joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10002fc7
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10002fc7
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10002fc7
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10002fc7
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10

Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10002fc7
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000e1cb
pop dword [ebp - 0x30]
mov eax, 0x1000e1cb
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x33e11
push 0
mov eax, 0x89a0e661
add eax, 0x86605a03
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x6b2b327b
add ecx, 0x94d50103
xor esi, esi
add esi, eax
mov edx, 0x4a08c125
sub edx, 0x3a073b25
add edx, dword [ebp - 0x30]
mov ebx, 0x89d6c42f
xor dword [ebp - 0x28], 0x7a9a5df8
mov edi, dword [edx]
xor dword [ebp - 0x28], esi
add edi, ebx
add dword [ebp - 0x14], 0x4bed4697
mov dword [esi], edi
xor dword [ebp - 0x2c], edx
add esi, 0x980db5ee
sub esi, 0x980db5ea
add edx, 0xbb91d9f9
sub edx, 0xbb91d9f5
loop 0x1000e221
add eax, 0x4982d861
sub eax, 0x49821796
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd1f58930
sub ecx, 0xc1f58930
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0xe7173329
sub eax, 0xe6d6f4d0
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8a094a11
add dword [ebp - 0x60], 0xc448fb3a
mov dword [ebp - 0x5c], 0xeb498e28
add dword [ebp - 0x5c], 0x46e9be1d
mov dword [ebp - 0x58], 0x16ac758f
sub dword [ebp - 0x58], 0xca603161
mov dword [ebp - 0x54], 0x8154b4eb
sub dword [ebp - 0x54], 0x8154b4eb
lea eax, [ebp - 0x60]
push eax
mov eax, 0x8e09fc4f
add eax, 0x72367415
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x5c27f84c
sub dword [ebp - 0x60], 0xe7b58ef6
mov dword [ebp - 0x5c], 0x3941c075
sub dword [ebp - 0x5c], 0xf7d55f00
mov dword [ebp - 0x58], 0xb41ab806
sub dword [ebp - 0x58], 0x50ab4b9a
mov dword [ebp - 0x54], 0xf81d76d0
sub dword [ebp - 0x54], 0xf81d76d0
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xee87e97c
sub eax, 0xee4778d4
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2b1
push 0
call eax
mov ecx, 0xec79f72f
add ecx, 0x13865e80
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x50]
mov esi, 0x9ec3b0d3
sub esi, 0xa29b0644
add dword [ebp - 0x44], eax
mov edi, dword [ebx]
add dword [ebp - 0x44], ecx
xor edi, esi
add dword [ebp - 4], 0xba124a5
mov dword [edx], edi
add dword [ebp - 0x4c], 0xae1e4d65
add edx, 4
add ebx, 0x683da325
add ebx, 0x97c25cdf
loop 0x403f77
add eax, 0xd3a16b68
sub eax, 0xd3a021d9
xor ebx, ebx
add ebx, eax
add eax, 0x7d119993
add eax, 0x82ee6672
mov ecx, 0x49e3467a
add ecx, 0xb65cb986
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4031cc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e3008], 0x8088405
inc edx
mov dword [ebx + 0x4e3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x409274
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.00404b80
push eax
call sub.user32.dll_HideCaret
cmp eax, 0xffffffff
je 0x4092cd
push eax
call sub.user32.dll_GetWindowThreadProcessId
test byte [ebp - 0x14c], 0x10
jne 0x4092cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetWindowRgn
test eax, eax
jne 0x4092d4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ce50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cf26
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404748
lea eax, [ebp - 8]
call fcn.00404bd0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b80
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cf10
mov eax, ebx
call fcn.0040275c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cf09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404b80
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cef3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cf38
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cef3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf10
mov eax, dword [ebp - 0x10]
call fcn.0040277c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf2d
lea eax, [ebp - 8]
call fcn.004046b0
ret
Function at 0x414170
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x11]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
xor eax, eax
push ebp
push 0x414233
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
lea eax, [ebp - 0x11]
call fcn.0040fff4
cmp word [esi], 0x101
jne 0x4141b0
lea eax, [ebp - 0x11]
call dword [0x4e6818]
cmp word [ebx], 0x101
jne 0x41420e
lea eax, [ebp - 0x21]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
xor eax, eax
push ebp
push 0x414207
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
lea eax, [ebp - 0x21]
call fcn.0040fff4
lea eax, [ebp - 0x21]
call dword [0x4e6818]
lea edx, [ebp - 0x21]
lea eax, [ebp - 0x11]
mov ecx, edi
call fcn.00414a24
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41421d
lea eax, [ebp - 0x21]
call fcn.0040fccc
ret
mov edx, ebx
lea eax, [ebp - 0x11]
mov ecx, edi
call fcn.00414a24
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41423a
lea eax, [ebp - 0x11]
call fcn.0040fccc
ret
Function at 0x426118
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42611e
ret

