joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5611a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5d61c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00554613
mov dword [ebp - 0x14], eax
cmp dword [0x5e25f0], esi
jne 0x56129b
push 0x800
push esi
push 0x5a8270
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x561228
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x56137b
push esi
push esi
push 0x5a8270
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x56137b
push 0x5a8288
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x56137b
push eax
call ebx
push 0x5a8294
push edi
mov dword [0x5e25f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5a82a4
push edi
mov dword [0x5e25f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5e25f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5e2600], eax
test eax, eax
je 0x561298
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5e25fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5612c0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5612b3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5612d5
push 4
pop eax
jmp 0x56137d
cmp dword [ebp - 0x14], esi
je 0x5612d5
push dword [0x5e25f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5612ba
mov eax, dword [0x5e25fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x561333
cmp dword [0x5e2600], edi
je 0x561333
push eax
call ebx
push dword [0x5e2600]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x561333
test eax, eax
je 0x561333
call ecx
test eax, eax
je 0x561328
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x561328
test byte [ebp - 8], 1
jne 0x561333
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x561363
mov eax, dword [0x5e25f4]
cmp eax, edi
je 0x561360
push eax
call ebx
test eax, eax
je 0x561360
call eax
mov esi, eax
test esi, esi
je 0x561360
mov eax, dword [0x5e25f8]
cmp eax, edi
je 0x561360
push eax
call ebx
test eax, eax
je 0x561360
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5e25f0]
call ebx
test eax, eax
je 0x56137b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x56137d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054b305
mov esp, ebp
pop ebp
ret
Function at 0x416218
Capabilities:
Hide graphical window

Disassembly:
push esi
push ebx
sub esp, 0x74
mov ebx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov esi, dword [eax + 8]
inc dword [ebx + 0x5c]
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [esi + 0x98]
mov edx, eax
and edx, 0xfffffffe
mov dword [esi + 0x98], edx
test eax, 0x10000
je 0x416299
mov dword [esp + 0x10], 0x12
mov eax, dword [ebx + 0x5c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.00416b28
xor eax, eax
add esp, 0x74
pop ebx
pop esi
ret
Function at 0x42fec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x7c]
test ebp, ebp
je 0x430010
test edx, edx
js 0x430018
lea ebx, [ebp + 0x10]
xor edi, edi
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x430010
mov dword [esp + 0x24], edi
mov esi, edx
mov edx, dword [esp + 0x78]
jmp 0x42ffe2
mov dword [esp + 4], edx
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
mov dword [esp + 0x20], edx
call dword [eax + 0x51c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov ecx, dword [ebx]
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [ebp]
mov dword [esp], eax
call fcn.0047c3f8
mov eax, dword [ebx]
mov edx, dword [esp + 0x20]
mov ecx, dword [0x67eb7c]
cmp edi, esi
jle 0x42ff65
mov edi, esi
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 0x20], edx
call dword [ecx + 0x51c]
mov ecx, dword [esp + 0x74]
add ecx, dword [ebx + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x70]
add ecx, dword [ebx + 0x10]
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call fcn.0047c9ec
mov edx, dword [esp + 0x20]
mov eax, dword [ebx + 8]
sub edx, eax
sub esi, eax
test esi, esi
jle 0x430010
add ebx, 0x20
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp dword [ebp + 0xc], eax
jle 0x430010
mov edi, dword [ebx + 0xc]
test edi, edi
jle 0x42ffc7
cmp edi, edx
jle 0x42ffc7
test edx, edx
jg 0x42ff00
mov dword [esp + 0x3c], 0
mov eax, dword [ebx]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
xor edx, edx
jmp 0x42ff59
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x5f5e100
jmp 0x42fedf
Function at 0x432288
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp + 4], 0xb8
mov dword [esp], 0x67e24c
mov eax, dword [0x67eb7c]
call dword [eax + 0x4cc]
mov dword [esp + 0x38], eax
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
dec eax
mov edx, dword [esp + 0x38]
mov dword [edx], eax
test eax, eax
je 0x4322c6
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, edx
add ebx, 0x40
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [0x67eb7c]
call dword [eax + 0x24c]
test eax, eax
je 0x432309
mov eax, dword [eax + 0xc]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
lea edx, [esp + 0x44]
mov dword [esp], edx
mov eax, dword [0x67eb7c]
call dword [eax + 0x30c]
test eax, eax
jne 0x4322e5
mov dword [esp], ebx
mov eax, dword [0x67eb7c]
call dword [eax + 0x1bc]
mov edx, dword [esp + 0x38]
add edx, 4
mov dword [esp + 0x3c], edx
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [0x67eb7c]
call dword [eax + 0x24c]
test eax, eax
je 0x432424
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], eax
add eax, 4
mov dword [esp + 0x30], eax
mov dword [esp + 4], 0xb8
mov dword [esp], 0x67e24c
mov eax, dword [0x67eb7c]
call dword [eax + 0x4cc]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x78]
test ecx, ecx
jle 0x4323e9
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
nop
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
add eax, dword [edx]
mov dword [esp + 0x20], eax
mov esi, eax
add esi, 4
mov edi, eax
add edi, 8
mov edx, dword [eax + 4]
test edx, edx
jle 0x4323c1
xor ebp, ebp
xor ebx, ebx
nop
mov eax, dword [edi]
mov eax, dword [eax + ebp + 8]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
inc ebx
add ebp, 0xc
cmp ebx, dword [esi]
jl 0x4323a8
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 8]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
inc dword [esp + 0x24]
add dword [esp + 0x28], 0xc
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
cmp edx, dword [eax + 0x78]
jl 0x432384
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 4]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
mov edx, dword [esp + 0x34]
mov dword [esp], edx
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
lea eax, [esp + 0x44]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x30c]
test eax, eax
jne 0x432340
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
mov eax, dword [0x67eb7c]
call dword [eax + 0x1bc]
mov eax, dword [esp + 0x38]
add eax, 0x7c
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x1bc]
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 0xb4]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x18]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4337fc
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov eax, dword [0x67e2b0]
test eax, eax
je 0x433808
ret
push edi
push esi
sub esp, 0x194
mov dword [esp + 0x34], 0x94
lea eax, [esp + 0x34]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
push eax
mov eax, dword [esp + 0x44]
mov dword [0x67e2b0], eax
cmp eax, 2
je 0x433848
mov dword [0x67e2b4], 1
add esp, 0x194
pop esi
pop edi
ret
cmp dword [esp + 0x38], 5
jne 0x433833
cmp dword [esp + 0x3c], 1
jne 0x433833
mov dword [esp + 0x30], 0xc8
lea esi, [esp + 0xc8]
mov ecx, 0xc8
xor eax, eax
mov edi, esi
rep stosb byte es:[edi], al
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelAppearance
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4338b4
mov dword [0x67e2b4], 2
mov eax, dword [0x67e2b0]
jmp 0x43383d
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Current
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push edi
mov edi, str.Windows_Standard
mov ecx, 0x11
repe cmpsb byte [esi], byte es:[edi]
seta al
setb dl
sub eax, edx
movsx eax, al
cmp eax, 1
sbb eax, eax
add eax, 2
mov dword [0x67e2b4], eax
jmp 0x4338ad
Function at 0x43391c
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov ecx, dword [0x67e264]
test ecx, ecx
je 0x433928
ret
sub esp, 0x4c
mov dword [0x67e264], 1
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0xff
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.COMCTL32.DLL_InitCommonControlsEx
push edx
test eax, eax
je 0x433a80
call fcn.004337fc
cmp eax, 2
je 0x433a94
mov dword [0x67fba4], 0x5d7fc0
mov dword [0x67e280], 3
mov dword [0x67e288], 0
mov dword [0x67e28c], 0
mov eax, dword [esp + 0x50]
mov dword [0x67e290], eax
mov dword [0x67e29c], 0
mov dword [0x67e2a0], 0
mov dword [0x67e2a4], 0x5f1141
mov dword [0x67e284], 0x435074
mov dword [0x67e294], 0
mov dword [0x67e298], 0
mov dword [esp], 0x67e280
call sub.USER32.dll_RegisterClassA
push ecx
test ax, ax
je 0x433a6c
mov dword [esp], 0
call sub.USER32.dll_GetKeyboardLayout
push edx
mov dword [esp + 0xc], 4
lea edx, [esp + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x20001004
and eax, 0xffff
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
jne 0x433a3c
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov dword [esp], 0x4336e8
call fcn.004174cc
add esp, 0x4c
ret
mov dword [esp + 8], 2
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
test eax, eax
je 0x433a24
mov eax, dword [esp + 0x20]
call fcn.0043364c
jmp 0x433a24
mov dword [esp], str.Unable_to_register_TkChild_class
mov eax, dword [0x67eb7c]
call dword [eax + 0x10]
jmp 0x4339eb
mov dword [esp], str.Unable_to_load_common_controls__
mov eax, dword [0x67eb7c]
call dword [eax + 0x10]
jmp 0x43395a
mov dword [0x67fba4], 0x5d7fa0
jmp 0x433972
Function at 0x47c9b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
add eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
pop ebx
jmp fcn.0047c3f8

Function at 0x4814e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 0x10
call sub.USER32.dll_GetKeyState
push ecx
movsx ebx, ax
shr ebx, 0x1f
mov dword [esp], 0x11
call sub.USER32.dll_GetKeyState
push edx
test ax, ax
js 0x4815bc
mov dword [esp], 0x12
call sub.USER32.dll_GetKeyState
push edx
test ax, ax
js 0x4815b0
mov dword [esp], 0x14
call sub.USER32.dll_GetKeyState
push ecx
test al, 1
je 0x481537
or ebx, 2
mov dword [esp], 0x90
call sub.USER32.dll_GetKeyState
push edx
test al, 1
je 0x48154b
or ebx, 8
mov dword [esp], 0x91
call sub.USER32.dll_GetKeyState
push ecx
test al, 1
je 0x48155f
or ebx, 0x20
mov dword [esp], 1
call sub.USER32.dll_GetKeyState
push edx
test ax, ax
js 0x4815a8
mov dword [esp], 4
call sub.USER32.dll_GetKeyState
push ecx
test ax, ax
js 0x4815a0
mov dword [esp], 2
call sub.USER32.dll_GetKeyState
push edx
test ax, ax
jns 0x481598
or bh, 4
mov eax, ebx
add esp, 0x18
pop ebx
ret
or bh, 2
jmp 0x481583
or bh, 1
jmp 0x481571
or ebx, 0x20000
jmp 0x481523
or ebx, 4
jmp 0x48150d
Function at 0x48193c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebp, eax
mov esi, edx
mov ebx, ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_MapVirtualKeyA
sub esp, 8
test ebx, ebx
jne 0x481a68
cmp ebp, 0x14
je 0x481a90
cmp ebp, 0x91
je 0x481a90
cmp ebp, 0x90
je 0x481a90
mov dword [esp + 4], 2
mov dword [esp], ebp
mov dword [esp + 0x28], eax
call sub.USER32.dll_MapVirtualKeyA
sub esp, 8
cmp eax, 0x7fff
mov edx, dword [esp + 0x28]
jbe 0x4819bc
mov eax, 0xff20
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [esp + 0x40]
mov ecx, 0x100
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
test esi, 1
je 0x4819d8
mov byte [esp + 0x50], pe_nt_image_headers32
test esi, 4
je 0x4819e5
mov byte [esp + 0x51], pe_nt_image_headers32
test esi, 0x10
je 0x4819f2
mov byte [esp + 0x52], pe_nt_image_headers32
test esi, 2
je 0x4819ff
mov byte [esp + 0x54], 1
test esi, 0x20
je 0x481a0f
mov byte [esp + 0xd1], 1
and esi, 8
je 0x481a1c
mov byte [esp + 0xd0], 1
mov dword [esp + 0x10], 0
lea esi, [esp + 0x3c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], ebp
mov dword [esp + 0x28], edx
call sub.USER32.dll_ToAscii
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x28]
js 0x481b48
cmp eax, 2
je 0x481aec
dec eax
jne 0x481a68
movzx eax, byte [esp + 0x3c]
cmp al, 0x1f
jbe 0x481a68
cmp al, 0x7f
jne 0x481a72
cmp ebp, 0x91
jbe 0x481a80
xor eax, eax
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, 0x11
je 0x481ad4
cmp ebp, 0x12
je 0x481abc
cmp ebp, 0x10
je 0x481aa4
nop
mov eax, dword [ebp*4 + 0x601d60]
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xa1
call sub.USER32.dll_GetKeyState
push ecx
test al, 0x80
je 0x481a90
mov eax, 0xffe2
jmp 0x481a72
mov dword [esp], 0xa5
call sub.USER32.dll_GetKeyState
push edx
test al, 0x80
je 0x481a90
mov eax, 0xffea
jmp 0x481a72
mov dword [esp], 0xa3
call sub.USER32.dll_GetKeyState
push ebx
test al, 0x80
je 0x481a90
mov eax, 0xffe4
jmp 0x481a72
movsx eax, byte [esp + 0x3c]
mov dword [esp], eax
call sub.USER32.dll_VkKeyScanA
push edi
movsx edx, ah
mov dword [esp + 0x2c], edx
movzx ebp, al
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.USER32.dll_MapVirtualKeyA
sub esp, 8
mov edx, eax
mov ecx, 0x100
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
test byte [esp + 0x2c], 1
je 0x481b30
mov byte [esp + 0x50], pe_nt_image_headers32
test byte [esp + 0x2c], 2
je 0x481b3c
mov byte [esp + 0x51], pe_nt_image_headers32
test byte [esp + 0x2c], 4
je 0x481b48
mov byte [esp + 0x52], pe_nt_image_headers32
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], ebp
call sub.USER32.dll_ToAscii
sub esp, 0x14
mov eax, 0xff20
jmp 0x481a72
Function at 0x481d44
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x24]
test edx, edx
je 0x481d74
xor eax, eax
jmp 0x481d5c
inc eax
cmp eax, 0x92
je 0x481d6c
cmp dword [eax*4 + 0x601d60], edx
jne 0x481d54
add esp, 0x1c
ret
cmp edx, 0x1f
ja 0x481d7a
lea esi, [esi]
xor eax, eax
add esp, 0x1c
ret
movsx edx, dl
mov dword [esp], edx
call sub.USER32.dll_VkKeyScanA
push ecx
cmp ax, 0xffff
je 0x481d74
movzx eax, al
jmp 0x481d65

Function at 0x482094
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov ebx, dword [esi + 0x30]
mov ebp, ebx
mov edi, dword [eax + 0xc0]
test edi, edi
jne 0x4820f4
mov eax, dword [esi + 0x34]
xor ecx, ecx
mov edx, ebx
call fcn.0048193c
mov edi, eax
test eax, eax
jne 0x4820d1
test bl, 0x14
jne 0x482100
test ebp, 1
jne 0x4820dc
mov eax, edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, ebp
and edx, 0xfffffffe
mov eax, dword [esi + 0x34]
xor ecx, ecx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0048193c
mov dword [esp], eax
call fcn.00481e00
jmp 0x4820b2
mov ebp, ebx
and ebp, 0xffffffeb
mov eax, dword [esi + 0x34]
xor ecx, ecx
mov edx, ebp
call fcn.0048193c
test eax, eax
je 0x4820c9
mov edi, eax
jmp 0x4820d1
Function at 0x484150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov edx, dword [ebp + 0xa4]
mov dword [esp + 0x28], edx
mov eax, dword [ebp]
mov edi, dword [eax + 0x20]
mov eax, dword [0x67eb7c]
call dword [eax + 0x2b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0x88
mov dword [esp], 0x67e600
mov eax, dword [0x67eb7c]
call dword [eax + 0x4cc]
mov ebx, eax
inc dword [eax]
test byte [ebp + 0x8b], 0x20
jne 0x4842d8
mov dword [esp], ebp
call fcn.004ccadc
mov esi, eax
test eax, eax
jne 0x4842cc
mov ebp, dword [ebp]
test ebp, ebp
je 0x4842cc
test edi, edi
je 0x48431c
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0041c298
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x34]
mov dword [esp + 0x44], edx
add edx, dword [edi + 0x44]
mov dword [esp + 0x4c], edx
add eax, dword [edi + 0x40]
mov dword [esp + 0x48], eax
mov dword [esp], 0
mov eax, dword [0x67eb7c]
call dword [eax + 0x3ac]
mov dword [esp], 0x17
call sub.USER32.dll_GetSystemMetrics
push edi
test eax, eax
je 0x4842fc
mov dword [esp], 1
call sub.USER32.dll_GetAsyncKeyState
push ecx
test ax, ax
js 0x484312
xor eax, eax
lea edx, [esp + 0x40]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.USER32.dll_TrackPopupMenu
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [0x67eb7c]
call dword [eax + 0x3ac]
lea eax, [esp + 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetCursorPos
push edi
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004815c4
mov ebp, dword [ebx]
test ebp, ebp
je 0x4842c0
mov dword [ebx], 0
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
dec dword [ebx]
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], fcn.0048303c
mov eax, dword [0x67eb7c]
call dword [eax + 0x148]
mov dword [esp], ebp
call fcn.0048303c
jmp 0x4841a5
mov dword [esp], 2
call sub.USER32.dll_GetAsyncKeyState
push edx
test ax, ax
jns 0x48423d
mov eax, 2
jmp 0x48423f
mov eax, dword [esp + 0x7c]
sub eax, 0x32
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x7c]
add eax, 0x32
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x78]
sub eax, 0x32
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x78]
add eax, 0x32
mov dword [esp + 0x48], eax
jmp 0x484200
Function at 0x4a8de8
Capabilities:
Hide graphical window

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xbc
mov ebp, dword [esp + 0xd0]
call fcn.004337c8
mov ebx, eax
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], eax
mov esi, str.TtkMonitorWindow
mov ecx, 0x11
mov edi, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x51]
xor eax, eax
mov cl, 0xf
rep stosb byte es:[edi], al
lea edi, [esp + 0x60]
mov esi, str.TtkMonitorClass
mov cl, 4
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x70]
mov cl, 0x10
rep stosb byte es:[edi], al
mov dword [esp + 0x80], 0x30
mov dword [esp + 0x84], 3
mov dword [esp + 0x88], 0x4a8cc4
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], ebx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [esp + 0x98], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [esp + 0xac], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], 5
lea esi, [esp + 0x60]
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
lea eax, [esp + 0x80]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
push edx
test ax, ax
je 0x4a8fd0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xcf0000
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov ebx, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], 0xffffffeb
mov dword [esp], eax
call sub.USER32.dll_SetWindowLongA
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], ebx
call sub.USER32.dll_UpdateWindow
push eax
mov dword [esp + 8], 0x4a8dd4
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004915e8
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004d1c84
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.004d2bdc
xor eax, eax
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
jmp 0x4a8f97
Function at 0x4ee848
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov ecx, dword [0x67e874]
test ecx, ecx
je 0x4ee874
mov eax, dword [0x67e878]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push edx
mov ebx, eax
test eax, eax
je 0x4ee89c
mov eax, ebx
add esp, 0x18
pop ebx
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x67e878], eax
mov dword [0x67e874], 1
cmp eax, 0xffffffff
jne 0x4ee85b
mov dword [esp], str.could_not_allocate_thread_local_storage
call fcn.00508428
jmp 0x4ee856
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x4ee86a
mov dword [esp], str.TlsGetValue_failed_from_TclpGetAllocCache
call fcn.00508428
jmp 0x4ee86a

Function at 0x4ee8b4
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [0x67e878]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x4ee8d8
add esp, 0x1c
ret
mov dword [esp + 0x20], str.TlsSetValue_failed_from_TclpSetAllocCache
add esp, 0x1c
jmp fcn.00508428