joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438a4f
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x102c
call fcn.00426a70
push ebp
mov ebp, dword [esp + 0x103c]
lea eax, [esp + 4]
push eax
push 0x800
lea ecx, [esp + 0x838]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x438a86
xor al, al
pop ebp
add esp, 0x102c
ret
mov edx, dword [esp + 0x1034]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edx
shr esi, 2
mov byte [ebp], 0
call fcn.00438a13
add esp, 4
xor ebx, ebx
mov dword [esp + 0x14], eax
test esi, esi
jbe 0x438b9a
push edi
cmp byte [ebp], 0
jne 0x438b99
mov eax, dword [esp + ebx*4 + 0x83c]
push eax
push 0
push 0x410
call dword [0x483188]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
mov edi, eax
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
mov ecx, dword [esp + 0x14]
push 0x104
lea eax, [esp + 0x22c]
push eax
push ecx
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x438b89
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x640]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x238]
push eax
call fcn.004152c0
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00412b83
mov eax, dword [esp + 0x105c]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00412af0
add esp, 0x24
test eax, eax
jne 0x438b69
mov edx, dword [esp + ebx*4 + 0x83c]
mov eax, dword [esp + 0x1044]
mov dword [eax], edx
jmp 0x438b85
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x438b89
mov eax, dword [esp + ebx*4 + 0x83c]
cmp ecx, eax
jne 0x438b89
mov ecx, dword [esp + 0x1044]
mov dword [ecx], eax
mov byte [ebp], 1
push edi
call dword [0x483308]
inc ebx
cmp ebx, esi
jb 0x438ab2
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
add esp, 0x102c
ret
Function at 0x4390d7
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [0x4836f8]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x4390f5
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x439107
push esi
push str.Shell_TrayWnd
call dword [0x4835a8]
mov esi, eax
push ebp
call dword [0x4835a4]
test eax, eax
je 0x43911b
push 9
push ebp
call dword [0x4836e0]
push ebp
mov dword [esp + 0xc], 0
call dword [0x4835a0]
test eax, eax
jne 0x43920e
push ebx
push edi
push eax
push esi
mov esi, dword [0x483624]
call esi
mov edi, eax
call dword [0x483160]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [0x483628]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [0x4835a0]
test eax, eax
jne 0x4391e8
push eax
push eax
push eax
push 0x12
call dword [0x483654]
push eax
push 0x12
call dword [0x4835c0]
push 0
push 2
push 0
push 0x12
call dword [0x483654]
push eax
push 0x12
call dword [0x4835c0]
push 0
push 0
push 0
push 0x12
call dword [0x483654]
push eax
push 0x12
call dword [0x4835c0]
push 0
push 2
push 0
push 0x12
call dword [0x483654]
push eax
push 0x12
call dword [0x4835c0]
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x4835a0]
test eax, eax
je 0x4391f0
mov dword [esp + 0x10], 4
jmp 0x4391f0
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4

Function at 0x43a770
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 8], 0
mov eax, dword [esp + 4]
je 0x43a78b
mov eax, dword [eax]
push 4
push eax
call dword [0x4836e0]
mov al, 1
ret 8
mov ecx, dword [eax]
push 0
push ecx
call dword [0x4836e0]
mov al, 1
ret 8

Function at 0x43a848
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x43a875
lea eax, [esp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push esi
call dword [0x483638]
test eax, eax
je 0x43a88e
push 1
jmp 0x43a877
push 0
push 0
push esi
call dword [0x483624]
push eax
call dword [0x483160]
push eax
call dword [0x483628]
pop esi
ret 8

Function at 0x43aeed
Capabilities:
Get token privileges

Disassembly:
push ebx
mov ebx, dword [0x483074]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
push esi
push 0
push eax
push 3
push edi
call ebx
test eax, eax
jne 0x43af3e
call dword [0x483304]
cmp eax, 0x7a
jne 0x43af4a
mov ecx, dword [esi]
push ecx
call fcn.0043ae47
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x43af4a
mov edx, dword [esi]
push esi
push edx
push eax
push 3
push edi
call ebx
test eax, eax
je 0x43af4a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
Function at 0x43affb
Capabilities:
Impersonate user

Disassembly:
movsx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
and eax, 2
or eax, 4
push 0
shr eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [0x483070]
neg eax
sbb eax, eax
neg eax
ret 0x14

