joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f512c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4f514e
xor eax, eax
jmp 0x4f523a
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x4f5161
xor eax, eax
inc eax
jmp 0x4f523a
and dword [ebp - 0x214], 0
mov eax, ebx
push esi
mov esi, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4f5170
sub eax, ecx
sar eax, 1
cmp eax, 0x104
jbe 0x4f518d
xor eax, eax
jmp 0x4f5239
xor eax, eax
push edi
cmp ax, word [ebx]
je 0x4f5232
push 0x62d6d4
push esi
call fcn.005d5fcd
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4f51bf
push 0x624804
push esi
call fcn.005d5fcd
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4f5232
mov esi, edi
sub esi, ebx
sar esi, 1
test esi, esi
jle 0x4f5224
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00402394
push esi
push ebx
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00419d2b
add esp, 0x1c
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x4f521e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], 1
cmp eax, 0xb7
je 0x4f5224
mov dword [ebp - 0x214], esi
lea esi, [edi + 2]
xor eax, eax
cmp ax, word [esi]
jne 0x4f5199
mov eax, dword [ebp - 0x214]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 4

Function at 0x4f5fde
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00402394
push 0x2454
push 0
push esi
call fcn.00402394
lea eax, [esi + 8]
mov dword [ebp - 0x38], eax
lea eax, [esi + 0x2148]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
mov eax, 0x800
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x2348]
lea ecx, [esi + 0x1048]
mov dword [ebp - 0x20], eax
mov eax, 0x80
mov dword [ebp - 8], ecx
lea ecx, [esi + 0x2048]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x28], 0x100
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4f6062
sub eax, ecx
lea ecx, [ebp - 0x3c]
push ecx
push 0x10000000
sar eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4f60be
mov eax, dword [ebp - 0x30]
cmp eax, 3
je 0x4f609a
cmp eax, 4
je 0x4f609a
cmp eax, 1
jne 0x4f60be
mov cx, word [ebp - 0x24]
and dword [esi + 0x2448], 0
and dword [esi + 0x244c], 0
or dword [esi + 0x2450], 0xffffffff
mov dword [esi + 4], eax
xor eax, eax
mov word [esi], cx
inc eax
jmp 0x4f60c0
xor eax, eax
leave
ret 4
Function at 0x4f62e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x208
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push str.Path
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
inc ebx
push 0x80000002
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4f6353
mov eax, ebx
jmp 0x4f63bc
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
call fcn.004250cb
push 0xc
push str.360safe.exe
lea eax, [ebp - 0x418]
call fcn.004496c2
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00402394
mov esi, dword [ebp - 0x418]
add esp, 0xc
lea edi, [ebp - 0x20c]
call fcn.00557bad
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4f63a0
sub eax, ecx
sar eax, 1
jne 0x4f63ca
lea eax, [esi - 0x10]
call fcn.0040acc3
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
lea eax, [ebp - 0x20c]
push str.9.0.0.0
push eax
call fcn.004cf18c
pop ecx
pop ecx
test eax, eax
js 0x4f63ef
mov edi, ebx
lea eax, [esi - 0x10]
call fcn.0040acc3
mov eax, edi
jmp 0x4f63bb
xor edi, edi
jmp 0x4f63e3
Function at 0x4fc038
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push ebx
push esi
push 0x60
push eax
call dword [ecx + 0x24]
xor eax, eax
mov dword [ebp - 4], eax
push ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
mov eax, esp
lea esi, [ebp - 0xc]
mov dword [eax], str.SKIN
call fcn.0044208d
push dword [ebp - 8]
push dword [0x6bb728]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x6bcd28]
mov edx, dword [ecx]
lea esi, [ebp - 4]
push esi
mov esi, 0x63ec60
push esi
push ebx
push eax
push 0x65cb50
push ecx
call dword [edx + 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
lea eax, [edi + 0x30]
push eax
push esi
push str.root
push ecx
call dword [edx + 0xb4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea ebx, [edi + 0x34]
push ebx
push esi
push str.rootgrid
push eax
call dword [ecx + 0xb4]
mov eax, dword [ebx]
mov ecx, dword [eax]
xor esi, esi
push esi
push 0x392
push eax
call dword [ecx + 0x78]
cmp dword [ebx], esi
je 0x4fc104
lea esi, [ebp - 0x14]
mov eax, ebx
call fcn.004df689
mov ecx, dword [eax]
mov dword [edi + 0xc8], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0xcc], eax
xor esi, esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push dword [edi + 0x28]
push 0x1450
push eax
call dword [ecx + 0x44]
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
push esi
push dword [edi + 0x5c]
push 0x13e5
push eax
call dword [ecx + 0x44]
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x1c]
mov eax, dword [edi + 0x24]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
push esi
push 0xa
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp - 0xc], esi
je 0x4fc15b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x4fc168
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x500044
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
push ebx
push esi
push 0x60
push eax
call dword [ecx + 0x24]
push ecx
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
xor ebx, ebx
mov eax, esp
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [eax], str.SKIN
call fcn.0044208d
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
push dword [0x6bb728]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x6bcd28]
mov edx, dword [ecx]
lea ebx, [ebp - 4]
push ebx
mov ebx, 0x63ec60
push ebx
push esi
push eax
push 0x65cc78
push ecx
call dword [edx + 0x14]
mov eax, dword [edi + 0x20]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea esi, [edi + 0x1f0]
push esi
push ebx
push str.root
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x5001b0
mov eax, dword [esi]
and dword [ebp - 8], 0
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push ebx
push str.JT_vg
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x50010d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push 0x3ff
push eax
call dword [ecx + 0x78]
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push dword [edi + 0x1f4]
push 0x1450
push eax
call dword [ecx + 0x44]
push 0
push 0xa
push 0x3f1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
and dword [edi + 0x98], 0
and dword [edi + 0x4c], 0
mov eax, edi
call fcn.00502426
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc4]
mov eax, dword [esi]
mov ecx, dword [eax]
push 0x413
push eax
call dword [ecx + 0x54]
mov esi, dword [esi]
mov eax, dword [esi]
push 0x412
push esi
call dword [eax + 0x54]
push 0x168
push str.360se_no_check_hung
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetPropW]
lea ecx, [edi + 4]
call fcn.004a3eb1
mov eax, dword [edi + 0x1f8]
push str.http:__dd.browser.360.cn_static_a_195.8305.gif
call fcn.004eb6e4
mov eax, dword [ebp - 8]
pop ecx
test eax, eax
je 0x5001b0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5001bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x10], 0
je 0x5001cc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x503069
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
lea ebx, [edi + 0x38]
mov eax, dword [ebx]
push esi
xor esi, esi
cmp eax, esi
je 0x503087
mov dword [ebx], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ecx
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov eax, esp
lea esi, [esp + 0x20]
mov dword [eax], str.SKIN
call fcn.0044208d
push dword [esp + 0x1c]
push dword [0x6bb728]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
push eax
push dword [edi + 0x34]
call fcn.004df277
mov ecx, dword [ebx]
mov eax, dword [edi + 0x24]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x18]
xor eax, eax
push eax
push dword [edi + 0x40]
push dword [edi + 0x3c]
push eax
push eax
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea ecx, [edi + 4]
call fcn.004a3eb1
mov eax, edi
call fcn.00503239
mov eax, dword [ebx]
and dword [esp + 0x14], 0
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x63ec60
push str.Title
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x50315b
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0x3e9
push eax
call dword [ecx + 0x28]
push dword [esp + 0x28]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebx]
and dword [esp + 0x10], 0
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
mov esi, 0x63ec60
push esi
push 0x65d538
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x503193
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push 0
push dword [edi + 0x58]
push 0x13a3
push eax
call dword [ecx + 0x44]
mov eax, dword [ebx]
and dword [esp + 0xc], 0
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push esi
push str.Client
push eax
call dword [ecx + 0xb4]
test eax, eax
js 0x5031d1
lea esi, [esp + 0x20]
lea eax, [esp + 0xc]
call fcn.004df689
