joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bd18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x47bd2a
add esp, 0xfffffff0
call fcn.004479a0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0042a5b0
mov eax, dword [0x519cb4]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x47c288
mov eax, dword [0x519cb8]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x47c2a8
mov eax, dword [ebp - 4]
call fcn.0047c2c8
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41b828]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41b828]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x41b828]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x41b828]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x41b828]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x476ae4
push eax
push 0
push 0
mov eax, dword [0x519d84]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x463db4]
call fcn.00465804
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x463db4]
call fcn.00465804
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x463db4]
call fcn.00465804
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.0047c81c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x47c660
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x47c660
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x47c660
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x47beb2
call fcn.004479f8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x47c418
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c5e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x47c5c1
mov dl, 1
mov eax, dword [0x41bd20]
call fcn.0044760c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00448494
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x47c5aa
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.0049ea58
test al, al
je 0x47c59e
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x47c5f4
lea eax, [ebp - 0x25c]
call fcn.00435de4
push eax
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x47c59e
xor eax, eax
push ebp
push 0x47c597
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x47c62c
mov eax, dword [ebp - 0x18]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x47c580
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, 0x100
call fcn.00448704
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x47c580
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, 0x100
call fcn.00448704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c59e
mov eax, dword [ebp - 0x18]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x47c48d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00421648
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5ea
lea eax, [ebp - 0x268]
call fcn.00448494
ret
Function at 0x47d144
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x51d7d8]
cmp byte [eax + 0xad], 0
jne 0x47d1bb
cmp dword [0x51d7f0], 0
jne 0x47d179
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x47d100
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x51d7f0], eax
cmp dword [0x51d7ec], 0
jne 0x47d194
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x51d7ec], eax
cmp dword [0x51d7f4], 0
jne 0x47d1bb
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x47d0a0
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x51d7f4], eax
pop ecx
pop ebp
ret

Function at 0x47d284
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0047d21c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x47d2a5
xor eax, eax
call fcn.0047d254
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.USER32.DLL_ShowWindow
cmp byte [ebp - 9], 0
je 0x47d2bf
mov al, 1
call fcn.0047d254
mov esp, ebp
pop ebp
ret

Function at 0x47db0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x51d7d8]
cmp dword [eax + 0x30], 0
je 0x47dbd6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x47dbcd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x47da8c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x47dbcd
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x47db87
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x47dbcd
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.0041e63c
push eax
call sub.USER32.DLL_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x47db9c
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret
Function at 0x47de0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x51d7d8]
cmp dword [eax + 0x30], 0
je 0x47df17
cmp byte [ebp - 5], 0
jne 0x47de9c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x47de91
push 0
push 0x47dd8c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
cmp dword [eax + 8], 0
jle 0x47de91
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x47de91
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
call fcn.0041e63c
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x47de69
mov eax, dword [ebp - 4]
inc dword [eax + 0x9c]
jmp 0x47df17
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jle 0x47df17
mov eax, dword [ebp - 4]
dec dword [eax + 0x9c]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x47df17
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
cmp dword [eax + 8], 0
jle 0x47df09
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x47df09
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
call fcn.0041e63c
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x47dee1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x47eb28
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xac], 0
je 0x47eb6d
push 0x100
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00448584
jmp 0x47eb7e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.004484e8
mov esp, ebp
pop ebp
ret

