joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44541e
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 1
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp dword [esp + 0x14], 0
jne 0x445274
mov dword [esp + 0x14], 0x400
cmp dword [esp + 0x10], 0
je 0x4452cd
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00436a0b
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4452fb
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4452c4
push eax
push edi
lea ecx, [esi + 0x44]
push ecx
call fcn.0043699d
mov eax, dword [esp + 0x10]
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x44527b
jmp 0x4452cd
push edi
call fcn.004127bd
add esp, 4
mov edx, dword [esi + 8]
or edx, dword [esi + 0xc]
jne 0x4452e9
push edx
push 0xdeadbeef
push 0x21
push esi
call fcn.00445207
pop edi
pop esi
pop ebx
ret 8
push 1
push 0
push 0
push esi
call fcn.00445207
pop edi
pop esi
pop ebx
ret 8
push edi
call fcn.004127bd
add esp, 4
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.00445207
pop edi
pop esi
pop ebx
ret 8
sub esp, 0x40c
push ebx
push esi
mov esi, dword [esp + 0x418]
mov eax, dword [esi + 0x34]
push edi
push 0x488478
push eax
mov dword [esp + 0x1c], fcn.004159db
call fcn.004155ec
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x445374
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.00445207
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004368b3
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x420]
lea ecx, [esp + 0xc]
push ecx
push 0x400
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4453f5
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4453c5
push edi
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004158e2
mov eax, dword [esp + 0x1c]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x44537c
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x44540b
push eax
push 0xdeadbeef
push 0x21
push esi
call fcn.00445207
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004368b3
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.00445207
lea edx, [esp + 0x10]
push edx
jmp 0x4453e0
push 1
push 0
push 0
push esi
call fcn.00445207
lea edx, [esp + 0x10]
push edx
jmp 0x4453e0
mov eax, dword [esp + 4]
cmp byte [eax + 0x30], 0
mov ecx, dword [esp + 8]
je 0x445439
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x44523a
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x445319
Function at 0x44549b
Capabilities:
Create http request

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp ecx, 1
jne 0x4454b5
movzx eax, word [esi + 0x8c]
jmp 0x4454b9
movzx eax, word [esi + 0x58]
cmp ecx, 1
movsx edx, ax
lea ecx, [esi + 0xb0]
je 0x4454ca
lea ecx, [esi + 0x7c]
mov eax, dword [esi + 0xc0]
push 0
cmp edx, 1
jne 0x4454de
push 0
push 0
push edx
jmp 0x445528
cmp edx, 2
jne 0x445522
mov ecx, dword [ecx]
push str._local_
push ecx
push 3
jmp 0x445528
cmp byte [esi + 0xdc], 0
je 0x445519
push 8
lea eax, [esp + 8]
push eax
push 0x32
push 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, 1
pop esi
add esp, 8
ret 8
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4454ef
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x4457b4
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [esp + 0x10]
mov ebp, ecx
mov ecx, dword [esp + 0x268]
push eax
push ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x445843
lea ebx, [ebx]
lea edx, [esp + 0x3c]
push 0x487fa4
push edx
call fcn.00414774
add esp, 8
test eax, eax
je 0x445833
lea eax, [esp + 0x3c]
push 0x48ae74
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x445833
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push ecx
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00438e13
add esp, 0xc
test al, al
je 0x445865
mov bl, 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4457e4
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_FindClose]
call esi
cmp byte [esp + 0x274], 0
jne 0x44587b
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
lea edx, [esp + 0x10]
push edx
push 0x48ae6c
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x445914
mov ebx, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test byte [esp + 0x10], 0x10
je 0x445904
lea eax, [esp + 0x3c]
push 0x487fa4
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x445904
lea ecx, [esp + 0x3c]
push 0x48ae74
push ecx
call fcn.00414774
add esp, 8
test eax, eax
je 0x445904
lea edx, [esp + 0x3c]
push edx
call ebx