Function at 0x43b1b7
Capabilities:
Create process on windows

Disassembly:
mov al, byte [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x1c], ecx
test al, 1
je 0x43b1d3
lea edi, [ecx + 1]
jmp 0x43b1dc
test al, 2
je 0x43b1dc
mov edi, 2
xor bl, bl
test al, 4
je 0x43b21f
push ebp
lea eax, [esp + 0x28]
push eax
push 0xa
mov dword [esp + 0x30], ecx
call dword [0x48330c]
push eax
call dword [0x483048]
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebp, eax
mov eax, dword [esp + 0x28]
push eax
call dword [0x483308]
test ebp, ebp
pop ebp
je 0x43b25c
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
or esi, 0x400
push esi
push edx
mov edx, dword [esp + 0x28]
push 0
push edi
push eax
push ecx
push edx
call dword [0x483058]
test eax, eax
setne bl
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43b26b
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
pop esi
mov al, bl
pop ebx
ret 0x24
Function at 0x442f23
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [0x4836e0]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 0x184]
mov eax, dword [ebp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 0x18], eax
cmp ecx, dword [esp + 0x1c]
je 0x442fdf
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x442fd5
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x442fcc
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
cmp dword [eax + 4], ecx
jne 0x442fcc
cmp byte [eax + 0x88], 0xb
je 0x442fcc
mov cl, byte [eax + 0x8b]
movzx edx, cl
cmp edx, dword [ebp + 0x184]
je 0x442fa0
cmp byte [ebp + 0x18c], 0
je 0x442fcc
cmp cl, 0xff
je 0x442fcc
cmp byte [eax + 0x88], 0xa
je 0x442fcc
mov eax, dword [eax]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
test byte [eax + 0x8a], 0x40
je 0x442fcc
cmp byte [eax + 0x88], 0x1a
jne 0x442fcc
mov eax, dword [eax]
push 0
push eax
call dword [0x48361c]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x442f59
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x184], ecx
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x44306e
lea ecx, [ecx]
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x443065
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
cmp dword [eax + 4], ecx
jne 0x443065
cmp byte [eax + 0x88], 0xb
je 0x443065
movzx edx, byte [eax + 0x8b]
cmp edx, dword [ebp + 0x184]
jne 0x443065
test byte [eax + 0x8a], 0x20
jne 0x443065
mov eax, dword [eax]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
mov ecx, dword [eax]
push 4
push ecx
call ebx
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
mov eax, dword [eax]
test byte [eax + 0x8a], 0x40
je 0x443065
cmp byte [eax + 0x88], 0x1a
jne 0x443065
mov ecx, dword [eax]
push 1
push ecx
call dword [0x48361c]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x442ff3
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x17c]
push 0
push edx
push 0x130c
push eax
call dword [0x483650]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x444146
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
push ebx
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [0x48301c]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x444210
mov ecx, dword [0x4a6dbc]
xor eax, eax
cmp byte [ecx + 0x2a], al
je 0x44419b
mov eax, 0x100
lea edx, [esp + 0x14]
push edx
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push esi
call dword [0x483040]
test eax, eax
jne 0x44421c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00444146
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov bl, al
call dword [0x483038]
test bl, bl
je 0x44421c
lea eax, [esp + 0x20]
push eax
push esi
call dword [0x483008]
test eax, eax
jne 0x44421c
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x444189
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x214
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x214
ret
Function at 0x444919
Capabilities:
Create http request

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp ecx, 1
jne 0x444933
movzx eax, word [esi + 0x8c]
jmp 0x444937
movzx eax, word [esi + 0x58]
cmp ecx, 1
movsx edx, ax
lea ecx, [esi + 0xb0]
je 0x444948
lea ecx, [esi + 0x7c]
mov eax, dword [esi + 0xc0]
push 0
cmp edx, 1
jne 0x44495c
push 0
push 0
push edx
jmp 0x4449a6
cmp edx, 2
jne 0x4449a0
mov ecx, dword [ecx]
push str._local_
push ecx
push 3
jmp 0x4449a6
cmp byte [esi + 0xdc], 0
je 0x444997
push 8
lea eax, [esp + 8]
push eax
push 0x32
push 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, 1
pop esi
add esp, 8
ret 8
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x44496d
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x4451ff
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a56d8], 0
push esi
push edi
mov esi, 0x4a4d08
jne 0x44521f
push 0
call fcn.00416338
push eax
call fcn.00436ebf
add esp, 8
mov dword [0x49323c], 0x270
mov dword [0x4a4d04], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x445234
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x44526f
mov ecx, dword [0x4a4d08]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret

Function at 0x445db8
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x445dd5
push esi
call fcn.0043800d
add esp, 4
test al, al
jne 0x445dee
push 1
jmp 0x445dd7
push 0
push 0
push esi
call dword [0x483624]
push eax
call dword [0x483160]
push eax
call dword [0x483628]
pop esi
ret
Function at 0x446064
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
mov byte [0x494cb6], 0
test edi, edi
je 0x4460ab
mov byte [0x494cb7], 1
call dword [0x483160]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x445f41
push esi
push esi
mov dword [esp + 0x24], edi
call fcn.004157a7
add esp, 0x18
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [0x483680]
mov edi, eax
test esi, esi
je 0x4460e2
push 0xffffffffffffffff
push esi
mov byte [0x494cb7], 0
call dword [0x4832f8]
push esi
call dword [0x483308]
cmp byte [0x494cb6], 1
jne 0x4460f4
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x446720
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x2c], 1
cmp word [eax], si
jne 0x446747
pop edi
pop esi
xor al, al
pop ebx
add esp, 8
ret 0x18
push ebp
push eax
or eax, 0xffffffff
call fcn.004108f0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x30]
push ebp
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
call fcn.00414cf0
inc eax
push eax
call fcn.00412c3a
mov ecx, eax
add esp, 0xc
mov dword [esp + 0x1c], ecx
mov al, byte [esi + ebp]
cmp al, 0x2b
je 0x446798
cmp al, 0x5e
je 0x446794
cmp al, 0x21
je 0x446794
cmp al, 0x23
jne 0x4467c8
cmp al, 0x2b
jne 0x4467a2
mov eax, dword [esp + 0x24]
mov byte [eax], 1
inc esi
jmp 0x446781
cmp al, 0x5e
jne 0x4467b0
mov edx, dword [esp + 0x28]
mov byte [edx], 1
inc esi
jmp 0x446781
cmp al, 0x21
jne 0x4467be
mov eax, dword [esp + 0x2c]
mov byte [eax], 1
inc esi
jmp 0x446781
cmp al, 0x23
jne 0x4467c5
mov byte [ebx], 1
inc esi
jmp 0x446781
mov al, byte [esi + ebp]
inc esi
mov byte [esp + 0x14], al
mov dword [esp + 0x10], esi
cmp al, 0x7b
jne 0x446879
lea edx, [esp + 0x10]
push edx
push ecx
push ebp
push 0x7d
call fcn.0043934a
test eax, eax
je 0x446800
mov byte [esp + 0x30], 0
jmp 0x4468b5
mov esi, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x493b10]
push esi
push eax
call fcn.004278b3
add esp, 8
test eax, eax
je 0x44681f
inc edi
cmp edi, 0x62
jl 0x446800
cmp edi, 0x62
jne 0x446861
movzx ecx, byte [esi]
push ecx
call dword [0x4835c4]
mov edx, dword [esp + 0x20]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x446843
mov ecx, dword [esp + 0x28]
mov byte [ecx], 1
test eax, 0x400
je 0x446851
mov edx, dword [esp + 0x2c]
mov byte [edx], 1
test eax, 0x100
je 0x4468b5
mov eax, dword [esp + 0x24]
mov byte [eax], 1
jmp 0x4468b5
cmp byte [edi + 0x493c98], 0
jne 0x4467ee
mov ecx, dword [edi*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x4468b5
mov eax, dword [esp + 0x14]
push eax
call dword [0x4835c4]
mov ecx, dword [esp + 0x20]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x446899
mov edx, dword [esp + 0x28]
mov byte [edx], 1
test eax, 0x400
je 0x4468a7
mov ecx, dword [esp + 0x2c]
mov byte [ecx], 1
test eax, 0x100
je 0x4468b5
mov edx, dword [esp + 0x24]
mov byte [edx], 1
mov eax, dword [esp + 0x20]
and dword [eax], 0xff
push ebp
call fcn.0041294d
mov eax, dword [esp + 0x20]
push eax
call fcn.0041294d
mov al, byte [esp + 0x38]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 0x18
Function at 0x4468e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [0x483654]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x4469c7
cmp edi, 0x14
je 0x4469c7
cmp edi, 0x90
je 0x4469c7
cmp edi, 0x91
je 0x4469c7
lea eax, [esp + 0x10]
push eax
call dword [0x4835b8]
shl esi, 0x10
or esi, 0xc0000001
cmp bl, 1
je 0x446958
push edi
call fcn.0043939e
cmp al, 1
jne 0x44695e
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x446971
test eax, 0x100
jne 0x446971
cmp edi, 0x12
jne 0x44698f
test al, 8
jne 0x44698f
test eax, 0x800
jne 0x44698f
mov ecx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x105
push ecx
jmp 0x44699a
mov edx, dword [ebp + 0x14]
push esi
push edi
push 0x101
push edx
call dword [0x483658]
xor byte [esp + edi + 0x10], 0x80
lea eax, [esp + edi + 0x10]
lea eax, [esp + 0x10]
push eax
call dword [0x4835b4]
push ebp
call fcn.00439774
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x4469dc
push edi
call fcn.0043939e
cmp al, 1
je 0x4469dc
push 0
push 2
jmp 0x4469e0
push 0
push 3
push esi
push edi
call dword [0x4835c0]
push ebp
call fcn.00439774
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc

Function at 0x4469fb
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
mov bl, byte [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0
push edi
call dword [0x483654]
cmp dword [ebp + 0x14], 0
mov esi, eax
je 0x446af2
cmp edi, 0x14
je 0x446af2
cmp edi, 0x90
je 0x446af2
cmp edi, 0x91
je 0x446af2
lea eax, [esp + 0x10]
push eax
call dword [0x4835b8]
or byte [esp + edi + 0x10], 0x80
lea ecx, [esp + 0x10]
push ecx
call dword [0x4835b4]
shl esi, 0x10
or esi, 1
cmp bl, 1
je 0x446a80
push edi
call fcn.0043939e
cmp al, 1
jne 0x446a86
or esi, 0x1000000
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x446a99
test eax, 0x100
jne 0x446a99
cmp edi, 0x12
jne 0x446ace
test al, 8
jne 0x446ace
test eax, 0x800
jne 0x446ace
mov edx, dword [ebp + 0x14]
or esi, 0x20000000
push esi
push edi
push 0x104
push edx
call dword [0x483658]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
mov eax, dword [ebp + 0x14]
push esi
push edi
push 0x100
push eax
call dword [0x483658]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
cmp bl, 1
je 0x446b07
push edi
call fcn.0043939e
cmp al, 1
je 0x446b07
push 0
push 0
jmp 0x446b0b
push 0
push 1
push esi
push edi
call dword [0x4835c0]
push ebp
call fcn.0043975d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
Function at 0x446b4b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446d47
mov eax, dword [esi + 0x14]
push edi
test eax, eax
je 0x446cda
push eax
call dword [0x483648]
test eax, eax
je 0x446cda
push ebp
lea eax, [esp + 0x1c]
push eax
call dword [0x4835b8]
mov edi, dword [0x483658]
mov ebp, ebx
and ebp, 1
je 0x446bc6
test bl, 8
jne 0x446bc6
test ebx, 0x800
jne 0x446bc6
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xe0000001
push ecx
push 0x12
push 0x105
push edx
jmp 0x446be2
test ebp, ebp
je 0x446be4
movzx eax, byte [esi + 0x19]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push ecx
call edi
mov eax, ebx
and eax, 8
mov dword [esp + 0x14], eax
je 0x446c0a
movzx edx, byte [esi + 0x18]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0xc0000001
push edx
push 0x11
push 0x101
push eax
call edi
mov eax, ebx
and eax, 2
mov dword [esp + 0x18], eax
je 0x446c32
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push edx
push 0x101
push eax
call edi
mov eax, ebx
and eax, 4
mov dword [esp + 0x10], eax
je 0x446c58
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 0xc0000001
push ecx
push 0x10
push 0x101
push edx
call edi
and ebx, 0x10
je 0x446c77
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push ecx
call edi
mov cl, 0x80
test ebx, ebx
je 0x446c81
xor byte [esp + 0x77], cl
cmp dword [esp + 0x18], 0
je 0x446c97
mov eax, dword [esi + 0x20]
xor byte [esp + 0x2c], cl
xor byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
cmp dword [esp + 0x10], 0
je 0x446ca9
xor byte [esp + 0x2c], cl
xor byte [esp + 0xbd], cl
cmp dword [esp + 0x14], 0
je 0x446cb4
xor byte [esp + 0x2d], cl
test ebp, ebp
pop ebp
je 0x446cbd
xor byte [esp + 0x2a], cl
lea edx, [esp + 0x18]
push edx
call dword [0x4835b4]
push esi
call fcn.00439774
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
mov edi, dword [0x4835c0]
test bl, 1
je 0x446cf2
movzx eax, byte [esi + 0x19]
push 0
push 2
push eax
push 0x12
call edi
test bl, 8
je 0x446d04
movzx ecx, byte [esi + 0x18]
push 0
push 2
push ecx
push 0x11
call edi
test bl, 2
je 0x446d19
movzx edx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x20]
push 0
push 2
push edx
push eax
call edi
test bl, 4
je 0x446d2e
movzx ecx, byte [esi + 0x1c]
push 0
push 2
push ecx
push 0xa1
call edi
test bl, 0x10
je 0x446d40
movzx edx, byte [esi + 0x1d]
push 0
push 2
push edx
push 0x5b
call edi
push esi
call fcn.00439774
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x446d52
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
test bl, 0x1f
je 0x446f3a
mov eax, dword [esi + 0x14]
push ebp
push edi
test eax, eax
je 0x446ecc
push eax
call dword [0x483648]
test eax, eax
je 0x446ecc
lea eax, [esp + 0x1c]
push eax
call dword [0x4835b8]
mov edi, ebx
and edi, 0x10
mov cl, 0x80
je 0x446da5
or byte [esp + 0x77], cl
mov eax, ebx
and eax, 2
mov dword [esp + 0x14], eax
je 0x446dbf
mov eax, dword [esi + 0x20]
or byte [esp + 0x2c], cl
or byte [esp + eax + 0x1c], cl
lea eax, [esp + eax + 0x1c]
mov eax, ebx
and eax, 4
mov dword [esp + 0x18], eax
je 0x446dd5
or byte [esp + 0x2c], cl
or byte [esp + 0xbd], cl
mov eax, ebx
and eax, 8
mov dword [esp + 0x10], eax
je 0x446de4
or byte [esp + 0x2d], cl
mov ebp, ebx
and ebp, 1
je 0x446def
or byte [esp + 0x2e], cl
lea ecx, [esp + 0x1c]
push ecx
call dword [0x4835b4]
test edi, edi
mov edi, dword [0x483658]
je 0x446e1c
movzx edx, byte [esi + 0x1d]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 1
push edx
push 0x5b
push 0x100
push eax
call edi
cmp dword [esp + 0x14], 0
je 0x446e3d
movzx ecx, byte [esi + 0x1b]
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push edx
push 0x100
push eax
call edi
cmp dword [esp + 0x18], 0
je 0x446e5c
movzx ecx, byte [esi + 0x1c]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x10
push 0x100
push edx
call edi
cmp dword [esp + 0x10], 0
je 0x446e7b
movzx eax, byte [esi + 0x18]
mov ecx, dword [esi + 0x14]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push ecx
call edi
test ebp, ebp
je 0x446f32
cmp dword [esp + 0x10], 0
jne 0x446eb0
test ebx, 0x800
jne 0x446eb0
movzx edx, byte [esi + 0x19]
mov eax, dword [esi + 0x14]
shl edx, 0x10
or edx, 0x20000001
push edx
push 0x12
push 0x104
push eax
jmp 0x446f30
test ebp, ebp
je 0x446f32
movzx ecx, byte [esi + 0x19]
mov edx, dword [esi + 0x14]
shl ecx, 0x10
or ecx, 1
push ecx
push 0x12
push 0x100
push edx
jmp 0x446f30
mov edi, dword [0x4835c0]
test bl, 0x10
je 0x446ee4
movzx eax, byte [esi + 0x1d]
push 0
push 0
push eax
push 0x5b
call edi
test bl, 2
je 0x446ef9
movzx ecx, byte [esi + 0x1b]
movzx edx, byte [esi + 0x20]
push 0
push 0
push ecx
push edx
call edi
test bl, 4
je 0x446f0e
movzx eax, byte [esi + 0x1c]
push 0
push 0
push eax
push 0xa1
call edi
test bl, 8
je 0x446f20
movzx ecx, byte [esi + 0x18]
push 0
push 0
push ecx
push 0x11
call edi
test bl, 1
je 0x446f32
movzx edx, byte [esi + 0x19]
push 0
push 0
push edx
push 0x12
call edi
push esi
call fcn.0043975d
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8