joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1c50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5b6b68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x4d1d2c
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x4d1d2c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4d1d2c
mov esi, dword [edi + 8]
imul esi, dword [edi + 4]
add esi, esi
add esi, esi
cmp word [edi + 0xe], 0x20
mov dword [esp + 0x18], 0
jne 0x4d1da7
mov ecx, dword [esp + 0x40]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edx, [esi + 0x28]
cmp eax, edx
jb 0x4d1da7
lea ecx, [esp + 0x20]
call fcn.00485c33
xor ebp, ebp
push ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x24]
call fcn.0048613d
push 0x34
call fcn.0049bcaa
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x4d1d42
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004861bc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 0x28
push edi
push ebx
call fcn.004c2690
add esp, 0xc
push ebp
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [ebx + 0x14], esi
mov ecx, dword [esp + 0x34]
push ebx
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
test ebp, ebp
je 0x4d1d89
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4d1d89
push esi
add edi, 0x28
push edi
push eax
call fcn.004c2690
add esp, 0xc
mov dword [esp + 0x18], ebp
push ebx
call fcn.0049bb08
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004861bc
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4d3880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b6dd8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4d396d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test eax, eax
jne 0x4d38c5
test ecx, ecx
je 0x4d396d
cmp esi, eax
jne 0x4d38e6
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004849df
push 1
push 1
push 0x21
push edi
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00484dff
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push ecx
push 0xffffffffffffffff
push edx
call fcn.004840f7
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00414450
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
call fcn.004840f7
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004bd4b0
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00484eb4
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x4d3af0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b6e21
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 2
call fcn.004d2fa0
lea eax, [esi + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 1
call fcn.004d16f0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.004d16f0
mov eax, dword [esi + 0x18]
add esi, 8
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.CXTPImageManagerResource::CBitmapDC.0
test eax, eax
je 0x4d3b6c
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, esi
call fcn.004861bc
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4d42a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b6f0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CXTPImageManagerIcon.0
push 1
mov dword [esp + 0x18], 8
call fcn.004d3800
lea ecx, [esi + 0x12c]
mov byte [esp + 0x14], 7
call fcn.004d3e50
lea ecx, [esi + 0x108]
mov byte [esp + 0x14], 6
call fcn.004d3e50
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 5
call fcn.004d3e50
lea ecx, [esi + 0xc0]
mov byte [esp + 0x14], 4
call fcn.004d3e50
lea ecx, [esi + 0x9c]
mov byte [esp + 0x14], 3
call fcn.004d3e50
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 2
call fcn.004d3e50
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 1
call fcn.004d3e50
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.004d3e50
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00482814
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4d6220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5b71b0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov edi, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
push 0xe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4d6353
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d634f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
xor eax, eax
test ebp, ebp
je 0x4d63d2
xor ebx, ebx
cmp ax, word [ebp + 4]
jae 0x4d6334
lea ecx, [esp + 0x18]
call fcn.004d1ec0
mov edx, dword [esp + 0x80]
movzx eax, bx
lea ecx, [eax*8]
sub ecx, eax
movzx esi, byte [ebp + ecx*2 + 6]
movzx edi, byte [ebp + ecx*2 + 7]
lea eax, [ebp + ecx*2]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x68], 0
cmp ecx, esi
jne 0x4d62d4
cmp edx, edi
je 0x4d62dc
test ecx, ecx
jne 0x4d6318
test edx, edx
jne 0x4d6318
movzx edx, word [eax + 0x12]
mov eax, dword [esp + 0x70]
push 0
push edi
push esi
push edx
push eax
lea ecx, [esp + 0x2c]
call fcn.004d3e60
test eax, eax
je 0x4d633e
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push esi
push edx
lea eax, [esp + 0x28]
push eax
call fcn.004d6090
test eax, eax
je 0x4d633e
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.004d3e50
inc ebx
cmp bx, word [ebp + 4]
jb 0x4d6296
mov eax, 1
jmp 0x4d63d2
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.004d3e50
xor eax, eax
jmp 0x4d63d2
lea ecx, [esp + 0x3c]
call fcn.004d1ec0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
push 0
push ecx
push edx
push edi
push esi
lea ecx, [esp + 0x50]
mov dword [esp + 0x7c], 1
call fcn.004d3e60
test eax, eax
jne 0x4d6397
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.004d3e50
xor eax, eax
jmp 0x4d63d2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
push eax
mov eax, dword [esp + 0x7c]
push ecx
push edx
push eax
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebx
call fcn.004d6090
lea ecx, [esp + 0x3c]
mov esi, eax
mov dword [esp + 0x68], 0xffffffff
call fcn.004d3e50
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x18
Function at 0x4d6510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5b7208
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x80]
test edi, edi
je 0x4d654d
mov eax, dword [edi + 4]
test eax, eax
jne 0x4d6554
xor eax, eax
jmp 0x4d66cc
mov esi, dword [esp + 0x88]
test esi, esi
jne 0x4d6581
cmp dword [esp + 0x84], esi
jne 0x4d6581
push eax
call fcn.004840f7
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.004d2c80
mov dword [esp + 0x88], eax
mov esi, eax
cmp dword [esp + 0x8c], 0
jne 0x4d65e1
cmp dword [esp + 0x90], 0
jne 0x4d65e1
test esi, esi
jle 0x4d65e1
mov eax, dword [edi + 4]
lea ecx, [esp + 0x2c]
push ecx
push 0
push eax
call fcn.004840f7
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.00496b32
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x1c]
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], ecx
mov eax, dword [edi + 4]
push eax
call fcn.004840f7
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004d2c80
xor ecx, ecx
cmp eax, esi
sete cl
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test esi, esi
jle 0x4d66c7
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4d6627
cmp dword [esp + 0x14], 0
jne 0x4d6627
cmp dword [eax + ebp*4], 0
je 0x4d66be
mov eax, dword [edi + 4]
push 0
push ebx
push eax
call fcn.004840f7
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004bd4b0
mov esi, eax
test esi, esi
je 0x4d654d
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4d6657
mov edi, dword [eax + ebp*4]
jmp 0x4d6659
mov edi, ebp
push 1
push esi
lea ecx, [esp + 0x54]
call fcn.004d3d50
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x8c], 0
call fcn.004d6090
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.004d3e50
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
inc ebx
inc ebp
cmp ebp, esi
jl 0x4d660b
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0x18
Function at 0x4d67f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b7270
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.004840f7
mov esi, dword [esp + 0x30]
mov edi, dword [eax + 0xc]
push esi
push edi
call fcn.004d13a0
add esp, 8
test eax, eax
je 0x4d68ae
lea ecx, [esp + 0x14]
call fcn.00526570
push 0x5dd90c
push esi
push edi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.005264b0
test eax, eax
jne 0x4d6889
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], vtable.CBitmap.0
call fcn.00407390
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4d6897
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.0048643b
mov dword [esp + 0x14], vtable.CBitmap.0
lea ecx, [esp + 0x14]
jmp 0x4d690e
call fcn.004840f7
mov edi, dword [eax + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], vtable.CBitmap.0
push esi
push edi
mov dword [esp + 0x30], 1
call fcn.004d1450
mov ecx, dword [esp + 0x3c]
add esp, 8
test ecx, ecx
je 0x4d68e2
mov dword [ecx], eax
test eax, eax
je 0x4d68f2
push esi
push edi
call fcn.004d1c50
add esp, 8
jmp 0x4d6902
push 0x40
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CBitmap.0
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.00407390
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4dffe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004de230
mov ecx, eax
jmp fcn.004df5a0

Function at 0x4ed7b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push eax
mov dword [esi], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x4ed730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
test eax, eax
je 0x4ed7fc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret

Function at 0x4ed800
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x4ed885
mov eax, dword [esi + 0x10]
push ebx
push eax
mov dword [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], edi
call ebx
test eax, eax
je 0x4ed873
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, edi
cmp dword [esp + 0x10], 0x103
jne 0x4ed872
mov eax, dword [esi + 8]
inc edi
cmp edi, 0xa
ja 0x4ed869
push 0x64
push eax
call ebp
mov edx, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
test eax, eax
jne 0x4ed840
jmp 0x4ed872
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebp
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4ff470
Capabilities:
Log keystrokes

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x74]
cmp dword [eax + 0x60], 2
jne 0x4ff482
xor eax, eax
pop edi
ret 4
push ebp
mov ebp, dword [esp + 0xc]
lea ecx, [ebp - 0x60]
cmp ecx, 9
ja 0x4ff498
cmp dword [eax + 0x80], 0
je 0x4ff4a5
push 2
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x4ff4ac
pop ebp
xor eax, eax
pop edi
ret 4
mov edx, dword [edi]
mov eax, dword [edx + 0x50]
push ebx
push esi
mov ecx, edi
call eax
mov ebx, eax
push ebx
call fcn.004fd100
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
and esi, ebx
xor ebx, ebx
cmp dword [edi + 0x84], ebx
jle 0x4ff514
push ebx
mov ecx, edi
call fcn.004fd740
mov ebp, eax
cmp dword [ebp + 0xe0], 0
jne 0x4ff50e
mov ecx, dword [edi + 0x74]
test byte [ecx + 0x60], 1
je 0x4ff503
test esi, esi
jne 0x4ff503
push ebp
call fcn.004fd100
add esp, 4
test eax, eax
je 0x4ff503
mov esi, ebp
inc ebx
cmp ebx, dword [edi + 0x84]
jl 0x4ff4d4
jmp 0x4ff510
mov esi, ebp
mov ebp, dword [esp + 0x14]
test esi, esi
je 0x4ff5be
push esi
call fcn.004fd100
add esp, 4
test eax, eax
je 0x4ff5be
mov edx, dword [esi]
mov eax, dword [edx + 0x1f4]
push ebp
mov ecx, esi
call eax
test eax, eax
jne 0x4ff5b2
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
mov ecx, edi
call fcn.004ff1c0
mov ebx, eax
test ebx, ebx
je 0x4ff5be
mov esi, dword [ebx + 0x100]
cmp dword [esi + 0xe0], 0
mov ebp, dword [ebx + 0x80]
jne 0x4ff56e
mov ecx, edi
call fcn.004fdc00
push 1
mov ecx, edi
call fcn.004fdab0
push 1
mov dword [edi + 0x44], 1
mov edx, dword [esi]
mov eax, dword [edx + 0x140]
push 0
push 1
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x148]
push 1
push ebp
mov ecx, esi
call eax
cmp dword [esp + 0x14], 0
jne 0x4ff5b2
mov edx, dword [ebx]
mov eax, dword [edx + 0xa8]
mov ecx, ebx
call eax
pop esi
pop ebx
pop ebp
mov eax, 1
pop edi
ret 4
pop esi
pop ebx
pop ebp
xor eax, eax
pop edi
ret 4

Function at 0x501220
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x5012c1
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
shr eax, 8
push edi
mov edi, dword [esi + 0x34]
cmp al, 2
jne 0x5012bf
test edi, edi
je 0x5012bf
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esi + 4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x501271
mov edx, dword [ebx]
mov eax, dword [edx + 0x24]
mov ecx, ebx
call eax
cmp dword [eax + 0x14], 0
jne 0x501271
mov eax, dword [edi + 0x2c]
jmp 0x501299
mov ecx, dword [esi + 0x34]
cmp dword [ecx + 0x58], 0
mov ecx, dword [esp + 0x1c]
jne 0x501282
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x501297
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x501299
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00501190
cmp ebp, 0x202
je 0x5012b6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5012bf
push 0
mov ecx, ebx
call fcn.00501090
pop edi
pop ebp
pop esi
pop ebx
ret 0xc
Function at 0x504970
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
mov ebp, ecx
call esi
test ax, ax
jl 0x504a7b
push 2
call esi
test ax, ax
jl 0x504a7b
push 4
call esi
test ax, ax
jl 0x504a7b
push ebx
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor edi, edi
cmp dword [ebp + 0x5c], edi
jle 0x504a62
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
test edi, edi
jl 0x504a76
cmp edi, dword [ebp + 0x5c]
jge 0x504a76
mov ecx, dword [ebp + 0x58]
mov esi, dword [ecx + edi*4]
mov edx, dword [esi + 0x20]
push edx
call ebx
test eax, eax
je 0x504a58
mov eax, dword [esi + 0x20]
push eax
call fcn.0047f1b7
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x18], ecx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x1c], edx