Function at 0x4803dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x480466
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00498278
test al, al
je 0x480466
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00497d30
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x480466
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x480456
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00497d30
push eax
call sub.USER32.DLL_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0048dd98
jmp 0x480466
mov cl, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x74]
mov eax, dword [ebp - 4]
call fcn.004801ac
pop ecx
pop ebp
ret
Function at 0x485f30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00448964
xor eax, eax
push ebp
push 0x486085
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x486058
xor eax, eax
push ebp
push 0x486051
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x485f89
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x486026
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x486015
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x485fda
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00448974
mov ecx, dword [ebp - 0x18]
inc ecx
mov edx, dword [ebp - 0x10]
call fcn.00446a30
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48601c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x519ef4]
mov dl, 1
mov eax, dword [0x432a28]
call fcn.004390c0
call fcn.00447ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48608c
lea eax, [ebp - 8]
call fcn.00448494
ret
Function at 0x486094
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48625e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x1c]
mov edx, 0x1b
mov al, 0x2d
call fcn.00448cac
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0x486274
call fcn.004487c0
mov eax, dword [ebp - 4]
call fcn.0042af28
dec eax
test eax, eax
jl 0x486159
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0042aee8
mov edx, dword [0x452918]
call fcn.004477c8
test al, al
je 0x486151
push dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0042aee8
lea edx, [ebp - 0x20]
call fcn.0048df48
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov edx, 3
mov al, 0x20
call fcn.00448cac
push dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00448834
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x4860ff
mov al, byte [0x486278]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x486284
mov eax, dword [ebp - 0x10]
call fcn.0043aa6c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.0044852c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.0048df48
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0xb
mov eax, 0x486274
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
lea edx, [ebp - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
call fcn.0048df48
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
mov eax, 0x486274
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
mov eax, 0x486274
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x78]
mov ecx, 9
mov eax, 0x486290
call fcn.00435e98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486265
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004484b8
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004484b8
lea eax, [ebp - 0x20]
call fcn.00448494
lea eax, [ebp - 0x1c]
call fcn.00448494
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004484b8
ret
Function at 0x48ab84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x51d890], 0
je 0x48acd9
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x519ca8]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x48acd9
mov eax, dword [0x51d894]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x51d890]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x48aca8
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x51d890]
call fcn.0041e63c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x48ac9c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x48ac9c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x48ac9c
mov eax, dword [ebp - 0x14]
call fcn.00497d30
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x48ac9c
push ebp
call fcn.0048ab38
pop ecx
test al, al
jne 0x48ac9c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00447838
test al, al
je 0x48ac9c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00447838
cmp byte [ebp - 1], 0
je 0x48ac9c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x30]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x48ac9c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x51d894]
call fcn.00489f68
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x48abf0
mov eax, dword [0x51d894]
cmp dword [eax + 8], 0
jle 0x48acc0
mov eax, dword [0x51d894]
call fcn.0048a044
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x48acd9
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0048a974
pop ecx
test al, al
jne 0x48acd9
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4941d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.USER32.DLL_GetMessagePos
call fcn.00432754
mov dword [ebp - 0x19], eax
movsx eax, word [ebp - 0x19]
mov dword [ebp - 0x21], eax
movsx eax, word [ebp - 0x17]
mov dword [ebp - 0x1d], eax
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x21]
mov eax, dword [ebp - 4]
call fcn.0048d8a0
cmp dword [ebp - 0xc], 0
jne 0x494229
push 0
push 0
lea edx, [ebp - 0x15]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004940e8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x494325
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x49425b
mov eax, dword [ebp - 0x15]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x40]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x11]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x44]
mov dword [ebp - 0x134], eax
jmp 0x49426d
mov eax, dword [ebp - 0x15]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x11]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xa]
cmp eax, 0x201
jge 0x4942ac
add eax, 0xffffff5f
sub eax, 2
jb 0x4942c4
dec eax
sub eax, 2
jb 0x4942d6
dec eax
sub eax, 2
jb 0x4942cd
jmp 0x4942df
add eax, 0xfffffdff
sub eax, 2
jb 0x4942c4
dec eax
sub eax, 2
jb 0x4942d6
dec eax
sub eax, 2
jb 0x4942cd
jmp 0x4942df
mov byte [ebp - 0x12c], 0
jmp 0x4942e6
mov byte [ebp - 0x12c], 2
jmp 0x4942e6
mov byte [ebp - 0x12c], 1
jmp 0x4942e6
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x121]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [ebp - 0x121]
call fcn.00472504
mov byte [ebp - 0x12b], al
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, dword [ebp - 0xc]
call fcn.0048f850
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov byte [ebp - 0xd], 1
jmp 0x494329
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x495184
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x240], 0
je 0x4951a5
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x4951da
mov eax, dword [ebp - 4]
test byte [eax + 0x55], 1
jne 0x4951ca
mov eax, dword [ebp - 4]
call fcn.00492fcc
test eax, eax
jne 0x4951ca
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x495304
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00494ab0
jmp 0x495304
push 0
call sub.USER32.DLL_GetDC
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4952fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00497d30
push eax
call sub.USER32.DLL_BeginPaint
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.0048f850
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00495184
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 4], edx
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x70]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00497d30
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495304
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 0x10]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 0x14]
push eax
call sub.GDI32.DLL_DeleteObject
ret
mov esp, ebp
pop ebp
ret