joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a36f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esi], eax
mov word [esi + 4], ax
cmp dword [edi + 0x20], eax
je 0x46a412
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a4f7
mov eax, 0x80
cmp byte [ebp - 0x60], al
je 0x46a3b7
cmp byte [ebp - 0xf0], al
jne 0x46a3c0
cmp byte [edi + 0x1a], 0
jne 0x46a3c0
mov byte [esi], 1
cmp byte [ebp - 0x5f], al
jne 0x46a3cf
cmp byte [edi + 0x1b], 0
jne 0x46a3cf
mov byte [esi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x46a3e1
cmp byte [edi + 0x1c], 0
jne 0x46a3e1
mov byte [esi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x46a3f3
cmp byte [edi + 0x1d], 0
jne 0x46a3f3
mov byte [esi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x46a4f7
cmp byte [edi + 0x1e], 0
jne 0x46a4f7
mov byte [esi + 4], 1
jmp 0x46a4f7
push ebx
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a43f
push 0xa0
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46a448
cmp byte [edi + 0x1a], 0
jne 0x46a448
mov byte [esi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a46e
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46a478
cmp byte [edi + 0x1b], 0
jne 0x46a478
mov byte [esi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a498
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46a4a2
cmp byte [edi + 0x1c], 0
jne 0x46a4a2
mov byte [esi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a4c2
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46a4cc
cmp byte [edi + 0x1d], 0
jne 0x46a4cc
mov byte [esi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a4ec
push 0x5b
call ebx
mov ecx, 0x8000
test cx, ax
je 0x46a4f6
cmp byte [edi + 0x1e], 0
jne 0x46a4f6
mov byte [esi + 4], 1
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x46a692
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10c
cmp byte [eax], 0
push esi
mov esi, ecx
je 0x46a6ae
mov byte [esi + 0x14], 1
mov cl, 1
jmp 0x46a6b1
mov cl, byte [esi + 0x14]
cmp byte [eax + 2], 0
je 0x46a6bb
mov byte [esi + 0x16], 1
cmp byte [eax + 3], 0
je 0x46a6c5
mov byte [esi + 0x17], 1
xor eax, eax
test cl, cl
je 0x46a6d3
cmp byte [esi + 0x1a], al
je 0x46a6d3
mov byte [esi + 0x14], al
cmp byte [esi + 0x15], al
je 0x46a6e0
cmp byte [esi + 0x1b], al
je 0x46a6e0
mov byte [esi + 0x15], al
cmp byte [esi + 0x16], al
je 0x46a6ed
cmp byte [esi + 0x1c], al
je 0x46a6ed
mov byte [esi + 0x16], al
cmp byte [esi + 0x17], al
je 0x46a6fa
cmp byte [esi + 0x1d], al
je 0x46a6fa
mov byte [esi + 0x17], al
cmp byte [esi + 0x18], al
je 0x46a707
cmp byte [esi + 0x1e], al
je 0x46a707
mov byte [esi + 0x18], al
cmp dword [esi + 0x20], eax
je 0x46a789
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a8c1
mov cl, byte [esi + 0x1a]
mov dl, byte [esi + 0x1b]
test cl, cl
sete al
dec al
and byte [ebp - 0x6c], al
test dl, dl
sete al
dec al
and byte [ebp - 0x6b], al
test cl, cl
jne 0x46a74c
test dl, dl
sete al
dec al
and byte [ebp - 0xfc], al
cmp byte [esi + 0x1c], 0
sete al
dec al
and byte [ebp - 0xfb], al
cmp byte [esi + 0x1d], 0
sete al
dec al
and byte [ebp - 0xfa], al
test cl, cl
sete al
dec al
and byte [ebp - 0xb1], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x46a8c1
push ebx
push edi
lea ecx, [ebp - 0xc]
call fcn.0046a2fc
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call ebx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x46a7c1
push 0xa0
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a7df
cmp byte [esi + 0x1a], 0
jne 0x46a7df
push 0xa0
lea ecx, [ebp - 0xc]
call fcn.0046b9e0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b29d
push 0xa1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a801
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a81f
cmp byte [esi + 0x1b], 0
jne 0x46a81f
push 0xa1
lea ecx, [ebp - 0xc]
call fcn.0046b9e0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b29d
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a83b
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a856
cmp byte [esi + 0x1c], 0
jne 0x46a856
push 0x11
lea ecx, [ebp - 0xc]
call fcn.0046b9e0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b29d
push 0x12
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x46a872
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
je 0x46a88d
cmp byte [esi + 0x1d], 0
jne 0x46a88d
push 0x12
lea ecx, [ebp - 0xc]
call fcn.0046b9e0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b29d
push 0x5b
call ebx
mov ebx, 0x8000
test bx, ax
jne 0x46a8a4
push 0x5b
call edi
test bx, ax
je 0x46a8bf
cmp byte [esi + 0x1e], 0
jne 0x46a8bf
push 0x5b
lea ecx, [ebp - 0xc]
call fcn.0046b9e0
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0046b29d
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x46b0ee
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
movzx edi, al
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bx, 1
cmp byte [ebp + 0xc], bl
je 0x46b150
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ecx
push 0
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046b927
mov ecx, dword [ebp - 4]
call fcn.0046a356
push ecx
push 2
push 0
push edi
call esi
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0046b927
mov ecx, dword [ebp - 4]
call fcn.0046a33f
pop esi
pop edi
mov al, bl
pop ebx
leave
ret 8

Function at 0x46b158
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46b23f
cmp bl, 0x14
je 0x46b23f
cmp bl, 0x90
je 0x46b23f
cmp bl, 0x91
je 0x46b23f
cmp bl, 0xff
je 0x46b22c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b1cf
movzx eax, bl
or byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 1
call fcn.0046a583
cmp al, 1
jne 0x46b1f1
mov edx, dword [ebp + 8]
or edx, 0x1000001
cmp byte [esi + 0x17], 0
jne 0x46b202
cmp byte [esi + 0x1d], 0
jne 0x46b202
cmp bl, 0x12
jne 0x46b220
cmp byte [esi + 0x16], 0
jne 0x46b220
cmp byte [esi + 0x1c], 0
jne 0x46b220
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x104
jmp 0x46b234
push edx
movzx eax, bl
push eax
push 0x100
jmp 0x46b234
push 1
push eax
push 0x102
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46b28f
cmp bl, 0xff
je 0x46b265
mov ecx, edi
call fcn.0046a583
push ecx
mov ecx, esi
cmp al, 1
jne 0x46b256
push 1
jmp 0x46b258
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046b927
jmp 0x46b28f
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0046a356
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46b29d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x20], 0
mov bl, byte [edi]
mov bh, byte [edi + 7]
movzx eax, word [edi + 8]
mov byte [ebp - 4], bl
mov byte [ebp + 8], bh
je 0x46b37d
cmp bl, 0x14
je 0x46b37d
cmp bl, 0x90
je 0x46b37d
cmp bl, 0x91
je 0x46b37d
cmp bl, 0xff
je 0x46b3cd
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b314
movzx eax, bl
xor byte [ebp + eax - 0x120], 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, bh
mov ecx, edi
shl eax, 0x10
mov edx, eax
mov dword [ebp + 8], eax
or edx, 0xc0000001
call fcn.0046a583
cmp al, 1
jne 0x46b339
mov edx, dword [ebp + 8]
or edx, 0xc1000001
cmp byte [esi + 0x17], 0
jne 0x46b34a
cmp byte [esi + 0x1d], 0
jne 0x46b34a
cmp bl, 0x12
jne 0x46b368
cmp byte [esi + 0x16], 0
jne 0x46b368
cmp byte [esi + 0x1c], 0
jne 0x46b368
or edx, 0x20000000
movzx eax, bl
push edx
push eax
push 0x105
jmp 0x46b372
push edx
movzx eax, bl
push eax
push 0x101
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46b3cd
cmp bl, 0xff
je 0x46b3a3
mov ecx, edi
call fcn.0046a583
push ecx
mov ecx, esi
cmp al, 1
jne 0x46b394
push 3
jmp 0x46b396
push 2
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0046b927
jmp 0x46b3cd
mov word [ebp - 0x1a], ax
xor edx, edx
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 6
inc edx
xor ecx, ecx
and dword [ebp - 0x14], ecx
and dword [ebp - 0x10], ecx
push eax
push edx
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], cx
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, esi
call fcn.0046a33f
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46b3db
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46b40c
cmp byte [esi + 1], 0
jne 0x46b40c
cmp byte [esi + 2], 0
jne 0x46b40c
cmp byte [esi + 3], 0
jne 0x46b40c
cmp byte [esi + 4], 0
je 0x46b5b5
cmp dword [edi + 0x20], 0
push ebx
je 0x46b53d
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46b53d
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b496
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46b454
or al, cl
or byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46b465
or al, cl
or byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46b471
or byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46b47d
or byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46b489
or byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46b4a7
cmp byte [esi + 1], 0
je 0x46b4be
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46b4db
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46b51a
cmp byte [esi + 2], 0
jne 0x46b503
cmp byte [edi + 0x1c], 0
jne 0x46b503
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x46b515
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push 0x100
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46b5ad
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push 0x100
push dword [edi + 0x20]
call ebx
jmp 0x46b5ad
xor ebx, ebx
cmp byte [esi], bl
je 0x46b556
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 1], bl
je 0x46b56e
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 2], bl
je 0x46b583
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 3], bl
je 0x46b598
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 4], bl
je 0x46b5ad
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046b927
mov ecx, edi
call fcn.0046a356
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46b5bb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x46b5ec
cmp byte [esi + 1], 0
jne 0x46b5ec
cmp byte [esi + 2], 0
jne 0x46b5ec
cmp byte [esi + 3], 0
jne 0x46b5ec
cmp byte [esi + 4], 0
je 0x46b7a3
cmp dword [edi + 0x20], 0
push ebx
je 0x46b725
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x46b725
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46b676
cmp byte [esi], 0
mov ecx, 0x80
mov al, byte [ebp - 0xf0]
je 0x46b634
xor al, cl
xor byte [ebp - 0x60], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 1], 0
je 0x46b645
xor al, cl
xor byte [ebp - 0x5f], cl
mov byte [ebp - 0xf0], al
cmp byte [esi + 2], 0
je 0x46b651
xor byte [ebp - 0xef], cl
cmp byte [esi + 3], 0
je 0x46b65d
xor byte [ebp - 0xee], cl
cmp byte [esi + 4], 0
je 0x46b669
xor byte [ebp - 0xa5], cl
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [esi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x46b687
cmp byte [esi + 1], 0
je 0x46b6a0
movzx eax, byte [edi + 0x26]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 2], 0
je 0x46b6bf
movzx eax, byte [edi + 0x24]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 3], 0
je 0x46b700
cmp byte [esi + 2], 0
jne 0x46b6e7
cmp byte [edi + 0x1c], 0
jne 0x46b6e7
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x46b6fb
movzx eax, byte [edi + 0x25]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push 0x101
push dword [edi + 0x20]
call ebx
cmp byte [esi + 4], 0
je 0x46b79b
movzx eax, byte [edi + 0x29]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push 0x101
push dword [edi + 0x20]
call ebx
jmp 0x46b79b
cmp byte [esi], 0
push 2
pop ebx
je 0x46b740
movzx eax, byte [edi + 0x27]
push ecx
push ebx
push eax
push 0xa0
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 1], 0
je 0x46b759
movzx eax, byte [edi + 0x28]
push ecx
push ebx
push eax
push 0xa1
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 2], 0
je 0x46b76f
movzx eax, byte [edi + 0x24]
push ecx
push ebx
push eax
push 0x11
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 3], 0
je 0x46b785
movzx eax, byte [edi + 0x25]
push ecx
push ebx
push eax
push 0x12
mov ecx, edi
call fcn.0046b927
cmp byte [esi + 4], 0
je 0x46b79b
movzx eax, byte [edi + 0x29]
push ecx
push ebx
push eax
push 0x5b
mov ecx, edi
call fcn.0046b927
mov ecx, edi
call fcn.0046a33f
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x46b7a9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
test esi, esi
js 0x46b82d
jne 0x46b7bc
push 0
jmp 0x46b827
cmp esi, 0xf
jae 0x46b826
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x46b826
mov dword [ebp - 4], esi
fild dword [ebp - 4]
test esi, esi
jns 0x46b7df
fadd qword [0x4c91b0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fstp qword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sbb eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
fild qword [ebp - 8]
fstp qword [ebp - 0x20]
call fcn.0041ef99
fdivr qword [ebp - 0x20]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 5
jnp 0x46b7e8
jmp 0x46b82d
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
leave
ret

Function at 0x46b97b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0046a67f
mov eax, dword [ebp + 8]
mov word [esi + 8], ax
test ax, ax
je 0x46b9d9
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x46b9d9
push ebx
mov ebx, eax
mov byte [esi], al
push 0
movzx eax, al
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
test bl, 1
je 0x46b9c2
mov byte [esi + 1], 1
test bl, 2
je 0x46b9cb
mov byte [esi + 3], 1
test bl, 4
pop ebx
je 0x46b9d5
mov byte [esi + 4], 1
mov al, 1
jmp 0x46b9db
xor al, al
pop esi
pop ebp
ret 4

Function at 0x46d2e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 8], edi
je 0x46d2fe
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0046d21c
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], edi
pop edi
pop esi
leave
ret 8
Function at 0x46d4e5
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20034
call fcn.004422a0
push ebx
push esi
lea eax, [ebp - 0x20034]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046e421
lea eax, [ebp - 0x10034]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046e421
pop ecx
pop ecx
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46d56f
cmp byte [ebp + 8], al
je 0x46d593
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call fcn.00425582
pop ecx
pop ecx
test eax, eax
je 0x46d654
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x46d654
lea ecx, [ebp - 0x20034]
call fcn.0046e7da
test al, al
je 0x46d593
lea ecx, [ebp - 0x10034]
call fcn.0046e7da
test al, al
je 0x46d599
cmp byte [ebp + 8], 0
jne 0x46d5d2
xor al, al
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040a1d4
lea ecx, [ebp - 0x34]
call fcn.0046d8a6
mov bl, al
lea ecx, [ebp - 0x34]
neg bl
sbb bl, bl
call fcn.0040ac28
add bl, 1
jne 0x46d593
lea ecx, [ebp - 0x10034]
call fcn.0046e7da
test al, al
je 0x46d593
lea eax, [ebp - 0x20034]
push str..
push eax
call fcn.00429388
lea eax, [ebp - 0x20034]
push eax
call fcn.00424cb3
xor ecx, ecx
mov word [ebp + eax*2 - 0x20032], cx
lea eax, [ebp - 0x10034]
push eax
call fcn.00424cb3
xor ecx, ecx
mov dword [ebp - 0x20], 2
add esp, 0x10
mov word [ebp + eax*2 - 0x10032], cx
lea eax, [ebp - 0x20034]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10034]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0x24], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46d593
mov al, 1
jmp 0x46d595
Function at 0x46d8a6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
mov dword [esp], eax
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 4]
push esi
push 0x49db28
mov dword [esp + 0x18], eax
inc dword [eax]
call fcn.0040699d
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d973
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
jne 0x46d90a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46d90f
jmp 0x46d977
cmp eax, 3
jne 0x46d97b
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
push 0x49db28
inc dword [eax]
call fcn.00403f9c
cmp eax, 0xffffffff
je 0x46d968
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x20]
call fcn.00408635
lea ecx, [esp + 0x18]
call fcn.0046d8a6
test al, al
je 0x46d966
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov bl, al
lea ecx, [esp + 0x18]
call fcn.0040ac28
jmp 0x46d97d
test al, 0x10
je 0x46d97b
mov bl, 1
jmp 0x46d97d
xor bl, bl
lea ecx, [esp + 8]
call fcn.0040ac28
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d98e
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.0040ae03
lea ecx, [esp + 0x30]
call fcn.0040ae03
lea ecx, [esp + 0x20]
call fcn.0040ae03
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00403ff7
mov ecx, dword [esp + 0x10]
call fcn.0046e7da
test al, al
je 0x46d9e5
push str..
lea ecx, [esp + 0x14]
call fcn.004059dc
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.00403e34
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x46da85
cmp al, 1
jne 0x46da85
test byte [esp + 0x40], 0x10
jne 0x46da60
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0040ad69
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00406aa4
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.004059dc
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x46da7c
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x46da18
mov al, bl
mov byte [esp + 0xe], al
jmp 0x46da18
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x46da90
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0040ac28
lea ecx, [esp + 0x30]
call fcn.0040ac28
lea ecx, [esp + 0x10]
call fcn.0040ac28
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret