joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x438]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x80
lea eax, [edi + 0xb0]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
mov dword [edi + 0x134], esi
mov eax, dword [esp + 0x18]
mov dword [edi + 0x130], eax
cmp esi, 4
jge 0x4820b6
push str.Received_too_short_packet
push ebp
call fcn.004606d0
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
mov edx, dword [edi + 0x148]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x4820d5.1
jmp dword [ecx*4 + 0x4821c4]
cmp esi, 4
jle case.0x4820d5.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4820d5.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.004619f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x4820d5.4
push 5
push edi
call fcn.00482ac0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x10], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.00482b30
add esp, 8
cmp eax, esi
jae case.0x4820d5.4
push dword [esp + 0x10]
push str.TFTP_error:__s
push ebp
call fcn.004607a0
jmp 0x48219a
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.00481df0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x4820d5.4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Internal_error:_Unexpected_packet
push 0x527e18
push ebp
call fcn.004606d0
add esp, 0xc
push ebp
call fcn.00476cc0
add esp, 4
test eax, eax
je 0x4820ae
push 5
push edi
call fcn.00482ac0
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x48be70
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0x18]
cmp eax, 0x64
jb 0x48bea0
push str.Couldnt_set_desired_mode
push esi
call fcn.004606d0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x48beb7
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.004607a0
add esp, 0xc
mov al, byte [esp + 0x18]
push ebp
cmp al, 0x13
jne 0x48bed1
push ebx
push esi
call fcn.0048bb70
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x14
jne 0x48bfde
mov edi, dword [esi + 0x18]
xor ebx, ebx
cmp byte [esi + 0x4d0], 2
mov dword [esp + 0x18], edi
jne 0x48bf4e
mov eax, dword [esi + 0x130]
mov eax, dword [eax]
test eax, eax
je 0x48bf4e
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
call fcn.0046a370
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x48c009
push 0x2f
push dword [esp + 0x18]
call fcn.004f3910
add esp, 8
test eax, eax
je 0x48bf3d
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x48bf4a
push dword [esp + 0x14]
call dword [0x562004]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x55c]
test ecx, ecx
jne 0x48bf6c
cmp byte [esi + 0xd41], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x550028
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x529ae8
cmove eax, edx
push eax
push ecx
push 0x52a500
call fcn.00465f70
push ebx
mov ebp, eax
call dword [0x562004]
add esp, 0x14
test ebp, ebp
jne 0x48bfa9
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x527e18
lea eax, [edi + 0x438]
push eax
push esi
call fcn.004a0590
push ebp
mov edi, eax
call dword [0x562004]
add esp, 0x14
test edi, edi
jne 0x48c009
push 0x1f
push esi
call fcn.00489d40
add esp, 8
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x15
jne 0x48bff6
push 0xd
push 1
push esi
call fcn.0048b6c0
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp al, 0x16
jne 0x48c009
push 0xe
push 1
push esi
call fcn.0048b6c0
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x49d060
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x562904]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.0050e677
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x49d0df
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00449070
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004606d0
push esi
call dword [0x562004]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x49d23f
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x49d139
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00449070
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004606d0
push 0
mov esi, 0x4d
call dword [0x562004]
add esp, 0x20
jmp 0x49d231
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49d179
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00449070
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004606d0
add esp, 0x1c
mov esi, 0x4d
jmp 0x49d21d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x49d1a7
jg 0x49d18d
cmp edi, 0x100000
jbe 0x49d1a7
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004606d0
add esp, 0xc
mov esi, 0x4d
jmp 0x49d21d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49d1bf
lea esi, [eax + 0x1b]
jmp 0x49d21d
test edi, edi
je 0x49d204
nop dword [eax]
nop word [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49d25c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49d258
add esi, eax
cmp esi, edi
jb 0x49d1d0
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0049ce60
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x562004]
add esp, 4
push dword [esp + 0x20]
call fcn.004fbf68
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f1532
add esp, 0x120
ret
mov edi, esi
jmp 0x49d204
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00449070
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004606d0
add esp, 0x1c
mov esi, 0x4d
jmp 0x49d21d
Function at 0x4a2ef0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4a2f17
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4a2f62
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4a2f66
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4a2fc6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4a2f85
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x4a2ff7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x53627d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x53627e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4a2fd0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4a3000
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.00463ea0
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x4a3168
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4a307c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4a30e1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4a30a0
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x4a310d
mov eax, dword [esi + 4]
push 1
push 0x53627d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x53627e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4a30e6
push dword [esp + 0x28]
call fcn.00463ea0
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x4a3138
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x562004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x4a3240
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4a3266
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a3296
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.00463ea0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x4a32ed
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x4a32fc
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4a330d
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x4a66d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522dcd
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x562904]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a0], ebx
call fcn.004a6920
mov esi, eax
cmp word [edi], bx
je 0x4a6729
cmp word [edi + 2], 0x3a
jne 0x4a6729
mov eax, edi
jmp 0x4a6760
mov ecx, esi
call fcn.004ada60
test al, al
jne 0x4a6837
push edi
lea eax, [ebp - 0x19c]
mov ecx, esi
push eax
call fcn.004ad2b0
mov ebx, 1
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0x1a0], ebx
call fcn.0040f7b0
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x118]
call fcn.004ad080
mov dword [ebp - 4], 2
test bl, 1
je 0x4a6785
lea ecx, [ebp - 0x19c]
call fcn.004ad160
push 0
push 0x80
push 3
push 0
push 1
push bind
lea ecx, [ebp - 0x118]
call fcn.0040f7b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a6825
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x4a6825
push esi
mov dword [ebp - 0x1a4], 0
call fcn.004f1b15
add esp, 4
mov dword [ebp - 0x1a0], eax
lea ecx, [ebp - 0x1a4]
push 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a4], esi
jne 0x4a6817
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x118]
mov dword [eax], esi
call fcn.004ad160
mov eax, dword [ebp - 0x1a0]
jmp 0x4a68ea
push dword [ebp - 0x1a0]
call fcn.004f1b10
add esp, 4
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.004ad160
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x94]
call fcn.004ad080
push 0x54ea7c
push 0x54e98c
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.004adc90
lea eax, [ebp - 0x94]
mov ecx, 0x56797c
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004a4610
mov esi, dword [ebp - 0x1ac]
cmp byte [esi + 0xd], 0
jne 0x4a68d1
lea ecx, [esi + 0x10]
call fcn.0040f7b0
push eax
lea ecx, [ebp - 0x94]
call fcn.004ad340
test al, al
jne 0x4a68d1
cmp esi, dword [0x56797c]
je 0x4a68d1
mov edi, dword [esi + 0xa4]
push edi
call fcn.004f1b15
add esi, 0x94
add esp, 4
mov ebx, eax
cmp dword [esi + 0x14], 0x10
jb 0x4a68c4
mov esi, dword [esi]
push edi
push esi
push ebx
call fcn.004f3a50
add esp, 0xc
jmp 0x4a68d5
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x94]
mov dword [eax], edi
call fcn.004ad160
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1532
mov esp, ebp
pop ebp
ret
Function at 0x4a6b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54ed84
push dword [ebp + 8]
call fcn.004a6910
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4a6b7a
push edi
push esi
call fcn.004a6910
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4a6b79
push esi
call fcn.004a6910
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4a6b79
push 0x4ac140
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0043fec0
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp + 0xc]
call fcn.004a6b90
add esp, 4
pop esi
pop ebp
ret

Function at 0x4a7270
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4a7295
or esi, 2
push 1
call edi
test ax, ax
jns 0x4a72a1
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x4a72ad
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4a72b9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4a9900
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x354]
call fcn.004ad890
mov ebx, dword [ebp + 8]
test eax, eax
jle 0x4a995b
nop
push esi
lea ecx, [edi + 0x354]
mov byte [ebp + 0xb], 0
call fcn.004ad290
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push ebx
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4a9aac
lea ecx, [edi + 0x354]
inc esi
call fcn.004ad890
cmp esi, eax
jl 0x4a9920
sub ebx, 0x100
je 0x4a9a35
sub ebx, 4
je 0x4a99d1
sub ebx, 2
jne 0x4a9a2a
cmp dword [edi + 0xe0], ebx
je 0x4a9a2a
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call fcn.00507120
mov ecx, dword [edi + 0xe0]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push reloc.WS2_32.dll_select
push edx
push 0x4abeb0
call dword [eax + 0x114]
mov esi, eax
test esi, esi
je 0x4a9a2a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x108]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edi + 0xe4]
test eax, eax
je 0x4a9a2a
mov ecx, dword [edi + 0xf8]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [edi + 0xf4]
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
call fcn.004a7270
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4a9a2a
mov ecx, dword [edi + 0xe4]
test ecx, ecx
je 0x4a9a93
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x4a9a93
mov ecx, dword [edi + 0xe4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4a9a93
mov ecx, dword [edi + 0xe4]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.004f33f6
add esp, 8
test eax, eax
je 0x4a9a93
mov ecx, dword [edi + 0xe4]
call fcn.004c14c0
test al, al
jne 0x4a9a2a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
setns al
movzx eax, al
push eax
call fcn.004ab240
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4aaca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x4aacdb
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x4aacdb
cmp esi, dword [edi + 0xe4]
je 0x4aacdb
cmp byte [edi + 0xdc], 0
jne 0x4aacdb
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x4aadd6
test eax, eax
je 0x4aad4a
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.004aa820
mov dword [edi + 0xe4], 0
test esi, esi
je 0x4aadd6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x4aadd6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x4aadd6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4aadd6
xorps xmm0, xmm0
mov dword [edi + 0xe4], esi
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.004aa820
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4abbe0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4abc91
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x5677bc
mov dword [ebp - 4], ebx
call fcn.004ad890
sub eax, 1
mov dword [ebp + 8], eax
js 0x4abc88
push eax
mov ecx, 0x5677bc
call fcn.004ad290
cmp dword [ebp - 4], 0
mov edi, eax
je 0x4abc7a
mov ecx, edi
call fcn.004a66b0
cmp dword [esi], eax
je 0x4abc49
mov ecx, edi
call fcn.004a66b0
cmp ebx, eax
jne 0x4abc6d
push esi
mov ecx, edi
call fcn.004abb80
test al, al
jne 0x4abd15
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.004a9900
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x4abc33
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
sub eax, 1
mov dword [ebp + 8], eax
jns 0x4abc20
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5677bc
xor edi, edi
call fcn.004ad890
test eax, eax
jle 0x4abc88
mov ecx, 0x5677bc
call fcn.004ad890
push edi
mov ecx, 0x5677bc
call fcn.004ad290
mov ebx, eax
mov ecx, ebx
call fcn.004a66b0
cmp dword [esi], eax
je 0x4abcdb
mov ecx, 0x5677bc
inc edi
call fcn.004ad890
cmp edi, eax
jl 0x4abca1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.004abb80
test al, al
jne 0x4abd15
mov eax, dword [esi + 8]
cmp eax, 0xe5
jne 0x4abcfb
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xc]
mov ecx, ebx
push eax
push dword [esi + 4]
call fcn.004a9900
test al, al
je 0x4abc88
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae730
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ae775
cmp byte [ebp + 8], 0
je 0x4ae769
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8