joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3004ff4c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x3004ffe5
cmp dword [ebp + 0x14], ebx
jne 0x3004ff81
push ebx
push ebx
push 0x140
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x3004ffe5
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call fcn.3004fa00
imul eax, eax, 0xc
mov ecx, dword [esi]
lea esi, [eax + ecx + 0x2e]
push dword [esi + 4]
push ebx
call fcn.30079b24
add esp, 0x10
cmp edi, ebx
jg 0x3004ffb6
mov dword [esi + 4], ebx
jmp 0x3004ffe4
inc edi
push edi
push ebx
call fcn.30079b76
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 4], eax
je 0x3004ffd5
push edi
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x3004ffe4
push dword [0x30093164]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x30051405
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push dword [ebp + 0xc]
push 0x3e9
push dword [ebp + 8]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push dword [ebp + 0xc]
push 0x3ea
push dword [ebp + 8]
call esi
push eax
call edi
push dword [ebp + 0x10]
push 0
push 0x470
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
ret

Function at 0x30053e3c
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x30095244]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, 0x4019
push esi
mov dword [ebp + 0x98], eax
call fcn.30056e7d
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
pop ecx
push ebx
push ebx
push 0x18b
push dword [ebp + 0xa4]
call edi
cmp eax, ebx
mov dword [ebp - 0x80], eax
je 0x30053f1c
push esi
call fcn.30056ed8
cmp eax, ebx
pop ecx
mov dword [ebp - 0x7c], eax
je 0x30053f1c
xor esi, esi
cmp dword [ebp - 0x80], ebx
mov dword [ebp - 0x78], ebx
jle 0x30053f13
lea eax, [ebp - 0x74]
push eax
push esi
push 0x189
push dword [ebp + 0xa4]
call edi
test eax, eax
jl 0x30053f0d
push ebx
push esi
push 0x199
push dword [ebp + 0xa4]
call edi
test eax, eax
je 0x30053f0d
push 0xa
push 0xc
lea eax, [ebp + 0x8c]
push eax
push dword [ebp - 0x78]
call fcn.30057371
lea eax, [ebp - 0x74]
add esp, 0x10
inc dword [ebp - 0x78]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x30053eec
sub eax, edx
push eax
lea eax, [ebp - 0x74]
push eax
push 1
push ebx
lea eax, [ebp + 0x8c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc esi
cmp esi, dword [ebp - 0x80]
jl 0x30053ea4
push dword [ebp - 0x7c]
call fcn.30056f10
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
pop ebx
call fcn.300843e7
add ebp, 0x9c
leave
ret
Function at 0x30054269
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x30095244]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push dword [esi + 4]
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x248]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x14
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x300542e4
push dword [esi + 8]
lea eax, [ebp - 0x118]
push dword [ebp + 8]
push eax
push dword [esi]
call fcn.3005402c
add esp, 0x10
lea eax, [ebp - 0x144]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x300542b4
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.300843e7
leave
ret
Function at 0x30055539
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, 0x100
cmp dword [ebp + 0xc], eax
push edi
mov edi, dword [ebp + 0x14]
jne 0x30055657
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jge 0x300555ec
cmp ebx, 0x21
je 0x3005557c
push 0x10
call esi
test ax, ax
jge 0x300555ec
cmp ebx, 9
jne 0x300555ec
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, 0xbc2
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
push 0x130b
push eax
mov dword [ebp + 0xc], eax
call edi
cmp eax, ebx
jg 0x300555ba
push ebx
push ebx
push 0x1304
push dword [ebp + 0xc]
call edi
dec eax
push ebx
mov ebx, dword [ebp + 0xc]
push eax
push 0x130c
push ebx
call edi
test eax, eax
jl 0x300555e5
lea eax, [ebp - 0x14]
push eax
push esi
push 0x4e
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0xfffffdd9
call edi
xor eax, eax
jmp 0x300556a3
push 0x11
call esi
test ax, ax
jge 0x30055692
cmp ebx, 0x22
je 0x30055607
cmp ebx, 9
jne 0x30055692
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, 0xbc2
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
push 0x130b
push eax
mov dword [ebp + 0xc], eax
call edi
push ebx
push ebx
push 0x1304
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call edi
dec eax
cmp dword [ebp - 4], eax
jl 0x3005564e
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
inc eax
jmp 0x300555bb
mov esi, 0x87
cmp dword [ebp + 0xc], esi
jne 0x30055692
test edi, edi
je 0x30055692
cmp dword [edi + 4], eax
jne 0x30055692
cmp dword [edi + 8], 9
jne 0x30055692
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x30055692
push edi
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CallWindowProcA]
or al, 4
jmp 0x300556a3
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CallWindowProcA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3005739d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 0x8000
jmp 0x300573d2
push esi
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x300573ea
mov eax, dword [ebp + 0xc]
cmp eax, esi
jne 0x300573f2
sub dword [ebp + 0x10], esi
add ebx, esi
add dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
lea eax, [ebp + 0xc]
push 0
push eax
ja 0x300573b8
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
jne 0x300573ef
or eax, 0xffffffff
jmp 0x300573f7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x300573fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, 0x8000
cmp eax, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
jbe 0x3005743b
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x3005745b
cmp dword [ebp + 0xc], esi
jne 0x3005745b
sub dword [ebp + 0x10], esi
add ebx, esi
cmp dword [ebp + 0x10], esi
ja 0x3005741b
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x3005745b
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0xc], eax
jne 0x3005745b
mov eax, dword [ebp - 4]
jmp 0x3005745e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x3005747f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x30057496
test al, 0x10
jne 0x30057496
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x30066eb2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 0xc]
push edi
lea esi, [ebx + 0x28]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x10]
movsd dword es:[edi], dword [esi]
mov dword [eax], 1
push ebx
mov dword [ebp - 4], eax
mov dword [ebx + 0x44], 0x1a
call fcn.30064679
pop ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0
je 0x30066f1a
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 8]
shl eax, 0x10
or eax, ecx
mov dword [ebp - 0x34], 0x202
xor esi, esi
jmp 0x30066f4b
push 3
push 0x209
push 0x100
xor esi, esi
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x30066f4e
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 8]
shl eax, 0x10
mov dword [ebp - 0x34], 0x200
or eax, ecx
mov dword [ebp - 0x2c], eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
mov eax, dword [ebp - 0x34]
js 0x30066f64
cmp eax, 0x202
jne 0x30066f6f
sub eax, 0x200
je 0x30066f93
dec eax
dec eax
jne 0x30066ef9
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 4]
cmp dword [eax], esi
je 0x30066fee
mov ecx, dword [ebx + 8]
cmp byte [ecx + 4], 1
je 0x30066fdf
cmp dword [ebp + 0x14], esi
jne 0x30066fdf
cmp dword [ebp + 0x10], esi
je 0x30066fdf
xor ecx, ecx
jmp 0x30066fe2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
sub esp, 0x10
mov edi, esp
push dword [ebp - 0x2c]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
movsd dword es:[edi], dword [esi]
call fcn.3007f13a
pop ecx
push edx
push eax
call fcn.30065e65
mov ecx, dword [ebp - 4]
add esp, 0x18
cmp dword [ebp - 0xc], eax
mov dword [ecx], eax
je 0x30066fcb
push ebx
call fcn.30064679
pop ecx
push dword [ebp - 0x2c]
call fcn.3007f13a
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
jmp 0x30066ef9
or ecx, 0xffffffff
mov dword [eax], esi
push ecx
mov esi, ebx
call fcn.300661de
jmp 0x30066ff4
push ebx
call fcn.30064679
pop ecx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x3006708f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
or dword [ebp - 8], 0xffffffff
push esi
mov esi, eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [esi + 0x44]
and edi, 0x4000
or edi, 0x1a
mov dword [esi + 0x44], edi
mov edi, dword [esi + 8]
xor edx, edx
cmp byte [edi + 4], 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
jne 0x300670d6
cmp dword [ebp + 0xc], edx
jne 0x300670d6
cmp dword [ebp + 8], edx
je 0x300670d6
mov dword [ebp - 8], edx
cmp dword [esi + 0x50], 0xd
je 0x300671c5
cmp byte [ecx + 1], 0
je 0x300670ef
cmp byte [ecx], 0
je 0x300671c5
xor edi, edi
push ebx
inc edi
push esi
mov dword [eax], edi
call fcn.30064679
pop ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetCapture]
mov ebx, dword [sym.imp.USER32.dll_GetFocus]
push 3
push 0x209
push 0x100
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x30067114
mov eax, dword [ebp - 0x2c]
sub eax, 0x100
je 0x30067148
dec eax
jne 0x300671a0
cmp dword [ebp - 0x28], 0x20
jne 0x300671a0
mov dword [ebp - 4], edi
jmp 0x300671a0
cmp dword [ebp - 0x28], 0x20
jne 0x3006718e
cmp word [ebp - 0x24], 0
je 0x3006718e
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x300671a0
push esi
call fcn.3006459c
test eax, eax
pop ecx
je 0x300671a0
call ebx
push dword [ebp - 8]
mov edi, eax
push esi
call fcn.30064f8a
pop ecx
pop ecx
call ebx
cmp eax, edi
jne 0x300671aa
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x300671aa
xor edi, edi
inc edi
jmp 0x300671a0
cmp dword [ebp - 0x28], 0xd
mov dword [ebp - 4], edi
je 0x300671aa
cmp dword [ebp - 0x28], 0x20
je 0x300671aa
mov dword [ebp - 0xc], edi
cmp dword [ebp - 4], 0
je 0x30067114
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 0x14]
and dword [eax], 0
cmp dword [ebp - 0xc], 0
pop ebx
je 0x300671c5
push esi
call fcn.30064679
jmp 0x300671cd
push dword [ebp - 8]
call fcn.300661de
and dword [esi + 0x44], 0x4000
pop ecx
pop edi
pop esi
leave
ret
Function at 0x3006fae2
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
xor ebx, ebx
push edi
push esi
mov dword [ebp - 4], ebx
call fcn.3006f7de
add esp, 0x10
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
jne 0x3006fbdd
cmp edi, dword [esi + 0x8c]
jne 0x3006fbb6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 2
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x3006fba4
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
push edi
mov ebx, eax
call esi
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x3006fb6b
test eax, eax
je 0x3006fb6b
push dword [ebp - 0xc]
push eax
push ebx
call fcn.3007e223
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax + 0x88], edi
jmp 0x3006fb7d
push 0x50000
mov dword [ebp - 4], 0x401
call fcn.30006571
pop ecx
test ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
je 0x3006fb8c
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 0
je 0x3006fbb6
push edi
call esi
cmp dword [ebp - 4], 0
je 0x3006fbb6
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x3006fbb6
push 0x50000
mov dword [ebp - 4], 0x401
call fcn.30006571
pop ecx
push dword [ebp - 8]
call fcn.3007ad53
mov esi, eax
push esi
call fcn.30079a01
push esi
call fcn.3007ad33
add esp, 0xc
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x3006fbe9
cmp dword [ebp - 4], 0x508
jne 0x3006fbe9
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3006fed5
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x30095244]
and dword [ebp - 0x30], 0
test word [ebp + 0xc], 0x1008
