joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5816f8a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
push 4
push 0x581b3be0
mov edi, 0x400
push 3
push edi
call esi
mov ebx, 0xff
lea eax, [ebp - 0x100]
push ebx
push eax
push 0xc
push edi
call esi
mov al, byte [ebp - 0x100]
push ebx
mov byte [0x581b3be4], al
lea eax, [ebp - 0x100]
push eax
push 0xd
push edi
call esi
lea eax, [ebp - 0x100]
push eax
call fcn.581911a0
test eax, eax
pop ecx
mov dword [0x581b3be8], eax
jl 0x5816f90c
cmp eax, 2
jle 0x5816f913
and dword [0x581b3be8], 0
push 1
push 0x581b3bec
push 0x1e
push edi
call esi
push 9
push 0x581b3bed
push 0x14
push edi
call esi
lea eax, [ebp - 0x100]
push ebx
push eax
push 0xf
push edi
call esi
mov al, byte [ebp - 0x100]
push ebx
mov byte [0x581b3bf6], al
lea eax, [ebp - 0x100]
push eax
push 0xe
push edi
call esi
mov al, byte [ebp - 0x100]
push 1
push 0x581b3bf8
push 0x1d
push edi
mov byte [0x581b3bf7], al
call esi
lea eax, [ebp - 0x100]
push ebx
push eax
push 0x100c
push edi
call esi
lea eax, [ebp - 0x100]
push eax
call fcn.581911a0
pop ecx
inc eax
push 7
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x100]
push ebx
push eax
push 0x100d
push edi
inc edx
mov dword [0x581b3bfc], edx
call esi
lea eax, [ebp - 0x100]
push eax
call fcn.581911a0
cmp eax, 0xc
pop ecx
mov dword [0x581b3c00], eax
jae 0x5816f9c5
mov eax, dword [eax*4 + 0x581a24f0]
mov dword [0x581b3c00], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58170352
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x38]
lea edi, [esi + 0x58]
mov dword [ebp - 8], eax
mov eax, edi
mov edx, dword [esi + 0x3c]
add dword [eax], ecx
add dword [eax + 4], edx
add eax, 8
mov edx, ebx
dec ebx
test edx, edx
jne 0x5817036e
mov eax, dword [edi + 4]
mov ebx, dword [edi]
push esi
mov dword [ebp - 0xc], eax
call fcn.5816fe81
test eax, eax
pop ecx
jne 0x581704a9
mov eax, dword [esi + 0x4c]
sub eax, 0x201
je 0x581703d6
push 2
pop ecx
sub eax, ecx
je 0x581703e3
dec eax
je 0x581703ca
sub eax, ecx
je 0x581703ca
dec eax
je 0x581703ba
sub eax, ecx
jne 0x581704a9
mov dword [ebp - 4], 4
mov dword [ebp + 8], 0x208
jmp 0x581703f1
mov dword [ebp - 4], ecx
mov dword [ebp + 8], 0x205
jmp 0x581703f1
cmp dword [0x581ae570], 0
jne 0x581704a9
mov dword [ebp - 4], 1
mov dword [ebp + 8], 0x202
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCapture]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 8]
jne 0x58170432
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x58170432
push 3
push 0x209
push 0x100
lea eax, [ebp - 0x2c]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x58170451
jmp 0x581703fa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ebx
movzx eax, cx
movzx edx, bx
shl eax, 0x10
or eax, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jmp 0x58170454
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
cmp ecx, 0x200
jb 0x58170497
cmp ecx, 0x209
ja 0x58170497
mov dword [esi + 0x4c], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], eax
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push esi
mov dword [edi], ecx
mov dword [esi + 0x5c], eax
call fcn.5816fe81
mov eax, dword [ebp - 0x20]
pop ecx
movsx ebx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 8]
jne 0x581703fa
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x58173063
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x581730cb
push esi
mov esi, dword [ebp + 8]
push 1
mov eax, dword [esi + 0x58]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.581706fc
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 4]
add esp, 0xc
cmp eax, ecx
je 0x581730ac
lea edx, [ebp - 8]
push 1
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x202
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
leave
ret
Function at 0x58173239
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
push edi
