joyce8/EMBER2024-capa huggingface dataset:
Function at 0x23b10330
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
je case.0x23b103b2.10
cmp dword [esi + 0x1bc], 0xffffffff
jne 0x23b10387
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, esi
call edx
test eax, eax
je 0x23b10387
mov eax, dword [esp + 8]
cmp eax, 0xd
je 0x23b1036d
cmp eax, 0x20
jne case.0x23b103b2.10
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0xc0]
push 0
push eax
call fcn.23ae62a0
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0xc0]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.23a67c80
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
add esp, 8
cmp eax, 0x1f
ja case.0x23b103b2.10
movzx eax, byte [eax + 0x23b10590]
jmp dword [eax*4 + 0x23b10564]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.23b0e780
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
push 0xffffffffffffffff
jmp 0x23b103bb
mov ecx, dword [esi + 0x1bc]
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.23b0fa80
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1bc]
push 1
push edx
mov ecx, esi
call fcn.23b0fa80
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1bc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.23b0fde0
cmp eax, 0xffffffff
jne 0x23b103c4
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push eax
push edx
call fcn.23b30310
cmp eax, dword [esi + 0x40]
jne case.0x23b103b2.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.23b0e780
cmp eax, 0xffffffff
je case.0x23b103b2.10
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1bc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.23b0fc50
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x1bc]
push 1
push ecx
mov ecx, esi
call fcn.23b0fc50
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1bc]
push 1
push edx
mov ecx, esi
call fcn.23b0fde0
cmp eax, 0xffffffff
jne 0x23b103c4
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0xb8]
push 1
push 0
push 1
push 1
push eax
call fcn.23b30310
cmp eax, dword [esi + 0x40]
jne case.0x23b103b2.10
push 1
jmp 0x23b10451
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x23b10528
mov ecx, dword [esi + 0x1bc]
push 1
push ecx
mov ecx, esi
call fcn.23b0e780
cmp eax, dword [esi + 0x1bc]
jle case.0x23b103b2.10
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1bc]
push 0xffffffffffffffff
push edx
mov ecx, esi
call fcn.23b0e780
cmp eax, dword [esi + 0x1bc]
jge case.0x23b103b2.10
push eax
mov ecx, esi
call fcn.23b0ff20
mov eax, 1
pop esi
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x98]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 8
Function at 0x23b11570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23bd94e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x23c68938]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x20]
push eax
call fcn.23a9c400
test eax, eax
jne 0x23b115e3
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.23b01100
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x14
dec eax
push eax
lea ecx, [esi - 0x20]
call fcn.23b0e360
mov esi, eax
test esi, esi
jne 0x23b1160b
mov eax, 0x80070057
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x14
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.23afd3d0
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], 0
call fcn.23a68820
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add esp, 4
test eax, eax
jne 0x23b11677
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.23a77e10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.23a11600
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x23b11677
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
push eax
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x23b1168f
call fcn.23a0f880
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x23b116bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x14