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
push 2
mov dword [ebp - 4], eax
pop esi
je 0x3006ff3a
push 0x28
lea eax, [ebp - 0x2c]
push eax
push 0x120009
call fcn.30056fa1
push 1
call fcn.3006f997
test eax, eax
pop ecx
je 0x3006ffd8
push dword [0x30096528]
call ebx
test eax, eax
jne 0x3006ff35
push dword [0x30096530]
call ebx
and byte [0x30096579], 0xdf
call fcn.3006f9ce
push 1
call fcn.3006f997
test eax, eax
pop ecx
je 0x3006ffd8
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x300966a4
call fcn.3006f7f6
add esp, 0xc
test eax, eax
je 0x3006ffd3
test byte [ebp + 0xc], 4
push edi
je 0x3006ff70
mov edi, dword [0x30096730]
jmp 0x3006ff92
test byte [ebp + 0xc], 8
je 0x3006ff8c
mov eax, dword [0x30096740]
cmp eax, dword [0x3009652c]
je 0x3006ff88
mov eax, dword [0x30096530]
mov edi, eax
jmp 0x3006ff92
mov edi, dword [0x300967bc]
push edi
call ebx
test eax, eax
jne 0x3006ffa6
push 0x80006
call fcn.30006571
pop ecx
jmp 0x3006ffd2
lea ecx, [ebp - 0x30]
push ecx
push eax
push edi
push 0x300966a4
call fcn.3006fd03
add esp, 0x10
test eax, eax
je 0x3006ffc2
xor esi, esi
inc esi
jmp 0x3006ffd2
mov esi, dword [ebp - 0x30]
sub esi, 0x404
neg esi
sbb esi, esi
and esi, 2
pop edi
call fcn.3006f9ce
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.300843e7
leave
ret
Function at 0x300705b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x300952a4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [0x300952a4], eax
call sub.MSVCRT.dll__setjmp3
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
jne 0x30070699
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
jne 0x3007060b
call fcn.30006657
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jne 0x30070622
call fcn.30006657
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x30070638
call fcn.30006657
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 4]
push dword [ebp - 4]
add edi, dword [eax]
add ebx, 0x28
call fcn.300700a4
add ebx, eax
pop ecx
mov eax, 0xff00
jmp 0x3007065f
cmp edi, ebx
jae 0x30070663
add edi, 4
cmp dword [edi], eax
jne 0x30070658
push esi
push esi
call fcn.30079671
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
pop ecx
jne 0x30070679
call fcn.30006657
push esi
push dword [ebp - 4]
push ebx
push 4
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jne 0x30070699
call fcn.30006657
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 4], esi
mov dword [0x300952a4], eax
je 0x300706a9
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], esi
je 0x300706b7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0xc], esi
je 0x300706ca
push 2
push dword [ebp - 0xc]
push esi
call fcn.300796c2
add esp, 0xc
cmp dword [ebp - 0x10], esi
jne 0x300706d7
push dword [ebp - 0x18]
call section.ERROR_TE
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x30075fe7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x30096b88]
or dword [eax + 0x48], 0xffffffff
mov eax, dword [0x30096b88]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax]
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push ebx
call fcn.300738cd
mov eax, dword [ebp - 4]
add esp, 0x10
cmp dword [ebp + 0x14], 0
mov dword [ebp - 8], eax
je 0x30076035
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.300736c4
pop ecx
pop ecx
test byte [ebp + 0x10], 4
jne 0x30076054
mov eax, dword [0x30096e7c]
cmp dword [eax + 0xee], 0
jne 0x30076054
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [ebp + 0x10], eax
jmp 0x3007606a
call fcn.30072332
mov ecx, dword [0x30096b88]
mov edi, dword [ecx + 0x5c]
add edi, dword [ecx + 0x58]
sub edi, eax
mov dword [ebp + 0x10], edi
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [ebp + 0x10]
call fcn.300755eb
push esi
call fcn.3007e68f
add esp, 0x18
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x300760ee
push esi
call dword [sym.imp.USER32.dll_SetCapture]
push 3
push 0x209
push 0x100
push esi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x300760c7
movzx eax, word [ebp + 0xc]
movzx ecx, bx
shl eax, 0x10
or eax, ecx
mov dword [ebp - 0x28], 0x200
mov dword [ebp - 0x20], eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
mov eax, dword [ebp - 0x28]
js 0x300760dd
cmp eax, 0x202
jne 0x300760e8
sub eax, 0x200
je 0x300760f3
dec eax
dec eax
jne 0x30076096
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x20]
movzx ebx, ax
shr eax, 0x10
mov dword [ebp + 0xc], eax
mov eax, dword [0x30096b88]
mov esi, dword [eax + 0xac]
sub esi, dword [ebp + 0xc]
test esi, esi
jle 0x30076115
push 0xffffffffffffffff
jmp 0x30076122
mov esi, dword [ebp + 0xc]
sub esi, dword [eax + 0xb4]
js 0x30076145
push 1
call fcn.300745a1
pop ecx
push 0
push 2
call fcn.30073de6
mov eax, dword [0x30096b88]
cmp esi, dword [eax + 0x10]
pop ecx
pop ecx
jg 0x30076145
push 0x64
call fcn.30071902
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.300738cd
mov eax, dword [ebp - 4]
add esp, 0x10
cmp dword [ebp + 0x14], 0
mov dword [ebp - 8], eax
je 0x30076174
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.300736c4
pop ecx
pop ecx
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [ebp + 0x10]
call fcn.300755eb
mov esi, dword [ebp - 0x10]
add esp, 0x14
jmp 0x30076096
Function at 0x3007a0c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x30096b0c], ebx
push edi
je 0x3007a2e9
cmp byte [0x30096b4a], bl
jne 0x3007a2e9
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [0x30096b14]
jne 0x3007a2dc
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x3007a2dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.30079d37
cmp byte [0x30096b39], bl
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
jne 0x3007a168
test byte [0x30096b10], 4
je 0x3007a23a
sub eax, dword [0x30096b4b]
mov ecx, dword [0x30096b00]
sub edx, dword [0x30096b4f]
cmp eax, ecx
jg 0x3007a161
neg ecx
cmp eax, ecx
jl 0x3007a161
mov eax, dword [0x30096b04]
cmp edx, eax
jg 0x3007a161
neg eax
cmp edx, eax
jge 0x3007a252
mov byte [0x30096b39], 1
push esi
push 1
call fcn.30079daf
mov al, byte [0x30096b10]
test al, 0x20
mov edi, dword [ebp + 0xc]
mov edx, dword [0x30096b10]
pop ecx
mov esi, 0x200
je 0x3007a1c0
test esi, edx
je 0x3007a27c
cmp byte [0x30096b7c], bl
je 0x3007a25d
cmp edi, dword [0x30096b28]
jl 0x3007a288
mov ecx, dword [0x30096b53]
mov byte [0x30096b7c], bl
mov dword [0x30096b20], ecx
mov dword [0x30096b28], edi
test al, 0x40
mov ecx, dword [ebp + 0x10]
je 0x3007a1fd
test esi, edx
je 0x3007a2b0
cmp byte [0x30096b7d], bl
je 0x3007a293
cmp ecx, dword [0x30096b2c]
jl 0x3007a2bc
mov eax, dword [0x30096b57]
mov byte [0x30096b7d], bl
mov dword [0x30096b24], eax
mov dword [0x30096b2c], ecx
mov eax, dword [0x30096b08]
mov eax, dword [eax + 4]
cmp eax, ebx
pop esi
je 0x3007a219
lea ecx, [ebp + 0xc]
push ebx
push ecx
call eax
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
cmp dword [0x30096b0c], ebx
je 0x3007a2c7
push ecx
push edi
call fcn.30079fcd
push ebx
call fcn.30079daf
add esp, 0xc
jmp 0x3007a2e9
cmp eax, dword [0x30096b4b]
jne 0x3007a161
cmp edx, dword [0x30096b4f]
jne 0x3007a161
mov byte [0x30096b39], bl
jmp 0x3007a2e9
cmp edi, dword [0x30096b20]
jg 0x3007a1ba
mov ecx, dword [0x30096b5b]
mov byte [0x30096b7c], 1
mov dword [0x30096b28], ecx
cmp byte [0x30096b7c], bl
je 0x3007a1ba
mov dword [0x30096b20], edi
jmp 0x3007a1c0
cmp ecx, dword [0x30096b24]
jg 0x3007a1f7
mov eax, dword [0x30096b5f]
mov byte [0x30096b7d], 1
mov dword [0x30096b2c], eax
cmp byte [0x30096b7d], bl
je 0x3007a1f7
mov dword [0x30096b24], ecx
jmp 0x3007a1fd
call dword [sym.imp.USER32.dll_ReleaseCapture]
push ebx
push dword [0x30096b14]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x3007a2e9
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call fcn.30079f67
pop ecx
pop edi
pop ebx
leave
ret