joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449953
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor eax, eax
push esi
mov esi, dword [eax + 0x517248]
mov edx, dword [edi]
mov dword [eax + edx], esi
add eax, 4
cmp eax, 0x48
jl 0x44995f
xor eax, eax
mov edx, 0x100
mov ebx, dword [eax + 0x517290]
mov esi, dword [edi + 4]
mov dword [eax + esi], ebx
add eax, 4
dec edx
jne 0x449979
cmp eax, 0x1000
jl 0x449974
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
mov edx, dword [ebp - 4]
add edx, eax
mov dword [ebp - 8], edx
push 0xc
lea eax, [esi + 1]
cdq
pop ebx
idiv ebx
lea eax, [esi + 2]
push 0xc
add dword [ebp - 4], 4
movzx ebx, byte [edx + ecx]
mov bh, byte [esi + ecx]
cdq
pop ecx
idiv ecx
mov eax, dword [ebp + 8]
shl ebx, 8
push 0xc
movzx eax, byte [edx + eax]
or ebx, eax
lea eax, [esi + 3]
cdq
idiv ecx
mov ecx, dword [ebp + 8]
shl ebx, 8
movzx eax, byte [edx + ecx]
or ebx, eax
mov eax, dword [ebp - 8]
xor dword [eax], ebx
lea eax, [esi + 4]
cdq
pop esi
idiv esi
cmp dword [ebp - 4], 0x48
mov esi, edx
jl 0x449997
and dword [ebp + 8], 0
and dword [ebp - 4], 0
xor esi, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.00449281
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [esi + eax], ecx
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
mov dword [esi + eax + 4], ecx
add esi, 8
cmp esi, 0x48
jl 0x4499fc
xor esi, esi
mov ebx, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.00449281
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 8]
mov dword [esi + eax], ecx
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
mov dword [esi + eax + 4], ecx
add esi, 8
dec ebx
jne 0x449a2a
cmp esi, 0x1000
jl 0x449a25
pop esi
pop ebx
leave
ret 4
Function at 0x44dddf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e2c32
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x515854]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x515854]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], eax
call fcn.0043bf95
mov ecx, dword [ebx + 0xc]
push 8
pop edi
cmp ecx, edi
jae 0x44de3c
xor al, al
jmp 0x44defc
mov eax, dword [ebx + 8]
mov edx, dword [eax]
test edx, edx
mov eax, dword [eax + 4]
mov dword [esp + 0x18], edx
je 0x44de57
test eax, eax
je 0x44de57
add ecx, 0xfffffff8
cmp ecx, eax
jb 0x44de35
mov eax, dword [ebx + 8]
and dword [esp + 0x10], 0
test edx, edx
mov dword [esp + 0x1c], eax
jbe 0x44defa
mov edx, 0x4ec52c
lea eax, [esp + 0x20]
call fcn.004074b0
and dword [esp + 0x98], 0
lea eax, [esp + 0x20]
push eax
push Ordinal_4
lea eax, [esp + 0x44]
push eax
call fcn.0044b7d4
lea esi, [esp + 0x20]
mov byte [esp + 0x98], 2
call fcn.00401650
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi + ecx]
mov edx, dword [ebx + 0xc]
add edi, 4
lea esi, [eax + edi]
cmp esi, edx
ja 0x44df1d
add edi, ecx
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.0044bcfc
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x18]
mov edi, esi
call fcn.0043e08c
or dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0044b838
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jb 0x44de6b
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004b6e9f
mov esp, ebp
pop ebp
ret
or dword [esp + 0x98], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0044b838
jmp 0x44de35
Function at 0x44df33
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e1b0a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x515854]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
push 8
pop ebx
cmp eax, ebx
jae 0x44df72
mov edi, ebx
call fcn.00401140
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
cmp eax, ebx
jb 0x44df8e
mov eax, ebx
mov dword [esi + 0xc], eax
cmp dword [edi + 0x10], ecx
mov dword [esp + 0x14], ecx
jbe 0x44e04b
push dword [esp + 0x14]
mov eax, edi
call fcn.0043b9ae
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.0044bb21
and dword [esp + 0x38], 0
mov ecx, dword [esi + 4]
mov ebx, dword [esp + 0x28]
mov edx, dword [esi + 0xc]
mov eax, ecx
add ebx, 4
sub eax, edx
cmp eax, ebx
jae 0x44dffd
test ecx, ecx
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
lea edi, [ecx + ebx*4]
jge 0x44dfe4
fadd qword [0x4feeb0]
fmul qword [0x4fef18]
call fcn.004d90a6
cmp eax, edi
jbe 0x44dff5
mov edi, eax
call fcn.00401140
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
add eax, ecx
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
push dword [esp + 0x28]
add eax, 4
push dword [esp + 0x28]
push eax
call fcn.004b9fe0
mov eax, dword [esi + 0xc]
add esp, 0xc
lea edx, [eax + ebx]
mov ecx, esi
call fcn.00401190
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004010a0
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [edi + 0x10]
jb 0x44df9e
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
sub eax, 8
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44eb0b
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [eax]
test eax, eax
push ebx
push edi
jne 0x44eb20
or eax, 0xffffffff
jmp 0x44ebad
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x44eb18
mov eax, dword [ebp - 4]
add dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
cmp ecx, dword [esi + 4]
je 0x44ebaa
mov ebx, ecx
sub ebx, dword [esi + 0x18]
cmp ebx, 0x3e8
jbe 0x44eb7e
mov edi, dword [esi + 0xc]
mov eax, edi
sub eax, dword [esi + 0x1c]
xor edx, edx
div ebx
test eax, eax
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jge 0x44eb75
fadd qword [0x4feeb0]
fstp qword [esi + 0x10]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0xc]
fild dword [esi + 0xc]
test eax, eax
jge 0x44eb8e
fadd qword [0x4feeb0]
mov eax, ecx
sub eax, dword [esi]
test eax, eax
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jge 0x44eba2
fadd qword [0x4feeb0]
fdivp st(1)
mov dword [esi + 4], ecx
fstp qword [esi + 0x20]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8

Function at 0x44fdf3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x515854]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x114
push esi
xor ebx, ebx
lea eax, [ebp - 0x120]
push ebx
push eax
mov edi, ecx
call fcn.004b9920
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, edi
xor esi, esi
call fcn.00478f82
test eax, eax
jbe 0x44fe5c
call fcn.00478f95
push dword [eax]
call fcn.004b6eae
pop ecx
mov eax, edi
inc esi
call fcn.00478f82
cmp esi, eax
jb 0x44fe43
mov esi, edi
call fcn.0044feb0
cmp dword [ebp - 0x110], 2
jne 0x44fe80
push edi
call fcn.0044f8df
push edi
call fcn.0044fbde
push edi
call fcn.0044f795
jmp 0x44fe94
xor esi, esi
test ebx, ebx
jne 0x44fe94
push edi
call fcn.0044fa41
inc esi
cmp esi, 0xa
mov ebx, eax
jl 0x44fe82
mov eax, edi
call fcn.00478f82
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.004b6e9f
leave
ret
Function at 0x450888
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, eax
jne 0x4508ad
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.00451ca3
xor al, al
jmp 0x450952
call fcn.004502c7
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push esi
call fcn.004b9571
push esi
call fcn.004bdbca
push ebx
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.004b9571
mov eax, dword [ebp - 4]
add esp, 0x1c
cmp eax, ebx
jg 0x4508e4
push ebx
push ebx
push 0xc
jmp 0x45089e
inc eax
push eax
call fcn.004b6eb3
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
mov byte [esi], bl
push esi
call fcn.004bce92
add esp, 0x14
cmp eax, 1
je 0x45090e
push esi
call fcn.004b6eae
pop ecx
jmp 0x45089a
mov edx, dword [ebp - 4]
mov byte [esi + edx], bl
cmp byte [esi], bl
mov ecx, esi
mov eax, esi
je 0x450937
mov dl, byte [ecx]
cmp dl, 0xd
jne 0x45092f
mov byte [eax], 0xa
inc eax
inc ecx
cmp byte [ecx], 0xa
jne 0x450933
jmp 0x450932
mov byte [eax], dl
inc eax
inc ecx
cmp byte [ecx], bl
jne 0x45091c
push ebx
push ebx
mov byte [eax], bl
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 8]
push esi
call fcn.004b6eae
xor eax, eax
cmp byte [edi + 0x2c], bl
pop ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x45a41e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, 0x100
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.0045a398
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
pop ecx
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x45a42f
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x45a470
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [esp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [esp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x45a479
pop esi
ret

Function at 0x45a4ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x100
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x45a4bc
pop edi
pop esi
pop ebp
ret

Function at 0x45a5b4
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x45a5f4
push ebx
push edi
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx edi, word [edi + edx*2]
shr dword [esp + 0x14], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [esp + 0x18]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x45a5c2
pop edi
pop ebx
pop esi
ret