Function at 0x427974
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x427a11
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x427a11
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x427a1c]
mov eax, ebx
call fcn.00427f6c
mov eax, dword [ebx + 0x14]
call fcn.00427674
call fcn.00426974
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayout
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.00426974
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetMenuState
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
add ecx, edi
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00417e4c
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x427ba8
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x427bdc]
mov eax, ebx
call fcn.00427f6c
inc edi
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClipboardData
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
ret

Function at 0x428008
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.00426ec4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.00426974
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetMenuState
pop ebx
ret

Function at 0x428034
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
call fcn.004273c4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebx + 0x10]
movzx eax, byte [eax + 0x18]
movzx eax, word [eax*2 + 0x4e380c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetMenuItemID
pop ebx
ret
Function at 0x428064
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.004276b0
push eax
call sub.user32.dll_GetParent
mov eax, dword [ebx + 0x14]
call fcn.004276b0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebx + 0x14]
call fcn.00427790
test al, al
jne 0x4280b7
mov eax, dword [ebx + 0x14]
call fcn.00427674
call fcn.00426974
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayout
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.00427674
call fcn.00426974
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayout
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret
Function at 0x4282a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
push 0
call sub.user32.dll_CallWindowProcA
mov dword [ebp - 0x18], eax
push 0
call sub.user32.dll_CallWindowProcA
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4283ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
push 0x18
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_EnableMenuItem
test bl, bl
je 0x428302
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CharNextA
mov dword [ebp - 0x10], eax
jmp 0x428364
push 0
call fcn.004073d8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x428317
call fcn.004281e8
xor eax, eax
push ebp
push 0x42835d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_CallNextHookEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x428344
call fcn.004281e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428364
mov eax, dword [ebp - 0x14]
push eax
push 0
call fcn.00407648
ret
cmp dword [ebp - 0x10], 0
je 0x4283ce
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetKeyNameTextA
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetKeyNameTextA
mov esi, eax
push 0xcc0020
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetWindow
test ebx, ebx
je 0x4283c0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetKeyNameTextA
test esi, esi
je 0x4283ce
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetKeyNameTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4283f5
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_DefFrameProcA
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_DefFrameProcA
ret
Function at 0x428778
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_MapVirtualKeyA
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4287c9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4287b0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4287a0
jmp 0x4287c9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4287b1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428980
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbfc
mov edi, eax
xor esi, esi
mov word [esp], 0x300
test edi, edi
je 0x4289cf
push 0
call sub.user32.dll_CallWindowProcA
mov ebx, eax
push edi
push ebx
call sub.user32.dll_GetKeyNameTextA
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x100
push 0
push ebx
call sub.user32.dll_DrawIcon
mov word [esp + 2], ax
push edi
push ebx
call sub.user32.dll_GetKeyNameTextA
push ebx
call sub.user32.dll_DefFrameProcA
jmp 0x4289e2
mov word [esp + 2], cx
mov eax, edx
lea edx, [esp + 4]
shl ecx, 2
call fcn.00402964
cmp word [esp + 2], 0
je 0x428a15
cmp word [esp + 2], 0x10
jne 0x4289fd
mov eax, esp
call fcn.004288e8
test al, al
jne 0x428a0b
movzx edx, word [esp + 2]
lea eax, [esp + 4]
call fcn.00428778
mov eax, esp
push eax
call sub.user32.dll_CreateCaret
mov esi, eax
mov eax, esi
add esp, 0x404
pop edi
pop esi
pop ebx
ret

