joyce8/EMBER2024-capa huggingface dataset:
Function at 0x762ed148
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x762ed16b
xor eax, eax
jmp 0x762ed2e5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, edi
jne 0x762ed180
xor eax, eax
jmp 0x762ed2e4
cmp dword [esi + 0x284], 0xffffffff
je 0x762ed1aa
cmp dword [esi + 0x288], 0xffffffff
je 0x762ed1aa
push 0x7f86
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x762ed2d8
push ebx
lea ebx, [esi + 0x27c]
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
push ebx
push esi
call fcn.762ecf36
cmp eax, 0x3b
mov dword [ebp - 4], eax
jae 0x762ed1d8
push 0x7f89
jmp 0x762ed1dd
push 0x7f86
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 0xc]
shr eax, 0x10
cmp ax, 0x201
jne 0x762ed2d7
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0x278]
cmp eax, 0x3b
mov edi, dword [sym.imp.USER32.dll_keybd_event]
jae 0x762ed248
movzx eax, byte [eax + 0x762e285c]
xor ecx, ecx
mov cl, byte [eax*4 + 0x762f6480]
push 0
push 2
push ecx
push eax
call edi
push dword [esi + 0x278]
push esi
push 0
push dword [ebp + 8]
call fcn.762ecda5
mov dword [esi + 0x278], 0x3b
cmp dword [ebp - 4], 0x3b
jae 0x762ed294
push esi
push dword [ebp - 4]
call fcn.762ed103
test eax, eax
je 0x762ed28a
mov ebx, dword [ebp - 4]
movzx eax, byte [ebx + 0x762e285c]
xor ecx, ecx
mov cl, byte [eax*4 + 0x762f6480]
push 0
push 0
push ecx
push eax
call edi
push ebx
push esi
push 0
push dword [ebp + 8]
mov dword [esi + 0x278], ebx
call fcn.762ecda5
jmp 0x762ed2d7
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x762ed2d7
lea eax, [ebp - 0x28]
push eax
call fcn.762eda80
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebx]
sub ecx, dword [ebp - 0x18]
lea eax, [esi + 0x284]
mov dword [eax], ecx
mov ecx, dword [esi + 0x280]
sub ecx, dword [ebp - 0x14]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi + 0x288], ecx
call fcn.762ecc1c
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
pop esi
pop edi
leave
ret 8
Function at 0x762edb3b
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x762edb62
cmp dword [ebp + 8], 3
jae 0x762edb62
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmLockImeDpi
cmp eax, esi
jne 0x762edb69
xor eax, eax
jmp 0x762edcb8
push edi
mov edi, dword [eax + 0x1c]
push eax
call sym.IMM32.dll_ImmUnlockImeDpi
test edi, 0x10000
jne 0x762edb82
xor eax, eax
jmp 0x762edcb7
cmp dword [0x762f615c], esi
push ebx
je 0x762edbff
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.762edad5
test eax, eax
jne 0x762edba2
xor eax, eax
jmp 0x762edcb6
xor edi, edi
push esi
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [edi*4 + 0x762f6480], eax
inc edi
cmp edi, 0xff
jb 0x762edba4
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
sub edi, dword [ebp - 0x20]
push 0x2d
mov dword [ebp - 0xc], eax
call esi
push 5
mov ebx, eax
call esi
add ebx, eax
push 0x2e
mov dword [0x762f6880], ebx
call esi
push 6
mov ebx, eax
call esi
add ebx, eax
xor esi, esi
mov dword [0x762f6884], ebx
mov dword [0x762f615c], esi
jmp 0x762edc02
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.762ed93c
test eax, eax
je 0x762edb9b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.762ed9f9
mov edx, dword [ebp + 0x10]
cmp edx, esi
mov ebx, dword [ebp - 4]
jge 0x762edc2c
xor edx, edx
jmp 0x762edc37
lea eax, [ebx + edx]
cmp eax, edi
jle 0x762edc37
sub edi, ebx
mov edx, edi
mov eax, dword [ebp + 0x14]
cmp eax, esi
mov ecx, dword [ebp - 8]
jge 0x762edc45
xor eax, eax
jmp 0x762edc52
lea edi, [ecx + eax]
cmp edi, dword [ebp - 0xc]
jle 0x762edc52
mov eax, dword [ebp - 0xc]
sub eax, ecx
mov edi, dword [ebp + 8]
dec edi
je 0x762edc81
dec edi
jne 0x762edb9b
push esi
push dword [0x762f6158]
push esi
push dword [ebp + 0xc]
push ecx
push ebx
push eax
push edx
push 0x88800000
push esi
push dword [0x762e28a0]
push 0x101
jmp 0x762edc9d
push esi
push dword [0x762f6158]
push esi
push dword [ebp + 0xc]
push ecx
push ebx
push eax
push edx
push 0x88000000
push esi
push dword [0x762e289c]
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x762ee804
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x762f6184]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], edi
call fcn.762ee656
test eax, eax
jne 0x762ee841
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x762ee8fa
push ebx
push edi
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebx, eax
cmp ebx, edi
jle 0x762ee8f3
push esi
mov esi, ebx
shl esi, 2
lea eax, [esi + 4]
push eax
push edi
call fcn.762e9949
mov edi, eax
test edi, edi
je 0x762ee8f2
push edi
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp eax, ebx
jne 0x762ee8e2
mov eax, dword [ebp - 0x164]
xor ebx, ebx
add eax, 0x78
mov dword [esi + edi], ebx
cmp word [eax], bx
jne 0x762ee891
mov esi, edi
jmp 0x762ee8bb
push eax
push 3
lea eax, [ebp - 0x15c]
push eax
call sym.IMM32.dll_ImmGetImeInfoEx
test eax, eax
je 0x762ee8e4
cmp dword [edi], ebx
mov esi, edi
je 0x762ee8bb
mov eax, dword [esi]
add esi, 4
cmp eax, dword [ebp - 0x15c]
je 0x762ee8bb
cmp dword [esi], ebx
jne 0x762ee8aa
cmp esi, ebx
jne 0x762ee8da
jmp 0x762ee8e4
push dword [ebp - 0x164]
push eax
call fcn.762ee4e5
add esi, 4
cmp eax, ebx
mov dword [ebp - 0x160], eax
jne 0x762ee8e4
mov eax, dword [esi]
cmp eax, ebx
je 0x762ee8e4
jmp 0x762ee8c1
xor ebx, ebx
push edi
push ebx
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, dword [ebp - 0x160]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.762f4432
leave
ret 4
Function at 0x762ee995
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x762f6184]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x160], edi
call fcn.762ee656
test eax, eax
jne 0x762ee9cd
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x762eeaa6
lea eax, [esi + 0x78]
cmp word [eax], di
push ebx
je 0x762ee9f8
push eax
push 3
lea eax, [ebp - 0x15c]
push eax
call sym.IMM32.dll_ImmGetImeInfoEx
test eax, eax
je 0x762eeaa3
mov esi, dword [ebp - 0x15c]
jmp 0x762eea79
push edi
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebx, eax
cmp ebx, edi
jle 0x762eeaa3
mov esi, ebx
shl esi, 2
lea eax, [esi + 4]
push eax
push edi
call fcn.762e9949
mov edi, eax
test edi, edi
mov dword [ebp - 0x164], edi
je 0x762eeaa3
push edi
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp eax, ebx
jne 0x762eea62
xor ebx, ebx
mov dword [esi + edi], ebx
cmp dword [edi], ebx
je 0x762eea62
mov esi, dword [ebp - 0x164]
push dword [esi]
call sym.IMM32.dll_ImmIsIME
test eax, eax
je 0x762eea5a
add esi, 4
cmp dword [esi], ebx
mov dword [ebp - 0x164], esi
je 0x762eea62
jmp 0x762eea3a
mov eax, dword [esi]
mov dword [ebp - 0x160], eax
push edi
push 0
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x160]
xor edi, edi
cmp esi, edi
je 0x762eeaa3
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, esi
je 0x762eeaa3
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
je 0x762eeaa3
push esi
push 1
push 0x50
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x762eeaa5
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.762f4432
leave
ret 8

Function at 0x762eec21
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x10]
cmp dword [esi + 4], 2
jne 0x762eec5d
movsx eax, word [esi + 0x14]
mov dword [ebp - 8], eax
movsx eax, word [esi + 0x16]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
mov dword [esi + 0x14], eax
push esi
push 8
push dword [ebp + 0xc]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmEscapeW
pop esi
leave
ret 0xc
Function at 0x762eed57
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov dword [ebp - 4], eax
call sym.IMM32.dll_ImmIsIME
test eax, eax
je 0x762eee2d
cmp dword [ebp + 0x10], ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
je 0x762eedcb
cmp eax, ebx
je 0x762eeda4
push eax
call edi
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x762eeda4
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x762eedb8
push eax
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x762eedb8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call sym.IMM32.dll_ImmConfigureIMEA
jmp 0x762eee01
cmp eax, ebx
je 0x762eeddc
push eax
call edi
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x762eeddc
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x762eedf0
push eax
call edi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x762eedf0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call sym.IMM32.dll_ImmConfigureIMEW
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x762eee19
cmp dword [ebp + 0x10], ebx
je 0x762eee19
push eax
call edi
mov esi, dword [esi + 0x18]
cmp esi, ebx
je 0x762eee28
cmp dword [ebp - 8], ebx
je 0x762eee28
push esi
call edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x762eee37
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 1
push dword [ebp + 0xc]
call fcn.762f4608
test eax, eax
je 0x762eeedd
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call ebx
push eax
call sym.IMM32.dll_ImmLockImeDpi
test eax, eax
mov dword [ebp - 8], eax
je 0x762eeedc
test byte [eax + 0x12], 8
push esi
push edi
mov edi, dword [ebp + 0x10]
je 0x762eeea8
movsx esi, byte [edi + 6]
add esi, edi
mov al, byte [esi]
mov byte [ebp + 0x12], al
mov al, byte [esi + 1]
push 1
mov byte [ebp + 0x13], al
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp + 0x12]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x762eeee1
mov al, byte [ebp - 4]
mov byte [esi], al
mov al, byte [ebp - 3]
mov byte [esi + 1], al
push dword [ebp - 8]
call sym.IMM32.dll_ImmUnlockImeDpi
push edi
push 0x31
push dword [ebp + 0xc]
push 0
call ebx
push eax
call sym.IMM32.dll_ImmEscapeW
mov esi, eax
test esi, esi
je 0x762eeed8
push 1
push 5
push 0x282
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp - 8]
call sym.IMM32.dll_ImmUnlockImeDpi
xor eax, eax
jmp 0x762eeeda
Function at 0x762ef28a
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
cmp eax, 0xfb
push esi
ja 0x762ef321
cmp eax, 0xfa
jae 0x762ef316
cmp eax, 0x1c
je 0x762ef30b
cmp eax, 0xef
jbe 0x762ef350
cmp eax, 0xf6
jbe 0x762ef316
cmp eax, 0xf7
je 0x762ef2ef
cmp eax, 0xf8
je 0x762ef2da
cmp eax, 0xf9
jne 0x762ef350
push 0
push 4
jmp 0x762ef30f
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push esi
push 1
jmp 0x762ef2fb
call sym.IMM32.dll_ImmConfigureIMEW
jmp 0x762ef36d
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push esi
push 2
cmp dword [ebp + 0x14], esi
push dword [ebp + 8]
push eax
je 0x762ef2e8
call sym.IMM32.dll_ImmConfigureIMEA
jmp 0x762ef36d
push 0
push 2
push 0x15
push dword [ebp + 0xc]
jmp 0x762ef368
push eax
push dword [ebp + 0xc]
call fcn.762eef3f
jmp 0x762ef36d
cmp eax, 0xfc
je 0x762ef359
mov ecx, 0xfd
cmp eax, ecx
je 0x762ef350
cmp eax, 0xffff
je 0x762ef33d
cmp eax, 0xffffffff
jne 0x762ef350
mov eax, dword [edx + 8]
cmp eax, 0x1c
je 0x762ef354
cmp eax, 0xef
jbe 0x762ef350
cmp eax, ecx
jbe 0x762ef354
xor eax, eax
jmp 0x762ef36d
xor eax, eax
inc eax
jmp 0x762ef36d
push 0
push 1
push 0x15
push dword [ebp + 8]
call sym.IMM32.dll_ImmGetContext
push eax
call sym.IMM32.dll_ImmNotifyIME
pop esi
pop ebp
ret 0x10

Function at 0x762efdb2
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax + 0x10]
push edi
mov edi, dword [eax + 0xc]
push 1
xor ebx, ebx
push ebx
push ebx
add edi, eax
push edi
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push ebx
add esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmGetConversionListA
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x762efe62
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x762efe65
push 1
push dword [ebp - 0xc]
push ebx
push edi
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmGetConversionListA
xor edi, edi
cmp dword [ebx + 8], edi
mov dword [ebp - 8], eax
jbe 0x762efe41
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
add eax, ebx
mov dl, byte [eax]
mov byte [esi], dl
mov al, byte [eax + 1]
inc esi
mov byte [esi], al
inc esi
inc edi
add ecx, 4
cmp edi, dword [ebx + 8]
jb 0x762efe29
mov ecx, dword [ebp + 0xc]
push dword [ebp - 4]
mov byte [esi], 0
movzx eax, word [ebx + 8]
shl eax, 1
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x762f356b
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
mov eax, dword [section..data]
test eax, eax
mov ebx, 0x80004005
je 0x762f35e4
test byte [eax + 2], 0x40
je 0x762f35e4
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762f35e4
push 1
push dword [ebp + 8]
call fcn.762f4608
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
shr ecx, 0x10
and cx, 0xf000
cmp cx, 0xe000
jne 0x762f35c1
xor eax, eax
jmp 0x762f35e6
push esi
push eax
call fcn.762e7719
mov esi, eax
test esi, esi
je 0x762f35e3
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [esi + 0xa0]
push esi
mov ebx, eax
call sym.IMM32.dll_ImmUnlockImeDpi
pop esi
mov eax, ebx
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x762f35f1
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [section..data]
push edi
xor edi, edi
test eax, eax
je 0x762f365c
test byte [eax + 2], 0x40
je 0x762f365c
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762f365c
push 1
push dword [ebp + 8]
call fcn.762f4608
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
shr ecx, 0x10
and cx, 0xf000
cmp cx, 0xe000
jne 0x762f363d
xor eax, eax
jmp 0x762f365e
push esi
push eax
call fcn.762e7719
mov esi, eax
test esi, esi
je 0x762f365b
push dword [ebp + 8]
call dword [esi + 0xa4]
push esi
mov edi, eax
call sym.IMM32.dll_ImmUnlockImeDpi
pop esi
mov eax, edi
pop edi
pop ebp
ret 4

Function at 0x762f36e3
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], esi
je 0x762f370a
cmp dword [section..data], esi
je 0x762f370a
mov dl, 1
mov ecx, edi
call fcn.762f4740
jmp 0x762f370c
xor eax, eax
cmp eax, esi
je 0x762f3765
test byte [eax + 0x1b], 0x80
je 0x762f3733
lea eax, [ebp - 4]
push eax
push 0x1388
push 3
push dword [ebp + 0xc]
push esi
push 0x505
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x762f3765
push 8
push esi
call fcn.762e9949
cmp eax, esi
je 0x762f3765
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push 0x762f3685
push esi
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x762f3765
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x762f37d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x762f3848
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x762f383d
and dword [ebp - 8], eax
and dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x762f3890
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0x762f383d
cmp dword [ebp - 8], 4
jne 0x762f383d
mov eax, dword [ebp - 0xc]
leave
ret
xor eax, eax
leave
ret

Function at 0x762f38b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x762f3918
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x762f3911
and dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x762f3948
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x762f3911
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x762f3aa7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x762f6184]
push edi
mov edi, 0x762f6020
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x762f620c], 0
jne 0x762f3c05
lea eax, [ebp - 0x364]
push eax
push 0x4090409
call sym.IMM32.dll_ImmLoadLayout
test eax, eax
je 0x762f3c05
push 0x104
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.762e829c
lea eax, [ebp - 0x20c]
push eax
call fcn.762e6cf8
test eax, eax
je 0x762f3c05
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x762f620c], eax
je 0x762f3c05
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x762f3ccc
push eax
call esi
test eax, eax
mov dword [0x762f61ec], eax
je 0x762f3bed
push 0x762f3cb4
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f61f0], eax
je 0x762f3bed
push 0x762f3c98
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f61f4], eax
je 0x762f3bed
push 0x762f3c7c
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f61f8], eax
je 0x762f3bed
push 0x762f3c5c
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f61fc], eax
je 0x762f3bed
push 0x762f3c44
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f6200], eax
je 0x762f3bed
push 0x762f3c28
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f6204], eax
je 0x762f3bed
push 0x762f3c1c
push dword [0x762f620c]
call esi
test eax, eax
mov dword [0x762f6208], eax
jne 0x762f3c04
mov eax, dword [0x762f620c]
test eax, eax
je 0x762f3c04
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x762f620c], 0
pop esi
push edi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [0x762f620c]
pop edi
call fcn.762f4432
leave
ret

Function at 0x762f3dc2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0xa0]
mov eax, dword [ecx + 0x24]
sub eax, dword [edx + 0xc]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x41a689
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004a68b0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push 0
call fcn.004917a1
mov ebx, eax
push 0
call fcn.00491ab8
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.00491810
mov ebx, eax
push 0
call fcn.00491b35
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push 0x80000004
push dword [0x1ddac78]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x5e
call fcn.004911ec
push 0xb
push 0x65
call fcn.0049f866
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x61
call fcn.0048b810
push 0xb
push 0x63
call fcn.0049f866
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x5f
call fcn.0048b810
push 0xb
push 0x64
call fcn.0049f866
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x60
call fcn.0048b810
push dword [0x1ddadb0]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x62
call fcn.00489076
call fcn.00438ec3
call fcn.004911e4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x41a87d
call fcn.00494c65
push eax
mov ebx, 0x5e
cmp ebx, dword [esp]
jne 0x41a87a
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41a879
call fcn.00494c56
push eax
mov ebx, 0x61
cmp ebx, dword [esp]
jne 0x41a847
mov eax, 0x533b3e
push eax
call fcn.00467b32
add esp, 0xc
jmp 0x41a8d4
mov ebx, 0x5f
cmp ebx, dword [esp]
jne 0x41a858
add esp, 0xc
jmp 0x41a8d4
mov ebx, 0x60
cmp ebx, dword [esp]
jne 0x41a869
add esp, 0xc
jmp 0x41a8d4
mov ebx, 0x62
cmp ebx, dword [esp]
jne 0x41a878
add esp, 0xc
jmp 0x41a8d4
pop eax
pop eax
pop eax
jmp 0x41a887
push 0x5e
call fcn.004911c6
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41a8ab
call fcn.00491b43
mov ebx, eax
cmp ebx, 0x5e
jne 0x41a8ab
call fcn.00438ec3
jmp 0x41a8d4
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41a8cf
call fcn.00491b43
mov ebx, eax
cmp ebx, 0x5e
jne 0x41a8cf
call fcn.00438ec3
jmp 0x41a8d4
jmp 0x41a7f4
push 0x5e
call fcn.00490f76
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x443de2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004a68b0
mov dword [esp], 0
jmp 0x443df5
mov eax, dword [esp + 0x10]
cmp eax, dword [esp]
jl 0x443eae
push 0
call fcn.004910a7
and eax, eax
je 0x443ea5
mov dword [esp + 4], 0xffffffff
call fcn.00449e6d
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x443e74
call fcn.00494c65
push eax
mov ebx, dword [0x1ddadd0]
cmp ebx, dword [esp]
jne 0x443e4f
push dword [esp + 8]
call fcn.00442959
mov ebx, eax
and ebx, ebx
jne 0x443e4d
jmp 0x443e71
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x443e67
push dword [esp + 8]
call fcn.004362cb
mov ebx, eax
and ebx, ebx
jne 0x443e65
jmp 0x443e71
push 3
call fcn.00490d8b
pop eax
jmp 0x443e7e
push 5
call fcn.00490d8b
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x443e9b
mov dword [0x1ddad84], 1
jmp 0x443ea5
mov dword [0x1ddad84], 0
inc dword [esp]
jno 0x443df5
xor eax, eax
add esp, 8
pop ebx
ret 4