joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0x573e30
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp edx, 0xfffffffe
push esi
push edi
jne 0x469772
mov ecx, 0x55
mov eax, 0xaa
mov word [esp + 0x18], cx
mov word [esp + 0x1c], cx
mov word [esp + 0x20], cx
mov word [esp + 0x24], cx
push ebx
lea ecx, [esp + 0xc]
mov word [esp + 0x1e], ax
mov word [esp + 0x22], ax
mov word [esp + 0x26], ax
mov word [esp + 0x2a], ax
call fcn.00459fb0
mov dword [esp + 0xc], vtable.CBitmap.0
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x10]
call fcn.00558033
lea ecx, [esp + 0x14]
call fcn.00459fb0
mov dword [esp + 0x14], vtable.CBrush.0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
mov byte [esp + 0x34], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x18]
call fcn.00558033
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005576a3
push 0xf
mov edi, eax
call fcn.00467170
mov ecx, eax
call fcn.00467a00
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x2c]
push 0x14
call fcn.00467170
mov ecx, eax
call fcn.00467a00
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
sub eax, edx
sub ecx, ebx
push 0xf00021
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
mov ecx, esi
call fcn.005576a3
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call fcn.0055808a
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 3
call fcn.0055808a
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x20
mov eax, dword [esp + 0x54]
cmp eax, 2
je 0x469783
test eax, eax
je 0x469783
xor esi, esi
jmp 0x469788
mov esi, 1
test eax, eax
je 0x469799
cmp eax, 1
je 0x469799
mov eax, edx
mov edx, dword [esp + 0x50]
jmp 0x46979d
mov eax, dword [esp + 0x50]
mov ecx, dword [ecx + 0x204]
mov edi, dword [ecx + 0x7c]
test edi, edi
je 0x4697b0
mov ecx, edx
mov edx, eax
mov eax, ecx
xor ecx, ecx
test esi, esi
sete cl
push ecx
push eax
mov eax, dword [esp + 0x40]
push edx
lea edx, [esp + 0x48]
push edx
push eax
call fcn.00440330
mov ecx, eax
call fcn.00440600
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x20
Function at 0x46ce80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x573fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00557e3f
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
add eax, 0x10c
mov dword [esp + 0x38], 0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0043f920
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
push ecx
push 1
push 0x5c0c04
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + 8]
add eax, 3
cmp eax, 0x12
jge 0x46bd9d
mov eax, 0x12
lea ecx, [esp + 0xc]
mov dword [esi + 0x18], eax
call fcn.0043f980
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00557eb1
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
jmp 0x46bd30
Function at 0x472ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00440330
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00441360
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 9
jne 0x472b78
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esi + 0xf8]
jl 0x472b2d
test eax, eax
je 0x472af1
mov eax, dword [eax + 0x14]
inc eax
jmp 0x472af3
xor eax, eax
mov edx, dword [esi + 0xd8]
mov ecx, dword [esi + 0x104]
cmp eax, edx
jl 0x472b1a
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, ecx
jne 0x472b20
xor eax, eax
push eax
mov ecx, esi
call fcn.00472a30
pop edi
pop esi
ret 0xc
test eax, eax
je 0x472b36
mov eax, dword [eax + 0x14]
jmp 0x472b3c
mov eax, dword [esi + 0xd8]
dec eax
test eax, eax
jge 0x472b59
mov eax, dword [esi + 0x104]
test eax, eax
je 0x472b64
dec eax
mov ecx, esi
push eax
call fcn.00472a30
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jne 0x472b6b
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, 0x25
jne 0x472bcd
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x472c91
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x472c91
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
test ecx, ecx
lea eax, [ecx - 1]
jg 0x472baa
lea eax, [edi - 1]
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x472bc0
mov eax, ecx
push eax
mov ecx, esi
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, 0x27
jne 0x472c24
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x472c91
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x472c91
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
dec edi
cmp ecx, edi
jge 0x472bff
lea eax, [ecx + 1]
jmp 0x472c01
xor eax, eax
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x472c17
mov eax, ecx
push eax
mov ecx, esi
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, 0x28
jne 0x472c58
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x472c39
mov eax, dword [eax + 0x14]
inc eax
jmp 0x472c3b
xor eax, eax
mov ecx, dword [esi + 0xd8]
xor edx, edx
cmp eax, ecx
mov ecx, esi
setge dl
dec edx
and edx, eax
push edx
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, 0x26
jne 0x472c83
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x472c6f
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jge 0x472c76
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.00472a30
pop edi
pop esi
ret 0xc
cmp eax, 0x10
je 0x472c91
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
ret 0xc
Function at 0x474e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5744c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, vtable.CRgn.0
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call esi
push eax
lea ecx, [esp + 0x10]
call fcn.00558033
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
push 0xfffffffffffffffc
lea edx, [esp + 0x18]
push 0xfffffffffffffffc
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x14]
push eax
call esi
push eax
lea ecx, [esp + 8]
call fcn.00558033
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.00558033
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
neg eax
mov edx, dword [esp + 0x10]
push 3
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, vtable.CGdiObject.0
mov dword [esp + 4], esi
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.0055808a
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call fcn.0055808a
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x47a900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5748be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00551f8a
xor edi, edi
mov eax, 0xa
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], 0x589d20
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x5859ac
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov dword [esi + 0x80], eax
mov dword [esi], method.COleDropTarget.virtual_0
mov dword [esi + 0x7c], 1
mov dword [edx], ecx
xor eax, eax
push esi
push 4
mov dword [edx + 4], ecx
mov byte [esp + 0x1c], 2
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea ecx, [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx]
call dword [edx + 0xc0]
mov ecx, dword [esi + 0x80]
mov dword [esi + 0x20], eax
push esi
push 2
mov eax, dword [ecx]
call dword [eax + 0xc0]
cmp eax, edi
je 0x47a9cb
lea ecx, [eax - 0x1c]
jmp 0x47a9cd
xor ecx, ecx
mov edx, dword [esi + 0x80]
mov dword [esi + 0x1c], ecx
mov eax, dword [edx + 0x7c]
mov edx, dword [esi + 0x20]
push eax
push 1
push edx
call fcn.00486c00
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x47c940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x574a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x5859ac
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xa
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push edi
mov eax, dword [ecx]
mov dword [esp + 0x3c], edi
call dword [eax + 0xc]
cmp dword [esp + 0x1c], edi
jne 0x47c9c1
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 1
cmp eax, edi
je 0x47cac4
mov eax, dword [eax]
cmp eax, edi
jne 0x47c9b6
jmp 0x47cac4
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x47c9d1
add eax, 0xffffffe4
jmp 0x47c9d3
xor eax, eax
push eax
mov ecx, ebp
call fcn.0047c7c0
cmp eax, edi
mov dword [esp + 0x40], eax
je 0x47caaa
cmp dword [eax + 8], edi
je 0x47caaa
mov ecx, dword [esp + 0x3c]
mov esi, dword [ecx + 0x78]
cmp esi, edi
je 0x47ca41
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x47ca0b
lea ebx, [eax - 0x3c]
jmp 0x47ca0d
xor ebx, ebx
lea ecx, [ebx + 0x3c]
call fcn.004ecba0
cmp eax, edi
je 0x47ca38
add eax, 0xffffffe4
cmp eax, edi
je 0x47ca38
push eax
mov ecx, ebp
call fcn.0047c7c0
cmp eax, edi
je 0x47ca38
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + 8]
je 0x47ca5d
cmp esi, edi
jne 0x47c9fb
mov ebx, 0x5859ac
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 4
cmp eax, edi
je 0x47cac4
mov eax, dword [eax]
cmp eax, edi
jne 0x47ca55
jmp 0x47cac4
lea ecx, [esp + 0x10]
push 2
push ecx
push ebx
mov ecx, ebp
call fcn.0047c8d0
mov dword [esp + 0x10], 0x5859ac
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
cmp eax, edi
je 0x47ca8a
mov eax, dword [eax]
cmp eax, edi
jne 0x47ca84
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.0054cf7e
mov eax, 1
jmp 0x47cadf
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 2
cmp eax, edi
je 0x47cac4
mov eax, dword [eax]
cmp eax, edi
jne 0x47cabe
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.0054cf7e
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x47e770
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x47e7f7
lea edi, [esi + 0xcc]
push 0x11
mov ecx, edi
call fcn.004ecbe0
test eax, eax
jne 0x47e7f7
mov ecx, edi
call fcn.00482c50
mov edi, dword [eax + 0xe8]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call fcn.0047d970
test eax, eax
je 0x47e7c3
add eax, 0x3c
jmp 0x47e7c5
xor eax, eax
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov ecx, edi
call fcn.004749f0
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x48b88a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x575498
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esi + 0xdc]
mov ecx, eax
mov eax, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
je 0x48b8d0
mov eax, ebp
sub eax, edi
jmp 0x48b8d2
sub eax, ebx
sub eax, edx
mov edx, dword [esi + 0x210]
dec eax
test ecx, ecx
je 0x48b8e7
push 0
push eax
push 0
push edx
jmp 0x48b8ed
push eax
push 0
push edx
push 0
lea ecx, [esp + 0x28]
call fcn.005622b6
mov eax, dword [esi + 0x20]
test eax, eax
je 0x48b913
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
mov eax, dword [ecx + 0x144]
test eax, eax
jne 0x48b91b
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48b940
mov eax, dword [esp + 0x4c]
push 0xf
sub eax, ebx
mov ecx, esi
mov ebp, eax
call fcn.00488ed0
mov edx, dword [esp + 0x20]
push eax
add edx, 2
push ebp
push edx
jmp 0x48b955
push 0xf
mov ecx, esi
sub ebp, edi
call fcn.00488ed0
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push ebp
push ebx
push edi
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.00562098
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x48b96f
lea ebx, [ecx + 0x3c]
jmp 0x48b971
xor ebx, ebx
lea edx, [esp + 0x3c]
push edx
call fcn.00483f80
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x3c], 0
sub esp, 0x10
mov eax, esp
push ebx
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.00552728
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18

Function at 0x493710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x575d73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00551f8a
xor edi, edi
mov dword [esi + 0x20], 0x58b8b8
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov ecx, esi
mov byte [esp + 0x14], 1
mov dword [esi], 0x58bcb0
call fcn.0056b168
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49a8d6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x575fae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
xor eax, eax
mov dword [esi + 8], 0x58c410
mov dword [esp + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], 0x58c404
push 1
mov byte [esp + 0x14], 2
mov dword [esi], 0x58c400
mov dword [esi + 0x1c], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x40], eax
call fcn.0049afc0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x49b830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x576097
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x5d2724]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov esi, dword [esp + 0x34]
mov ebx, 1
mov dword [esp + 0x28], ebx
fld qword [esi]
call fcn.00533404
test eax, eax
jne 0x49b8a0
lea ecx, [esp + 0x34]
push str._H:_M:_S
push ecx
mov ecx, esi
call fcn.0052aeb2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call fcn.00552861
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x49b921
mov edx, dword [esi]
mov eax, dword [esi + 4]
fld qword [esi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.00533404
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
fcomp qword [esp + 0x18]
fnstsw ax
test ah, 0x40
je 0x49b8f9
lea ecx, [esp + 0x34]
push str._Y__d__m
push ecx
mov ecx, esi
call fcn.0052aeb2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00552861
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x49b921
lea edx, [esp + 0x34]
push str._Y__d__mT_H:_M:_S
push edx
mov ecx, esi
call fcn.0052aeb2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.00552861
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
call fcn.00552728
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0055249d
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.00552728
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x49e4a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x576333
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x58c674
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x10], 1
test eax, eax
jne 0x49e4ea
mov eax, dword [esi + 0x44]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x49e4ea
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x49e4ea
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 0x44]
call fcn.00552728
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0
call fcn.00552728
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0049bba0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x49f050
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x60]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x49f0ff
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 0x34]
shr eax, 8
cmp al, 2
jne 0x49f0ff
test edi, edi
je 0x49f0ff
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ebx
lea ecx, [esi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x49f0ab
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x49f0ab
mov eax, dword [edi + 0x2c]
jmp 0x49f0d0
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x58]
test ecx, ecx
mov ecx, ebx
jne 0x49f0b9
mov ecx, ebp
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x49f0ce
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x49f0d0
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0049ef80
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x49f0f6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x49f0ff
push 0
mov ecx, esi
call fcn.0049ef00
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x4a5310
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebx, 0x112
push edi
mov esi, ecx
ja 0x4a545f
cmp ebx, 0x112
je 0x4a53bb
mov eax, ebx
sub eax, 2
je 0x4a5384
sub eax, 3
je 0x4a5347
sub eax, 0x42
jne 0x4a5365
cmp ebp, dword [esi + 0x124]
jne 0x4a5365
mov eax, dword [esi - 0x20]
push 0
push 0x2fbf
push 0x113
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push ebp
mov ecx, esi
call fcn.0043cf10
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esi + 0x128]
test eax, eax
je 0x4a5365
lea ecx, [esi - 0x3c]
call fcn.0043dc50
test eax, eax
je 0x4a539d
mov eax, dword [eax + 0x1c]
cmp ebp, eax
jne 0x4a5365
mov ecx, dword [esi + 0x128]
push ecx
push ebp
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x128], 0
jmp 0x4a5365
lea edi, [esi - 0x3c]
mov ecx, edi
call fcn.004a79b0
test eax, eax
je 0x4a5365
push 0x435fd0
mov ecx, 0x5da48c
call fcn.00567d84
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x4a5365
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4a5365
mov ecx, edi
call fcn.0043dd70
test eax, eax
jne 0x4a5365
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x4a5365
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
jne 0x4a5365
mov edx, dword [edi]
push 0x12
mov ecx, edi
call dword [edx + 0x170]
test eax, eax
je 0x4a543e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
mov ecx, edi
call fcn.0043dd40
test eax, eax
je 0x4a5453
push 0
push edi
mov ecx, eax
call fcn.0043ab50
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
cmp ebx, 0x220
jb 0x4a5365
cmp ebx, 0x222
jbe 0x4a534f
cmp ebx, 0x230
jne 0x4a5365
mov eax, dword [esi - 0x3c]
lea edi, [esi - 0x3c]
mov ecx, edi
call dword [eax + 0xdc]
test eax, eax
mov ecx, edi
je 0x4a5523
call fcn.0043dd70
test eax, eax
je 0x4a54cd
mov ecx, edi
call fcn.0043dc50
mov ecx, dword [eax + 0x1c]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [edx], 0
mov eax, 1
pop ebx
ret 0x14
mov eax, dword [esi + 0x58]
mov ebx, dword [esp + 0x1c]
test ah, 4
jne 0x4a54f7
mov eax, dword [ebx]
test eax, eax
jne 0x4a54ef
mov ecx, dword [esi + 0x128]
test ecx, ecx
je 0x4a54f7
test eax, eax
jne 0x4a54ef
mov eax, ecx
push eax
mov ecx, edi
call fcn.004a52b0
mov ecx, edi
call fcn.0043dc50
mov eax, dword [eax + 0x1c]
push 0
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov ecx, edi
call fcn.004a43e0
pop edi
pop esi
mov dword [ebx], 0
pop ebp
mov eax, 1
pop ebx
ret 0x14
call fcn.0043dc50
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.00553a10
test eax, eax
jne 0x4a5365
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov eax, 1
pop ebx
ret 0x14