Function at 0x23b140e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23bd95f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x23c68938]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x23c68938]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, ecx
mov eax, 0x55
mov edx, eax
mov ecx, 0xaa
mov word [esp + 0x2c], ax
mov eax, ecx
mov word [esp + 0x2e], cx
mov ecx, edx
mov word [esp + 0x30], dx
mov edx, eax
mov word [esp + 0x32], ax
mov eax, ecx
mov word [esp + 0x34], cx
mov ecx, edx
xor ebx, ebx
mov word [esp + 0x36], dx
mov word [esp + 0x38], ax
mov word [esp + 0x3a], cx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBitmap.0
lea edx, [esp + 0x2c]
push edx
push 1
push 1
push 8
push 8
mov dword [esp + 0x5c], ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x24]
call fcn.23a38bcc
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], vtable.CBrush.0
mov eax, dword [esp + 0x24]
push eax
mov byte [esp + 0x4c], 1
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x1c]
call fcn.23a38bcc
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.23a38d2d
mov edx, dword [esi]
push 0xf
mov ecx, ebp
mov ebx, eax
mov dword [esp + 0x18], edx
call fcn.23adaa20
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0x2c]
mov ecx, esi
call edx
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x14
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.23adaa20
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov ebp, eax
mov eax, dword [edi + 0xc]
mov edi, dword [edi + 8]
push 0xf00021
sub eax, ecx
push eax
sub edi, edx
push edi
push ecx
mov ecx, dword [esi + 4]
push edx
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call fcn.23a38d2d
mov edx, dword [esi]
mov eax, dword [esp + 0x28]
mov edx, dword [edx + 0x2c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebp
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
call fcn.23a38c24
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 0
mov dword [esp + 0x18], vtable.CBrush.0
call fcn.23a38df7
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x20], vtable.CBitmap.0
call fcn.23a38df7
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.23a4addf
add esp, 0x38
ret 8
Function at 0x23b16140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23bd96f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x23c68938]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.23b160f0
lea ecx, [esi + 0x5dc]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CXTPVisualStudio2008Theme.0
call fcn.23a64640
lea ecx, [esi + 0x5fc]
call fcn.23a64600
lea ecx, [esi + 0x608]
call fcn.23a64600
mov eax, dword [esi + 0x45c]
mov dword [esi + 0x80], 0xa
mov dword [eax + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x23b16aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23bd9728
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x23c68938]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.23b145a0
lea ecx, [esi + 0x5dc]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CXTPVisualStudio2010Theme.0
call fcn.23a64600
mov ecx, dword [esi + 0x45c]
mov eax, 1
mov dword [esi + 0x80], 0xa
mov dword [ecx + 0x30], eax
mov dword [esi + 0x56c], eax
mov dword [esi + 0x568], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x570], 2
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x23b19820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.23af8ab0
mov ecx, esi
call fcn.23af8a20
mov edi, eax
mov ecx, edi
call fcn.23a7c200
push 0xffffffffffffffff
push str.GroupSpacing
push str.Ribbon
mov ecx, esi
call fcn.23af8a20
mov ecx, eax
call fcn.23aa3f60
neg eax
push 0xffffffffffffffff
sbb eax, eax
push str.GroupClientText
inc eax
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x67c], eax
call fcn.23aa3de0
push 0xffffffffffffffff
push str.ControlEditNormal
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x390], eax
mov dword [esi + 0x438], 0x8d8d8d
call fcn.23aa3de0
push 0xffffff
push str.ControlEditSelected
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x660], eax
call fcn.23aa3de0
push 0xffffffffffffffff
