joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a75c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x2a]
xor ecx, ecx
mov edx, 6
call fcn.004035a4
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a4
lea eax, [ebp - 0x44]
push eax
push esi
call sub.user32.dll_EnumWindows
call fcn.0042a750
xor edx, edx
push ebp
push 0x42a94a
push dword fs:[edx]
mov dword fs:[edx], esp
push 2
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x38]
call fcn.0042a61c
push 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x34]
call fcn.0042a61c
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor edx, edx
push ebp
push 0x42a923
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.0040a890
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
call fcn.0040a890
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
call fcn.0040a890
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
call fcn.0040a890
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
push eax
push 2
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x38]
call fcn.0042a688
mov eax, dword [ebp - 0x24]
push eax
push 0x10
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x34]
call fcn.0042a688
cmp byte [ebp - 1], 0
je 0x42a85f
mov eax, dword [ebp - 0xc]
add eax, 0x16
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x30]
mov ecx, 4
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov word [ebp - 0x28], 1
mov word [ebp - 0x26], 1
lea edx, [ebp - 0x2a]
mov ecx, 6
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov esi, dword [ebp - 0x20]
mov eax, esi
mov dl, byte [eax + 4]
mov byte [ebp - 0x54], dl
mov dl, byte [eax + 8]
mov byte [ebp - 0x53], dl
mov dx, word [eax + 0xc]
imul dx, word [eax + 0xe]
mov word [ebp - 0x52], dx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x16
lea edx, [ebp - 0x54]
mov ecx, 0x10
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
mov edx, dword [eax + 8]
add dword [eax + 8], edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a92a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00402a78
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
call fcn.00402a78
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
call fcn.00402a78
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.00402a78
ret
Function at 0x42fe38
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x28]
push eax
push esi
push 0x102b
push ebx
call sub.user32.dll_MapVirtualKeyA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4332a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
push esp
push esi
call sub.user32.dll_GetKeyboardState
mov eax, dword [0x4bbddc]
mov eax, dword [eax]
mov edx, dword [eax + 0x44]
test edx, edx
je 0x4332ee
mov eax, dword [0x4bbf94]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x4332de
mov edx, dword [0x4bbf94]
call fcn.00453d8c
mov ebx, eax
jmp 0x4332fe
mov eax, dword [0x4bbddc]
mov eax, edx
call fcn.00453d8c
mov ebx, eax
jmp 0x4332fe
mov eax, dword [0x4bbf94]
mov eax, dword [eax]
xor edx, edx
call fcn.00457740
mov ebx, eax
push 0x15
push 0
push 0
mov eax, ebx
call fcn.00457474
mov edi, eax
mov eax, ebx
call fcn.00457458
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
mov ecx, 3
cdq
idiv ecx
add edi, eax
push edi
mov eax, ebx
call fcn.00457440
mov edi, eax
mov eax, ebx
call fcn.0045748c
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
sar eax, 1
jns 0x433346
adc eax, 0
add edi, eax
push edi
push 0
push esi
call sub.user32.dll_RemovePropA
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x433efc
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
mov eax, dword [0x4bbccc]
cmp byte [eax], 0
je 0x433f3f
cmp dword [ebx + 0x3c], 0
je 0x433f3f
mov eax, esp
push eax
push 0x105
push 0x465
mov eax, dword [ebx + 0x3c]
push eax
call sub.user32.dll_GetCursorPos
push eax
call sub.user32.dll_MapVirtualKeyA
mov edx, esi
mov eax, esp
call fcn.0040b2c4
jmp 0x433f49
mov eax, esi
mov edx, dword [ebx + 0x78]
