joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb520
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e14bd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x65eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x10]
call fcn.004a09f0
lea eax, [esi + 0x20]
mov dword [esi], vtable.CXTPMarkupPathGeometry.0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
push eax
mov dword [ebp - 4], 0
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
test edi, edi
jle 0x4eb667
xor ecx, ecx
mov eax, edi
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005649e3
lea edx, [edi*8]
mov dword [esi + 0x14], eax
add esp, 4
test edx, edx
je 0x4eb5e9
test eax, eax
jne 0x4eb60f
call fcn.005a1c31
mov dword [eax], 0x16
call fcn.005a1920
push edi
call fcn.005649e3
add esp, 4
mov ecx, eax
mov dword [esi + 0x1c], ecx
test eax, eax
je 0x4eb657
mov ecx, dword [ebp + 0xc]
push edi
test ecx, ecx
je 0x4eb64c
push ecx
push eax
call fcn.0059d630
add esp, 0xc
jmp 0x4eb667
mov ecx, dword [ebp + 8]
push edx
test ecx, ecx
je 0x4eb629
push ecx
push eax
call fcn.0059d630
push edi
call fcn.005649e3
add esp, 0x10
jmp 0x4eb5f2
push 0
push eax
call fcn.0059dbb0
call fcn.005a1c31
mov dword [eax], 0x16
call fcn.005a1920
push edi
call fcn.005649e3
add esp, 0x10
jmp 0x4eb5f2
push 0
push eax
call fcn.0059dbb0
add esp, 0xc
call fcn.005a1c31
mov dword [eax], 0x16
call fcn.005a1920
mov ecx, esi
call fcn.004ee7e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f4670
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x100]
test esi, esi
je 0x4f46f8
mov eax, dword [ebp + 8]
shr eax, 8
push ebx
mov ebx, dword [esi + 0x34]
cmp al, 2
jne 0x4f46f7
test ebx, ebx
je 0x4f46f7
push dword [ebp + 0x10]
lea eax, [esi + 4]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4f46ac
mov ecx, dword [ebx + 0x2c]
jmp 0x4f46d0
mov eax, dword [esi + 0x34]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x40]
cmp dword [eax + 0x58], 0
cmovne edx, dword [ebp + 0x10]
add edx, dword [esi + 0x1c]
cmp edx, ecx
jl 0x4f46d0
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov ecx, edx
cmp edx, eax
cmovge ecx, eax
push ecx
mov ecx, edi
call fcn.004f33a0
cmp dword [ebp + 8], 0x202
je 0x4f46ee
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4f46f7
push 0
mov ecx, edi
call fcn.004f2e60
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x500ad0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e28ad
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x65eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.0056509a
mov dword [ebp - 4], 0
mov dword [edi], vtable.CXTPMenuBarMDIMenuInfo.0
call fcn.0056500f
mov ecx, eax
test ecx, ecx
je 0x500c08
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 1
call fcn.0056500f
mov ecx, eax
test ecx, ecx
je 0x500c08
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x28], eax
push 0x44
mov byte [ebp - 4], 2
call fcn.005649a6
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x500b69
mov ecx, eax
call fcn.004aea90
jmp 0x500b6b
xor eax, eax
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [edi + 0x20], eax
call fcn.004b0a70
mov ebx, dword [ebp + 0xc]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], 0
call fcn.005710c5
call fcn.005710c5
mov ecx, dword [eax + 0xc]
movzx eax, bx
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [edi + 0x2c], eax
call fcn.005710c5
mov ecx, dword [eax + 4]
call fcn.005704db
mov dword [ebp - 0x10], eax
test eax, eax
je 0x500bf2
call fcn.005710c5
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
call fcn.005704fc
mov esi, eax
cmp ebx, dword [esi + 0x54]
je 0x500bd8
cmp dword [ebp - 0x10], 0
jne 0x500bb8
jmp 0x500bf2
mov eax, dword [esi]
lea ecx, [edi + 0x24]
push 1
push ecx
mov ecx, esi
call dword [eax + 0x64]
mov eax, dword [esi]
lea ecx, [edi + 0x28]
push 6
push ecx
mov ecx, esi
call dword [eax + 0x64]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00404e0e
int3
Function at 0x501540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
cmp edi, 0x220
ja 0x501690
je 0x50157b
cmp edi, 0x47
ja 0x5015e7
je 0x501570
mov eax, edi
sub eax, 2
je 0x5015ab
sub eax, 3
jne 0x501590
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x12c]
jne 0x501590
push 0
push 0x2fbf
push 0x113
push dword [esi - 0x60]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.004cbcc0
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [esi + 0x130], 0
je 0x501590
lea ecx, [esi - 0x80]
call fcn.004cadf0
test eax, eax
jne 0x5015c4
xor ecx, ecx
jmp 0x5015c7
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
cmp eax, ecx
jne 0x501590
push dword [esi + 0x130]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x130], 0
jmp 0x501590
cmp edi, 0x112
jne 0x501590
lea ebx, [esi - 0x80]
mov ecx, ebx
call fcn.004acea0
test eax, eax
je 0x501590
push 0x4a48d0
mov ecx, 0x669f38
call fcn.0057c2be
test eax, eax
je 0x501772
cmp dword [eax + 4], 0
jg 0x501590
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x501590
mov ecx, ebx
call fcn.004caed0
test eax, eax
jne 0x501590
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x501590
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x501590
mov eax, dword [ebx]
mov ecx, ebx
push 0x12
call dword [eax + 0x220]
test eax, eax
jne 0x501684
mov ecx, ebx
call fcn.004cac00
test eax, eax
je 0x501684
push 0
push ebx
mov ecx, eax
call fcn.004a6d60
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14
mov eax, edi
sub eax, 0x221
je 0x50157b
sub eax, 1
je 0x50157b
sub eax, 0xe
jne 0x501590
mov eax, dword [esi - 0x80]
lea ecx, [esi - 0x80]
call dword [eax + 0x188]
lea ecx, [esi - 0x80]
test eax, eax
je 0x501749
call fcn.004caed0
test eax, eax
je 0x5016f5
lea ecx, [esi - 0x80]
call fcn.004cadf0
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
test dword [esi + 0x54], 0x400
mov edi, dword [ebp + 0x10]
jne 0x50171e
mov eax, dword [edi]
test eax, eax
jne 0x501715
cmp dword [esi + 0x130], eax
je 0x50171e
mov eax, dword [esi + 0x130]
push eax
lea ecx, [esi - 0x80]
call fcn.00502300
lea ecx, [esi - 0x80]
call fcn.004cadf0
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
lea ecx, [esi - 0x80]
call fcn.005017b0
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
call fcn.004cadf0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
jne 0x501590
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
call fcn.00564a96
int3
Function at 0x504860
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
mov eax, dword [edi + 4]
je 0x50489a
test eax, eax
jne 0x5048ac
push esi
call fcn.005710c5
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x504690
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop esi
mov dword [edi + 4], eax
pop edi
pop ebp
ret 4
test eax, eax
je 0x5048ac
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [edi + 4], 0
pop edi
pop ebp
ret 4
Function at 0x508210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jne 0x50835f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0xc0]
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x160]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x84]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x15c]
push 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x5082dc
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x5082bc
sub eax, dword [ebp - 0x18]
cdq
idiv dword [esi + 0x14c]
lea ecx, [eax + 1]
mov eax, dword [esi + 0x13c]
cmp eax, ecx
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jl 0x5082dc
sub eax, dword [ebp - 0x20]
cdq
idiv dword [esi + 0x150]
lea edi, [eax + 1]
mov eax, dword [esi + 0x140]
cmp eax, edi
cmovl edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x15c]
jne 0x50830c
cmp edi, dword [esi + 0x160]
jne 0x50830c
push 0
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00508380
jmp 0x50835f
push 1
push dword [esi + 0x148]
mov ecx, esi
mov dword [esi + 0x15c], eax
push dword [esi + 0x144]
mov dword [esi + 0x160], edi
call fcn.00508380
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0x164], 1
mov eax, dword [ecx]
call dword [eax + 0x1a4]
push dword [ebp - 8]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0xc]
mov dword [esi + 0x164], 0
call dword [eax + 0x104]
push dword [ebp + 8]
mov ecx, esi
call fcn.004b50a0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00599f9c
mov esp, ebp
pop ebp
ret 4

Function at 0x50b0c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x50b0d0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x50c680
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 8], 0
je 0x50c6f9
mov edi, dword [ebp + 8]
cmp edi, 0x26
je 0x50c6a7
cmp edi, 0x28
je 0x50c6a7
cmp edi, 0x22
je 0x50c6a7
cmp edi, 0x21
jne 0x50c6f9
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x50c6f9
push 5
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 8]
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x50c6f9
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50cdc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x50ce1b
mov esi, dword [ebp + 8]
cmp esi, 0x2e
je 0x50cde2
cmp esi, 8
je 0x50cde2
xor eax, eax
jmp 0x50cde7
mov eax, 1
mov dword [edi + 0x170], eax
mov eax, dword [edi + 0x144]
test eax, eax
je 0x50ce04
cmp dword [eax + 0x80], 0
jne 0x50cf80
cmp esi, 9
jne 0x50ce24
cmp dword [edi + 0x194], 0
je 0x50ce1b
test byte [edi + 0x174], 8
jne 0x50ce79
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
cmp esi, 0xd
je 0x50ce1b
cmp esi, 0x1b
jne 0x50ce79
mov ecx, dword [edi + 0x138]
mov eax, dword [ecx]
call dword [eax + 0x1a8]
push dword [edi + 0x150]
mov ecx, edi
call fcn.0050dfc0
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.0050e340
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x50cebd
cmp dword [eax + 0x20], 0
je 0x50cebd
push 0x12
call ebx
test ax, ax
jns 0x50cebd
push 0x11
call ebx
test ax, ax
js 0x50cebd
mov ecx, dword [edi + 0xc0]
call fcn.004cac00
test eax, eax
je 0x50cebd
movzx ecx, si
push ecx
mov ecx, eax
call fcn.004a5b40
test eax, eax
jne 0x50cf56
cmp esi, 0x73
jne 0x50cf33
push 0x12
call ebx
test ax, ax
jns 0x50cf46
mov ecx, dword [edi + 0x194]
test ecx, ecx
je 0x50cee2
push dword [ebp + 0xc]
push esi
call fcn.0050c680
test eax, eax
jne 0x50cf56
cmp dword [edi + 0x144], 0
je 0x50cf08
cmp esi, 0x26
je 0x50ceff
cmp esi, 0x28
je 0x50ceff
cmp esi, 0x22
je 0x50ceff
cmp esi, 0x21
jne 0x50cf62
push 0x12
call ebx
test ax, ax
js 0x50cf62
mov ecx, edi
call fcn.0050c720
test eax, eax
je 0x50cf62
mov ecx, dword [edi + 0x138]
mov edx, dword [ebp + 0xc]
push edx
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x258]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
cmp esi, 0x26
je 0x50cf3d
cmp esi, 0x28
jne 0x50cecb
push 0x12
call ebx
test ax, ax
jns 0x50cecb
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
push 0
call dword [eax + 0xd4]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, dword [edi + 0x144]
test ecx, ecx
je 0x50cf80
cmp dword [ecx + 0x20], 0
je 0x50cf80
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.004c6e40
test eax, eax
jne 0x50cf56
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 8
Function at 0x50dd10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x240]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x144], 0
je 0x50dd69
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x50de4d
mov eax, dword [ebp + 0xc]
cmp eax, 0x26
je 0x50dd5e
cmp eax, 0x28
je 0x50dd5e
cmp eax, 0x21
je 0x50dd5e
cmp eax, 0x22
jne 0x50de4d
push dword [ebp + 0x10]
push eax
push 0x100
jmp 0x50ddcf
mov edi, dword [ebp + 0xc]
cmp edi, 0x73
jne 0x50de2e
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x50de4d
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
push 1
push 0x102
push 0x102
push dword [esi + 0x20]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x50ddd6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x102
mov ecx, esi
call fcn.0056746d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x240]
cmp dword [ebp - 4], eax
je 0x50de20
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
mov edi, dword [ebx + 0x144]
test edi, edi
je 0x50de20
mov eax, dword [edi + 0x20]
test eax, eax
je 0x50de20
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x26
je 0x50de3c
cmp edi, 0x28
jne 0x50dd86
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x50dd86
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x511130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2c65
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.004c2e90
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.005753d4
mov esi, dword [ebp + 0x18]
mov ecx, edi
sub esi, dword [ebp + 0x10]
push 0x34
call fcn.004c2e90
push eax
mov eax, dword [ebp + 0x1c]
push 1
push esi
mov esi, dword [ebp - 0x24]
dec eax
push eax
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00575374
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.0048ce40
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.004c2e90
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405ebd
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x51123b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.0048d200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret 0x18
Function at 0x513170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x74]
test eax, eax
je case.0x5131ed.10
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x5131c5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x8c]
test eax, eax
je 0x5131c5
mov eax, dword [ebp + 8]
cmp eax, 0xd
je 0x5131ab
cmp eax, 0x20
jne case.0x5131ed.10
mov ecx, dword [esi + 0xc0]
push 0
push dword [esi + 0x40]
call fcn.004cd2b0
mov eax, 1
pop esi
pop ebp
ret 8
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc0]
call fcn.0048e6b0
mov eax, dword [ebp + 8]
add esp, 8
add eax, 0xfffffff7
cmp eax, 0x1f
ja case.0x5131ed.10
movzx eax, byte [eax + 0x5133c4]
jmp dword [eax*4 + 0x513398]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.005122a0
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
jmp 0x5131f6
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512610
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512610
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512350
cmp eax, 0xffffffff
jne 0x5131ff
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push eax
push dword [esi + 0x40]
call fcn.004b05f0
cmp eax, dword [esi + 0x40]
jne case.0x5131ed.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.005122a0
cmp eax, 0xffffffff
je case.0x5131ed.10
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512480
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512480
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 1
push dword [esi + 0x1bc]
mov ecx, esi
call fcn.00512350
cmp eax, 0xffffffff
jne 0x5131ff
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push 1
push dword [esi + 0x40]
call fcn.004b05f0
cmp eax, dword [esi + 0x40]
jne case.0x5131ed.10
push 1
jmp 0x51328b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x1bc]
test ax, ax
js 0x513362
push 1
push ecx
mov ecx, esi
call fcn.005122a0
cmp eax, dword [esi + 0x1bc]
jle case.0x5131ed.10
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.005122a0
cmp eax, dword [esi + 0x1bc]
jge case.0x5131ed.10
push eax
mov ecx, esi
call fcn.00514020
mov eax, 1
pop esi
pop ebp
ret 8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x5165a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x60]
test edi, edi
je 0x516636
mov eax, dword [ebp + 8]
shr eax, 8
push ebx
mov ebx, dword [edi + 0x34]
cmp al, 2
jne 0x516635
test ebx, ebx
je 0x516635
push dword [ebp + 0x10]
lea eax, [edi + 4]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x5165ea
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp dword [eax + 0x14], 0
jne 0x5165ea
mov ecx, dword [ebx + 0x2c]
jmp 0x51660e
mov eax, dword [edi + 0x34]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x40]
cmp dword [eax + 0x58], 0
cmovne edx, dword [ebp + 0x10]
add edx, dword [edi + 0x1c]
cmp edx, ecx
jl 0x51660e
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov ecx, edx
cmp edx, eax
cmovge ecx, eax
push ecx
mov ecx, esi
call fcn.00515ef0
cmp dword [ebp + 8], 0x202
je 0x51662c
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x516635
push 0
mov ecx, esi
call fcn.00515da0
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x51d9f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3695
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xaa0055
mov dword [ebp - 0x1c], 0xaa0055
mov dword [ebp - 0x18], 0xaa0055
mov dword [ebp - 0x14], 0xaa0055
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], vtable.CBitmap.0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [ebp - 0x34]
call fcn.00571b9a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CBrush.0
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00571b9a
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.00572264
mov esi, dword [ebx]
mov ecx, edi
push 0xf
mov dword [ebp - 0x3c], eax
call fcn.004c2e90
push eax
mov ecx, ebx
call dword [esi + 0x2c]
mov esi, dword [ebp - 0x24]
mov ecx, edi
push 0x14
mov ebx, eax
mov esi, dword [esi]
call fcn.004c2e90
mov ecx, dword [ebp - 0x24]
push eax
call dword [esi + 0x30]
mov edi, eax
mov eax, dword [ebp - 0x38]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov esi, dword [eax]
sub ecx, edx
push ecx
mov ecx, dword [eax + 8]
sub ecx, esi
push ecx
push edx
push esi
mov esi, dword [ebp - 0x24]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_PatBlt]
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.00572264
mov eax, dword [esi]
mov ecx, esi
push ebx
call dword [eax + 0x2c]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x30]
lea ecx, [ebp - 0x2c]
call fcn.00571d0a
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CBrush.0
call fcn.00415fe6
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.CBitmap.0
call fcn.00415fe6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret 8