joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f571
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5ce180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x5d4610]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x42f5ca
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42f5ef
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5d4610], eax
jmp 0x42f5d3
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x42f5ef
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [0x57b960]
call esi
jmp 0x42f731
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.0042f9d0
lea eax, [ebp - 0x14]
push eax
call fcn.00551c60
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.00553356
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0042f9d0
lea eax, [ebp - 0x14]
push eax
call fcn.00551c60
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.00553356
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.0042f9d0
lea eax, [ebp - 0x14]
push eax
call fcn.00551c60
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00553356
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0042f9d0
lea eax, [ebp - 0x14]
push eax
call fcn.00551c60
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00553356
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.0042f9d0
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.00551c60
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00553356
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c4e2
leave
ret
Function at 0x439d5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x439d74
call fcn.00415d93
mov esi, dword [eax + 0xc]
push 0x5832e0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x439db6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x439db6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x439db6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00439dbf
jmp 0x439db8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44e233
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5ce180]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x44e25f
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x44e28a
cmp dword [0x5d4954], 0
jne 0x44e28a
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x44e286
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x44e286
push edi
call fcn.0055d4bb
pop ecx
jmp 0x44e301
mov eax, edi
jmp 0x44e301
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0054eba0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x44e310
push esi
call fcn.00414151
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push esi
push 1
push 2
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054c4e2
leave
ret 4
call fcn.00413a5d
int3
Function at 0x455fda
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x456138
push esi
push edi
push 0x58b460
call fcn.0041fb97
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x456073
mov edi, dword [ebx + 0x168]
jmp 0x45605f
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45605f
push esi
call fcn.0041a58c
push eax
push 0x5cd8c4
call fcn.0041faf8
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x45605f
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x57b960]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x45605f
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x45600e
lea ecx, [ebx + 0x164]
call fcn.00427575
jmp 0x456136
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x456136
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00411d08
mov edi, dword [eax]
test edi, edi
jne 0x45609f
xor esi, esi
jmp 0x4560a2
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456126
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x456126
cmp dword [ebp - 0x10], 0
jne 0x4560fb
push edi
push 0x5cd8c4
call fcn.0041faf8
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
push eax
push 0x58bad0
call fcn.0041faf8
pop ecx
pop ecx
test eax, eax
je 0x456126
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.00455153
test eax, eax
jne 0x456126
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.0045327b
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x45608a
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x461ab7
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x461bfc
mov ecx, 0x5d5634
call fcn.0042e6da
mov esi, eax
test esi, esi
je 0x461bf1
mov ebx, dword [ebp + 8]
xor eax, eax
cmp word [esi + 8], ax
jne 0x461bbc
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x461b7d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
add ecx, 0xfffffffd
cmp ax, 0x11
jne 0x461b47
push 0x585a28
call fcn.00461c3a
pop ecx
mov ecx, 0x3fc
test eax, eax
je 0x461b47
cmp dword [ebp + 0x10], 0
lea eax, [ecx - 0xe]
push 0xfc11
cmovne eax, ecx
push eax
push 5
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x461b61
mov ecx, 0x3fc
cmp dword [ebp + 0x10], 0
mov eax, 0x3ee
push 5
cmovne eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x461b7d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x461b80
push edi
push ebx
push eax
call fcn.0045e107
add esp, 0xc
jmp 0x461b80
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.00413dba
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x461bf6
mov eax, dword [ebx]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.00420a01
mov ax, word [edi]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
mov edi, dword [esi + 4]
test edi, edi
je 0x461bca
push edi
call fcn.00551c60
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.004033b0
mov eax, dword [ebp + 0xc]
mov edx, 0xffff
movzx ecx, word [esi + 8]
pop edi
pop esi
mov word [eax], cx
xor eax, eax
cmp cx, dx
pop ebx
setne al
pop ebp
ret 0xc
call fcn.00413a5d
call fcn.00413a77
int3

Function at 0x4653cb
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [ecx + 0x14]
cmp dword [esi - 0xc], 0
je 0x465401
push ebx
mov ebx, dword [ecx + 8]
push edi
mov edi, dword [ecx + 0xc]
call fcn.00403590
test eax, eax
je 0x4653e9
mov eax, dword [eax + 0x20]
push 1
push edi
push ebx
push esi
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
sbb eax, eax
pop ebx
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x49020a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x490237
or dword [esi + 0x3c], 1
or dword [esi + 0x38], 2
jmp 0x49024c
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x49024c
or dword [esi + 0x3c], 2
or dword [esi + 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], edx
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0041a58c
jmp 0x49031d
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0041a58c
cmp eax, edi
jne 0x490327
push 1
push 0x209
push 0x200
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4902b9
push 1
push 0x109
push 0x100
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4902fd
mov eax, dword [ebp - 0x1c]
cmp eax, 0x202
je 0x490327
cmp eax, 0x205
je 0x490327
cmp eax, 0x201
je 0x490327
cmp eax, 0x204
je 0x490327
cmp eax, 0x100
jne 0x4902e5
cmp dword [ebp - 0x18], 0x1b
je 0x490327
push dword [ebp - 8]
lea eax, [esi + 0x24]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
sbb edx, dword [ebp - 4]
test edx, edx
jb 0x49031d
ja 0x490316
cmp eax, dword [0x5d5d54]
jbe 0x49031d
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], 0
je 0x49026e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4a3738
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5cd954], 0
push esi
push edi
je 0x4a37c0
cmp dword [0x5cd998], 0xfffffffe
jne 0x4a37ac
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x4a37c0
mov edi, 0x5d5dc0
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5d5dd8], 0
jne 0x4a37c4
push 0
push 0
push 0x4a37ca
call fcn.0055cba2
add esp, 0xc
mov dword [0x5d5dd8], eax
test eax, eax
je 0x4a379c
cmp eax, 0xffffffff
je 0x4a379c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x5cd998], esi
jmp 0x4a37a3
and dword [0x5d5dd8], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4a37c0
mov eax, dword [ebp + 8]
mov dword [0x5cd998], eax
cmp eax, 0xffffffff
jne 0x4a37c0
and dword [0x5d5dd8], 0
pop edi
pop esi
pop ebp
ret
call fcn.00413a5d
int3

Function at 0x4a86f7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5ce180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041f50c
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push dword [esi + 0x20]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x21
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov ebx, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, esi
mov dword [ebp - 0x1c], eax
call fcn.0041a19b
mov esi, eax
push 2
pop eax
test edi, 0x1000
je 0x4a876c
cmp esi, 3
push eax
cmove esi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4a8769
xor eax, eax
jmp 0x4a87c0
push 2
pop eax
push 0xa
pop edi
cmp esi, edi
jl 0x4a8778
cmp esi, 0x11
jle 0x4a877d
cmp esi, 4
jne 0x4a87be
test dword [ebp - 0x18], 0x800
jne 0x4a87c0
mov eax, dword [ebp - 0x1c]
neg ebx
push ebx
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test dword [ebp - 0x18], 0x200
je 0x4a87be
mov eax, esi
sub eax, 4
je 0x4a87ff
sub eax, 9
je 0x4a87ef
sub eax, 1
je 0x4a87df
dec eax
sub eax, 1
je 0x4a87d1
sub eax, 1
je 0x4a87ff
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c4e2
leave
ret 8
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
push 0xf
pop ecx
cmovg edi, ecx
jmp 0x4a87fb
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
add eax, 0xb
jmp 0x4a87c0
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x10]
push 0xc
pop eax
cmovl edi, eax
mov eax, edi
jmp 0x4a87c0
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
push 0xb
pop eax
push 0xf
pop edx
cmovg eax, edx
jmp 0x4a87c0
Function at 0x4b4658
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x4b47df
je 0x4b4806
sub eax, 0xa1
je 0x4b4806
sub eax, 1
je 0x4b4806
dec eax
sub eax, 1
je 0x4b4806
sub eax, 1
je 0x4b4806
dec eax
sub eax, 1
je 0x4b4806
sub eax, 1
je 0x4b4806
sub eax, 0x58
jne 0x4b4844
cmp dword [edi + 0xc0], 0xffffffff
je 0x4b4806
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4b4806
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x4b4734
sub eax, 1
jne 0x4b4806
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x4b4723
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
test eax, eax
jne 0x4b4780
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x4b46f9
jmp 0x4b485e
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x4b485e
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
test eax, eax
jne 0x4b4780
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x4b474b
jmp 0x4b485e
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
mov ecx, eax
call fcn.0041f78a
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x4b485e
sub eax, 0x200
je 0x4b4806
sub eax, 1
je 0x4b4806
sub eax, 1
je 0x4b4806
dec eax
sub eax, 1
je 0x4b4806
sub eax, 1
je 0x4b4806
dec eax
sub eax, 1
je 0x4b4806
sub eax, 1
jne 0x4b4844
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x4b4825
cmp dword [eax + 0x20], ebx
je 0x4b4825
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x4b4844
cmp dword [eax + 0x20], ebx
je 0x4b4844
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 4], 0x203
jne 0x4b4863
lea eax, [edi + 0x2250]
test eax, eax
je 0x4b485a
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x4b4863
xor eax, eax
inc eax
jmp 0x4b486b
push esi
mov ecx, edi
call fcn.004aeb15
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4bd629
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5ce180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x18], eax
cmp edi, 0x20
jne 0x4bd695
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 0x20]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
mov ecx, esi
add eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
add eax, 0x17
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004be630
mov ecx, esi
call fcn.004bd993
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x4bd6e1
push ebx
xor ebx, ebx
cmp dword [esi + 0x318], ebx
jne 0x4bd6b1
cmp edi, 0x79
je 0x4bd6aa
cmp edi, 0x12
jne 0x4bd6ad
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x4bd6e0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
push 0x10
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
cmp edi, 0x12
je 0x4bd6f1
cmp edi, 0x79
je 0x4bd6f1
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054c4e2
leave
ret 0xc
cmp dword [0x5d5d8c], ebx
jne 0x4bd6de
test byte [esi + 0x330], 2
jne 0x4bd6de
cmp edi, 0x12
je 0x4bd71a
cmp edi, 0x79
jne 0x4bd6de
mov ecx, 0x8000
test dword [ebp - 0x20], ecx
jne 0x4bd6de
test ecx, eax
jne 0x4bd6de
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0041a58c
cmp eax, esi
jne 0x4bd73d
test dword [ebp + 0x10], 0x40000000
jne 0x4bd73d
cmp edi, 0x79
jne 0x4bd74b
mov ecx, dword [ebp - 0x18]
jmp 0x4bd744
cmp edi, 0x79
jne 0x4bd74b
mov ecx, esi
call fcn.0041f78a
jmp 0x4bd767
cmp dword [esi + 0x2d4], ebx
jge 0x4bd767
push ebx
push 0xc8
push 0xec1a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
jmp 0x4bd6e0
Function at 0x4cd1f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x1b8]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
mov ecx, dword [0x5cd850]
test al, 0x80
push 0xffffffffffffffff
pop eax
cmovne ecx, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x2b4]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
push dword [ebp - 4]
mov esi, eax
push 0x5cdaf0
mov dword [ebp - 0xc], esi
call fcn.0041faf8
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x4cd30d
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4cd30d
test ebx, ebx
je 0x4cd29d
mov eax, dword [ebx]
push 0
mov esi, dword [eax + 0x228]
mov ecx, esi
call dword [0x57b960]
mov ecx, ebx
call esi
push eax
push 0x5cdb34
call fcn.0041faf8
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x4cd29f
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 2
jne 0x4cd316
test eax, eax
je 0x4cd2ef
mov eax, dword [edi]
mov esi, dword [eax + 0x1c0]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
test al, 0x40
je 0x4cd30d
cmp dword [ebp - 4], 0
je 0x4cd2ef
mov ebx, dword [ebp - 8]
push edi
mov eax, dword [ebx]
mov esi, dword [eax + 0x24c]
mov ecx, esi
call dword [0x57b960]
mov ecx, ebx
call esi
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, edi
jmp 0x4cd30f
mov eax, dword [edi]
push 5
push 0
push ebx
mov esi, dword [eax + 0x1f8]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp esi, 3
jne 0x4cd30d
test ebx, ebx
je 0x4cd30d
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 0x184]
mov ecx, esi
call dword [0x57b960]
mov ecx, ebx
call esi
test eax, eax
je 0x4cd30d
mov eax, dword [edi]
mov esi, dword [eax + 0x18c]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
test eax, eax
je 0x4cd30d
mov eax, dword [edi]
push 0
mov esi, dword [eax + 0x240]
mov ecx, esi
call dword [0x57b960]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0
push 1
push 5
mov esi, dword [eax + 0x34c]
mov ecx, esi
push ebx
call dword [0x57b960]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x4cd30f
Function at 0x4cf6b5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x4cf754
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x4cf750
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4cf750
cmp dword [ebx], eax
jne 0x4cf750
mov eax, dword [ebx + 4]
sub eax, 1
je 0x4cf72a
sub eax, 1
je 0x4cf6fa
sub eax, 1
jne 0x4cf750
mov edi, 0x428e
jmp 0x4cf72f
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4cf72f
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x57b960]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x4cf72f
add edi, 3
jmp 0x4cf72f
mov edi, 0x3ea0
push edi
mov ecx, 0x5d5e9c
call fcn.0040f5a0
test eax, eax
je 0x4cf754
mov eax, dword [0x5d5e9c]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x4cf749
call fcn.00413a5d
int3