call fcn.00405030
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x43754c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor edi, edi
mov eax, dword [ebx + 8]
test eax, eax
je 0x4375a8
dec eax
jne 0x43756b
xor edx, edx
mov eax, ebx
call fcn.0041cc70
mov edi, dword [eax]
jmp 0x4375a8
call sub.user32.dll_EnableScrollBar
push eax
call sub.user32.dll_GetKeyNameTextA
mov esi, eax
jmp 0x4375a0
mov ecx, esp
mov edx, esi
mov eax, ebx
call fcn.00437460
test al, al
je 0x437596
mov eax, dword [ebx + 4]
mov edx, dword [esp]
mov eax, dword [eax + edx*4]
mov edi, dword [eax]
jmp 0x4375a0
push 2
push esi
call sub.user32.dll_GetCursor
mov esi, eax
test edi, edi
jne 0x4375a8
test esi, esi
jne 0x43757a
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x437b5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
call fcn.00437f94
mov esi, eax
mov dword [ebp - 0x14], esi
push 4
push esi
call sub.user32.dll_GetCursor
mov edx, dword [0x4bbddc]
mov edx, dword [edx]
cmp eax, dword [edx + 0x30]
je 0x437bb7
mov eax, dword [ebp - 0x14]
call fcn.004370e4
mov esi, eax
test esi, esi
je 0x437cea
jmp 0x437ba6
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x437ba4
mov eax, esi
call fcn.0044078c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x437cea
mov esi, ebx
jmp 0x437bc7
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x437bc5
mov eax, esi
call fcn.0044078c
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, dword [ebp - 0x14]
je 0x437cea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x437c0c
mov edx, dword [ebp + 8]
mov esi, eax
jmp 0x437bf9
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x437bf7
mov eax, esi
call fcn.0044078c
mov dword [ebp - 0x1c], eax
jmp 0x437c36
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [0x436618]
call fcn.00404378
test al, al
je 0x437c31
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.0044078c
mov dword [ebp - 0x1c], eax
jmp 0x437c36
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 9]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 5]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x1c]
push eax
push 0x437af0
call fcn.00408c1c
push eax
call sub.user32.dll_CreateMenu
cmp byte [ebp - 8], 0
je 0x437cea
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
push eax
mov eax, dword [ebp + 8]
dec eax
push eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, ebx
mov si, 0xffbd
call fcn.004043e8
mov eax, dword [0x4beda8]
mov edx, dword [0x435484]
call fcn.00404378
test al, al
je 0x437cd1
mov eax, dword [0x4beda8]
mov eax, dword [eax + 0x38]
cmp dword [eax + 0xa0], 0
je 0x437cd1
mov eax, dword [0x4beda8]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0xa0]
call fcn.0044078c
cmp eax, dword [ebp - 0x14]
je 0x437cea
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMenuStringA
test eax, eax
je 0x437cea
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ef4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], ecx
xor ecx, ecx
test eax, eax
je 0x437f40
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp byte [0x4bedc4], 2
sete cl
mov byte [ebp - 8], cl
lea ecx, [ebp - 0x18]
push ecx
and edx, 0x7f
push edx
push 0xb02f
push eax
call sub.user32.dll_MapVirtualKeyA
mov ecx, eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov dword [0x4beda4], edi
xor edx, edx
push ebp
push 0x4386c5
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 8], eax
mov byte [0x4bedac], 0
cmp byte [edi + 0x9b], 0
jne 0x4385a4
lea edx, [ebp - 8]
mov eax, edi
mov si, 0xffdc
call fcn.004043e8
cmp dword [0x4beda4], 0
jne 0x43857d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4386db
cmp dword [ebp - 8], 0
jne 0x4386ae
mov ecx, edi
mov dl, 1
mov eax, dword [0x4353f4]
call fcn.004377e4
mov dword [ebp - 8], eax
mov byte [0x4bedac], 1
jmp 0x4386ae
lea edx, [ebp - 8]
mov eax, edi
mov si, 0xffe3
call fcn.004043e8
cmp dword [0x4beda4], 0
jne 0x4385c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4386db
cmp dword [ebp - 8], 0
jne 0x4385e6
mov ecx, edi
mov dl, 1
mov eax, dword [0x43551c]
call fcn.004378fc
mov dword [ebp - 8], eax
mov byte [0x4bedac], 1
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x38]
mov eax, esi
mov edx, dword [0x436618]
call fcn.00404378
test al, al
je 0x438616
mov eax, dword [ebp - 8]
add eax, 0x44
push eax
mov eax, esi
call fcn.0044078c
push eax
call sub.user32.dll_GetKeyboardState
jmp 0x4386a1
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x38]
cmp dword [esi + 0x30], 0
jne 0x43864d
mov eax, esi
mov edx, dword [0x436618]
call fcn.00404378
test al, al
jne 0x43864d
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_DrawMenuBar
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x44], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x48], edx
jmp 0x438675
lea ecx, [ebp - 0x20]
xor edx, edx
xor eax, eax
call fcn.0041b628
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov eax, esi
call fcn.00439ce8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x44], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x48], edx
mov esi, dword [ebp - 8]
mov edx, dword [esi + 0x48]
mov eax, dword [ebp - 8]
mov edi, dword [eax + 0x38]
add edx, dword [edi + 0x4c]
mov eax, dword [esi + 0x44]
add eax, dword [edi + 0x48]
lea ecx, [ebp - 0x18]
call fcn.0041b628
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x4c], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x50], edx
mov eax, dword [ebp - 8]
lea esi, [eax + 0x44]
lea edi, [eax + 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004383b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4386db
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e83c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or word [ebx + 0x54], 0x80
push esi
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00438b0c
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
push esi
call sub.gdi32.dll_IntersectClipRect
xor edi, edi
xor eax, eax
mov dword [ebp - 8], eax
push 0xffffffffffffffec
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_GetKeyboardLayout
test ah, 2
je 0x43e8a1
mov dword [ebp - 8], 0xa
mov edi, 0x200f
jmp 0x43e8c3
push 0xfffffffffffffff0
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_GetKeyboardLayout
test eax, 0x800000
je 0x43e8c3
mov dword [ebp - 8], 3
mov edi, 0xa00f
test edi, edi
je 0x43e910
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_RedrawWindow
push edi
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sub.user32.dll_CharLowerBuffA
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00438b0c
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push 0
push 0
push esi
call sub.gdi32.dll_IntersectClipRect
push 0
mov ecx, esi
mov edx, 0x14
mov eax, ebx
call fcn.0043b368
push 0
mov ecx, esi
mov edx, 0xf
mov eax, ebx
call fcn.0043b368
mov eax, dword [ebx + 0x19c]
test eax, eax
je 0x43e977
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x43e977
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x19c]
call fcn.0041cc70
cmp byte [eax + 0x57], 0
je 0x43e96f
mov edx, dword [eax + 0x44]
push edx
mov ecx, dword [eax + 0x40]
mov edx, esi
call fcn.0043e83c
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x43e94d
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.gdi32.dll_RestoreDC
and word [ebx + 0x54], 0xff7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x440180
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp esi, dword [ebx + 0x40]
jne 0x4401ad
cmp edi, dword [ebx + 0x44]
jne 0x4401ad
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebx + 0x48]
jne 0x4401ad
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x4c]
je 0x44024e
mov eax, ebx
call fcn.00440a90
test al, al
je 0x4401e4
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetPropA
test eax, eax
jne 0x4401e4
push 0x14
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
push 0