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x20], ecx
mov edx, dword [esi + 0x18]
mov dword [esp + 0x24], edx
test byte [esi + 8], 1
lea ecx, [esp + 0x18]
push ecx
je 0x504a1f
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x504a26
mov ecx, eax
call fcn.00485edd
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x504a58
test byte [esi + 8], 1
jne 0x504a6c
lea edx, [esp + 0x10]
push edx
push 0
mov ecx, ebp
call fcn.00503e60
cmp eax, dword [esi + 0x20]
je 0x504a6c
inc edi
cmp edi, dword [ebp + 0x5c]
jl 0x5049c2
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0x18
ret
call fcn.0047b415
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret
Function at 0x505b00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5b969d
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [0x62ece4]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x210]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.004827ec
xor ebx, ebx
lea edi, [esi + 0x98]
mov dword [esi], vtable.CXTPToolTipContext.0
mov dword [esp + 0x218], ebx
mov dword [edi + 4], ebx
mov dword [edi], vtable.CFont.0
lea ebp, [esi + 0xa0]
mov dword [ebp + 4], ebx
mov dword [ebp], vtable.CFont.0
push ebx
mov byte [esp + 0x21c], 2
mov dword [esi + 0x60], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 1
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
sub eax, edx
sar eax, 1
push 0x2c
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x64]
push ebx
push eax
call fcn.0049af70
add esp, 0xc
call fcn.004ecf30
mov ecx, eax
call fcn.004ee180
push ebx
push ebx
push ebx
mov dword [esi + 0x34], eax
or eax, 0xffffffff
push ebx
lea ecx, [esi + 0x44]
push ecx
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x38], 1
mov dword [esi + 0x40], 2
call dword [sym.imp.USER32.dll_SetRect]
push 0x1f4
or eax, 0xffffffff
lea edx, [esp + 0x1c]
push ebx
push edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
call fcn.0049af70
add esp, 0xc
push ebx
lea eax, [esp + 0x1c]
push eax
push 0x1f4
push 0x29
mov dword [esp + 0x28], 0x1f4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [esp + 0x164], 0x190
call fcn.005217f0
mov ecx, eax
call fcn.00521450
mov ebx, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea ecx, [esp + 0x154]
push ecx
mov byte [esp + 0x16f], al
call ebx
push eax
mov ecx, edi
call fcn.0048640f
mov dword [esp + 0x164], 0x2bc
lea edx, [esp + 0x154]
push edx
call ebx
push eax
mov ecx, ebp
call fcn.0048640f
mov eax, esi
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.00499aa8
add esp, 0x208
ret
Function at 0x50a0d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, dword [esi + 0xfc]
call fcn.0050cfc0
mov ebx, eax
mov eax, dword [esi + 0xd0]
cmp eax, 0xffffffff
je 0x50a137
cmp dword [esi + 0x100], 5
jne 0x50a137
cmp dword [esi + 0xf8], 1
jne 0x50a137
test ebx, ebx
je 0x50a114
cmp dword [ebx + 0x80], eax
je 0x50a137
cmp eax, dword [esi + 0xcc]
jne 0x50a12c
mov edx, dword [esi]
mov eax, dword [edx + 0x148]
push 0
push 0xffffffffffffffff
mov ecx, esi
call eax
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.00509840
mov ecx, esi
test ebx, ebx
je 0x50a236
push edi
call fcn.00508420
test eax, eax
jne 0x50a1fd
mov edx, dword [ebx]
mov eax, dword [edx + 0x128]
mov ecx, ebx
call eax
test eax, eax
je 0x50a1fd
push esi
push 0x632980
call fcn.004900e7
add esp, 8
test eax, eax
je 0x50a1fd
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x50a1fd
mov ecx, esi
call fcn.005083f0
mov edi, eax
test edi, edi
je 0x50a1fd
cmp dword [edi + 0x60], 0
je 0x50a1fd
mov ecx, dword [edi + 0x74]
cmp dword [ecx + 0x44], 0
je 0x50a1fd
push 1
mov ecx, edi
call fcn.004fdea0
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.00509840
mov edx, dword [esi]
mov eax, dword [edx + 0x148]
push 0
push 0xffffffffffffffff
mov ecx, esi
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx]
mov edx, dword [edx + 0x100]
push eax
push ecx
mov ecx, ebx
call edx
push 0
mov ecx, edi
call fcn.004fdea0
mov eax, dword [edi]
mov edx, dword [eax + 0x54]
push 0
mov ecx, edi
call edx
mov ecx, edi
call fcn.004fdc00
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, esi
call fcn.00508420
test eax, eax
je 0x50a218
mov eax, dword [ebx]
mov edx, dword [eax + 0x128]
mov ecx, ebx
call edx
test eax, eax
je 0x50a1f7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [ebx]
mov eax, dword [eax + 0xcc]
push ecx
push edx
push 0
mov ecx, ebx
call eax
pop edi
pop esi
pop ebx
ret 0xc
call fcn.0047f111
pop esi
pop ebx
ret 0xc