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push eax
mov eax, dword [esp + 0x26c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.004457b4
test al, al
je 0x445926
push 0x48ae74
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x445898
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x254
ret 0x10
Function at 0x446126
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a56b8], 0
push esi
push edi
mov esi, 0x4a4ce8
jne 0x446146
push 0
call fcn.004171d4
push eax
call fcn.00437298
add esp, 8
mov dword [0x49321c], 0x270
mov dword [0x4a4ce4], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x44615b
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x446196
mov ecx, dword [0x4a4ce8]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x446725
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x44680a
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446777
push 1
push esi
push eax
call fcn.004377a3
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0xc
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4467e5
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x4467ba
cmp eax, 0xffffffff
jne 0x446762
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 1
push SysReAllocString
push 0x4883e4
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446777
test eax, eax
je 0x446777
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004377a3
push esi
call fcn.004377d3
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0xc
test al, 1
je 0x4467a7
mov eax, dword [esi]
test eax, eax
je 0x446786
pop esi
add esp, 0xc
ret 0xc
Function at 0x44681f
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x446906
push ecx
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446874
push 1
push esi
push eax
call fcn.004377a3
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0x14
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4468e1
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0x14
push ecx
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x4468b6
cmp eax, 0xffffffff
jne 0x44685f
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 2
push 0x40000000
push 0x4883e4
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446874
test eax, eax
je 0x446874
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.004377a3
push esi
call fcn.004377d3
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0x14
test dword [esp + 0x18], eax
je 0x4468a4
mov eax, dword [esi]
test eax, eax
je 0x446883
pop esi
add esp, 0xc
ret 0x14

Function at 0x446930
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x446942
push eax
call fcn.0044657f
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x446953
mov dword [esp + 4], eax
jmp fcn.0044657f
ret 4

Function at 0x446956
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x446980
push esi
call fcn.00437835
test al, al
je 0x446980
mov eax, dword [esi + 8]
push eax
call fcn.004465ec
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0043777a
cmp dword [esi + 0x24], 0
jne 0x4469b3
push esi
call fcn.00437819
test al, al
je 0x4469b3
push esi
call fcn.00437809
test al, al
jne 0x4469b3
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004465ec
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0043777a
pop esi
ret 4

Function at 0x4469de
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
push ecx
mov dword [esp + 0x18], edx
call fcn.004377ed
test al, al
je 0x446a30
test ebx, ebx
je 0x446a30
test edi, edi
je 0x446a30
push esi
push edx
lea eax, [esp + 0x1c]
push eax
lea esi, [ecx + 0x18]
mov ecx, dword [esi]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x446a26
push esi
call fcn.004377d3
add esp, 4
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
pop edi
mov eax, edx
pop ebx
ret 0xc
Function at 0x446ea1
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x446ebe
push esi
call fcn.0043856b
add esp, 4
test al, al
jne 0x446ed7
push 1
jmp 0x446ec0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret

Function at 0x44782c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x2c], 1
cmp word [eax], si
jne 0x447853
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x18
push ebp
push eax
or eax, 0xffffffff
call fcn.00410190
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x30]
push ebp
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
call fcn.00414b70
inc eax
push eax
call fcn.00412aaa
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x1c], ecx
mov al, byte [esi + ebp]
cmp al, 0x2b
je 0x4478a4
cmp al, 0x5e
je 0x4478a0
cmp al, 0x21
je 0x4478a0
cmp al, 0x23
jne 0x4478d4
cmp al, 0x2b
jne 0x4478ae
mov eax, dword [esp + 0x24]
mov byte [eax], 1
inc esi
jmp 0x44788d
cmp al, 0x5e
jne 0x4478bc
mov edx, dword [esp + 0x28]
mov byte [edx], 1
inc esi
jmp 0x44788d
cmp al, 0x21
jne 0x4478ca
mov eax, dword [esp + 0x2c]
mov byte [eax], 1
inc esi
jmp 0x44788d
cmp al, 0x23
jne 0x4478d1
mov byte [ebx], 1
inc esi
jmp 0x44788d
mov al, byte [esi + ebp]
inc esi
mov byte [esp + 0x14], al
mov dword [esp + 0x10], esi
cmp al, 0x7b
jne 0x447985
lea edx, [esp + 0x10]
push edx
push ecx
push ebp
push 0x7d
call fcn.00439bc9
test eax, eax
je 0x44790c
mov byte [esp + 0x30], 0
jmp 0x4479c1
mov esi, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x493af0]
push esi
push eax
call fcn.004280ba
add esp, 8
test eax, eax
je 0x44792b
inc edi
cmp edi, 0x62
jl 0x44790c
cmp edi, 0x62
jne 0x44796d
movzx ecx, byte [esi]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [esp + 0x20]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x44794f
mov ecx, dword [esp + 0x28]
mov byte [ecx], 1
test eax, 0x400
je 0x44795d
mov edx, dword [esp + 0x2c]
mov byte [edx], 1
test eax, 0x100
je 0x4479c1
mov eax, dword [esp + 0x24]
mov byte [eax], 1
jmp 0x4479c1
cmp byte [edi + 0x493c78], 0
jne 0x4478fa
mov ecx, dword [edi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x4479c1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [esp + 0x20]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x4479a5
mov edx, dword [esp + 0x28]
mov byte [edx], 1
test eax, 0x400
je 0x4479b3
mov ecx, dword [esp + 0x2c]
mov byte [ecx], 1
test eax, 0x100
je 0x4479c1
mov edx, dword [esp + 0x24]
mov byte [edx], 1
mov eax, dword [esp + 0x20]
and dword [eax], 0xff
push ebp
call fcn.004127bd
mov eax, dword [esp + 0x20]
push eax
call fcn.004127bd
mov al, byte [esp + 0x38]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x18
Function at 0x4479ec
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x447ad3
cmp edi, 0x14
je 0x447ad3
cmp edi, 0x90
je 0x447ad3
cmp edi, 0x91
je 0x447ad3
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
or esi, 0xc0000001
cmp bl, 1
je 0x447a64
push edi
call fcn.00439c1d
cmp al, 1
jne 0x447a6a
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x447a7d
test eax, 0x100
jne 0x447a7d
cmp edi, 0x12
jne 0x447a9b
test al, 8
jne 0x447a9b
test eax, 0x800
jne 0x447a9b
mov ecx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x105
push ecx
jmp 0x447aa6
mov edx, dword [ebp + 0x14]
push esi
push edi
push 0x101
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor byte [esp + edi + 0x10], 0x80
lea eax, [esp + edi + 0x10]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
push ebp
call fcn.00439ff3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x447ae8
push edi
call fcn.00439c1d
cmp al, 1
je 0x447ae8
push 0
push 2
jmp 0x447aec
push 0
push 3
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.00439ff3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc

Function at 0x447b07
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x447bfe
cmp edi, 0x14
je 0x447bfe
cmp edi, 0x90
je 0x447bfe
cmp edi, 0x91
je 0x447bfe
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [esp + edi + 0x10], 0x80
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
shl esi, 0x10
or esi, 1
cmp bl, 1
je 0x447b8c
push edi
call fcn.00439c1d
cmp al, 1
jne 0x447b92
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x447ba5
test eax, 0x100
jne 0x447ba5
cmp edi, 0x12
jne 0x447bda
test al, 8
jne 0x447bda
test eax, 0x800
jne 0x447bda
mov edx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x104
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00439fdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0x100
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.00439fdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x447c13
push edi
call fcn.00439c1d
cmp al, 1
je 0x447c13
push 0
push 0
jmp 0x447c17
push 0
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.00439fdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
Function at 0x447c57
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x447e53
mov eax, dword [esi + 0x14]
push edi
test eax, eax
je 0x447de6
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x447de6
push ebp
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 1
je 0x447cd2