push str.MenuPopupText
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x664], eax
call fcn.23aa3de0
push 0xffffffffffffffff
push str.MenuPopupGripper
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x378], eax
call fcn.23aa3de0
push eax
lea ecx, [esi + 0x500]
call fcn.23a64f20
fld dword [0x23be6e24]
push ecx
fstp dword [esp]
push 0xffffffffffffffff
push str.MenuPopupExpandedGripperDark
push str.Ribbon
mov ecx, edi
call fcn.23aa3de0
push eax
push 0xffffffffffffffff
push str.MenuPopupExpandedGripperLight
push str.Ribbon
mov ecx, edi
call fcn.23aa3de0
push eax
lea ecx, [esi + 0x4e0]
call fcn.23a64670
mov eax, dword [esi + 0x45c]
push 0xffffffffffffffff
push str.ControlHighlightText
mov dword [eax + 0x34], 0
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x30c], 0xa7a7a7
call fcn.23aa3de0
mov dword [esi + 0x384], eax
mov dword [esi + 0x36c], 0x868686
mov dword [esi + 0x354], 0xfafafa
push 0xc5c5c5
push str.MenuPopupSeparator
push str.Ribbon
mov ecx, edi
call fcn.23aa3de0
fld dword [0x23be6e24]
push ecx
fstp dword [esp]
push 0xeeeee9
push 0xeeeee9
lea ecx, [esi + 0x4c0]
mov dword [esi + 0x674], eax
call fcn.23a64670
push 0xffffffffffffffff
push str.RibbonText
push str.Ribbon
mov ecx, edi
call fcn.23aa3de0
push 0x8d8d8d
push str.RibbonGrayText
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x66c], eax
call fcn.23aa3de0
push 0xc5c5c5
push str.MenuPopupGripperShadow
push str.Ribbon
mov ecx, edi
mov dword [esi + 0x670], eax
call fcn.23aa3de0
cmp dword [esi + 0x67c], 0
mov dword [esi + 0x678], eax
je 0x23b19a20
mov ecx, dword [esi + 0xe8]
mov dword [ecx + 4], 0
mov edx, dword [esi + 0xe8]
mov dword [edx + 8], 1
jmp 0x23b19a3a
mov eax, dword [esi + 0xe8]
mov dword [eax + 4], 1
mov ecx, dword [esi + 0xe8]
mov dword [ecx + 8], 0
push 0x35
mov ecx, esi
call fcn.23adaa20
push eax
push str.ControlEditDisabledBorder
push str.Toolbar
mov ecx, edi
call fcn.23aa3de0
pop edi
mov dword [esi + 0x668], eax
mov ecx, esi
pop esi
jmp fcn.23b17950
Function at 0x23b22360
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
cmp esi, 8
je 0x23b223a5
cmp esi, 0x21
jb 0x23b2237a
cmp esi, 0x2e
jbe 0x23b223a5
cmp esi, 0x43
je 0x23b2238e
cmp esi, 0x56
je 0x23b2238e
cmp esi, 0x58
je 0x23b2238e
cmp esi, 0x5a
jne 0x23b2239b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x23b223a5
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x20]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
call fcn.23a35b5d
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x1c
ret 8
Function at 0x23b247a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
je 0x23b2493c
mov eax, dword [esi + 0x134]
test eax, eax
je 0x23b2493c
cmp dword [eax + 0x20], 0
je 0x23b2493c
test eax, eax
je 0x23b247dd
cmp dword [eax + 0x54], 0
je 0x23b247dd
mov eax, 2
pop esi
ret 8
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xd
je 0x23b24935
cmp edi, 9
je 0x23b24935
cmp edi, 0x1b
jne 0x23b24829
lea eax, [esi + 0x154]
push eax
mov ecx, esi
call fcn.23b24700
mov edx, dword [esi]
mov eax, dword [edx + 0x70]
push 0
mov ecx, esi
call eax
mov ecx, dword [esi + 0xc0]
xor eax, eax
cmp dword [ecx + 0xb4], 2
pop edi
sete al
pop esi
ret 8
push ebx
test eax, eax
je 0x23b2486e
cmp dword [eax + 0x20], 0
je 0x23b2486e
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
test ax, ax
jge 0x23b2486e
push 0x11
call ebx
test ax, ax
jl 0x23b2486e
mov ecx, dword [esi + 0xc0]
call fcn.23ae4e30
test eax, eax
je 0x23b2486e
movzx edx, di
push edx
mov ecx, eax
call fcn.23ae49c0
test eax, eax
jne 0x23b248f7
mov ecx, esi
call fcn.23aff200
test eax, eax
je 0x23b24902
cmp dword [esi + 0x16c], 0
je 0x23b24902
cmp edi, 0x26
je 0x23b24890
cmp edi, 0x28
jne 0x23b24902
mov ecx, esi
call fcn.23b22560
test eax, eax
jne 0x23b24902
mov eax, dword [esi]
mov edx, dword [eax + 0x16c]
xor ecx, ecx
cmp edi, 0x26
sete cl
lea ecx, [ecx + ecx - 1]
push ecx
push 1
mov ecx, esi
call edx
mov eax, dword [esi + 0x134]
test eax, eax
je 0x23b248f7
mov edi, dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x23b248f7
mov esi, dword [esi + 0x134]
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop ebx
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x160]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x23b2491b
push ebx
push edi
call fcn.23b256e0
test eax, eax
jne 0x23b248f7
mov ecx, dword [esi + 0x134]
push ebx
push edi
call fcn.23b22360
neg eax
pop ebx
sbb eax, eax
pop edi
add eax, 2
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x23b256e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi + 8], 0
jne 0x23b256f5
xor eax, eax
pop edi
add esp, 0x1c
ret 8
push ebx
mov ebx, dword [esp + 0x28]
cmp ebx, 0x26
je 0x23b2570e
cmp ebx, 0x28
je 0x23b2570e
cmp ebx, 0x22
je 0x23b2570e
cmp ebx, 0x21
jne 0x23b2571b
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x23b25725
pop ebx
xor eax, eax
pop edi
add esp, 0x1c
ret 8
mov eax, dword [edi + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 1
push eax
call esi
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
push edx
push eax
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
neg eax
pop esi
sbb eax, eax
pop ebx
neg eax
pop edi
add esp, 0x1c
ret 8
Function at 0x23b257c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x23b257d0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x23b26b30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x218]
push edi
call edx
mov ebx, dword [esp + 0x30]
cmp dword [ebx + 0x144], 0
mov ebp, eax
je 0x23b26b93
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x23b26b87
mov eax, dword [esp + 0x34]
cmp eax, 0x26
je 0x23b26b77
cmp eax, 0x28
je 0x23b26b77
cmp eax, 0x21
je 0x23b26b77
cmp eax, 0x22
jne 0x23b26b87
mov ecx, dword [esp + 0x38]
push ecx
push eax
push 0x100
jmp 0x23b26c17
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
mov edi, dword [esp + 0x34]
cmp edi, 0x73
jne 0x23b26bab
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x23b26b87
jmp 0x23b26bc2
cmp edi, 0x26
je 0x23b26bb5
cmp edi, 0x28
jne 0x23b26bc2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x23b26b87
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x1c], 0x100
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
mov edx, dword [esi + 0x20]
push 1
push 0x102
push 0x102
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x23b26c1e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 0x102
mov ecx, esi
call fcn.23a306db
mov eax, dword [esi]
mov edx, dword [eax + 0x218]
mov ecx, esi
call edx
cmp ebp, eax
je 0x23b26c6e
mov eax, dword [ebx]
mov edx, dword [eax + 0x16c]
mov ecx, ebx
call edx
mov esi, dword [ebx + 0x144]
test esi, esi
je 0x23b26c6e
cmp dword [esi + 0x20], 0
je 0x23b26c6e
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x23b29450
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
jne 0x23b29462
pop esi
ret 8
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0x2e
je 0x23b29475
cmp edi, 8
je 0x23b29475
xor eax, eax
jmp 0x23b2947a
mov eax, 1
mov dword [esi + 0x170], eax
mov eax, dword [esi + 0x144]
test eax, eax
je 0x23b2949a
cmp dword [eax + 0x54], 0
je 0x23b2949a
pop edi
mov eax, 2
pop esi
ret 8
cmp edi, 9
jne 0x23b294b8
cmp dword [esi + 0x194], 0
je 0x23b294b1
test byte [esi + 0x174], 8
jne 0x23b29510
pop edi
xor eax, eax
pop esi
ret 8
cmp edi, 0xd
je 0x23b294b1
cmp edi, 0x1b
jne 0x23b29510
mov ecx, dword [esi + 0x138]
mov eax, dword [ecx]
mov edx, dword [eax + 0x180]
call edx
mov eax, dword [esi + 0x150]
push eax
mov ecx, esi
call fcn.23b25a70
lea ecx, [esi + 0x154]
push ecx
mov ecx, esi
call fcn.23b29120
mov edx, dword [esi]
mov eax, dword [edx + 0x70]
push 0
mov ecx, esi
call eax
mov ecx, dword [esi + 0xc0]
xor eax, eax
cmp dword [ecx + 0xb4], 2
pop edi
sete al
pop esi
ret 8
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x23b29555
cmp dword [eax + 0x20], 0
je 0x23b29555
push 0x12
call ebp
test ax, ax
jge 0x23b29555
push 0x11
call ebp
test ax, ax
jl 0x23b29555
mov ecx, dword [esi + 0xc0]
call fcn.23ae4e30
test eax, eax
je 0x23b29555
movzx edx, di
push edx
mov ecx, eax
call fcn.23ae49c0
test eax, eax
jne 0x23b295f3
cmp edi, 0x73
jne 0x23b295cd
push 0x12
call ebp
test ax, ax
jge 0x23b295e0
mov ecx, dword [esi + 0x194]
push ebx
mov ebx, dword [esp + 0x18]
test ecx, ecx
je 0x23b2957d
push ebx
push edi
call fcn.23b256e0
test eax, eax
jne 0x23b295c1
cmp dword [esi + 0x144], 0
je 0x23b295a3
cmp edi, 0x26
je 0x23b2959a
cmp edi, 0x28
je 0x23b2959a
cmp edi, 0x22
je 0x23b2959a
cmp edi, 0x21
jne 0x23b295fe
push 0x12
call ebp
test ax, ax
jl 0x23b295fe
mov ecx, esi
call fcn.23b266c0
test eax, eax
je 0x23b295fe
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx]
mov eax, dword [edx + 0x230]
push ebx
push edi
push esi
call eax
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
ret 8
cmp edi, 0x26
je 0x23b295d7
cmp edi, 0x28
jne 0x23b29563
push 0x12
call ebp
test ax, ax
jge 0x23b29563
mov edx, dword [esi]
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov eax, dword [edx + 0xd4]
push ecx
mov ecx, esi
call eax
pop ebp
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x144]
test ecx, ecx
je 0x23b2961e
cmp dword [ecx + 0x20], 0
je 0x23b2961e
push ebx
push edi
call fcn.23b22360
test eax, eax
mov eax, 1
jne 0x23b29623
mov eax, 2
pop ebx
pop ebp
pop edi
pop esi
ret 8
Function at 0x23b2bfd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, ecx
cmp ebx, 0x112
ja 0x23b2c10d
je 0x23b2c063
mov eax, ebx
sub eax, 2
je 0x23b2c022
sub eax, 3
je 0x23b2c001
sub eax, 0x42
jne 0x23b2c208
cmp ebp, dword [esi + 0x124]
jne 0x23b2c208
mov eax, dword [esi - 0x34]
push 0
push 0x2fbf
push 0x113
push eax
jmp 0x23b2c202
cmp dword [esi + 0x128], 0
je 0x23b2c208
lea ecx, [esi - 0x54]
call fcn.23ae64b0
test eax, eax
je 0x23b2c03e
mov eax, dword [eax + 0x20]
cmp ebp, eax
jne 0x23b2c208
mov ecx, dword [esi + 0x128]
push ecx
push ebp
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x128], 0
jmp 0x23b2c208
lea edi, [esi - 0x54]
mov ecx, edi
call fcn.23b02ea0
test eax, eax
je 0x23b2c208
push 0x23ae2830
mov ecx, 0x23c7de2c
call fcn.23a3dde5
test eax, eax
jne 0x23b2c08d
call fcn.23a2f00f
cmp dword [eax + 4], 0
jg 0x23b2c208
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x23b2c208
mov ecx, edi
call fcn.23ae4e60
test eax, eax
jne 0x23b2c208
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x23b2c208
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
jne 0x23b2c208
mov edx, dword [edi]
mov eax, dword [edx + 0x1f8]
push 0x12
mov ecx, edi
call eax
test eax, eax
jne 0x23b2c101
mov ecx, edi
call fcn.23ae4e30
test eax, eax
je 0x23b2c101
push 0
push edi
mov ecx, eax
call fcn.23ae34c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
cmp ebx, 0x220
jb 0x23b2c208
cmp ebx, 0x222
jbe 0x23b2c1f2
cmp ebx, 0x230
jne 0x23b2c208
mov edx, dword [esi - 0x54]
mov eax, dword [edx + 0x160]
lea edi, [esi - 0x54]
mov ecx, edi
call eax
mov ecx, edi
test eax, eax
je 0x23b2c1ce
call fcn.23ae4e60
test eax, eax
je 0x23b2c17c
mov ecx, edi
call fcn.23ae64b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x14
test dword [esi + 0x54], 0x400
mov ebx, dword [esp + 0x1c]
jne 0x23b2c1a3
mov eax, dword [ebx]
test eax, eax
jne 0x23b2c19b
mov esi, dword [esi + 0x128]
test esi, esi
je 0x23b2c1a3
mov eax, esi
push eax
mov ecx, edi
call fcn.23b2bae0
mov ecx, edi
call fcn.23ae64b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, edi
call fcn.23b2ba00
pop edi
pop esi
pop ebp
mov dword [ebx], 0
mov eax, 1
pop ebx
ret 0x14
call fcn.23ae64b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x6c]
call eax
test eax, eax
jne 0x23b2c208
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
ret 0x14
mov edx, dword [esi - 0x34]
push 0
push 0x2fbf
push 0x113
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edx
push ebx
push ebp
mov ecx, esi
call fcn.23ae63e0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x23b2eae0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xa8]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret