joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push ebx
push esi
add esp, 4
and ebx, 0x9407
call 0x40ad92
add byte [ebx + 0x41], cl
cmp dl, byte [eax + 0x3a]
dec ebx
add esp, 4
sub ebx, 0xc53e
pop ebx
push edx
jmp 0x40ada6
or edx, 0x6375
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x40adc5
mov dword [ebp - 0x2a8], 0
jmp 0x40b010
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push esi
and esi, 0x940a
and esi, 0x1208e
pop esi
push edi
push ebx
add esp, 4
jmp 0x40adeb
pop edi
push ebx
call 0x40adf9
add byte [edi], bh
dec ebp
dec esi
inc esi
xor ecx, dword [ecx - 0x7d]
les eax, [ebx + ebp*8]
add al, 0x34
inc edi
cmp byte [ebx + ebx*2], dh
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
push ebx
add esp, 4
jmp 0x40ae38
or esi, 0x9dde
sub esi, 0xe027
pop esi
push ecx
jmp 0x40ae4c
jmp 0x40ae52
or ecx, 0xed3d
xor ecx, 0x16442
add byte [ecx - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
push edx
add esp, 4
and eax, 0xbc6b
and eax, 0x6b9e
pop eax
push edi
add edi, 0x14358
call 0x40aedb
add byte [0x3b3a4e4c], bh
dec esp
add esp, 4
jmp 0x40aee7
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push eax
push ecx
add esp, 4
jmp 0x40af75
and eax, 0x1372b
pop eax
push edi
push edi
add esp, 4
add al, 0xeb
invalid
jmp 0x40af91
jmp 0x40af99
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push esi
xor esi, 0x3854
pop esi
push edi
push esi
add esp, 4
add edi, 0x17dba
pop edi
push eax
push ecx
add esp, 4
and eax, 0x14010
add eax, 0x12dd4
add eax, 0xaeee
xor eax, 0x11a10
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
push ecx
or ecx, 0x100fe
and ecx, 0xe80c
add ecx, 0x1cd1
xor ecx, 0xa912
pop ecx
push ebx
push ebx
add esp, 4
call 0x40b03e
add byte [eax + 0x34], cl
aas
invalid
Function at 0x40adf9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push ebx
push esi
add esp, 4
and ebx, 0x9407
call 0x40ad92
add byte [ebx + 0x41], cl
cmp dl, byte [eax + 0x3a]
dec ebx
add esp, 4
sub ebx, 0xc53e
pop ebx
push edx
jmp 0x40ada6
or edx, 0x6375
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x40adc5
mov dword [ebp - 0x2a8], 0
jmp 0x40b010
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push esi
and esi, 0x940a
and esi, 0x1208e
pop esi
push edi
push ebx
add esp, 4
jmp 0x40adeb
pop edi
push ebx
call 0x40adf9
add byte [edi], bh
dec ebp
dec esi
inc esi
xor ecx, dword [ecx - 0x7d]
les eax, [ebx + ebp*8]
add al, 0x34
inc edi
cmp byte [ebx + ebx*2], dh
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
push ebx
add esp, 4
jmp 0x40ae38
or esi, 0x9dde
sub esi, 0xe027
pop esi
push ecx
jmp 0x40ae4c
jmp 0x40ae52
or ecx, 0xed3d
xor ecx, 0x16442
add byte [ecx - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
push edx
add esp, 4
and eax, 0xbc6b
and eax, 0x6b9e
pop eax
push edi
add edi, 0x14358
call 0x40aedb
add byte [0x3b3a4e4c], bh
dec esp
add esp, 4
jmp 0x40aee7
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push eax
push ecx
add esp, 4
jmp 0x40af75
and eax, 0x1372b
pop eax
push edi
push edi
add esp, 4
add al, 0xeb
invalid
jmp 0x40af91
jmp 0x40af99
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push esi
xor esi, 0x3854
pop esi
push edi
push esi
add esp, 4
add edi, 0x17dba
pop edi
push eax
push ecx
add esp, 4
and eax, 0x14010
add eax, 0x12dd4
add eax, 0xaeee
xor eax, 0x11a10
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
push ecx
or ecx, 0x100fe
and ecx, 0xe80c
add ecx, 0x1cd1
xor ecx, 0xa912
pop ecx
push ebx
push ebx
add esp, 4
call 0x40b03e
add byte [eax + 0x34], cl
aas
invalid
Function at 0x40aedb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push ebx
push esi
add esp, 4
and ebx, 0x9407
call 0x40ad92
add byte [ebx + 0x41], cl
cmp dl, byte [eax + 0x3a]
dec ebx
add esp, 4
sub ebx, 0xc53e
pop ebx
push edx
jmp 0x40ada6
or edx, 0x6375
pop edx
cmp dword [ebp - 0xc68], 0
jne 0x40adc5
mov dword [ebp - 0x2a8], 0
jmp 0x40b010
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push esi
and esi, 0x940a
and esi, 0x1208e
pop esi
push edi
push ebx
add esp, 4
jmp 0x40adeb
pop edi
push ebx
call 0x40adf9
add byte [edi], bh
dec ebp
dec esi
inc esi
xor ecx, dword [ecx - 0x7d]
les eax, [ebx + ebp*8]
add al, 0x34
inc edi
cmp byte [ebx + ebx*2], dh
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
push ebx
add esp, 4
jmp 0x40ae38
or esi, 0x9dde
sub esi, 0xe027
pop esi
push ecx
jmp 0x40ae4c
jmp 0x40ae52
or ecx, 0xed3d
xor ecx, 0x16442
add byte [ecx - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
push edx
add esp, 4
and eax, 0xbc6b
and eax, 0x6b9e
pop eax
push edi
add edi, 0x14358
call 0x40aedb
add byte [0x3b3a4e4c], bh
dec esp
add esp, 4
jmp 0x40aee7
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x40af05
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x40af5f
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x40ae2d
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40ae2d
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40af49
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x40af53
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x40afa8
push eax
push ecx
add esp, 4
jmp 0x40af75
and eax, 0x1372b
pop eax
push edi
push edi
add esp, 4
add al, 0xeb
invalid
jmp 0x40af91
jmp 0x40af99
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x40b010
push esi
xor esi, 0x3854
pop esi
push edi
push esi
add esp, 4
add edi, 0x17dba
pop edi
push eax
push ecx
add esp, 4
and eax, 0x14010
add eax, 0x12dd4
add eax, 0xaeee
xor eax, 0x11a10
pop eax
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x40b006
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x40add1
mov dword [ebp - 0x2a8], 0
push ecx
or ecx, 0x100fe
and ecx, 0xe80c
add ecx, 0x1cd1
xor ecx, 0xa912
pop ecx
push ebx
push ebx
add esp, 4
call 0x40b03e
add byte [eax + 0x34], cl
aas
invalid
Function at 0x42d473
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507a2b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5aa5a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 7
lea ecx, [esi + 0x38]
call fcn.004fed5c
mov byte [ebp - 4], 6
lea ecx, [esi + 0x34]
call fcn.004fed5c
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
call fcn.004fed5c
mov byte [ebp - 4], 4
lea ecx, [esi + 0x2c]
call fcn.004fed5c
mov byte [ebp - 4], 3
lea ecx, [esi + 0x28]
call fcn.004fed5c
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
call fcn.004fed5c
mov byte [ebp - 4], 1
lea ecx, [esi + 0x10]
call fcn.004fed5c
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004fed5c
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.004fed5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442b37
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x84
mov eax, 0x50ae7a
call fcn.00502a53
lea ecx, [ebp - 0x3c]
call fcn.004ff382
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call sym.designer.exe_void___cdecl_GetExeFileDescriptor_unsigned_short_int__class_BOFileDescriptor__
lea eax, [ebp - 0x3c]
push eax
call fcn.004ff1a2
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.004fed56
mov byte [ebp - 4], 1
lea eax, [ebp - 0x4c]
push 0x10
push 0
push eax
call fcn.00503872
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00503872
and dword [ebp - 0x88], 0
add esp, 0x18
and dword [ebp - 0x84], 0
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x64], 0x40
call fcn.004ff3a6
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004fedb0
mov byte [ebp - 4], 2
mov edi, 0x53d4d0
cmp esi, 1
je 0x442be2
cmp esi, 2
je 0x442be2
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004fedc2
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004fedce
pop ecx
pop ecx
cmp esi, 1
je 0x442c07
cmp esi, 2
je 0x442c07
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.004fedd4
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push 0x5283bc
push eax
call fcn.004fedd4
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
call fcn.004fedce
add esp, 0x10
cmp esi, 1
je 0x442cc7
mov eax, dword [0x525800]
push dword [ebp - 0x10]
mov esi, dword [0x5257d4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call esi
mov byte [ebp - 4], 3
mov eax, dword [0x525800]
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call esi
add esp, 0x10
mov byte [ebp - 4], 4
lea edx, [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add ecx, 4
push edx
lea edx, [ebp - 0x90]
add eax, 4
push edx
xor edx, edx
push edx
push edx
push 0x20
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
mov dword [esi], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.004054f7
test al, al
je 0x442cac
push dword [ebp - 0x18]
call fcn.00500f18
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004054f7
test al, al
je 0x442cd7
push dword [ebp - 0x1c]
call fcn.00500f18
pop ecx
jmp 0x442cd7
push 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004fed5c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004fed5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004ff388
mov eax, esi
call fcn.00502a1c
ret
Function at 0x44527e
Capabilities:
Terminate process

Disassembly:
push 8
mov eax, 0x50b37c
call fcn.00502a53
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x44]
push dword [ecx + 0x24]
mov ecx, dword [ecx + 0xc]
call dword [0x527b8c]
mov edi, eax
test edi, edi
je 0x44539c
mov ecx, dword [edi]
push edi
call dword [ecx + 0x24]
pop ecx
cmp eax, 2
je 0x44539c
lea ecx, [ebp - 0x10]
call fcn.004fedb0
and dword [ebp - 4], 0
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
mov ecx, dword [edi]
and eax, 0xffff0000
neg eax
push edi
sbb esi, esi
and esi, 0xfffffffb
add esi, 5
call dword [ecx + 0x24]
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x10]
cmp eax, 3
mov eax, dword [edi]
push ecx
push edi
jne 0x4452f5
call dword [eax + 0xd4]
jmp 0x4452fb
call dword [eax + 0xcc]
add esp, 0xc
push esi
push 5
push ebx
call fcn.00445227
add esp, 0xc
lea ecx, [ebp - 0x14]
call dword [0x52673c]
mov byte [ebp - 4], 1
call dword [0x527ca4]
push 0xa91d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
push dword [ebp - 0x10]
mov ecx, dword [0x525800]
mov ebx, eax
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
push eax
call dword [0x5257d4]
pop ecx
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, 4
push eax
call dword [0x52682c]
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004054f7
test al, al
je 0x445370
push dword [ebp + 8]
call fcn.00500f18
pop ecx
mov esi, dword [ebx]
lea ecx, [ebp - 0x14]
call dword [0x526740]
push eax
mov ecx, ebx
call dword [esi + 0x34]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [0x526734]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004fed5c
jmp 0x4453a3
push ebx
call fcn.00445022
pop ecx
test edi, edi
je 0x4453fb
mov eax, dword [edi]
push 1
push edi
call dword [eax + 0x38]
pop ecx
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.004fed56
mov dword [ebp - 4], 3
call fcn.004419da
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1a8]
test eax, eax
je 0x4453ef
call fcn.004419da
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1a8]
lea edx, [ebp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004fed5c
call fcn.00502a1c
ret

Function at 0x455579
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x50616c
call fcn.00502a53
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call dword [0x526738]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [0x526740]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4555b1
and esi, 0x10
jne 0x4555c0
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00456076
pop ecx
pop ecx
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [0x526734]
mov eax, esi
call fcn.00502a1c
ret
Function at 0x45fbc2
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
mov eax, 0x50fa14
call fcn.00502a53
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov edi, eax
pop ecx
test edi, edi
je 0x45fd85
lea ecx, [ebp + 0xc]
call dword [0x52673c]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0xc]
movzx esi, word [ebp + 8]
push esi
call dword [0x5262e8]
sub esi, 0xe701
je 0x45fcf2
sub esi, 1
je 0x45fc88
sub esi, 1
jne 0x45fd78
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x45fc68
lea ecx, [ebp + 0xc]
call dword [0x526740]
push eax
lea ecx, [ebp - 0x14]
call dword [0x525818]
mov byte [ebp - 4], 7
mov ecx, eax
call dword [0x5257c4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 8
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff1c
pop ecx
pop ecx
mov byte [ebp - 4], 7
jmp 0x45fd3a
push 0x52831e
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 9
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff1c
jmp 0x45fd6b
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x45fcd5
