joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b8b30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov eax, vtable.Rect.0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
push esi
push eax
lea edx, [esp + 0x60]
mov ecx, edi
mov byte [esp + 0x7c], 1
call fcn.00467c00
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x50]
cmp eax, ebx
jle 0x468ad7
mov ecx, dword [esp + 0x5c]
sub ecx, dword [esp + 0x54]
cmp ecx, ebx
jle 0x468ad7
imul ecx, eax
cmp ecx, ebx
jle 0x468ad7
mov ecx, dword [esp + 0x44]
sub ecx, dword [esp + 0x3c]
cmp ecx, ebx
jle 0x468ad7
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x40]
sub eax, ebp
cmp eax, ebx
jle 0x468ad7
imul eax, ecx
cmp eax, ebx
jle 0x468ad7
mov edx, dword [edi]
mov eax, dword [edx + 0x60]
mov ecx, edi
call eax
mov edx, dword [esi]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x60]
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 0x40]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call edx
mov esi, dword [eax + 4]
mov eax, dword [edi]
mov edx, dword [eax + 0x40]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], esi
call edx
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp ebp, dword [esp + 0x48]
mov dword [esp + 0x24], eax
mov edi, ebp
jge 0x468ad7
mov ebx, ebp
mov ecx, ebp
imul ebx, esi
imul ecx, eax
mov dword [esp + 0x70], ecx
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
cmp esi, ecx
jge 0x468ac4
mov ecx, esi
and ecx, 0x80000007
jns 0x468a64
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, 0x80
sar eax, cl
mov ecx, eax
mov eax, esi
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x7c]
sar eax, 3
add eax, dword [esp + 0x70]
mov al, byte [eax + edx]
test al, cl
je 0x468ab9
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x1c]
sub edx, ebp
sub edx, dword [esp + 0x78]
lea ecx, [ebx + esi]
mov cx, word [eax + ecx*2]
mov eax, dword [esp + 0x20]
add edx, edi
imul edx, dword [esp + 0x18]
sub edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x74]
add edx, dword [esp + 0x50]
add edx, esi
mov word [eax + edx*2], cx
inc esi
cmp esi, dword [esp + 0x44]
jl 0x468a55
mov eax, dword [esp + 0x24]
add dword [esp + 0x70], eax
add ebx, dword [esp + 0x28]
inc edi
cmp edi, dword [esp + 0x48]
jl 0x468a49
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x10
Function at 0x468af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b8b00
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x68]
xor esi, esi
mov eax, vtable.Rect.0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x70]
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x70]
push ecx
push edx
push edi
push eax
lea edx, [esp + 0x58]
mov ecx, ebp
mov byte [esp + 0x74], 1
call fcn.00467c00
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x48]
cmp eax, esi
jle 0x468cc9
mov ecx, dword [esp + 0x54]
sub ecx, dword [esp + 0x4c]
cmp ecx, esi
jle 0x468cc9
imul ecx, eax
cmp ecx, esi
jle 0x468cc9
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x34]
cmp ecx, esi
jle 0x468cc9
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
sub eax, ebx
cmp eax, esi
jle 0x468cc9
imul eax, ecx
cmp eax, esi
jle 0x468cc9
mov edx, dword [ebp]
mov eax, dword [edx + 0x60]
mov ecx, ebp
call eax
mov edx, dword [edi]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x60]
mov ecx, edi
call eax
mov edx, dword [edi]
mov edx, dword [edx + 0x40]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call edx
mov esi, dword [eax + 4]
mov eax, dword [ebp]
mov edx, dword [eax + 0x40]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
mov dword [esp + 0x24], esi
call edx
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp ebx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov ebp, ebx
jge 0x468cc9
mov ecx, ebx
mov edi, ebx
imul ecx, eax
imul edi, esi
add edi, dword [esp + 0x6c]
mov dword [esp + 0x68], ecx
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
cmp esi, ecx
jge 0x468cb6
lea ecx, [ecx]
mov ecx, esi
and ecx, 0x80000007
jns 0x468c5f
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, 0x80
sar eax, cl
mov ecx, eax
mov eax, esi
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x78]
sar eax, 3
add eax, dword [esp + 0x68]
mov al, byte [eax + edx]
test al, cl
je 0x468cab
mov ecx, dword [esp + 0x4c]
sub ecx, ebx
sub ecx, dword [esp + 0x74]
mov dl, byte [edi + esi]
mov eax, dword [esp + 0x18]
add ecx, ebp
imul ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x70]
add ecx, dword [esp + 0x48]
add ecx, esi
mov byte [ecx + eax], dl
inc esi
cmp esi, dword [esp + 0x3c]
jl 0x468c50
mov eax, dword [esp + 0x1c]
add dword [esp + 0x68], eax
add edi, dword [esp + 0x20]
inc ebp
cmp ebp, dword [esp + 0x40]
jl 0x468c41
mov al, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x14
Function at 0x468eb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bc9b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], vtable.Dimension.0
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call edx
test al, al
je 0x468f0c
call fcn.00468f30
lea ecx, [esi + 0x28]
call fcn.00458920
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4698a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
movzx ebx, word [ecx + 6]
push ebp
push esi
mov esi, edx
movzx edx, word [eax + 4]
mov dword [esp + 0x14], edx
movzx edx, word [eax + 6]
mov dword [esp + 0x24], edx
movzx edx, word [eax + 8]
mov dword [esp + 0x30], edx
movzx edx, word [eax + 0xa]
push edi
movzx edi, word [ecx + 4]
movzx ecx, word [ecx + 8]
mov dword [esp + 0x14], edx
movzx edx, word [eax + 0xc]
movzx eax, word [eax + 0xe]
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ecx
lea ebp, [esi + 0x20]
lea eax, [edi + 1]
mov ecx, ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ebx
call fcn.004699e0
lea ecx, [esi + 0x38]
lea eax, [ebx + 1]
mov dword [esp + 0x20], ecx
call fcn.004699e0
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x50]
inc eax
mov dword [esp + 0x2c], ecx
call fcn.004699e0
mov esi, edi
xor ebx, ebx
shr esi, 1
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
sar edx, 2
cmp ebx, edx
jb 0x469932
call fcn.00480e22
mov eax, esi
xor edx, edx
div edi
mov ecx, dword [esp + 0x14]
add esi, dword [esp + 0x18]
inc ebx
shl eax, cl
mov ecx, dword [ebp + 0xc]
mov dword [ecx + ebx*4 - 4], eax
cmp ebx, edi
jbe 0x469920
mov ebx, dword [esp + 0x1c]
mov edi, ebx
xor esi, esi
shr edi, 1
jmp 0x469960
mov ebp, dword [esp + 0x20]
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
sar edx, 2
cmp esi, edx
jb 0x469976
call fcn.00480e22
mov eax, edi
xor edx, edx
div ebx
mov ecx, dword [esp + 0x24]
add edi, dword [esp + 0x28]
inc esi
shl eax, cl
mov ecx, dword [ebp + 0xc]
mov dword [ecx + esi*4 - 4], eax
cmp esi, ebx
jbe 0x469960
mov ebx, dword [esp + 0x10]
mov edi, ebx
xor esi, esi
shr edi, 1
lea esp, [esp]
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 0xc]
sar edx, 2
cmp esi, edx
jb 0x4699b6
call fcn.00480e22
mov eax, edi
xor edx, edx
div ebx
mov ecx, dword [esp + 0x30]
add edi, dword [esp + 0x34]
inc esi
shl eax, cl
mov ecx, dword [ebp + 0xc]
mov dword [ecx + esi*4 - 4], eax
cmp esi, ebx
jbe 0x4699a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x46a7e0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4be5a8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x413f30
push 0
mov dword [esi], vtable.Thread.0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.GateKicker.0
call fcn.0041ada0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x46acd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bc8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 8], 0
je 0x46ad7a
lea ecx, [esp + 0x18]
call fcn.00404990
push ebx
lea eax, [esp + 0x1c]
push str.The__s___function_has_failed:_connection_has_already_been_closed.
push eax
mov dword [esp + 0x8c], 0
call fcn.004056a0
mov eax, dword [esp + 0x34]
add esp, 0xc
mov esi, eax
cmp eax, dword [esp + 0x2c]
jbe 0x46ad3b
call fcn.00480e22
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x46ad76
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x46ad54
call fcn.00480e22
push esi
lea ecx, [esp + 0x38]
push ecx
call fcn.004048f0
push 0x56e7fc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], vtable.IOException.0
call fcn.004841dc
mov eax, dword [eax]
jmp 0x46ad4a
mov eax, dword [esi + 0x18]
mov edx, dword [eax + 4]
lea edi, [esi + 0x18]
mov ecx, edi
mov dword [esp + 0x10], vtable.AutoLock.0
mov dword [esp + 0x14], edi
call edx
mov dword [esp + 0x80], 1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46adb4
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x10], 0
cmp byte [esi + 0x14], 0
je 0x46ae32
lea ecx, [esp + 0x34]
mov byte [esi + 0x14], 0
call fcn.00404990
push ebx
push ebx
lea eax, [esp + 0x3c]
push str.Transport_was_reconnected_outside_from_the__s___function._The__s___function_at_this_time_will_be_aborted.
push eax
mov byte [esp + 0x90], 2
call fcn.004056a0
mov eax, dword [esp + 0x54]
add esp, 0x10
mov esi, eax
cmp eax, dword [esp + 0x48]
jbe 0x46adf4
call fcn.00480e22
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x46ae2e
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x46ae0d
call fcn.00480e22
lea ecx, [esp + 0x54]
push ecx
call fcn.00404880
push 0x56eab0
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x5c], vtable.ReconnectException.0
call fcn.004841dc
mov eax, dword [eax]
jmp 0x46ae03
mov esi, dword [esi + 0xc]
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46b030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bc880
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
lea esi, [esp + 0x14]
call fcn.0045ccb0
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea esi, [esp + 0x1c]
call fcn.0045ccb0
mov ecx, dword [eax]
sub ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
sbb eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x3c]
sub eax, ecx
test eax, eax
jle 0x46b19a
lea esi, [esp + 0x2c]
call fcn.0045ccb0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub ecx, dword [esp + 0x14]
sbb eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x3c]
sub eax, ecx
je 0x46b19a
cmp byte [edi + 8], 0
jne 0x46b19a
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x46b0d4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 0x18]
mov eax, dword [edx + 4]
lea esi, [edi + 0x18]
mov ecx, esi
call eax
mov ecx, dword [ebp + 0xc]
cmp dword [edi + 0xc], ecx
je 0x46b0f2
mov byte [edi + 0x14], 0
mov byte [esp + 0x13], 1
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp byte [esp + 0x13], 0
je 0x46b073
mov esi, dword [edi + 0x40]
push str.ReconnectingChannel_was_successfully_reconnected.
call fcn.004239b0
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x46b21b
lea ecx, [esp + 0x54]
call fcn.00404990
mov eax, dword [ebp + 8]
push eax
push eax
lea edx, [esp + 0x5c]
push str.Transport_was_reconnected_in_the__s___function._The__s___function___at_this_time_will_be_aborted
push edx
mov dword [esp + 0xb0], 1
call fcn.004056a0
mov eax, dword [esp + 0x74]
add esp, 0x10
mov esi, eax
cmp eax, dword [esp + 0x68]
jbe 0x46b15c
call fcn.00480e22
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x46b214
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x46b179
call fcn.00480e22
lea eax, [esp + 0x74]
push eax
call fcn.00404880
push 0x56eab0
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.ReconnectException.0
call fcn.004841dc
lea ecx, [esp + 0x38]
call fcn.00404990
mov ecx, dword [ebp + 8]
push ecx
lea edx, [esp + 0x3c]
push str.The_ReconnectingChannel::_s___function_failed.
push edx
mov dword [esp + 0xac], 0
call fcn.004056a0
mov eax, dword [esp + 0x54]
add esp, 0xc
mov esi, eax
cmp eax, dword [esp + 0x4c]
jbe 0x46b1d5
call fcn.00480e22
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x46b210
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x46b1ee
call fcn.00480e22
push esi
lea eax, [esp + 0x58]
push eax
call fcn.004048f0
push 0x56e7fc
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x5c], vtable.IOException.0
call fcn.004841dc
mov eax, dword [eax]
jmp 0x46b1e4
mov eax, dword [eax]
jmp 0x46b16f
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46c370
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
movzx ecx, byte [ebp + 0xc]
push esi
push edi
mov edi, eax
movzx eax, byte [ebp + 8]
mov esi, dword [edi + 8]
push ecx
movzx edx, bl
push edx
push eax
push 0x564550
mov dword [esp + 0x18], eax
call fcn.00423a10
movzx eax, byte [edi + 4]
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 2]
mov esi, dword [edi + 8]
push eax
movzx eax, byte [edi + 1]
push ecx
movzx ecx, byte [edi]
push edx
push eax
push ecx
push str.The_modifier_states_before:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
call fcn.00423a10
mov al, byte [ebp + 8]
add esp, 0x28
cmp al, 0x11
je 0x46c3d3
cmp al, 0xa3
je 0x46c3d3
cmp al, 0xa2
jne 0x46c3da
test bl, bl
sete dl
mov byte [edi], dl
cmp al, 0x12
je 0x46c3e6
cmp al, 0xa5
je 0x46c3e6
cmp al, 0xa4
jne 0x46c3ee
test bl, bl
sete cl
mov byte [edi + 1], cl
cmp al, 0x2e
jne 0x46c3fc
test bl, bl
sete dl
mov byte [edi + 2], dl
jmp 0x46c420
cmp al, 0x10
je 0x46c408
cmp al, 0xa1
je 0x46c408
cmp al, 0xa0
jne 0x46c410
test bl, bl
sete cl
mov byte [edi + 3], cl
cmp al, 0x5b
je 0x46c418
cmp al, 0x5c
jne 0x46c420
test bl, bl
sete dl
mov byte [edi + 4], dl
movzx eax, byte [edi + 4]
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 2]
mov esi, dword [edi + 8]
push eax
movzx eax, byte [edi + 1]
push ecx
movzx ecx, byte [edi]
push edx
push eax
push ecx
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
call fcn.00423a10
add esp, 0x18
cmp byte [edi], 0
je 0x46c4a0
cmp byte [edi + 1], 0
je 0x46c4a0
cmp byte [edi + 2], 0
je 0x46c4a0
cmp byte [edi + 4], 0
jne 0x46c4a0
cmp byte [edi + 3], 0
jne 0x46c4a0
cmp byte [edi + 5], 0
mov esi, dword [edi + 8]
je 0x46c48b
push str.Try_simulate_the_CtrlAltDel_combination
call fcn.00423a10
mov eax, dword [edi + 8]
add esp, 4
call fcn.0041b720
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
call fcn.00423a10
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
movzx dx, byte [ebp + 8]
xor eax, eax
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xc]
mov esi, 1
push eax
mov dword [esp + 0x14], esi
mov word [esp + 0x18], dx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [esp + 0x12], ax
test bl, bl
je 0x46c4ea
mov dword [esp + 0x14], 2
cmp byte [ebp + 0xc], 0
je 0x46c4f4
or dword [esp + 0x14], esi
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x46c483
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46c52f
lea edx, [esp + 0x28]
push edx
mov edi, eax
call fcn.00419b30
push 0x56e788
lea eax, [esp + 0x2c]
push eax
call fcn.004841dc
push str.SendInput___function_failed
lea ecx, [esp + 0x2c]
push ecx
call fcn.004048f0
push 0x56e6e0
lea edx, [esp + 0x2c]
push edx
call fcn.004841dc
int3
Function at 0x46c8d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bc790
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax]
test cl, cl
jne 0x46c914
cmp byte [eax + 1], cl
jne 0x46c914
mov byte [esp + 0xf], cl
cmp byte [eax + 3], cl
je 0x46c919
mov byte [esp + 0xf], 1
test cl, cl
je 0x46c92e
cmp byte [eax + 1], 0
jne 0x46c92e
cmp byte [eax + 3], 0
mov byte [esp + 0xe], 1
je 0x46c933
mov byte [esp + 0xe], 0
push esi
push edi
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx ebx, ax
cmp bx, 0xffff
jne 0x46ca01
cmp byte [esp + 0xe], 0
je 0x46c98f
lea eax, [edi - 0x41]
cmp ax, 0x19
ja 0x46c96f
mov ax, di
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [edi - 0x61]
cmp cx, 0x19
ja 0x46c98f
lea eax, [edi - 0x20]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
call fcn.00404990
movzx edx, di
push edx
lea eax, [esp + 0x14]
push str.Cant_translate_the__d_character_to_the_scan_code
push eax
mov dword [esp + 0x84], 0
call fcn.004056a0
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov esi, eax
cmp eax, dword [esp + 0x24]
jbe 0x46c9ca
call fcn.00480e22
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x46c9fd
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x46c9e3
call fcn.00480e22
push esi
lea ecx, [esp + 0x30]
push ecx
call fcn.004048f0
push 0x56e6e0
lea edx, [esp + 0x30]
push edx
call fcn.004841dc
mov eax, dword [eax]
jmp 0x46c9d9
mov ecx, ebx
call fcn.0046cb00
test al, al
je 0x46ca2a
push str.Special_dead_symbol_must_be_inserted_only_as_unicode_character
lea eax, [esp + 0x30]
push eax
call fcn.004048f0
push 0x56e6e0
lea ecx, [esp + 0x30]
push ecx
call fcn.004841dc
push edi
call fcn.0046cbd0
test al, al
jne 0x46ca81
lea ecx, [esp + 0x10]
call fcn.00404990
movzx edx, di
push edx
lea eax, [esp + 0x14]
push str.Cant_get_the__d_character_by_one_keyboard_event
push eax
mov dword [esp + 0x84], 1
call fcn.004056a0
add esp, 0xc
lea esi, [esp + 0x10]
call fcn.00404b20
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.004048f0
push 0x56e6e0
lea edx, [esp + 0x30]
push edx
call fcn.004841dc
cmp byte [esp + 0xf], 0
jne 0x46cae5
mov eax, esi
and eax, 0xffff0000
cmp eax, 0xf0010000
jne 0x46caba
cmp di, 0x36
jne 0x46caba
push str.Special_case_for_the_6_character_on_the_USA_international_keyboard__it_will_be_inserted_as_an_unicode
lea eax, [esp + 0x30]
push eax
call fcn.004048f0
push 0x56e6e0
lea ecx, [esp + 0x30]
push ecx
call fcn.004841dc
cmp eax, 0x4140000
jne 0x46cae5
cmp di, 0x5c
jne 0x46cae5
push str.Special_case_for_the__character_on_the_norwegian_keyboard__it_will_be_inserted_as_an_unicode
lea edx, [esp + 0x50]
push edx
call fcn.004048f0
push 0x56e6e0
lea eax, [esp + 0x50]
push eax
call fcn.004841dc
mov ax, bx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4