test bl, 8
jne 0x447cd2
test ebx, 0x800
jne 0x447cd2
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xe0000001
push ecx
push 0x12
push 0x105
push edx
jmp 0x447cee
test ebp, ebp
je 0x447cf0
movzx eax, byte [esi + 0x19]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push ecx
call edi
mov eax, ebx
and eax, 8
mov dword [esp + 0x14], eax
je 0x447d16
movzx edx, byte [esi + 0x18]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x11
push 0x101
push eax
call edi
mov eax, ebx
and eax, 2
mov dword [esp + 0x18], eax
je 0x447d3e
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push edx
push 0x101
push eax
call edi
mov eax, ebx
and eax, 4
mov dword [esp + 0x10], eax
je 0x447d64
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x10
push 0x101
push edx
call edi
and ebx, 0x10
je 0x447d83
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push ecx
call edi
mov cl, 0x80
test ebx, ebx
je 0x447d8d
xor byte [esp + 0x77], cl
cmp dword [esp + 0x18], 0
je 0x447da3
mov eax, dword [esi + 0x20]
xor byte [esp + 0x2c], cl
xor byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
cmp dword [esp + 0x10], 0
je 0x447db5
xor byte [esp + 0x2c], cl
xor byte [esp + 0xbd], cl
cmp dword [esp + 0x14], 0
je 0x447dc0
xor byte [esp + 0x2d], cl
test ebp, ebp
pop ebp
je 0x447dc9
xor byte [esp + 0x2a], cl
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
push esi
call fcn.00439ff3
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 1
je 0x447dfe
movzx eax, byte [esi + 0x19]
push 0
push 2
push eax
push 0x12
call edi
test bl, 8
je 0x447e10
movzx ecx, byte [esi + 0x18]
push 0
push 2
push ecx
push 0x11
call edi
test bl, 2
je 0x447e25
movzx edx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x20]
push 0
push 2
push edx
push eax
call edi
test bl, 4
je 0x447e3a
movzx ecx, byte [esi + 0x1c]
push 0
push 2
push ecx
push 0xa1
call edi
test bl, 0x10
je 0x447e4c
movzx edx, byte [esi + 0x1d]
push 0
push 2
push edx
push 0x5b
call edi
push esi
call fcn.00439ff3
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x447e5e
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x448046
mov eax, dword [esi + 0x14]
push ebp
push edi
test eax, eax
je 0x447fd8
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x447fd8
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x447eb1
or byte [esp + 0x77], cl
mov eax, ebx
and eax, 2
mov dword [esp + 0x14], eax
je 0x447ecb
mov eax, dword [esi + 0x20]
or byte [esp + 0x2c], cl
or byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
mov eax, ebx
and eax, 4
mov dword [esp + 0x18], eax
je 0x447ee1
or byte [esp + 0x2c], cl
or byte [esp + 0xbd], cl
mov eax, ebx
and eax, 8
mov dword [esp + 0x10], eax
je 0x447ef0
or byte [esp + 0x2d], cl
mov ebp, ebx
and ebp, 1
je 0x447efb
or byte [esp + 0x2e], cl
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
test edi, edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x447f28
movzx edx, byte [esi + 0x1d]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 1
push edx
push 0x5b
push 0x100
push eax
call edi
cmp dword [esp + 0x14], 0
je 0x447f49
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push edx
push 0x100
push eax
call edi
cmp dword [esp + 0x18], 0
je 0x447f68
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x10
push 0x100
push edx
call edi
cmp dword [esp + 0x10], 0
je 0x447f87
movzx eax, byte [esi + 0x18]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push ecx
call edi
test ebp, ebp
je 0x44803e
cmp dword [esp + 0x10], 0
jne 0x447fbc
test ebx, 0x800
jne 0x447fbc
movzx edx, byte [esi + 0x19]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0x20000001
push edx
push 0x12
push 0x104
push eax
jmp 0x44803c
test ebp, ebp
je 0x44803e
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x12
push 0x100
push edx
jmp 0x44803c
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x447ff0
movzx eax, byte [esi + 0x1d]
push 0
push 0
push eax
push 0x5b
call edi
test bl, 2
je 0x448005
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x20]
push 0
push 0
push ecx
push edx
call edi
test bl, 4
je 0x44801a
movzx eax, byte [esi + 0x1c]
push 0
push 0
push eax
push 0xa1
call edi
test bl, 8
je 0x44802c
movzx ecx, byte [esi + 0x18]
push 0
push 0
push ecx
push 0x11
call edi
test bl, 1
je 0x44803e
movzx edx, byte [esi + 0x19]
push 0
push 0
push edx
push 0x12
call edi
push esi
call fcn.00439fdc
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8