joyce8/EMBER2024-capa huggingface dataset:
Function at 0x762670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x77c633
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x74]
fldz
mov esi, dword [ebp + 0x18]
lea eax, [esp + 0x48]
fstp qword [esp + 0x2c]
push eax
lea ebx, [esp + 0x30]
call fcn.0041cc80
xor ebx, ebx
mov dword [esp + 0x6c], ebx
fldz
mov eax, dword [ebp + 0x18]
fstp qword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x74], eax
jle 0x762729
fild dword [esp + 0x14]
sub esp, 8
fidiv dword [esp + 0x7c]
fstp qword [esp]
call fcn.00435ec0
fst qword [esp + 0x2c]
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
sub ecx, eax
sar ecx, 3
cmp esi, ecx
jb 0x762708
fstp st(0)
call fcn.006441b7
mov eax, dword [esp + 0x54]
fld qword [esp + 0x2c]
fld qword [eax + esi*8]
inc esi
fadd st(1)
mov dword [esp + 0x14], esi
fstp qword [eax + esi*8 - 8]
mov eax, dword [ebp + 0x18]
cmp esi, eax
fadd qword [esp + 0x1c]
mov dword [esp + 0x74], eax
fstp qword [esp + 0x1c]
jl 0x7626d1
mov eax, dword [ebp + 0x18]
fldz
fstp qword [esp + 0x14]
mov dword [esp + 0x74], eax
fild dword [esp + 0x74]
push eax
lea eax, [esp + 0x78]
mov ecx, ebp
xor esi, esi
fstp qword [esp + 0x28]
fld1
fstp dword [esp + 0x78]
call fcn.0041cd50
xor edi, edi
cmp dword [ebp + 0x18], ebx
mov dword [esp + 0x74], edi
jle 0x762830
fld qword [esp + 0x24]
fsub qword [0x7a8008]
fstp qword [esp + 0x34]
fldz
fst qword [esp + 0x2c]
fld qword [esp + 0x14]
mov edx, dword [esp + 0x58]
sub edx, dword [esp + 0x54]
sar edx, 3
cmp edi, edx
jb 0x762799
fstp st(1)
fstp st(0)
call fcn.006441b7
fld qword [esp + 0x2c]
fld qword [esp + 0x14]
mov eax, dword [esp + 0x54]
fld qword [eax + edi*8]
fdiv qword [esp + 0x1c]
fld qword [esp + 0x34]
fmul st(1), st(0)
fxch st(1)
faddp st(2)
fxch st(1)
fst qword [esp + 0x14]
fild dword [esp + 0x74]
fdivrp st(2)
fxch st(1)
fstp qword [esp + 0x3c]
fcom st(1)
fnstsw ax
test ah, 1
jne 0x76281e
jmp 0x7627cd
fxch st(1)
fld qword [esp + 0x24]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x762806
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
sar ecx, 2
cmp esi, ecx
jb 0x7627f4
fstp st(0)
call fcn.006441b7
fld qword [esp + 0x14]
fld qword [esp + 0x3c]
mov edx, dword [ebp + 0xc]
fstp dword [esp + 0x74]
fld dword [esp + 0x74]
fstp dword [edx + esi*4]
inc esi
mov dword [esp + 0x74], esi
fild dword [esp + 0x74]
fcom st(1)
fnstsw ax
test ah, 0x41
jnp 0x7627cb
fst qword [esp + 0x2c]
fxch st(1)
inc edi
cmp edi, dword [ebp + 0x18]
mov dword [esp + 0x74], edi
jl 0x762779
fstp st(1)
fstp st(0)
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x762841
push eax
call fcn.006441c7
add esp, 4
mov eax, dword [esp + 0x48]
push eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call fcn.006441c7
add esp, 4
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 4
Function at 0x769710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x77b872
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x34], esi
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esi], vtable.Sexy::Announcement.0
lea edi, [esi + 0x10]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
lea ecx, [esi + 0x30]
mov byte [esp + 0x40], 1
call fcn.00434f60
lea ecx, [esi + 0xa0]
call fcn.00434f60
lea ecx, [esi + 0x110]
call fcn.00434f60
mov dword [esi + 0x184], ebp
cmp ebp, ebx
je 0x7697c2
mov edx, dword [ebp]
mov eax, dword [edx + 0x2ac]
mov ecx, ebp
call eax
mov ecx, 0x1f4
add eax, 0x200
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 0x184]
mov dword [esi + 8], eax
cmp byte [ecx + 0x2efc], bl
jne 0x7697c2
mov dword [esi + 8], 0x320
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x54]
push edx
mov ecx, edi
call fcn.00401880
push 0x2c
mov ebp, 0xf
push str.b0_1_0.003333_1__Q_______O
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004016e0
push ebx
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0x30]
mov byte [esp + 0x48], 2
call fcn.00435cc0
mov edi, 0x10
mov byte [esp + 0x40], 1
cmp dword [esp + 0x2c], edi
jb 0x769822
mov ecx, dword [esp + 0x18]
push ecx
call fcn.006441c7
add esp, 4
push 0x2d
push str.b0_1_0.003333_1__Q________O
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004016e0
push ebx
lea edx, [esp + 0x18]
push edx
lea eax, [esi + 0xa0]
mov byte [esp + 0x48], 3
call fcn.00435cc0
mov byte [esp + 0x40], 1
cmp dword [esp + 0x2c], edi
jb 0x76986c
mov eax, dword [esp + 0x18]
push eax
call fcn.006441c7
add esp, 4
fld qword [0x7a8008]
sub esp, 8
lea eax, [esi + 0x110]
fstp qword [esp]
call fcn.00435d30
mov eax, dword [esi + 0x184]
mov byte [esi + 0x180], 1
mov byte [esi + 0x181], 1
mov ecx, dword [0x8827ac]
mov dword [esi + 0x188], ecx
cmp eax, ebx
je 0x7698ba
lea edi, [eax + 0x3034]
lea ebx, [esp + 0x30]
mov dword [esp + 0x30], esi
call fcn.0041b790
cmp dword [esp + 0x64], 8
jb 0x7698ce
mov edx, dword [esp + 0x50]
push edx
call fcn.006441c7
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x34
ret 0x20
Function at 0xda8d64
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xe25028], 0x8088405
inc edx
mov dword [ebx + 0xe25028], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xdcfc24
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov esi, dword [ebx + 4]
push dword [ebx + 0xc]
push dword [ebx + 8]
mov eax, esi
call fcn.00dc0080
lea edx, [ebx + 0x3c]
mov ecx, pe_nt_image_headers32
mov eax, esi
call fcn.00dc028c
cmp word [ebx + 0x3c], 0x5a4d
je 0xdcfc76
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
mov byte [esp + 4], 0xb
push esp
push 0
mov ecx, 0xdcfd5c
mov dl, 1
mov eax, dword [0xdad76c]
call fcn.00db279c
call fcn.00da9bc4
mov eax, dword [ebx + 0x78]
cdq
add eax, dword [ebx + 8]
adc edx, dword [ebx + 0xc]
push edx
push eax
mov eax, esi
call fcn.00dc0080
lea edx, [ebx + 0x7c]
mov ecx, 0xf8
mov eax, esi
call fcn.00dc028c
cmp word [ebx + 0x7c], 0x454e
jne 0xdcfcc4
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
mov byte [esp + 4], 0xb
push esp
push 0
mov ecx, 0xdcfd90
mov dl, 1
mov eax, dword [0xdcf5c4]
call fcn.00db279c
call fcn.00da9bc4
cmp dword [ebx + 0x7c], 0x4550
je 0xdcfcf1
mov eax, dword [ebx + 0x38]
mov dword [esp], eax
mov byte [esp + 4], 0xb
push esp
push 0
mov ecx, 0xdcfdb4
mov dl, 1
mov eax, dword [0xdad76c]
call fcn.00db279c
call fcn.00da9bc4
mov eax, dword [ebx + 0x1a4]
test eax, eax
je 0xdcfd20
mov ecx, 0x3a
mov edx, 2
call fcn.00dced00
mov ecx, dword [ebx + 0x78]
sub ecx, 0x40
mov edx, pe_nt_image_headers32
mov eax, dword [ebx + 0x1a4]
call fcn.00dced00
mov eax, dword [ebx + 0x1a8]
test eax, eax
je 0xdcfd4f
mov ecx, 0x36
mov edx, 2
call fcn.00dced2c
mov ecx, dword [ebx + 0x78]
sub ecx, 0x40
mov edx, pe_nt_image_headers32
mov eax, dword [ebx + 0x1a8]
call fcn.00dced2c
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0xdd039c
Capabilities:
Inspect section memory permissions

Disassembly:
test eax, 0x40000000
je 0xdd03d3
test eax, 0x80000000
je 0xdd03bf
test eax, 0x20000000
je 0xdd03b8
mov eax, pe_nt_image_headers32
jmp 0xdd0402
mov eax, 4
jmp 0xdd0402
test eax, 0x20000000
je 0xdd03cd
mov eax, 0x20
jmp 0xdd0402
mov eax, 2
ret
test eax, 0x80000000
je 0xdd03ef
test eax, 0x20000000
je 0xdd03e8
mov eax, 0x80
jmp 0xdd0402
mov eax, 8
jmp 0xdd0402
test eax, 0x20000000
je 0xdd03fd
mov eax, 0x10
jmp 0xdd0402
mov eax, 1
ret

Function at 0xdd2908
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, 0xffffffff
mov ecx, edi
shr ecx, 2
jecxz 0xdd295f
mov edx, dword [esi]
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0xe27948]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0xe27948]
shr edx, 0x10
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0xe27948]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0xe27948]
add esi, 4
loop 0xdd291d
mov ecx, edi
and ecx, 3
jecxz 0xdd2977
mov bl, al
xor bl, byte [esi]
shr eax, 8
inc esi
xor eax, dword [ebx*4 + 0xe27948]
loop 0xdd2966
xor eax, 0xffffffff
pop ebx
pop edi
pop esi
ret
Function at 0xddcba8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xddcbae
ret
Function at 0xe18c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0x20
call fcn.00dac838
push eax
call fcn.00dac700
test eax, eax
je 0xe18cea
lea eax, [esp + 0x10]
push eax
push 0xe18d04
push 0
call fcn.00dac6f8
test eax, eax
je 0xe18cea
mov dword [esp + 0xc], 1
cmp byte [esp], 0
je 0xe18cc2
mov dword [esp + 0x18], 2
jmp 0xe18cc8
xor eax, eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.00dac6f0
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
cmp dword [esp + 4], 0
je 0xe18cfb
mov eax, dword [esp + 4]
push eax
call fcn.00dac728
mov eax, ebx
add esp, 0x1c
pop ebx
ret

Function at 0xe46970
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0xe4698d
xor eax, eax
jmp 0xe46a15
mov cl, byte [esi]
and cl, 0xff
and ecx, 0xff
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
shl ecx, 3
lea edx, [eax + 1]
mov dl, byte [esi + edx]
and dl, 0xff
and edx, 0xff
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0xe469d2
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.00e4649c
test al, al
jne 0xe46a0c
xor eax, eax
jmp 0xe46a15
mov edx, ebx
mov eax, edi
call fcn.00e4644c
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x534be4], 1
mov dword [0x534be8], 1
mov dword [0x534bec], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x406880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0xac
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x28], ecx
mov ebx, dword [esp + 0xc8]
mov dword [esp], eax
call method.sf::Font.loadPage_unsigned_int__const
sub esp, 4
mov ebp, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 4], eax
mov eax, dword [edi + 4]
movzx edi, bl
xor ebx, ebx
mov esi, edi
mov dword [esp], eax
call sym._FT_Get_Char_Index
mov dword [esp + 0x2c], edi
xor edi, edi
mov ecx, eax
mov eax, dword [esp + 0xcc]
shld edi, esi, 0x1f
shl esi, 0x1f
mov edx, eax
xor eax, eax
or edi, edx
mov edx, dword [ebp + 8]
or esi, eax
or edi, ebx
or esi, ecx
lea ebx, [ebp + 4]
test edx, edx
je 0x406934
mov dword [esp + 0x20], ebx
mov ebp, ebx
jmp 0x406908
mov ebp, edx
mov edx, ebx
test edx, edx
je 0x40691e
mov eax, dword [edx + 0x14]
cmp dword [edx + 0x10], esi
mov ebx, dword [edx + 8]
mov ecx, dword [edx + 0xc]
sbb eax, edi
jae 0x406900
mov edx, ecx
test edx, edx
jne 0x406908
mov ebx, dword [esp + 0x20]
cmp ebx, ebp
je 0x406934
cmp esi, dword [ebp + 0x10]
mov eax, edi
sbb eax, dword [ebp + 0x14]
jae 0x406a60
mov eax, dword [esp + 0x2c]
fld dword [esp + 0xcc]
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc4]
fstp dword [esp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call method.sf::Font.loadGlyph_unsigned_int__unsigned_int__bool__float__const
sub esp, 0x14
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 8]
mov eax, ebx
test edx, edx
je 0x406a30
mov dword [esp + 0x20], ebx
mov ebx, eax
jmp 0x406a08
mov ebx, edx
mov edx, eax
test edx, edx
je 0x406a1e
mov ecx, dword [edx + 0x14]
cmp dword [edx + 0x10], esi
mov eax, dword [edx + 8]
mov ebp, dword [edx + 0xc]
sbb ecx, edi
jae 0x406a00
mov edx, ebp
test edx, edx
jne 0x406a08
mov eax, ebx
mov ebx, dword [esp + 0x20]
cmp ebx, eax
je 0x406a30
cmp esi, dword [eax + 0x10]
sbb edi, dword [eax + 0x14]
jae 0x406a47
lea edx, [esp + 0x68]
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], edx
call sym.__ZNSt8_Rb_treeIySt4pairIKyN2sf5GlyphEESt10_Select1stIS4_ESt4lessIyESaIS4_EE22_M_emplace_hint_uniqueIJS0_IyS3_EEEESt17_Rb_tree
sub esp, 8
add esp, 0xac
add eax, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
add esp, 0xac
lea eax, [ebp + 0x18]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x408350
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._fread
add esp, 0x1c
ret

Function at 0x4090c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret
Function at 0x44f5b0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f590
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f586.80
jmp dword [edx*4 + 0x4f4ef0]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f592
mov eax, 0x13
jmp 0x44f5a6
mov eax, 0x6f
jmp 0x44f5a6
mov eax, 0x6d
jmp 0x44f5a6
mov eax, 0x6e
jmp 0x44f5a6
mov eax, 0x62
jmp 0x44f5a6
mov eax, 0x63
jmp 0x44f5a6
mov eax, 0x64
jmp 0x44f5a6
mov eax, 0x65
jmp 0x44f5a6
mov eax, 0x66
jmp 0x44f5a6
mov eax, 0x67
jmp 0x44f5a6
mov eax, 0x68
jmp 0x44f5a6
mov eax, 0x69
jmp 0x44f5a6
mov eax, 0xa3
jmp 0x44f5a6
mov eax, 0xa5
jmp 0x44f5a6
mov eax, 0x61
jmp 0x44f5a6
mov eax, 0x60
jmp 0x44f5a6

Function at 0x44f6e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f6ea
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6
Function at 0x44f6f1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f6f8
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f6ff
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6
Function at 0x44f706
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f70d
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f714
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6