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_RemovePropA
jmp 0x44023c
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], edi
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x4c], eax
mov eax, ebx
call fcn.00440a90
test al, al
je 0x44023c
mov dword [ebp - 0x2c], 0x2c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x3c]
mov eax, ebx
call fcn.00439b70
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_RemoveMenu
mov eax, ebx
call fcn.00439824
mov eax, ebx
mov si, 0xffd0
call fcn.004043e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x440a9c
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov ebx, eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetPropA
test eax, eax
je 0x440ad9
mov dword [esp + 0x10], 0x2c
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetKeyboardLayoutList
lea esi, [esp + 0x2c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x440ae6
push esp
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetKeyboardState
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetKeyboardLayout
test eax, 0x40000000
je 0x440b21
push 0xfffffffffffffff8
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetKeyboardLayout
mov esi, eax
test esi, esi
je 0x440b21
push esp
push esi
call sub.user32.dll_LoadKeyboardLayoutA
lea eax, [esp + 8]
push eax
push esi
call sub.user32.dll_LoadKeyboardLayoutA
mov eax, dword [esp]
mov dword [ebx + 0x40], eax
mov eax, dword [esp + 4]
mov dword [ebx + 0x44], eax
mov eax, dword [esp + 8]
sub eax, dword [esp]
mov dword [ebx + 0x48], eax
test eax, eax
jge 0x440b42
add dword [ebx + 0x40], eax
neg dword [ebx + 0x48]
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 4]
mov dword [ebx + 0x4c], eax
mov eax, ebx
call fcn.00439824
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x441f50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
push ebx
call fcn.0040916c
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x444f54
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
sub edx, 1
jb 0x444f63
sub edx, 0x67
je 0x444f82
jmp 0x444fb3
mov eax, ebx
call fcn.00444eb8
cmp byte [ebx + 0xd], 0
jne 0x444f79
mov eax, ebx
call fcn.00444f04
jmp 0x444fb3
mov eax, ebx
call fcn.00444ed4
pop ebx
ret
cmp byte [ebx + 0x20], 0
je 0x444fb3
cmp byte [ebx + 0xd], 0
je 0x444f9f
push 0
lea eax, [ebx + 0x10]
push eax
push 0
push 0x68
call sub.user32.dll_SetCursor
jmp 0x444fb3
push 0
push 0
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.user32.dll_MapVirtualKeyA
mov dword [ebx + 0x10], eax
pop ebx
ret

Function at 0x44cc34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
mov cl, 1
mov eax, esi
call fcn.0044cb78
mov edi, eax
test edi, edi
je 0x44ccd4
test byte [edi + 0x1c], 0x10
jne 0x44cc5b
mov eax, edi
call fcn.0044bc4c
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x44]
xor edx, edx
mov eax, edi
call fcn.0044c2e4
mov ebx, eax
xor edx, edx
mov eax, edi
call fcn.0044c7e0
or bl, al
test bl, bl
je 0x44cc83
mov eax, edi
call fcn.00449cbc
mov eax, dword [0x4bbddc]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44ccd0
mov edx, dword [0x4bbddc]
mov ebx, eax
cmp byte [ebx + 0x22f], 2
jne 0x44ccd0
cmp edi, dword [ebx + 0x258]
jne 0x44ccd0
push 0
push 0
push 0x234
mov eax, dword [ebx + 0x254]
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x44ccd0
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_BringWindowToTop
mov bl, 1
jmp 0x44ccf3
test byte [esi + 0x1c], 0x10
jne 0x44ccf3
mov eax, esi
mov edx, dword [0x448ab4]
call fcn.00404378
test al, al
je 0x44ccf3
mov eax, dword [esi + 0x34]
call fcn.0044bc4c
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450ae4
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test esi, esi
je 0x450b2b
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetKeyboardLayout
test bl, bl
je 0x450b06
test ah, 2
jne 0x450b2b
or eax, 0x200
jmp 0x450b10
test ah, 2
je 0x450b2b
and eax, 0xfffffdff
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_ReleaseDC
push 0x37
push 0
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_RemovePropA
pop esi
pop ebx
ret
Function at 0x4513a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0044078c
push eax
call sub.user32.dll_GetKeyboardLayout
test eax, 0x840000
setne al
and eax, 0x7f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x18], 1
jne 0x4513fe
push ebp
mov dx, 0x15
xor eax, eax
call fcn.00451328
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00439c18
add ebx, eax
mov eax, ebx
jmp 0x45141e
push ebp
mov dx, 0x14
mov ax, 1
call fcn.00451328
pop ecx
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00439bd4
add ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453c8c
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
cmp byte [ebx + 0x22f], 2
jne 0x453cbd
cmp dword [ebx + 0x254], 0
je 0x453cbd
push 0
push 0
push 0x229
mov eax, dword [ebx + 0x254]
push eax
call sub.user32.dll_MapVirtualKeyA
call fcn.004370e4
pop ebx
ret

Function at 0x453f38
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
cmp byte [ebp + 0x22f], 2
jne 0x453fac
cmp dword [ebp + 0x254], 0
je 0x453fac
xor esi, esi
mov eax, dword [ebp + 0x248]
test eax, eax
je 0x453f63
mov edx, dword [eax]
call dword [edx + 0x34]
mov esi, eax
xor edi, edi
mov eax, dword [ebp + 0x258]
test eax, eax
je 0x453f76
call fcn.00449dec
mov edi, eax
mov eax, ebp
call fcn.0044078c
push eax
call sub.user32.dll_GetAsyncKeyState
cmp esi, eax
setne bl
push edi
push esi
push 0x230
mov eax, dword [ebp + 0x254]
push eax
call sub.user32.dll_MapVirtualKeyA
test bl, bl
je 0x453fac
mov eax, ebp
call fcn.0044078c
push eax
call sub.user32.dll_BringWindowToTop
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x454000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4541c6
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x454094
mov eax, dword [0x4bee24]
call fcn.00457784
dec eax
test eax, eax
jl 0x454094
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov edx, edi
mov eax, dword [0x4bee24]
call fcn.00457770
cmp esi, dword [eax + 0x248]
jne 0x45408e
mov edx, edi
mov eax, dword [0x4bee24]
call fcn.00457770
cmp ebx, eax
je 0x45408e
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x4bbbb8]
call fcn.0040765c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41a3d4]
call fcn.0040dfc0
call fcn.004049b8
inc edi
dec dword [ebp - 4]
jne 0x454039
mov eax, dword [ebx + 0x248]
test eax, eax
je 0x4540a5
xor edx, edx
call fcn.0044d204
test byte [ebx + 0x1c], 8
jne 0x4540b5
test esi, esi
je 0x4540b7
test byte [esi + 0x1c], 8
je 0x4540b7
xor esi, esi
mov dword [ebx + 0x248], esi
test esi, esi
je 0x4540ca
mov edx, ebx
mov eax, esi
call fcn.00425278
test esi, esi
je 0x45417d
test byte [ebx + 0x1c], 0x10
jne 0x4540e5
cmp byte [ebx + 0x229], 3
je 0x45417d
mov eax, dword [ebx + 0x248]
cmp byte [eax + 0x5c], 0
jne 0x4540fa
cmp byte [ebx + 0x22f], 1
jne 0x454100
test byte [ebx + 0x1c], 0x10
je 0x454158
mov eax, ebx
call fcn.00440a90
test al, al
je 0x454197
mov eax, dword [ebx + 0x248]
mov edx, dword [eax]
call dword [edx + 0x34]
mov edi, eax
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_GetAsyncKeyState
cmp edi, eax
je 0x454146
mov eax, dword [ebx + 0x248]
mov edx, dword [eax]
call dword [edx + 0x34]
push eax
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_PeekMessageA
mov eax, ebx
call fcn.0044078c
mov edx, eax
mov eax, esi
call fcn.0044d204
jmp 0x454197
cmp byte [ebx + 0x22f], 1
je 0x454197
mov eax, ebx
call fcn.00440a90
test al, al
je 0x454197
push 0
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_PeekMessageA
jmp 0x454197
mov eax, ebx
call fcn.00440a90
test al, al
je 0x454197
push 0
mov eax, ebx
call fcn.0044078c
push eax
call sub.user32.dll_PeekMessageA
cmp byte [ebx + 0x22e], 0
je 0x4541a9
mov dl, 1
mov eax, ebx
call fcn.004550c0
mov eax, ebx
call fcn.00453f38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4541cd
lea eax, [ebp - 0x10]
call fcn.00404fdc
ret