xor eax, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
and ecx, 0x4000
or ecx, 0x1a
mov dword [ebp - 8], edi
mov dword [esi + 0x44], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], eax
cmp byte [ecx + 4], 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
jne 0x58173294
cmp dword [ebp + 0x10], eax
jne 0x58173294
cmp dword [ebp + 0xc], eax
je 0x58173287
mov dword [ebp - 4], eax
jmp 0x58173294
cmp byte [edi + 5], 0
je 0x58173294
mov dword [ebp - 0x10], 1
cmp dword [esi + 0x50], 0xd
je 0x581733ea
cmp byte [edi + 1], 0
je 0x581732ad
cmp byte [edi], 0
je 0x581733ea
push esi
mov dword [ebx + 4], 1
call fcn.5816fe23
pop ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetCapture]
push 0x20
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x581733de
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 4]
jne 0x581733db
test byte [esi], 1
je 0x581733db
push 3
push 0x209
push ebx
lea eax, [ebp - 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x581733ca
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
jb 0x58173352
cmp eax, 0x108
ja 0x58173352
mov dword [esi + 0x4c], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x54], eax
push esi
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], eax
call fcn.5816feaf
test eax, eax
pop ecx
jne 0x581733db
mov eax, dword [ebp - 0x2c]
sub eax, ebx
je 0x5817336b
dec eax
jne 0x581733c4
cmp dword [ebp - 0x28], 0x20
jne 0x581733c4
mov dword [ebp + 8], 1
jmp 0x581733c4
cmp dword [ebp - 0x28], 0x20
jne 0x58173413
cmp word [ebp - 0x24], 0
je 0x58173413
cmp byte [edi], 0
je 0x581733c4
push esi
call fcn.5816fd2d
test eax, eax
pop ecx
je 0x581733c4
call dword [sym.imp.USER32.dll_GetFocus]
push dword [ebp - 4]
mov edi, eax
push esi
call fcn.5816fd0a
pop ecx
pop ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x581733ba
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x581733c1
mov dword [ebp + 8], 1
mov edi, dword [ebp - 8]
cmp dword [ebp + 8], 0
jne 0x581733db
push 0x20
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x581732e3
mov ebx, dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx + 4], 0
xor eax, eax
cmp dword [ebp - 0xc], eax
je 0x581733f8
push esi
call fcn.5816fe23
pop ecx
jmp 0x58173407
push dword [ebp - 0x10]
push dword [ebp - 4]
push esi
call fcn.5817351b
add esp, 0xc
and dword [esi + 0x44], 0x4000
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x28], 0xd
push 1
pop eax
mov dword [ebp + 8], eax
je 0x581733c4
cmp dword [ebp - 0x28], 0x20
je 0x581733c4
mov dword [ebp - 0xc], eax
jmp 0x581733c4
Function at 0x581751cf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
test ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], ebx
je 0x58175379
lea edi, [esi + 0x58]
push 1
push edi
push esi
call fcn.581706fc
add esp, 0xc
push 1
push edi
push ebx
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [edi + 4]
mov dword [esi + 0x48], ebx
mov ebx, dword [edi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetCapture]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp + 8]
jne 0x58175265
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x58175265
push 3
push 0x209
push 0x100
lea eax, [ebp - 0x40]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x58175285
jmp 0x5817522f
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], 0x202
movzx eax, cx
movzx edx, bx
shl eax, 0x10
or eax, edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ecx
jmp 0x58175288
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x200
jb 0x581752bf
cmp ecx, 0x209
ja 0x581752bf
mov dword [esi + 0x4c], ecx
mov ecx, dword [ebp - 0x38]
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], eax
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
push esi
mov dword [edi], ecx
mov dword [esi + 0x5c], eax
call fcn.5816fe81
mov eax, dword [ebp - 0x34]
pop ecx
cmp dword [ebp - 0x3c], 0x202
je 0x58175373
cmp dword [ebp - 0x3c], 0x200
jne 0x5817522f
mov ecx, dword [ebp - 0x30]
mov ebx, eax
push ecx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], ecx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x5817522f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xc]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x84
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x5817522f
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
call dword [sym.imp.USER32.dll_ReleaseCapture]
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xc]
shl eax, 0x10
or eax, ecx
push eax
push 1
push 0x201
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 4]
je 0x58175379
jmp 0x58175226
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5817afb3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov ecx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
push edi
mov dword [ebp - 8], ecx
cmp dword [ecx + 0xc], edx
mov dword [ebp + 8], edx
je 0x5817b08a
cmp byte [ebx + 0x19], dl
jne 0x5817b08a
cmp byte [ebx + 0x98], dl
je 0x5817b08a
cmp byte [ebx + 0x18], dl
jne 0x5817b08a
cmp byte [ebx + 0x1a], dl
jne 0x5817b08a
push 6
lea esi, [eax + 0x48]
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x60], edx
call fcn.5817bf5c
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
lea eax, [ebp - 0x120]
mov esi, 0x100
push eax
push esi
push 0xd
push dword [ebx]
call edi
cmp eax, esi
jg 0x5817b07a
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
push dword [eax]
call fcn.5816de55
add esp, 0xc
mov byte [ebp + 0xb], al
push dword [ebx]
mov eax, dword [0x581b3d88]
call dword [eax + 0xc]
cmp al, byte [ebp + 0xb]
je 0x5817b073
movzx eax, byte [ebp + 0xb]
push 0
push eax
push 0x454
push dword [ebx]
call edi
mov dword [ebp + 8], 1
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push 6
lea esi, [ebp - 0x20]
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x5817b08c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5817bb64
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x5817bc30
cmp dword [ebp + 0xc], edi
push esi
je 0x5817bc10
mov eax, dword [0x581b27ac]
add eax, 8
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
jne 0x5817bba1
push ebx
call fcn.5817d328
pop ecx
push ebx
call fcn.5817bca4
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
pop ecx
test eax, eax
je 0x5817bbf9
push edi
push edi
push 0x451
push ebx
call esi
test eax, eax
je 0x5817bbf9
push 1
push edi
push edi
push ebx
call fcn.5817bc34
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x100]
push eax
push 0x100
push 0xd
push ebx
call esi
lea eax, [ebp + edi - 0x100]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.58146a86
add eax, edi
push eax
jmp 0x5817bbff
cmp dword [ebp + 0x10], edi
je 0x5817bc02
push edi
push edi
jmp 0x5817bc06
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xb1
push ebx
call esi
jmp 0x5817bc1f
push 0xfffffffffffffffe
push edi
push 0xb1
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0xc]
push dword [0x581b27ac]
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x5817e41b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x581b3b4c], ebx
push esi
push edi
je 0x5817e610
cmp byte [0x581b3b90], bl
jne 0x5817e610
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [0x581b3b54]
jne 0x5817e603
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x5817e603
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.5817e816
cmp byte [0x581b3b7c], bl
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
jne 0x5817e4db
test byte [0x581b3b50], 4
je 0x5817e4b0
sub eax, dword [0x581b3b94]
mov ecx, dword [0x581b3b40]
sub edx, dword [0x581b3b98]
cmp eax, ecx
jg 0x5817e4c8
neg ecx
cmp eax, ecx
jl 0x5817e4c8
mov eax, dword [0x581b3b44]
cmp edx, eax
jg 0x5817e4c8
neg eax
cmp edx, eax
jl 0x5817e4c8
jmp 0x5817e4c0
cmp eax, dword [0x581b3b94]
jne 0x5817e4c8
cmp edx, dword [0x581b3b98]
jne 0x5817e4c8
mov byte [0x581b3b7c], bl
jmp 0x5817e4cf
mov byte [0x581b3b7c], 1
cmp byte [0x581b3b7c], bl
je 0x5817e610
push 1
call fcn.5817e88e
mov al, byte [0x581b3b50]
mov edi, dword [ebp + 0xc]
mov edx, dword [0x581b3b50]
pop ecx
test al, 0x20
mov esi, 0x200
je 0x5817e559
test esi, edx
je 0x5817e543
mov cl, byte [0x581b3bc9]
cmp cl, bl
je 0x5817e528
cmp edi, dword [0x581b3b68]
jl 0x5817e524
mov ecx, dword [0x581b3b9c]
mov byte [0x581b3bc9], bl
mov dword [0x581b3b60], ecx
jmp 0x5817e543
cmp cl, bl
jne 0x5817e543
cmp edi, dword [0x581b3b60]
jg 0x5817e543
mov ecx, dword [0x581b3ba4]
mov byte [0x581b3bc9], 1
mov dword [0x581b3b68], ecx
cmp byte [0x581b3bc9], bl
je 0x5817e553
mov dword [0x581b3b60], edi
jmp 0x5817e559
mov dword [0x581b3b68], edi
mov ecx, dword [ebp + 0x10]
test al, 0x40
je 0x5817e5ba
test esi, edx
je 0x5817e5a4
mov al, byte [0x581b3bca]
cmp al, bl
je 0x5817e58b
cmp ecx, dword [0x581b3b6c]
jl 0x5817e587
mov eax, dword [0x581b3ba0]
mov byte [0x581b3bca], bl
mov dword [0x581b3b64], eax
jmp 0x5817e5a4
cmp al, bl
jne 0x5817e5a4
cmp ecx, dword [0x581b3b64]
jg 0x5817e5a4
mov eax, dword [0x581b3ba8]
mov byte [0x581b3bca], 1
mov dword [0x581b3b6c], eax
cmp byte [0x581b3bca], bl
je 0x5817e5b4
mov dword [0x581b3b64], ecx
jmp 0x5817e5ba
mov dword [0x581b3b6c], ecx
mov eax, dword [0x581b3b48]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x5817e5d5
lea ecx, [ebp + 0xc]
push ebx
push ecx
call eax
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
cmp dword [0x581b3b4c], ebx
je 0x5817e5ee
push ecx
push edi
call fcn.5817e6c4
pop ecx
pop ecx
push ebx
call fcn.5817e88e
jmp 0x5817e60f
call dword [sym.imp.USER32.dll_ReleaseCapture]
push ebx
push dword [0x581b3b54]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x5817e610
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
call fcn.5817e615
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5817e7c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.5818bc7b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
pop ecx
pop ecx
push 0x10
call esi
test ah, 0x80
je 0x5817e7f7
push 4
pop edi
push 0x11
call esi
test ah, 0x80
je 0x5817e803
or edi, 8
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.5817e41b
add esp, 0xc
pop edi
pop esi
leave
ret

Function at 0x5817f04c
Capabilities:
Log keystrokes via polling

Disassembly:
xor eax, eax
cmp byte [0x581b27c0], al
jne 0x5817f0e0
push edi
push esi
push 4
push 0x2a
push eax
push dword [0x581b4b20]
push eax
push eax
push 0x5814ec90
push 2
call fcn.58148b1e
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
add esp, 0x20
push 0x3a
call esi
mov edx, dword [0x581ae534]
mov edi, 0xff
movsx eax, ax
mov ecx, eax
push eax
and ecx, edi
mov dword [edx + 0x270], ecx
call fcn.5816b7ab
pop ecx
mov ecx, dword [0x581ae534]
push 0x3b
mov dword [ecx + 0x274], eax
call esi
mov edx, dword [0x581ae534]
movsx eax, ax
mov ecx, eax
push eax
and ecx, edi
mov dword [edx + 0x278], ecx
call fcn.5816b7ab
pop ecx
pop esi
mov ecx, dword [0x581ae534]
mov byte [0x581b27c0], 1
pop edi
mov dword [ecx + 0x27c], eax
ret
Function at 0x58180ba2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x581ae530]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push esi
mov dword [0x581ae530], eax
push edi
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.58190d38
mov esi, dword [ebp + 8]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x58180bf2
mov eax, dword [ebp - 4]
mov dword [0x581ae530], eax
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x58180beb
push 0
push eax
call fcn.5816a767
pop ecx
pop ecx
push edi
call fcn.5817e278
pop ecx
mov ecx, dword [esi]
mov ebx, 0x5a0
mov edi, ebx
mov eax, dword [ecx + 0xc]
imul eax, eax, 0x9ec
cdq
idiv edi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x10]
imul eax, eax, 0x9ec
cdq
idiv edi
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x14]
imul eax, eax, 0x9ec
cdq
idiv edi
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
imul eax, eax, 0x9ec
cdq
idiv edi
xor edi, edi
mov dword [ebp - 8], eax
mov eax, dword [0x581b27cc]
cmp dword [eax], edi
je 0x58180c78
add ecx, 0x44
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [esi]
add eax, 0x44
push eax
push edi
push 0x581aa570
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push 0x581aa574
push ecx
lea ecx, [eax + 0x44]
push ecx
push dword [eax + 4]
jmp 0x58180c85
lea eax, [ebp - 0x14]
push str.Microsoft_Access
push eax
push edi
push dword [ecx + 4]
call fcn.5818edb6
mov ecx, dword [esi]
mov edi, eax
push 6
push edi
mov dword [ecx], eax
call fcn.5816aa41
pop ecx
pop ecx
push 8
push edi
call fcn.5816aa41
mov eax, dword [esi]
pop ecx
pop ecx
push 0
push ebx
push ebx
push edi
mov dword [eax + 0x38], 6
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push 0x5a
push edi
call ebx
push eax
push 0x58
push edi
call ebx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov eax, dword [esi]
push 0
push dword [eax + 0x158]
push dword [eax + 0x154]
push edi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov eax, dword [0x581b27cc]
push esi
push edi
push dword [eax + 4]
push dword [0x581ae538]
call fcn.5814173c
mov eax, dword [0x581b27cc]
add esp, 0x10
mov dword [eax + 8], edi
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [0x581ae530], eax
pop ebx
leave
ret
Function at 0x5818f7c4
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x581b34e8], 0
push esi
jne 0x5818f8e1
mov esi, str.COMDLG32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, 0x20
mov dword [0x581b3b04], eax
jae 0x5818f800
push 0x2030
push esi
push 0x8ac
call fcn.5814eb7c
add esp, 0xc
jmp 0x5818f8d3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetOpenFileNameA
push eax
call esi
test eax, eax
mov dword [0x581b3ae8], eax
je 0x5818f8d3
push str.GetSaveFileNameA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3b20], eax
je 0x5818f8d3
push str.FindTextA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3aa8], eax
je 0x5818f8d3
push str.ReplaceTextA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3adc], eax
je 0x5818f8d3
push str.ChooseFontA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3ab4], eax
je 0x5818f8d3
push str.PrintDlgA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3ad4], eax
je 0x5818f8d3
push str.PageSetupDlgA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3ac8], eax
je 0x5818f8d3
push str.CommDlgExtendedError
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3b0c], eax
je 0x5818f8d3
push str.GetFileTitleA
push dword [0x581b3b04]
call esi
test eax, eax
mov dword [0x581b3abc], eax
jne 0x5818f8d7
xor eax, eax
pop esi
ret
mov dword [0x581b34e8], 1
push 1
pop eax
pop esi
ret

Function at 0x5818fba2
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x581b34f4], 0
push esi
jne 0x5818fc58
mov esi, str.MPR.DLL
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, 0x20
mov dword [0x581b3ac4], eax
jae 0x5818fbdb
push 0x2030
push esi
push 0x8ac
call fcn.5814eb7c
add esp, 0xc
jmp 0x5818fc4a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WNetEnumResourceA
push eax
call esi
test eax, eax
mov dword [0x581b3afc], eax
je 0x5818fc4a
push str.WNetCloseEnum
push dword [0x581b3ac4]
call esi
test eax, eax
mov dword [0x581b3ad8], eax
je 0x5818fc4a
push str.WNetGetConnectionA
push dword [0x581b3ac4]
call esi
test eax, eax
mov dword [0x581b3b1c], eax
je 0x5818fc4a
push str.WNetGetUserA
push dword [0x581b3ac4]
call esi
test eax, eax
mov dword [0x581b3b14], eax
je 0x5818fc4a
push str.WNetOpenEnumA
push dword [0x581b3ac4]
call esi
test eax, eax
mov dword [0x581b3b08], eax
jne 0x5818fc4e
xor eax, eax
pop esi
ret
mov dword [0x581b34f4], 1
push 1
pop eax
pop esi
ret