joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df55
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042e442
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x42df91
call fcn.0042e172
mov dword [esi + 0xc], 1
jmp 0x42df96
call fcn.0042e172
cmp dword [esi], 0
je 0x42dfe1
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x42dfbc
push edi
call fcn.00404a30
lea ecx, [edi + 1]
push ecx
jmp 0x42dfcb
push 0xff
call fcn.00425841
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004083b0
pop edi
jmp 0x42e005
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x42e005
push dword [esi]
push dword [ebp - 4]
call fcn.0042d85f
pop esi
leave
ret 0xc

Function at 0x42e0c9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042e172
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42e111
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00404a30
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004083b0
jmp 0x42e11c
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042d85f
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42e4fc
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58712f
call fcn.0055938f
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42e522
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42e57c
lea ecx, [ebp - 0x10]
call fcn.00402250
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0056d75d
push eax
call fcn.004032c0
add esp, 0x14
test esi, esi
je 0x42e56f
push esi
call fcn.005617e0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004258cb
mov eax, ebx
call fcn.0055935d
ret 8
Function at 0x432982
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x4329c1
call fcn.0042b12d
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4329c1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4329c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00438f4f
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4333ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x43345a
cmp dword [esi + 0x20], 0
je 0x43345a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43345a
cmp dword [ebp + 8], 0
je 0x43345a
xor edi, edi
mov ebx, edi
call fcn.0042b12d
push 0x59bee8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x43343e
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43345a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00439ad0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x433456
mov ecx, esi
call fcn.0043316c
mov eax, edi
jmp 0x43345c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43a69c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x43a6e4
call fcn.0042b12d
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43a6e4
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43a6f1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x43a72d
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x43a710
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x43a719
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x43a72b
test di, di
jne 0x43a72b
test dx, dx
je 0x43a72d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43a732
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x43a75d
cmp dword [esi + 0x80], 0
jne 0x43a75d
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.0042b12d
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43a78d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43a78d
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.0043a9f9
jmp 0x43a78f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43a796
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.0042b12d
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43a7d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43a7d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0043a7de
jmp 0x43a7d8
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x43aace
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x5879ff
call fcn.005593f8
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0042b12d
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x43ab2d
call fcn.0042b12d
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43ab41
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x43ab3d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x43ab49
or eax, 0xffffffff
jmp 0x43ac9b
mov ecx, edi
call fcn.0043b0d8
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0043166c
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x43abd5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x43abd5
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x43abd5
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0042a15c
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x43abd2
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x595a04]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x43abd2
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0042e5c7
test eax, eax
je 0x43abd2
push 0
mov ecx, esi
call fcn.0042e39a
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0043130b
push ebx
call fcn.004329ef
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0043aa71
test eax, eax
jne 0x43ac1e
cmp dword [edi + 0x9c], eax
jne 0x43ac1e
call fcn.0042b12d
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.004329ef
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0043aa71
and dword [edi + 0x9c], 0
jmp 0x43ac49
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x43ac5d
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0042e39a
test esi, esi
je 0x43ac6a
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x43ac80
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x43ac80
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0043b08f
mov eax, dword [edi + 0x68]
call fcn.0055935d
ret
Function at 0x43c989
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x43c9df
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x43c9b8
call fcn.0042f479
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x43c9cd
call fcn.0042f479
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x43c9df
call fcn.0042f479
call fcn.0042b12d
cmp dword [eax + 0x3c], 0
je 0x43c9f4
push esi
mov ecx, ebx
call fcn.0043c0af
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.0043cbda
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x43ca1d
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x43ca29
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x440664
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x4407aa
mov ecx, 0x5ea6d8
call fcn.0042aabb
mov esi, eax
test esi, esi
je 0x44079f
xor eax, eax
cmp word [esi + 8], ax
jne 0x440769
push str.comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x440725
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [ebp + 0x10]
mov ecx, 0x3ff
and ax, cx
cmp ax, 0x11
jne 0x4406eb
push 0x59d778
call fcn.004407e8
pop ecx
test eax, eax
je 0x4406eb
mov eax, edi
neg eax
push 0xfc11
sbb eax, eax
and eax, 0xe
add eax, 0x3ee
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x440706
neg edi
push 5
sbb edi, edi
and edi, 0xe
add edi, 0x3ee
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x440725
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x44072b
push ebx
push edi
push eax
call fcn.0044020d
add esp, 0xc
jmp 0x44072b
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 2
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.00425ffe
pop ecx
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4407a4
mov eax, dword [edi]
push eax
mov eax, dword [eax - 0xc]
inc eax
push eax
push ecx
call fcn.00426fa5
mov ax, word [ebx]
add esp, 0xc
mov word [esi + 8], ax
xor eax, eax
jmp 0x44076c
mov ebx, dword [ebp + 0xc]
mov edi, dword [esi + 4]
test edi, edi
je 0x44077a
push edi
call fcn.005617e0
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.00409540
movzx ecx, word [esi + 8]
mov edx, 0xffff
xor eax, eax
mov word [ebx], cx
pop edi
cmp cx, dx
pop esi
setne al
pop ebx
pop ebp
ret 0xc
call fcn.004250b5
call fcn.004250cf
int3
Function at 0x44fbcd
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x588be6
call fcn.005593c2
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x700], edi
test ecx, ecx
je 0x44fd5e
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x44fd30
sub eax, 1
je 0x44fc4c
sub eax, 1
je 0x44fc24
sub eax, 1
je 0x44fc4c
push 0x595de0
mov ecx, edi
call fcn.004021a0
mov eax, edi
call fcn.00559371
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x44fc0e
lea eax, [ebp - 0x4e8]
push eax
jmp 0x44fc13
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44fc0e
push esi
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], esi
push eax
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], esi
call fcn.0042c47e
test eax, eax
je 0x44fc0e
lea ecx, [ebp - 0x700]
call fcn.00402250
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x44fce6
test byte [ebp - 0x428], 0x18
jne 0x44fd08
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x430]
call dword [0x595a04]
mov ecx, ebx
call esi
jmp 0x44fd08
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x595a04]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.004039d0
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.004258cb
jmp 0x44fc1a
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x44fc0e
lea eax, [ebp - 0x6f0]
jmp 0x44fc49
call fcn.004250b5
int3

Function at 0x44fed6
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004a0059
call fcn.0042b17b
cmp dword [eax + 0x14], 0
jne 0x44fef1
mov ecx, esi
pop esi
jmp fcn.0044f1da
pop esi
ret

Function at 0x45086e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x5eb1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], esi
test eax, eax
je 0x4508d8
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x4508bd
lea eax, [ebp - 0x2ac]
push eax
jmp 0x4508c2
push 0x5a0858
call fcn.004021a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00558ddd
leave
ret 8
call fcn.004250b5
int3

Function at 0x450dbd
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00409b20
call fcn.0042b17b
cmp dword [eax + 0x14], 0
jne 0x450dd8
mov ecx, esi
pop esi
jmp fcn.00450618
pop esi
ret
Function at 0x459d1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x459d36
call fcn.0042b12d
mov esi, dword [eax + 0xc]
push 0x5a1f44
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x459d78
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x459d78
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x459d78
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00459d81
jmp 0x459d7a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x481d86
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x481f0d
je 0x481f34
sub eax, 0xa1
je 0x481f34
sub eax, 1
je 0x481f34
dec eax
sub eax, 1
je 0x481f34
sub eax, 1
je 0x481f34
dec eax
sub eax, 1
je 0x481f34
sub eax, 1
je 0x481f34
sub eax, 0x58
jne 0x481f72
cmp dword [edi + 0xc0], 0xffffffff
je 0x481f34
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x481f34
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x481e62
sub eax, 1
jne 0x481f34
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x481e51
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
test eax, eax
jne 0x481eae
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x481e27
jmp 0x481f8c
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x481f8c
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
test eax, eax
jne 0x481eae
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x481e79
jmp 0x481f8c
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
mov ecx, eax
call fcn.0042e750
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x481f8c
sub eax, 0x200
je 0x481f34
sub eax, 1
je 0x481f34
sub eax, 1
je 0x481f34
dec eax
sub eax, 1
je 0x481f34
sub eax, 1
je 0x481f34
dec eax
sub eax, 1
je 0x481f34
sub eax, 1
jne 0x481f72
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x481f53
cmp dword [eax + 0x20], ebx
je 0x481f53
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x481f72
cmp dword [eax + 0x20], ebx
je 0x481f72
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 4], 0x203
jne 0x481f91
lea eax, [edi + 0x2250]
test eax, eax
je 0x481f88
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x481f91
xor eax, eax
inc eax
jmp 0x481f99
push esi
mov ecx, edi
call fcn.00479d4c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4a06fd
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5eb1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x4a0729
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4a0754
cmp dword [0x5f1f54], 0
jne 0x4a0754
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x4a0750
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4a0750
push edi
call fcn.0056f085
pop ecx
jmp 0x4a07cb
mov eax, edi
jmp 0x4a07cb
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0055e340
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4a07da
push esi
call fcn.0042c9b1
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push esi
push 1
push 2
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00558ddd
leave
ret 4
call fcn.004250b5
int3
Function at 0x4bd24d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x4bd3ab
push esi
push edi
push 0x5addf8
call fcn.00425ed7
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x4bd2e6
mov edi, dword [ebx + 0x168]
jmp 0x4bd2d2
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bd2d2
push esi
call fcn.004329ef
push eax
push 0x5eaa70
call fcn.00425e38
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x4bd2d2
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x595a04]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x4bd2d2
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x4bd281
lea ecx, [ebx + 0x164]
call fcn.00428c88
jmp 0x4bd3a9
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4bd3a9
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00428b77
mov edi, dword [eax]
test edi, edi
jne 0x4bd312
xor esi, esi
jmp 0x4bd315
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bd399
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4bd399
cmp dword [ebp - 0x10], 0
jne 0x4bd36e
push edi
push 0x5eaa70
call fcn.00425e38
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x595a04]
mov ecx, edi
call esi
push eax
push 0x5a2ef0
call fcn.00425e38
pop ecx
pop ecx
test eax, eax
je 0x4bd399
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.004bc3be
test eax, eax
jne 0x4bd399
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.004ba4f4
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x4bd2fd
pop edi
pop esi
pop ebx
leave
ret 4