mov ecx, dword [eax]
mov dword [edi + 0x48], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], 1
mov ebx, dword [ebx]
mov eax, dword [ebx]
push 0
push dword [edi + 0x54]
push 0x1450
push ebx
call dword [eax + 0x44]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5031f1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5031ff
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x50320d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp + 0x18], 0
je 0x50321e
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5054b9
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x50551a
and dword [ebp - 0x2b8], 0
push 0x2b0
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.00402394
add esp, 0xc
push 0x100
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x50551a
mov eax, dword [ebp - 0x2b8]
jmp 0x50551c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403fc1
leave
ret
Function at 0x50c7d9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
sub eax, dword [esi + 0xb8]
sub ecx, dword [esi + 0xbc]
cdq
xor eax, edx
sub eax, edx
push edi
cmp eax, 2
jg 0x50c808
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jle 0x50c8c5
lea ebx, [esi + 0x24]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x78]
test eax, eax
je 0x50c8c5
push dword [esi + 0xb8]
mov edi, dword [esi + 0xbc]
mov eax, esi
call fcn.0050bace
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 0x80]
sub edx, ecx
sar edx, 2
dec edx
cmp eax, edx
ja 0x50c8c5
xor edi, edi
lea eax, [ecx + eax*4]
mov eax, dword [eax]
cmp dword [esi + 0x5c], edi
je 0x50c8c0
cmp eax, edi
je 0x50c8c0
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx]
push eax
mov dword [0x6a2e80], 1
call dword [edx + 0x20]
push dword [esi + 4]
mov dword [0x6a2e80], edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50c8c0
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x50c8c0
mov esi, ebx
jmp 0x50c896
mov esi, eax
cmp eax, edi
je 0x50c899
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp + 8], edi
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
push esi
call dword [eax + 0xc]
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x50c88a
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x50c8c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x50c8c7
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x50ccdb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x50ccf7
xor eax, eax
jmp 0x50ce37
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0050d7ae
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x7c]
jmp 0x50cdf8
mov eax, dword [edi]
test eax, eax
je 0x50cd1e
lea esi, [eax - 0x24]
mov dword [ebp - 0xc], esi
jmp 0x50cd25
and dword [ebp - 0xc], 0
mov esi, dword [ebp - 0xc]
lea eax, [esi + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
test eax, eax
je 0x50cdf2
mov eax, dword [esi + 0x40]
sub eax, 0x10
call fcn.0040ae7a
lea ebx, [eax + 0x10]
cmp dword [ebx - 0xc], 0
mov dword [ebp - 4], ebx
jne 0x50cd5a
lea eax, [ebx - 0x10]
call fcn.0040acc3
jmp 0x50cdf2
push 0
lea eax, [ebp + 0xc]
xor ecx, ecx
push eax
inc ecx
lea eax, [ebp - 4]
call fcn.004d684e
lea eax, [ebp + 0xc]
call fcn.004dd137
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
call fcn.00445200
test eax, eax
je 0x50ce0b
push 0x652558
lea esi, [ebp - 4]
call fcn.004ea980
cmp eax, 0xffffffff
je 0x50cddc
mov ecx, dword [ebx - 0xc]
dec ecx
cmp eax, ecx
je 0x50cddc
inc eax
push eax
lea eax, [ebp - 0x14]
xor ecx, ecx
push eax
inc ecx
mov eax, esi
call fcn.004d684e
lea edi, [ebp + 0xc]
call fcn.0044539e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040acc3
mov eax, edi
call fcn.004dd137
mov ecx, dword [ebp - 0x10]
mov eax, edi
push eax
call fcn.00445200
test eax, eax
je 0x50ce3b
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040acc3
lea eax, [ebx - 0x10]
call fcn.0040acc3
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
add edi, 4
mov dword [ebp - 8], edi
cmp edi, dword [eax + 0x80]
jne 0x50cd10
xor esi, esi
jmp 0x50ce5c
push 0
push 1
mov eax, esi
call fcn.0050bf3c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040acc3
lea eax, [ebx - 0x10]
call fcn.0040acc3
lea eax, [edi - 0x10]
call fcn.0040acc3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0xc]
xor esi, esi
push 0
inc esi
push esi
call fcn.0050bf3c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040acc3
lea eax, [ebx - 0x10]
call fcn.0040acc3
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040acc3
