joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44489c
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 1
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
cmp dword [esp + 0x14], 0
jne 0x4446f2
mov dword [esp + 0x14], 0x400
cmp dword [esp + 0x10], 0
je 0x44474b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00436632
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x444779
mov eax, dword [esp + 0x10]
test eax, eax
je 0x444742
push eax
push edi
lea ecx, [esi + 0x44]
push ecx
call fcn.004365c4
mov eax, dword [esp + 0x10]
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4446f9
jmp 0x44474b
push edi
call fcn.0041294d
add esp, 4
mov edx, dword [esi + 8]
or edx, dword [esi + 0xc]
jne 0x444767
push edx
push 0xdeadbeef
push 0x21
push esi
call fcn.00444685
pop edi
pop esi
pop ebx
ret 8
push 1
push 0
push 0
push esi
call fcn.00444685
pop edi
pop esi
pop ebx
ret 8
push edi
call fcn.0041294d
add esp, 4
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.00444685
pop edi
pop esi
pop ebx
ret 8
sub esp, 0x40c
push ebx
push esi
mov esi, dword [esp + 0x418]
mov eax, dword [esi + 0x34]
push edi
push 0x488468
push eax
mov dword [esp + 0x1c], fcn.004164dd
call fcn.0041644f
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x4447f2
push eax
push 0xdeadbeef
push 0x1f
push esi
call fcn.00444685
mov bl, al
lea eax, [esp + 0x10]
push eax
call fcn.004364da
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x420]
lea ecx, [esp + 0xc]
push ecx
push 0x400
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x444873
mov eax, dword [esp + 0xc]
test eax, eax
je 0x444843
push edi
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00415d17
mov eax, dword [esp + 0x1c]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x4447fa
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x444889
push eax
push 0xdeadbeef
push 0x21
push esi
call fcn.00444685
lea ecx, [esp + 0x10]
push ecx
mov bl, al
call fcn.004364da
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40c
ret 8
push 0
push 0xdeadbeef
push 0x20
push esi
call fcn.00444685
lea edx, [esp + 0x10]
push edx
jmp 0x44485e
push 1
push 0
push 0
push esi
call fcn.00444685
lea edx, [esp + 0x10]
push edx
jmp 0x44485e
mov eax, dword [esp + 4]
cmp byte [eax + 0x30], 0
mov ecx, dword [esp + 8]
je 0x4448b7
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x4446b8
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp 0x444797
Function at 0x444919
Capabilities:
Create http request

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp ecx, 1
jne 0x444933
movzx eax, word [esi + 0x8c]
jmp 0x444937
movzx eax, word [esi + 0x58]
cmp ecx, 1
movsx edx, ax
lea ecx, [esi + 0xb0]
je 0x444948
lea ecx, [esi + 0x7c]
mov eax, dword [esi + 0xc0]
push 0
cmp edx, 1
jne 0x44495c
push 0
push 0
push edx
jmp 0x4449a6
cmp edx, 2
jne 0x4449a0
mov ecx, dword [ecx]
push str._local_
push ecx
push 3
jmp 0x4449a6
cmp byte [esi + 0xdc], 0
je 0x444997
push 8
lea eax, [esp + 8]
push eax
push 0x32
push 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, 1
pop esi
add esp, 8
ret 8
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x44496d
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x444c3a
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
sub esp, 0x254
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
mov ebp, ecx
mov ecx, dword [esp + 0x268]
push eax
push ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x444cc9
lea ebx, [ebx]
lea edx, [esp + 0x3c]
push 0x487f84
push edx
call fcn.00414904
add esp, 8
test eax, eax
je 0x444cb9
lea eax, [esp + 0x3c]
push 0x48adf8
push eax
call fcn.00414904
add esp, 8
test eax, eax
je 0x444cb9
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push ecx
push edx
lea eax, [esp + 0x44]
push eax
call fcn.004388b4
add esp, 0xc
test al, al
je 0x444ceb
mov bl, 1
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x444c6a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
call esi
cmp byte [esp + 0x274], 0
jne 0x444d01
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
lea edx, [esp + 0x10]
push edx
push 0x48adf0
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x444d9a
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [esp + 0x10], 0x10
je 0x444d8a
lea eax, [esp + 0x3c]
push 0x487f84
push eax
call fcn.00414904
add esp, 8
test eax, eax
je 0x444d8a
lea ecx, [esp + 0x3c]
push 0x48adf8
push ecx
call fcn.00414904
add esp, 8
test eax, eax
je 0x444d8a
lea edx, [esp + 0x3c]
push edx
call ebx
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x26c]
push eax
mov eax, dword [esp + 0x26c]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00444c3a
test al, al
je 0x444dac
push 0x48adf8
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x444d1e
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x254
ret 0x10
Function at 0x4451ff
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a56d8], 0
push esi
push edi
mov esi, 0x4a4d08
jne 0x44521f
push 0
call fcn.00416338
push eax
call fcn.00436ebf
add esp, 8
mov dword [0x49323c], 0x270
mov dword [0x4a4d04], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x445234
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x44526f
mov ecx, dword [0x4a4d08]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x4456f5
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x4457da
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x445747
push 1
push esi
push eax
call fcn.004371c6
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0xc
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4457b5
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x44578a
cmp eax, 0xffffffff
jne 0x445732
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 1
push accept
push 0x4883c4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x445747
test eax, eax
je 0x445747
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.004371c6
push esi
call fcn.004371f6
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0xc
test al, 1
je 0x445777
mov eax, dword [esi]
test eax, eax
je 0x445756
pop esi
add esp, 0xc
ret 0xc
Function at 0x4457ef
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x4458d6
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x445844
push 1
push esi
push eax
call fcn.004371c6
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0x14
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4458b1
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x445886
cmp eax, 0xffffffff
jne 0x44582f
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 2
push 0x40000000
push 0x4883c4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x445844
test eax, eax
je 0x445844
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.004371c6
push esi
call fcn.004371f6
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0x14
test dword [esp + 0x18], eax
je 0x445874
mov eax, dword [esi]
test eax, eax
je 0x445853
pop esi
add esp, 0xc
ret 0x14

Function at 0x445914
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
push ecx
mov dword [esp + 0x18], edx
call fcn.00437210
test al, al
je 0x445966
test ebx, ebx
je 0x445966
test edi, edi
je 0x445966
push esi
push edx
lea eax, [esp + 0x1c]
push eax
lea esi, [ecx + 0x18]
mov ecx, dword [esi]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44595c
push esi
call fcn.004371f6
add esp, 4
mov eax, dword [esp + 0x18]
pop esi
pop edi
pop ebx
ret 0xc
pop edi
mov eax, edx
pop ebx
ret 0xc

Function at 0x445db8
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x445dd5
push esi
call fcn.0043800d
add esp, 4
test al, al
jne 0x445dee
push 1
jmp 0x445dd7
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret
Function at 0x446064
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
mov byte [0x494cb6], 0
test edi, edi
je 0x4460ab
mov byte [0x494cb7], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x445f41
push esi
push esi
mov dword [esp + 0x24], edi
call fcn.004157a7
add esp, 0x18
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
test esi, esi
je 0x4460e2
push 0xffffffffffffffff
push esi
mov byte [0x494cb7], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x494cb6], 1
jne 0x4460f4
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x4461cd
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004461b0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
ret 0xc
Function at 0x446720
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x2c], 1
cmp word [eax], si
jne 0x446747
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x18
push ebp
push eax
or eax, 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x30]
push ebp
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
call fcn.00414cf0
inc eax
push eax
call fcn.00412c3a
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x1c], ecx
mov al, byte [esi + ebp]
cmp al, 0x2b
je 0x446798
cmp al, 0x5e
je 0x446794
cmp al, 0x21
je 0x446794
cmp al, 0x23
jne 0x4467c8
cmp al, 0x2b
jne 0x4467a2
mov eax, dword [esp + 0x24]
mov byte [eax], 1
inc esi
jmp 0x446781
cmp al, 0x5e
jne 0x4467b0
mov edx, dword [esp + 0x28]
mov byte [edx], 1
inc esi
jmp 0x446781
cmp al, 0x21
jne 0x4467be
mov eax, dword [esp + 0x2c]
mov byte [eax], 1
inc esi
jmp 0x446781
cmp al, 0x23
jne 0x4467c5
mov byte [ebx], 1
inc esi
jmp 0x446781
mov al, byte [esi + ebp]
inc esi
mov byte [esp + 0x14], al
mov dword [esp + 0x10], esi
cmp al, 0x7b
jne 0x446879
lea edx, [esp + 0x10]
push edx
push ecx
push ebp
push 0x7d
call fcn.0043934a
test eax, eax
je 0x446800
mov byte [esp + 0x30], 0
jmp 0x4468b5
mov esi, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x493b10]
push esi
push eax
call fcn.004278b3
add esp, 8
test eax, eax
je 0x44681f
inc edi
cmp edi, 0x62
jl 0x446800
cmp edi, 0x62
jne 0x446861
movzx ecx, byte [esi]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [esp + 0x20]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x446843
mov ecx, dword [esp + 0x28]
mov byte [ecx], 1
test eax, 0x400
je 0x446851
mov edx, dword [esp + 0x2c]
mov byte [edx], 1
test eax, 0x100
je 0x4468b5
mov eax, dword [esp + 0x24]
mov byte [eax], 1
jmp 0x4468b5
cmp byte [edi + 0x493c98], 0
jne 0x4467ee
mov ecx, dword [edi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x4468b5
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov ecx, dword [esp + 0x20]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x446899
mov edx, dword [esp + 0x28]
mov byte [edx], 1
test eax, 0x400
je 0x4468a7
mov ecx, dword [esp + 0x2c]
mov byte [ecx], 1
test eax, 0x100
je 0x4468b5
mov edx, dword [esp + 0x24]
mov byte [edx], 1
mov eax, dword [esp + 0x20]
and dword [eax], 0xff
push ebp
call fcn.0041294d
mov eax, dword [esp + 0x20]
push eax
call fcn.0041294d
mov al, byte [esp + 0x38]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x18
Function at 0x4468e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x4469c7
cmp edi, 0x14
je 0x4469c7
cmp edi, 0x90
je 0x4469c7
cmp edi, 0x91
je 0x4469c7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
or esi, 0xc0000001
cmp bl, 1
je 0x446958
push edi
call fcn.0043939e
cmp al, 1
jne 0x44695e
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x446971
test eax, 0x100
jne 0x446971
cmp edi, 0x12
jne 0x44698f
test al, 8
jne 0x44698f
test eax, 0x800
jne 0x44698f
mov ecx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x105
push ecx
jmp 0x44699a
mov edx, dword [ebp + 0x14]
push esi
push edi
push 0x101
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor byte [esp + edi + 0x10], 0x80
lea eax, [esp + edi + 0x10]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
push ebp
call fcn.00439774
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x4469dc
push edi
call fcn.0043939e
cmp al, 1
je 0x4469dc
push 0
push 2
jmp 0x4469e0
push 0
push 3
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.00439774
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc

Function at 0x4469fb
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x446af2
cmp edi, 0x14
je 0x446af2
cmp edi, 0x90
je 0x446af2
cmp edi, 0x91
je 0x446af2
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [esp + edi + 0x10], 0x80
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
shl esi, 0x10
or esi, 1
cmp bl, 1
je 0x446a80
push edi
call fcn.0043939e
cmp al, 1
jne 0x446a86
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x446a99
test eax, 0x100
jne 0x446a99
cmp edi, 0x12
jne 0x446ace
test al, 8
jne 0x446ace
test eax, 0x800
jne 0x446ace
mov edx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x104
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0x100
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x446b07
push edi
call fcn.0043939e
cmp al, 1
je 0x446b07
push 0
push 0
jmp 0x446b0b
push 0
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
Function at 0x446b4b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446d47
mov eax, dword [esi + 0x14]
push edi
test eax, eax
je 0x446cda
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x446cda
push ebp
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 1
je 0x446bc6
test bl, 8
jne 0x446bc6
test ebx, 0x800
jne 0x446bc6
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xe0000001
push ecx
push 0x12
push 0x105
push edx
jmp 0x446be2
test ebp, ebp
je 0x446be4
movzx eax, byte [esi + 0x19]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push ecx
call edi
mov eax, ebx
and eax, 8
mov dword [esp + 0x14], eax
je 0x446c0a
movzx edx, byte [esi + 0x18]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x11
push 0x101
push eax
call edi
mov eax, ebx
and eax, 2
mov dword [esp + 0x18], eax
je 0x446c32
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push edx
push 0x101
push eax
call edi
mov eax, ebx
and eax, 4
mov dword [esp + 0x10], eax
je 0x446c58
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x10
push 0x101
push edx
call edi
and ebx, 0x10
je 0x446c77
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push ecx
call edi
mov cl, 0x80
test ebx, ebx
je 0x446c81
xor byte [esp + 0x77], cl
cmp dword [esp + 0x18], 0
je 0x446c97
mov eax, dword [esi + 0x20]
xor byte [esp + 0x2c], cl
xor byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
cmp dword [esp + 0x10], 0
je 0x446ca9
xor byte [esp + 0x2c], cl
xor byte [esp + 0xbd], cl
cmp dword [esp + 0x14], 0
je 0x446cb4
xor byte [esp + 0x2d], cl
test ebp, ebp
pop ebp
je 0x446cbd
xor byte [esp + 0x2a], cl
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_SetKeyboardState]
push esi
call fcn.00439774
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 1
je 0x446cf2
movzx eax, byte [esi + 0x19]
push 0
push 2
push eax
push 0x12
call edi
test bl, 8
je 0x446d04
movzx ecx, byte [esi + 0x18]
push 0
push 2
push ecx
push 0x11
call edi
test bl, 2
je 0x446d19
movzx edx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x20]
push 0
push 2
push edx
push eax
call edi
test bl, 4
je 0x446d2e
movzx ecx, byte [esi + 0x1c]
push 0
push 2
push ecx
push 0xa1
call edi
test bl, 0x10
je 0x446d40
movzx edx, byte [esi + 0x1d]
push 0
push 2
push edx
push 0x5b
call edi
push esi
call fcn.00439774
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x446d52
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446f3a
mov eax, dword [esi + 0x14]
push ebp
push edi
test eax, eax
je 0x446ecc
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x446ecc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x446da5
or byte [esp + 0x77], cl
mov eax, ebx
and eax, 2
mov dword [esp + 0x14], eax
je 0x446dbf
mov eax, dword [esi + 0x20]
or byte [esp + 0x2c], cl
or byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
mov eax, ebx
and eax, 4
mov dword [esp + 0x18], eax
je 0x446dd5
or byte [esp + 0x2c], cl
or byte [esp + 0xbd], cl
mov eax, ebx
and eax, 8
mov dword [esp + 0x10], eax
je 0x446de4
or byte [esp + 0x2d], cl
mov ebp, ebx
and ebp, 1
je 0x446def
or byte [esp + 0x2e], cl
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
test edi, edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
je 0x446e1c
movzx edx, byte [esi + 0x1d]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 1
push edx
push 0x5b
push 0x100
push eax
call edi
cmp dword [esp + 0x14], 0
je 0x446e3d
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push edx
push 0x100
push eax
call edi
cmp dword [esp + 0x18], 0
je 0x446e5c
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x10
push 0x100
push edx
call edi
cmp dword [esp + 0x10], 0
je 0x446e7b
movzx eax, byte [esi + 0x18]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push ecx
call edi
test ebp, ebp
je 0x446f32
cmp dword [esp + 0x10], 0
jne 0x446eb0
test ebx, 0x800
jne 0x446eb0
movzx edx, byte [esi + 0x19]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0x20000001
push edx
push 0x12
push 0x104
push eax
jmp 0x446f30
test ebp, ebp
je 0x446f32
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x12
push 0x100
push edx
jmp 0x446f30
mov edi, dword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x446ee4
movzx eax, byte [esi + 0x1d]
push 0
push 0
push eax
push 0x5b
call edi
test bl, 2
je 0x446ef9
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x20]
push 0
push 0
push ecx
push edx
call edi
test bl, 4
je 0x446f0e
movzx eax, byte [esi + 0x1c]
push 0
push 0
push eax
push 0xa1
call edi
test bl, 8
je 0x446f20
movzx ecx, byte [esi + 0x18]
push 0
push 0
push ecx
push 0x11
call edi
test bl, 1
je 0x446f32
movzx edx, byte [esi + 0x19]
push 0
push 0
push edx
push 0x12
call edi
push esi
call fcn.0043975d
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8