 0x2000
je 0x471077
push esi
call fcn.004b7bfb
pop ecx
test eax, eax
jne 0x471077
cmp esi, 0x2d
je 0x471077
cmp esi, 0x2e
je 0x471077
cmp esi, 0x2c
je 0x471077
jmp 0x471092
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x471077
test dword [edi + 0x370], 0x1000
jmp 0x471075
test byte [edi + 0x374], 0x80
jne 0x471077
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x471092
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4712ff
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x2c]
push edi
push esi
call fcn.00448f50
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x2c], 0x524c18
mov dword [ebp - 0x24], 0x526900
mov byte [ebp - 4], bl
mov dword [ebp - 0xc], edi
call dword [eax + 0x94]
cmp byte [ebp - 4], bl
jne 0x471368
cmp edi, 0xd
jne 0x47136d
test dword [esi + 0x370], 0x1000
jne 0x47136d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x47136d
mov dword [esi + 0x10], ebx
jmp 0x471387
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47379a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
and eax, 0x8000
and edi, 0x8000
jne 0x4737fd
test ecx, ecx
jne 0x4737e3
test eax, eax
jne 0x4737dc
inc eax
jmp 0x473831
push 2
pop eax
push 4
jmp 0x473830
test eax, eax
jne 0x4737ee
push 4
pop eax
push 2
jmp 0x473830
push 6
pop eax
push 0x10
mov word [ebx + 0x170], ax
pop eax
jmp 0x473838
test ecx, ecx
jne 0x47380f
test eax, eax
jne 0x47380b
push 8
pop eax
inc ecx
jmp 0x473831
test ecx, ecx
je 0x47381e
test eax, eax
jne 0x47381a
push 0x40
pop eax
push 3
jmp 0x473830
test ecx, ecx
jne 0x473829
test eax, eax
je 0x473829
push 0x20
pop eax
push 5
jmp 0x473830
mov eax, 0x80
push 7
pop ecx
mov word [ebx + 0x170], cx
test word [ebx + 0x174], ax
je 0x47384f
mov ax, word [ebx + 0x176]
mov word [ebx + 0x170], ax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00448f50
mov ax, word [ebx + 0x170]
lea ecx, [ebp - 0x28]
mov word [ebp - 6], ax
mov ax, word [ebx + 0x172]
mov word [ebp - 8], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 0x28], 0x524c18
mov dword [ebp - 0x20], 0x526fd4
call dword [eax + 0x94]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48741a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x487427
xor eax, eax
jmp 0x487455
push dword [ecx + 4]
call fcn.004584cb
pop ecx
test eax, eax
je 0x487442
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x487423
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4
Function at 0x487543
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.0048741a
test eax, eax
je 0x487578
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.00486fdf
xor eax, eax
inc eax
jmp 0x487675
push esi
push dword [ebx + 4]
call fcn.004584cb
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
je 0x487622
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x487622
cmp edi, 0x25
je 0x4875b2
cmp edi, 0x27
je 0x4875c0
cmp edi, 0x26
je 0x4875b2
cmp edi, 0x28
jne 0x487622
cmp edi, 0x27
je 0x4875c0
cmp edi, 0x28
je 0x4875c0
push 2
jmp 0x4875c2
push 3
pop edi
jmp 0x4875d0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x48760c
push edi
mov ecx, esi
call fcn.0044ab64
mov esi, eax
test esi, esi
jne 0x4875c5
mov ecx, dword [ebp - 4]
cmp edi, 3
setne al
push eax
call fcn.0044a85d
mov ecx, eax
jmp 0x4875ff
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x48760c
push edi
mov ecx, esi
call fcn.0044ab64
mov esi, eax
test esi, esi
jne 0x4875f1
jmp 0x48761d
push 1
mov ecx, esi
call fcn.004a577e
push eax
mov ecx, ebx
call fcn.004878ff
xor eax, eax
inc eax
jmp 0x487674
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.00488f97
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.004876c9
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call fcn.00401a00
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4