mov eax, esi
jmp 0x50ce34
Function at 0x50d65a
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
je 0x50d71c
cmp dword [esi + 0x74], edi
je 0x50d68d
push edi
push edi
call fcn.0050d65a
push 0x2c
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00402394
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x50d736
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
mov dword [esp + 0x18], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x50d733
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0xc], eax
je 0x50d733
cmp dword [esp + 0xc], edi
je 0x50d733
cmp ebx, edi
je 0x50d733
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50d733
push dword [esp + 0xc]
push edi
push 0x50d5f3
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x74], eax
mov dword [0x6a2e88], ebx
jmp 0x50d733
mov eax, dword [esi + 0x74]
cmp eax, edi
je 0x50d72a
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x74], edi
mov dword [0x6a2e88], edi
xor eax, eax
inc eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403fc1
mov esp, ebp
pop ebp
ret 8
Function at 0x51603c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xa0], 0
push edi
jne 0x5161ca
and dword [esp + 0x10], 0
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0xa8]
sub eax, dword [esp + 0x14]
push ecx
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x10], eax
lea edi, [esi + 0xa4]
fild dword [esp + 0x10]
fstp dword [esp]
call fcn.00499bce
mov eax, dword [edi]
sub eax, dword [esp + 0x14]
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp dword [esp]
fstp qword [esp + 0x1c]
call fcn.00499bce
fadd qword [esp + 0x1c]
pop ecx
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
call fcn.005f1347
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fcomp dword [0x6766a0]
fnstsw ax
test ah, 0x41
jne 0x5161ca
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x5161ca
cmp dword [esi + 0x18], ebx
jne 0x516116
push dword [esi + 0xac]
call fcn.00516dde
test eax, eax
je 0x5161ca
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
jne 0x51612e
mov eax, dword [esi + 0xa8]
cmp eax, dword [esp + 0x14]
je 0x5161ca
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x5161ca
push dword [esi + 0xac]
push esi
call fcn.005161dc
push dword [esi + 0xac]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
push eax
push esi
call fcn.005170d0
cmp dword [esi + 0x18], 2
mov dword [esi + 0xa0], ebx
jne 0x5161a5
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [esp + 0x1c], eax
sub eax, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
sub ecx, dword [esp + 0x24]
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [esp + 0x18]
push eax
jmp 0x5161a6
push edi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x14]
mov edi, esi
push dword [esi + 0xac]
call fcn.0051635a
and dword [esi + 0xa0], 0
and dword [esi + 0x9c], 0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403fc1
mov esp, ebp
pop ebp
ret
Function at 0x5167d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
sub ecx, 0x200
push edi
je 0x516804
dec ecx
dec ecx
jne 0x5168f4
and dword [esi + 0x9c], ecx
jmp 0x5168f4
movsx ecx, ax
shr eax, 0x10
cwde
cmp dword [esi + 0x38], ecx
jne 0x516819
cmp dword [esi + 0x3c], eax
je 0x5168f4
xor ebx, ebx
inc ebx
push ebx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x516869
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00515faa
test eax, eax
je 0x5168f4
mov eax, esi
call fcn.0051773d
mov eax, esi
call fcn.0051775e
mov eax, ebx
jmp 0x5168f6
mov ecx, esi
call fcn.00516fa6
mov edi, eax
push 0xfffffffffffffffe
pop eax
cmp edi, eax
jne 0x516886
cmp dword [esi + 0x20], eax
je 0x51688b
mov dword [esi + 0x20], eax
mov dword [ebp - 4], ebx
jmp 0x5168c1
cmp edi, 0xffffffff
je 0x5168c1
push edi
call fcn.00516dde
mov ebx, eax
lea eax, [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, 0xffffffff
je 0x5168a5
cmp ebx, eax
jge 0x5168f4
cmp dword [esi + 0x20], edi
je 0x5168c1
push ebx
mov eax, esi
call fcn.00517010
cmp eax, 3
je 0x5168c1
mov dword [esi + 0x20], edi
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x5168f4
push eax
mov eax, esi
call fcn.0051665c
test eax, eax
je 0x5168f4
cmp dword [ebp - 4], 0
je 0x5168ea
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
je 0x5168ea
mov eax, esi
call fcn.0051773d
mov edi, dword [esi + 0x20]
mov eax, esi
call fcn.005168fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret