joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45912d
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
push ecx
pop esi
lea eax, [ebp - 8]
push eax
push 0xb0
mov dword [ebp - 0x10], esi
push dword [esi]
call edi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x45915d
xor al, al
jmp 0x4591d7
push ebx
sub ebx, ebx
push ebx
push ebx
push 0xe
push dword [esi]
call edi
push eax
pop edi
test edi, edi
je 0x4591d4
cmp edi, dword [ebp - 8]
jb 0x4591d4
cmp edi, dword [ebp - 4]
jb 0x4591d4
sub ecx, ecx
lea esi, [edi + 1]
push 2
pop edx
push esi
pop eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
pop ecx
push eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0xc]
or eax, eax
je 0x4591c9
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x4591b8
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
push eax
call fcn.00407d2c
mov bl, 1
push esi
call fcn.0042106c
pop ecx
mov al, bl
jmp 0x4591d6
xor al, al
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x459b50
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [ebp - 4], esi
push dword [esi]
call fcn.0045ae57
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub ebx, ebx
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 1
push eax
cmp dword [ebp + 8], ebx
jge 0x459ba8
push 0x25
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x459bd0
push 0x27
push 0x100
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
mov edi, dword [ebp - 4]
push 0x101
push dword [edi]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [edi]
call fcn.0045ae57
pop edi
pop esi
mov al, 1
pop ebx
push ebp
pop esp
pop ebp
ret 4

Function at 0x45a37c
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esp
pop ebp
push esi
xor esi, esi
cmp byte [ebp + 0xc], 1
jne 0x45a3a7
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x45a3c0
push 1
jmp 0x45a3a8
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebp
ret 8
Function at 0x45afdc
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push ecx
pop ebx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 8], ebx
call fcn.00407eec
push dword [ebx]
call fcn.0041619a
test al, al
je 0x45b004
xor al, al
jmp 0x45b099
mov ecx, ebx
call fcn.0045b0a2
mov ebx, eax
or ebx, ebx
jne 0x45b016
mov ebx, 0x7fff
xor ecx, ecx
lea esi, [ebx + 1]
push 2
pop edx
push esi
pop eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
pop ecx
push eax
pop edi
mov eax, dword [ebp - 8]
push edi
push esi
push 0xd
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
or eax, eax
jle 0x45b090
push edi
call fcn.00423980
pop ecx
cmp eax, ebx
jne 0x45b087
sub ecx, ecx
test eax, eax
je 0x45b068
mov dl, byte [ecx + edi]
cmp dl, 0x20
jl 0x45b087
cmp dl, 0x7e
jg 0x45b087
inc ecx
cmp ecx, eax
jb 0x45b056
push edi
lea ecx, [ebp - 0x18]
call fcn.0045ae14
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.0040793a
lea ecx, [ebp - 0x18]
call fcn.00405a64
jmp 0x45b090
mov ecx, dword [ebp + 8]
push edi
call fcn.00407d2c
push edi
call fcn.0042106c
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45fc4d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebx]
push 2
pop edx
mov esi, dword [ecx + edi]
lea eax, [ecx + 4]
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebp + 8], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420ff6
mov ecx, dword [ebx]
add esi, esi
add ecx, edi
mov edi, eax
push esi
push ecx
push edi
call fcn.00421080
add dword [ebx], esi
xor eax, eax
mov ecx, dword [ebp + 8]
add esp, 0x10
mov word [esi + edi], ax
or ecx, ecx
jle 0x45fca8
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x45fc9f
push edi
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x460219
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
push ecx
pop edi
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x4602bc
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4603a1
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x460261
cmp byte [ebp - 0xf0], al
jne 0x46026a
cmp byte [edi + 0x1a], 0
jne 0x46026a
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x460279
cmp byte [edi + 0x1b], 0
jne 0x460279
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x46028b
cmp byte [edi + 0x1c], 0
jne 0x46028b
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x46029d
cmp byte [edi + 0x1d], 0
jne 0x46029d
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x4603a1
cmp byte [edi + 0x1e], 0
jne 0x4603a1
mov byte [esi + 4], 1
jmp 0x4603a1
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4602e9
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x4602f2
cmp byte [edi + 0x1a], 0
jne 0x4602f2
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460318
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x460322
cmp byte [edi + 0x1b], 0
jne 0x460322
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460342
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46034c
cmp byte [edi + 0x1c], 0
jne 0x46034c
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46036c
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x460376
cmp byte [edi + 0x1d], 0
jne 0x460376
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460396
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x4603a0
cmp byte [edi + 0x1e], 0
jne 0x4603a0
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
push ebp
pop esp
pop ebp
ret 4
Function at 0x46052c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x460544