Function at 0x429140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, ebx
mov ecx, dword [ebp + 8]
mov eax, esi
call fcn.00428ff0
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.user32.dll_CallWindowProcA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4291dd
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x429194
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyState
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetDC
push 0
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 8]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DrawIconEx
test eax, eax
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4291e4
cmp dword [ebp - 8], 0
je 0x4291d3
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyState
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DefFrameProcA
ret
Function at 0x42b088
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
test esi, esi
je 0x42b13e
cmp word [ecx + 0x26], 8
ja 0x42b13e
lea edx, [ebp - 0x410]
mov ecx, 0xff
mov eax, dword [ebp - 4]
call fcn.00428a24
mov ebx, eax
test ebx, ebx
je 0x42b13e
push 0
call fcn.004073d8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_CallWindowProcA
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42b137
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x410]
push eax
push ebx
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetLastActivePopup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b13e
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DefFrameProcA
mov eax, dword [ebp - 8]
push eax
push 0
call fcn.00407648
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4499c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4499e0
cmp dword [esi + 4], 0
je 0x449a0d
test byte [ebx + 0x55], 1
jne 0x4499ff
mov eax, ebx
call fcn.00448564
test eax, eax
jne 0x4499ff
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x449b1d
mov edx, esi
mov eax, ebx
call fcn.004494e8
jmp 0x449b1d
push 0
call fcn.004073d8
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.user32.dll_CallNextHookEx
mov dword [ebp - 8], eax
push edi
push 0
call fcn.00407648
push 0
call sub.user32.dll_CallWindowProcA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x449b16
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044b834
push eax
call fcn.00407228
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00446200
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004499c4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.user32.dll_CharUpperBuffA
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0044b834
push eax
call fcn.00407350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449b1d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DefFrameProcA
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DefWindowProcA
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f75c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffff0
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x44f83f
mov eax, dword [esi + 0x14]
cmp byte [eax + 0x10], 1
jne 0x44f7ba
mov edx, 2
mov eax, esi
call fcn.0044d790
mov dword [esp], eax
mov eax, dword [ebx + 0xc]
sar eax, 1
jns 0x44f790
adc eax, 0
mov edx, dword [ebx + 0x54]
sub edx, eax
mov dword [esp + 4], edx
mov edx, 2
mov eax, dword [ebx + 0x60]
call fcn.0044d7fc
add eax, dword [esp]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
add eax, dword [ebx + 0xc]
mov dword [esp + 0xc], eax
jmp 0x44f7fb
mov eax, dword [ebx + 0xc]
sar eax, 1
jns 0x44f7c4
adc eax, 0
mov edx, dword [ebx + 0x50]
sub edx, eax
mov dword [esp], edx
mov edx, 1
mov eax, esi
call fcn.0044d790
mov dword [esp + 4], eax
mov eax, dword [esp]
add eax, dword [ebx + 0xc]
mov dword [esp + 8], eax
mov edx, 1
mov eax, dword [ebx + 0x60]
call fcn.0044d7fc
add eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x10]
call fcn.004276b0
push eax
mov eax, dword [ebx + 0x58]
push eax
call sub.user32.dll_GetKeyNameTextA
mov esi, eax
push 0x5a0049
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
sub ecx, eax
push ecx
push edx
push eax
mov eax, dword [ebx + 0x58]
push eax
call sub.user32.dll_GetClassNameA
push esi
mov eax, dword [ebx + 0x58]
push eax
call sub.user32.dll_GetKeyNameTextA
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x450630
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4507a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.user32.dll_IsDialogMessageA
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4507bc
call fcn.00409bc4
mov edx, dword [ebp - 4]
mov eax, 0x4e6b2c
call fcn.00404704
mov eax, dword [0x4e6b2c]
call fcn.00404b80
push eax
call sub.user32.dll_OpenClipboard
mov word [0x4e6b28], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4e6668]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.user32.dll_IsIconic
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4507d0
call fcn.00409bc4
mov edx, dword [ebp - 0x10]
mov eax, 0x4e6b30
call fcn.00404704
mov eax, dword [0x4e6b30]
call fcn.00404b80
push eax
call sub.user32.dll_OpenClipboard
mov word [0x4e6b2a], ax
mov eax, dword [0x4e6b30]
call fcn.00404b80
push eax
call fcn.00407638
mov dword [0x4e6b34], eax
mov dl, 1
mov eax, dword [0x416c84]
call fcn.0041983c
mov dword [0x4e6b6c], eax
call fcn.00450234
mov dl, 1
mov eax, dword [0x441da4]
call fcn.0045005c
mov dword [0x4e6b1c], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45b6d8]
call fcn.00462388
mov edx, dword [0x4e5c08]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45b7b0]
call fcn.0046346c
mov edx, dword [0x4e5a3c]
mov dword [edx], eax
mov eax, dword [0x4e5a3c]
mov eax, dword [eax]
mov dl, 1
call fcn.004650fc
mov ecx, 0x442118
mov edx, 0x442128
mov eax, dword [0x43fa24]
call fcn.00418c7c
push 0x4507e4
call sub.user32.dll_LoadCursorA
mov ebx, eax
test ebx, ebx
je 0x45078a
push 0x4507ec
push ebx
call sub.user32.dll_LoadIconA
mov dword [0x4e3c3c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4507af
lea eax, [ebp - 0x10]
call fcn.004046b0
lea eax, [ebp - 4]
call fcn.004046b0
ret