Function at 0x45bf25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea ecx, [esi + 0x19c]
push ebx
xor ebx, ebx
mov dword [esi + 0x3bcd4], ebx
mov dword [esi + 0x3bcd0], ebx
push edi
mov dword [ecx + 0x30], ebx
mov dword [ecx + 0x4c], ebx
mov dword [ecx + 0x20], ebx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], ebx
mov dword [ebp - 4], ebx
lea eax, [ecx + 0x70]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], 8
mov edi, edx
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr edx, 1
xor edx, edi
dec dword [ebp - 8]
jne 0x45bf72
inc dword [ebp - 4]
mov dword [eax], edx
add eax, 4
cmp dword [ebp - 4], 0x100
jb 0x45bf68
mov dword [esi + 0x118], ebx
lea eax, [esi + 0x148]
mov dword [eax], ebx
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea eax, [ebp - 0x38]
mov dword [esi + 0x198], ecx
call fcn.0045a089
push esi
call fcn.0045a18c
pop ecx
push 2
pop eax
mov dword [ebp - 8], eax
mov byte [esi + 0x306a0], bl
mov byte [esi + 0x306a1], 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor edi, edi
sar ecx, 1
dec ecx
inc edi
shl edi, cl
cmp edi, ebx
jbe 0x45c02f
mov eax, dword [ebp - 8]
push edi
push dword [ebp - 4]
lea eax, [eax + esi + 0x306a0]
push eax
call fcn.004b9920
add esp, 0xc
add dword [ebp - 8], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jl 0x45c006
mov dword [ebp - 4], 8
mov edx, 0x10000
mov eax, dword [ebp - 4]
push 4
xor ecx, ecx
pop edi
imul eax, eax
add ecx, ecx
jmp 0x45c056
shr eax, 1
inc ecx
cmp eax, edx
jae 0x45c053
dec edi
jne 0x45c04c
mov eax, 0xa1
sub eax, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 0x10
shr ecx, 4
cmp dword [ebp - 4], 0x800
mov dword [esi + ecx*4 + 0x30ea0], eax
jb 0x45c044
pop edi
mov dword [esi + 0x325ac], ebx
mov dword [esi + 0x3bd14], ebx
pop ebx
leave
ret
Function at 0x45ef22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x45efaf
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004b9fe0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x45ef6f
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x45ef91
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x45f06c
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x45efd7
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x45efe2
xor eax, eax
jmp 0x45f02d
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x45efff
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.00463f68
jmp 0x45f010
cmp ecx, 2
jne 0x45f017
push edx
push dword [edi + 0x30]
mov edx, dword [edi]
call fcn.00464182
pop ecx
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
pop ecx
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.004b9fe0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x45f058
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x45f06c
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x45ef2d
pop edi
pop ebx
leave
ret
Function at 0x461ef6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [esi], ebx
je 0x461f08
xor eax, eax
jmp 0x461fb2
lea eax, [esi + 0x30]
push eax
call fcn.00464c60
test eax, eax
pop ecx
je 0x461f1e
push 0xc
pop eax
jmp 0x461fb2
push edi
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.00464bb9
test eax, eax
pop ecx
jne 0x461fa8
lea eax, [esi + 0x18]
push eax
call fcn.00464bb9
test eax, eax
pop ecx
jne 0x461fa8
lea eax, [esi + 0x1c]
push eax
call fcn.00464bb9
test eax, eax
pop ecx
jne 0x461fa8
push dword [ebp + 0x10]
lea eax, [esi + 0x20]
push dword [ebp + 0x10]
push eax
call fcn.00464c16
add esp, 0xc
test eax, eax
jne 0x461fa8
push dword [ebp + 0x10]
lea eax, [esi + 0x24]
push ebx
push eax
call fcn.00464c16
add esp, 0xc
test eax, eax
jne 0x461fa8
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [esi + 4], edi
push dword [ebp + 8]
push ebx
push ebx
call fcn.004ba4fd
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x461fad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x461fa8
mov eax, edi
cmp eax, ebx
je 0x461fad
push 0xc
pop eax
jmp 0x461fb1
mov dword [esi], edi
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x465176
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x46518c
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x465198
or edi, 1
push 1
call esi
test ax, ax
jge 0x4651a4
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x4651b0
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x4651bc
or edi, 0x20
mov ax, di
pop edi
pop esi
ret

Function at 0x465267
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x178]
cmp eax, ecx
je 0x46528f
cmp byte [ebp + 0xc], 0
je 0x46528f
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0xbc]
cmp ebx, eax
je 0x465334
test eax, eax
je 0x4652d4
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xbc]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
and dword [esi + 0xbc], 0
test ebx, ebx
je 0x465334
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x128]
cmp eax, esi
jne 0x465334
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd0]
test al, al
je 0x465334
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test al, al
je 0x465334
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [esi + 0xbc], ebx
mov dword [ebp - 0x28], 0x11
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xbc]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
pop edi
pop ebx
leave
ret 8
Function at 0x465fce
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x1d4]
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
cmp eax, edi
je 0x465ffd
push dword [ebp + 8]
push eax
push dword [esi + 0x178]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x465ffd
mov al, 1
jmp 0x466078
mov eax, dword [ebp + 0xc]
sub eax, 0x100
je 0x46607e
push 4
pop edx
sub eax, edx
je 0x46602a
dec eax
jne 0x466076
cmp dword [esi + 0xbc], edi
je 0x466076
push 9
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2c], 5
jmp 0x46603f
cmp dword [esi + 0xbc], edi
je 0x466076
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [esi + 0xc4]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0xc8]
mov word [ebp - 0x14], bx
mov dword [ebp - 0x18], eax
call fcn.00465176
mov word [ebp - 0x12], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xbc]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
xor al, al
pop edi
pop ebx
leave
ret 0xc
cmp ebx, 9
jne 0x466076
cmp dword [esi + 0xbc], edi
je 0x4660ce
mov ecx, dword [esi + 0xbc]
mov eax, dword [ecx]
call dword [eax + 0xd0]
test al, al
je 0x4660ce
mov ecx, dword [esi + 0xbc]
mov eax, dword [ecx]
call dword [eax + 0x120]
test al, al
je 0x4660ce
mov ecx, dword [esi + 0xbc]
mov eax, dword [ecx]
call dword [eax + 0x2c]
cmp eax, 0xa
jne 0x4660ce
mov eax, dword [esi + 0xbc]
cmp byte [eax + 0x56d], 0
jne 0x466076
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
push eax
mov eax, esi
call fcn.004651c2
jmp 0x465ff9
Function at 0x46f40c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x568], ebx
push edi
je 0x46f4c6
cmp dword [ebp + 8], 0x100
mov edi, dword [ebp + 0xc]
jne 0x46f48c
cmp di, 0xd
jne 0x46f47a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x46f462
cmp byte [esi + 0x56f], bl
jne 0x46f462
mov eax, dword [esi + 0x448]
cmp eax, ebx
je 0x46f45e
push ebx
push ebx
push 0x10
push esi
push eax
call fcn.00465c4c
xor eax, eax
jmp 0x46f4c9
cmp byte [esi + 0x56e], bl
jne 0x46f4ac
mov eax, dword [esi + 0x448]
cmp eax, ebx
je 0x46f45e
push ebx
push ebx
push 0xf
jmp 0x46f457
mov eax, dword [esi + 0x448]
cmp eax, ebx
je 0x46f4ac
push dword [ebp + 0x10]
push edi
push 0x14
jmp 0x46f4a5
cmp dword [ebp + 8], 0x101
jne 0x46f4ac
mov eax, dword [esi + 0x448]
cmp eax, ebx
je 0x46f4ac
push dword [ebp + 0x10]
push edi
push 0x13
push esi
push eax
call fcn.00465c4c
push dword [ebp + 0x14]
mov eax, dword [esi + 0x568]
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
push edi
push dword [ebp + 8]
call dword [eax + 0xc]
jmp 0x46f4c9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4771ab
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push ebx
mov ebx, ecx
cmp byte [ebx + 0x62c], al
push esi
sete byte [ebp + 0xb]
test al, al
push edi
mov byte [ebx + 0x62c], al
je 0x4771d3
or dword [ebx + 0x45c], 2
jmp 0x4771da
and dword [ebx + 0x45c], 0xfffffffd
xor esi, esi
cmp dword [ebx + 0x448], esi
je 0x477270
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [ebx + 0x630]
setl cl
cmp eax, esi
je 0x477252
cmp byte [ebx + 0x635], 0
je 0x47720d
test cl, cl
jne 0x477252
cmp byte [ebx + 0x62c], 0
je 0x477252
push eax
mov eax, dword [ebx + 0x448]
call fcn.00465626
mov edi, eax
cmp edi, esi
je 0x47727a
call fcn.00478f82
test eax, eax
jbe 0x477252
call fcn.00478f95
mov ecx, dword [eax]
cmp ecx, ebx
je 0x477246
mov eax, dword [ecx]
push 0
call dword [eax + 0x2d8]
mov eax, edi
inc esi
call fcn.00478f82
cmp esi, eax
jb 0x477231
cmp byte [ebp + 0xb], 0
jne 0x477270
movzx eax, byte [ebx + 0x62c]
push 0
push eax
push 0xe
push ebx
push dword [ebx + 0x448]
call fcn.00465c4c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x11c]
pop edi
pop esi
pop ebx
pop ebp
ret 4