mov byte [esi + 0x14], 1
cmp byte [eax + 2], 0
je 0x46054e
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x460558
mov byte [esi + 0x17], 1
sub eax, eax
cmp byte [esi + 0x14], al
je 0x460567
cmp byte [esi + 0x1a], al
je 0x460567
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x460574
cmp byte [esi + 0x1b], al
je 0x460574
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x460581
cmp byte [esi + 0x1c], al
je 0x460581
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x46058e
cmp byte [esi + 0x1d], al
je 0x46058e
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x46059b
cmp byte [esi + 0x1e], al
je 0x46059b
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x46061d
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or eax, eax
je 0x460755
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x4605e0
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x460755
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.00460195
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x460655
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x460673
cmp byte [esi + 0x1a], 0
jne 0x460673
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.0046189f
lea eax, [ebp - 0xc]
push esi
pop ecx
push eax
call fcn.00461121
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x460695
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x4606b3
cmp byte [esi + 0x1b], 0
jne 0x4606b3
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.0046189f
lea eax, [ebp - 0xc]
push esi
pop ecx
push eax
call fcn.00461121
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4606cf
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x4606ea
cmp byte [esi + 0x1c], 0
jne 0x4606ea
push 0x11
lea ecx, [ebp - 0xc]
call fcn.0046189f
lea eax, [ebp - 0xc]
push esi
pop ecx
push eax
call fcn.00461121
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x460706
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x460721
cmp byte [esi + 0x1d], 0
jne 0x460721
push 0x12
lea ecx, [ebp - 0xc]
call fcn.0046189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00461121
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x460738
push 0x5b
call edi
test bx, ax
je 0x460753
cmp byte [esi + 0x1e], 0
jne 0x460753
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.0046189f
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00461121
pop edi
pop ebx
pop esi
push ebp
pop esp
pop ebp
ret 4
Function at 0x460f7b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [ebp + 0xc], bl
je 0x460fdc
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004617d7
mov ecx, dword [ebp - 4]
call fcn.004601fe
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004617d7
mov ecx, dword [ebp - 4]
call fcn.004601e5
pop esi
pop edi
mov al, bl
pop ebx
push ebp
pop esp
pop ebp
ret 8

Function at 0x460fe6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push ecx
pop esi
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x4610c1
cmp bl, 0x14
je 0x4610c1
cmp bl, 0x90
je 0x4610c1
cmp bl, 0x91
je 0x4610c1
cmp bl, 0xff
je 0x4610ae
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or eax, eax
je 0x461059
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx edx, bh
mov ecx, edi
shl edx, 0x10
or edx, 1
call fcn.0046042e
cmp al, 1
jne 0x461073
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x461084
cmp byte [esi + 0x1d], 0
jne 0x461084
cmp bl, 0x12
jne 0x4610a2
cmp byte [esi + 0x16], 0
jne 0x4610a2
cmp byte [esi + 0x1c], 0
jne 0x4610a2
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x4610b6
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x4610b6
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x461111
cmp bl, 0xff
je 0x4610e7
mov ecx, edi
call fcn.0046042e
push ecx
mov ecx, esi
cmp al, 1
jne 0x4610d8
push 1
jmp 0x4610da
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004617d7
jmp 0x461111
mov word [ebp - 0x1a], ax
sub edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.004601fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x461121
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push ecx
pop esi
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x4611f9
cmp bl, 0x14
je 0x4611f9
cmp bl, 0x90
je 0x4611f9
cmp bl, 0x91
je 0x4611f9
cmp bl, 0xff
je 0x461249
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or eax, eax
je 0x461198
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx edx, bh
push edi
pop ecx
shl edx, 0x10
or edx, 0xc0000001
call fcn.0046042e
cmp al, 1
jne 0x4611b5
or edx, 0x1000000
cmp byte [esi + 0x17], 0
jne 0x4611c6
cmp byte [esi + 0x1d], 0
jne 0x4611c6
cmp bl, 0x12
jne 0x4611e4
cmp byte [esi + 0x16], 0
jne 0x4611e4
cmp byte [esi + 0x1c], 0
jne 0x4611e4
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x4611ee
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x461249
cmp bl, 0xff
je 0x46121f
mov ecx, edi
call fcn.0046042e
push ecx
mov ecx, esi
cmp al, 1
jne 0x461210
push 3
jmp 0x461212
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004617d7
jmp 0x461249
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
sub ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.004601e5
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 4
Function at 0x461276
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
push ecx
pop edi
cmp byte [esi], 0
jne 0x4612a7
cmp byte [esi + 1], 0
jne 0x4612a7
cmp byte [esi + 2], 0
jne 0x4612a7
cmp byte [esi + 3], 0
jne 0x4612a7
cmp byte [esi + 4], 0
je 0x461455
cmp dword [edi + 0x20], 0
push ebx
je 0x4613dd
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
or eax, eax
je 0x4613dd
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or eax, eax
je 0x461331
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x4612ef
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x461300
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46130c
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x461318
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x461324
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x461342
cmp byte [esi + 1], 0
je 0x461359
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x461376
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4613ba
cmp byte [esi + 2], 0
jne 0x46139f
cmp byte [edi + 0x1c], 0
jne 0x46139f
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x4613b5
test al, al
je 0x4613ba
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46144d
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x46144d
xor ebx, ebx
cmp byte [esi], bl
je 0x4613f6
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
push edi
pop ecx
call fcn.004617d7
cmp byte [esi + 1], bl
je 0x46140e
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004617d7
cmp byte [esi + 2], bl
je 0x461423
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
push edi
pop ecx
call fcn.004617d7
cmp byte [esi + 3], bl
je 0x461438
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.004617d7
cmp byte [esi + 4], bl
je 0x46144d
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.004617d7
push edi
pop ecx
call fcn.004601fe
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46145d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46148e
cmp byte [esi + 1], 0
jne 0x46148e
cmp byte [esi + 2], 0
jne 0x46148e
cmp byte [esi + 3], 0
jne 0x46148e
cmp byte [esi + 4], 0
je 0x46164a
cmp dword [edi + 0x20], 0
push ebx
je 0x4615cc
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
or eax, eax
je 0x4615cc
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x461518
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x4614d6
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x4614e7
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x4614f3
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x4614ff
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46150b
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x461529
cmp byte [esi + 1], 0
je 0x461542
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x461561
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
mov al, byte [esi + 3]
test al, al
je 0x4615a7
cmp byte [esi + 2], 0
jne 0x46158a
cmp byte [edi + 0x1c], 0
jne 0x46158a
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x4615a2
test al, al
je 0x4615a7
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x461642
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x461642
cmp byte [esi], 0
push 2
pop ebx
je 0x4615e7
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
push edi
pop ecx
call fcn.004617d7
cmp byte [esi + 1], 0
je 0x461600
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.004617d7
cmp byte [esi + 2], 0
je 0x461616
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
push edi
pop ecx
call fcn.004617d7
cmp byte [esi + 3], 0
je 0x46162c
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
push edi
pop ecx
call fcn.004617d7
cmp byte [esi + 4], 0
je 0x461642
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
push edi
pop ecx
call fcn.004617d7
push edi
pop ecx
call fcn.004601e5
pop ebx
pop edi
pop esi
push ebp
pop esp
pop ebp
ret 4
Function at 0x461652
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
test esi, esi
js 0x4616d7
jne 0x461666
push 0
jmp 0x4616d1
cmp esi, 0xf
jae 0x4616d0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4616d0
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jns 0x461689
fadd qword [0x4bbac8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
sbb eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fstp qword [ebp - 0x20]
call fcn.004207f6
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x461692
jmp 0x4616d7
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x461831
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
sub eax, eax
mov dword [esi + 4], eax
mov byte [esi + 0xa], al
mov eax, dword [ebp + 8]
mov dword [esi], 0xff
mov word [esi + 8], ax
test ax, ax
jne 0x461855
xor al, al
jmp 0x46189a
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x461851
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x461885
mov byte [esi + 1], 1
test bl, 2
je 0x46188e
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x461898
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x46189f
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
pop esi
sub eax, eax
sub ecx, ecx
mov dword [esi + 6], eax
mov al, byte [ebp + 8]
mov dword [esi + 1], ecx
mov byte [esi + 5], cl
mov byte [esi + 0xa], cl
mov byte [esi], al
cmp al, 0xff
jne 0x4618c2
xor al, al
jmp 0x4618d2
push ecx
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x463696
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
pop esi
call fcn.00463595
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
push ebp
pop esp
pop ebp
ret 8