lea ecx, [ebp + 0xc]
call dword [0x526740]
push eax
lea ecx, [ebp - 0x14]
call dword [0x525818]
mov byte [ebp - 4], 4
mov ecx, eax
call dword [0x5257c4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff16
pop ecx
pop ecx
mov byte [ebp - 4], 4
jmp 0x45fd3a
push 0x52831e
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 6
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff16
jmp 0x45fd6b
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x45fd50
lea ecx, [ebp + 0xc]
call dword [0x526740]
push eax
lea ecx, [ebp - 0x14]
call dword [0x525818]
mov byte [ebp - 4], 1
mov ecx, eax
call dword [0x5257c4]
push eax
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff10
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004fed5c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call dword [0x5257f0]
jmp 0x45fd78
push 0x52831e
lea ecx, [ebp - 0x10]
call fcn.004fedb6
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004fff10
pop ecx
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.004fed5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [0x526734]
call fcn.00502a1c
ret
Function at 0x460eb8
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x50fbfb
call fcn.00502a53
mov esi, ecx
push 0x2000
push 0x540ccc
lea ecx, [ebp - 0x10]
xor ebx, ebx
call dword [0x525e90]
and dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call dword [0x52673c]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [esi + 0xc]
push dword [esi + 0x10]
push dword [esi + 4]
push dword [esi + 8]
push str.__OLE_allocations______________________________________________________________n__u__u_allocations_for__u__u_bytes_n
push eax
call dword [0x5262ec]
add esp, 0x18
lea ecx, [ebp - 0x14]
call dword [0x526740]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call edi
push str._______________________________________________________________________________n
call edi
push 0x5af208
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5af1f4]
cmp dword [ecx + 0xc], ebx
je 0x460fb5
mov eax, dword [ecx + 4]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x460fae
lea eax, [ebp - 0x18]
push eax
call fcn.00460fe6
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
mov eax, dword [eax]
add eax, 0xfffffff0
push eax
call fcn.00460c94
push 0x540e60
lea ecx, [ebp - 0x10]
call dword [0x5266bc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call dword [0x52631c]
push 0x540e68
lea ecx, [ebp - 0x10]
call dword [0x5266bc]
lea ecx, [ebp - 0x10]
call dword [0x526740]
push eax
call edi
push 0x539768
lea ecx, [ebp - 0x10]
call dword [0x52682c]
inc ebx
cmp dword [ebp - 0x18], 0
je 0x460fae
mov ecx, dword [0x5af1f4]
jmp 0x460f42
push 0x540e6c
call edi
push 0x5af208
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [0x526734]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [0x526734]
mov eax, ebx
call fcn.00502a1c
ret

Function at 0x46102d
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x519264
call fcn.00502a53
mov edi, ecx
mov ebx, 0x5af208
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
test esi, esi
je 0x461121
cmp dword [0x5af1fc], 0
jne 0x46108b
mov ecx, dword [0x5af1f4]
push 0
push esi
call fcn.00501ebc
test eax, eax
je 0x461121
mov ecx, dword [esi - 0xc]
sub dword [edi + 0x10], ecx
dec dword [edi + 8]
mov ecx, dword [0x5af1f4]
push eax
call fcn.00501eb6
jmp 0x461121
cmp dword [0x5af1f8], 0
je 0x461121
mov ecx, dword [0x5af1f4]
push 0
push esi
call fcn.00501ebc
test eax, eax
je 0x461121
lea ecx, [ebp + 8]
call dword [0x52673c]
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea eax, [esi - 0x10]
mov ecx, edi
push eax
call fcn.00460c94
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push 0x540b3c
push eax
call fcn.00449944
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
push eax
call dword [0x5266cc]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [0x526734]
push 0x540b44
lea ecx, [ebp + 8]
call dword [0x5266bc]
lea ecx, [ebp + 8]
call dword [0x526740]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [0x526734]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00502a1c
ret 4
Function at 0x46121e
Capabilities:
Print debug messages

Disassembly:
mov ecx, 0x5af32c
jmp fcn.00460eb8