joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e6fc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503745
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xc]
push eax
call fcn.00426ed3
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push 0
push eax
push ecx
mov ecx, esp
push 0x555a80
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
or dword [esp + 0x30], 0xffffffff
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8

Function at 0x49e7de
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503745
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x54e830
mov dword [esp + 0x14], eax
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push 0
push eax
push ecx
mov ecx, esp
push 0x555aa4
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
or dword [esp + 0x30], 0xffffffff
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8

Function at 0x49e8ce
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.0046f32a
and dword [esp + 0x38], 0
lea ecx, [esp + 0x14]
push eax
call fcn.00427093
push 0
mov eax, ecx
mov byte [esp + 0x3c], 1
push eax
push ecx
mov ecx, esp
push 0x555b38
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
mov byte [esp + 0x38], 0
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8
Function at 0x49ec09
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.004b7907
and dword [esp + 0x38], 0
lea ecx, [esp + 0x14]
push eax
call fcn.00427093
push 0
mov eax, ecx
mov byte [esp + 0x3c], 1
push eax
push ecx
mov ecx, esp
push 0x555a4c
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
mov byte [esp + 0x38], 0
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8

Function at 0x49ed11
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503fd1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54d894]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.004b7907
and dword [esp + 0x38], 0
lea ecx, [esp + 0x14]
push eax
call fcn.00427093
push 0
mov eax, ecx
mov byte [esp + 0x3c], 1
push eax
push ecx
mov ecx, esp
push 0x555b1c
call fcn.0042db52
mov ecx, esi
call fcn.0043ff36
mov byte [esp + 0x38], 0
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x54]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db457
mov esp, ebp
pop ebp
ret 8
Function at 0x4a121f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x504ce9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
push edi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x2c]
push eax
call fcn.0049255e
mov ecx, edi
call fcn.0049226c
lea ecx, [eax + 0x10]
mov edx, dword [ecx]
lea eax, [edi + 0x308]
push eax
lea eax, [edi + 4]
push eax
lea eax, [esp + 0x14]
push eax
call dword [edx + 0xc]
and dword [esp + 0x58], 0
lea esi, [edi + 0x30c]
movd xmm2, dword [edi + 0x18]
mov ecx, esi
cvtdq2ps xmm2, xmm2
push eax
subss xmm2, dword [0x52f2f8]
call fcn.00470ba3
or dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0046dac0
mov ecx, esi
call fcn.004709ea
cvtss2sd xmm0, xmm0
lea ecx, [esp + 0x2c]
addsd xmm0, qword [0x52f378]
movsd qword [esp + 0xc], xmm0
mov eax, dword [esp + 0xc]
add eax, 0xa
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0042503e
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x2c]
add eax, 0xffffffd2
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0042503e
mov ecx, dword [edi + 0x70]
push eax
call fcn.00491084
push 0xa
push 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
call fcn.00406980
push 0x1a
lea ecx, [edi + 0x74]
call fcn.00498eb6
mov eax, dword [edi + 0x8c]
lea ecx, [esp + 0xc]
add eax, 0x10
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004250c5
push eax
lea ecx, [edi + 0x74]
call fcn.00491084
push 0x10
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.004250c5
lea esi, [edi + 0x150]
push 0x1a
mov ecx, esi
call fcn.00498eb6
push dword [edi + 0x168]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.004250c5
push eax
mov ecx, esi
call fcn.00491084
lea esi, [edi + 0x22c]
push 0x1a
mov ecx, esi
call fcn.00498eb6
push dword [edi + 0x244]
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
call fcn.00425082
push eax
mov ecx, esi
call fcn.00491084
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ad01e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x505c59
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
push edi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [ebp + 0xc], 0
movss xmm6, dword [0x52f0e4]
movss dword [esp + 0xc], xmm6
je 0x4ad06f
cmp byte [ebp + 0x10], 0
jne 0x4ad07d
movss xmm6, dword [0x52f0b0]
jmp 0x4ad077
movss xmm6, dword [0x52f074]
movss dword [esp + 0xc], xmm6
call fcn.0049361e
movss xmm0, dword [0x52f05c]
test al, al
jne 0x4ad098
mulss xmm6, xmm0
movss dword [esp + 0xc], xmm6
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jge 0x4ad0ae
sub ecx, eax
movd xmm3, eax
movd xmm1, ecx
jmp 0x4ad0b8
sub eax, ecx
movd xmm3, ecx
movd xmm1, eax
cvtdq2ps xmm3, xmm3
push 0
sub esp, 0xc
lea ecx, [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movaps xmm5, xmm3
mulss xmm3, dword [0x52f0d8]
mulss xmm5, dword [0x52efc4]
mulss xmm1, xmm0
movaps xmm0, xmm5
movss dword [esp + 0x20], xmm3
addss xmm0, dword [0x52ef70]
addss xmm5, xmm1
movss xmm1, dword [0x52f080]
movss dword [esp + 0x28], xmm0
movss dword [esp + 8], xmm5
and dword [esp + 4], 0
push esp
movss dword [esp + 0x28], xmm5
call fcn.00444fd5
movaps xmm2, xmm6
mov ecx, eax
call fcn.00444c8d
movss xmm1, dword [0x52f0d8]
addss xmm3, xmm5
push ecx
push esp
lea ecx, [esp + 0x3c]
call fcn.00444fd5
movaps xmm2, xmm6
mov ecx, eax
call fcn.00444c8d
xorps xmm2, xmm2
lea ecx, [esp + 0x58]
call fcn.0044523e
mov edi, dword [ebp + 8]
mov ecx, edi
and dword [esp + 0x70], 0
push eax
call fcn.0044b6bf
or dword [esp + 0x70], 0xffffffff
push dword [esp + 0x58]
call fcn.004dc624
movss xmm3, dword [esp + 0x14]
mov ecx, edi
movss xmm2, dword [esp + 0x18]
movss xmm1, dword [esp + 0x1c]
movss dword [esp], xmm3
call fcn.0044bc7d
movss xmm4, dword [esp + 0x18]
lea eax, [esp + 0x28]
movss xmm5, dword [esp + 0x14]
movss xmm3, dword [esp + 0x10]
addss xmm4, dword [0x52f1b0]
addss xmm5, dword [0x52f1b0]
subss xmm3, dword [0x52f278]
movss xmm2, dword [esp + 0xc]
push ecx
mov dword [esp], 0x3f800000
lea ecx, [esi + 0xdc]
push eax
movss dword [esp + 0x20], xmm4
movss dword [esp + 0x1c], xmm5
movss dword [esp + 0x18], xmm3
call fcn.00444c8d
mov edx, eax
movaps xmm2, xmm5
movaps xmm1, xmm4
mov ecx, edi
call fcn.004b072e
pop ecx
mov ecx, esi
call fcn.0048f6a1
lea ecx, [esi + 0x100]
add esi, 0xe0
test al, al
push ecx
mov eax, esp
cmovne esi, ecx
mov dword [eax], 0x24
movss xmm1, dword [esp + 0x14]
lea eax, [esp + 0x30]
movaps xmm0, xmm1
mulss xmm1, dword [0x52f034]
push 1
mulss xmm0, dword [0x52f04c]
push ecx
movaps xmm3, xmm1
addss xmm1, dword [esp + 0x24]
addss xmm3, dword [esp + 0x20]
push ecx
movss dword [esp + 4], xmm0
mov ecx, esi
movss dword [esp], xmm0
push eax
movaps xmm2, xmm1
call fcn.00448e83
movss xmm0, dword [esp + 0xc]
mulss xmm0, dword [0x52f080]
push ecx
push esp
mov ecx, 0x54ea90
movaps xmm2, xmm0
call fcn.00444c8d
mov ecx, edi
call fcn.0044b67d
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0044ba75
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4af388
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x505e74
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edx, ecx
movd xmm0, dword [ebp + 0x18]
mov eax, dword [0x54ea8c]
cvtdq2ps xmm0, xmm0
push 0
push dword [ebp + 0x10]
movaps xmm1, xmm0
mulss xmm1, dword [0x52f0a0]
push ecx
mov ecx, esp
subss xmm0, xmm1
movss dword [esp + 0x1c], xmm1
mov dword [ecx], eax
lea ecx, [edx - 0x2c]
mov eax, dword [ecx]
lea edx, [esp + 0x28]
push edx
mulss xmm0, dword [0x52f05c]
push dword [ebp + 8]
movss dword [esp + 0x38], xmm1
movss dword [esp + 0x20], xmm0
movss dword [esp + 0x30], xmm0
movss dword [esp + 0x34], xmm0
movss dword [esp + 0x3c], xmm1
call dword [eax + 4]
movss xmm1, dword [esp + 0xc]
mulss xmm1, dword [0x52f1b0]
mov eax, dword [0x54ea90]
push ecx
mov ecx, esp
addss xmm1, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
addss xmm1, dword [0x52f1b0]
cvttss2si esi, xmm1
call fcn.0044b67d
lea ecx, [esp + 0x14]
push 1
movd xmm1, dword [ebp + 0x18]
cvtdq2ps xmm1, xmm1
mulss xmm1, dword [0x52f098]
call fcn.0046ed3c
mov ecx, dword [ebp + 8]
and dword [esp + 0x38], 0
push eax
call fcn.0044b6fe
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004037f3
push 1
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
push dword [ebp + 0x18]
mov dword [eax], 0x21
mov eax, dword [ebp + 0x14]
sub eax, esi
sub eax, 4
push eax
push 0
push esi
push dword [ebp + 0xc]
call fcn.0044b859
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4c8e01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
push edi
mov eax, dword [ecx + 0x14]
mov dword [esi], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 4], eax
mov edx, dword [ecx + 0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x80]
mov edi, dword [eax + 0x78]
test edi, edi
je 0x4c8e37
mov edi, dword [edi + 8]
jmp 0x4c8e39
mov edi, ebx
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
push ecx
push ecx
mov eax, esp
push ecx
mov ecx, edi
movdqu xmmword [esp + 0x38], xmm0
mov dword [eax], ebx
mov dword [eax + 4], edx
lea eax, [esp + 0x20]
push eax
call fcn.00490d4d
mov ecx, edi
push dword [eax + 4]
call fcn.004c7edd
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
test eax, eax
je 0x4c8f9f
push 1
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.004c99db
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4c8e91
mov eax, ebx
jmp 0x4c8e9a
push eax
add ecx, 0xc
call fcn.0041e52e
mov ecx, dword [esi + 8]
mov edi, dword [esp + 0x1c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esi + 4], edi
cmp dword [ecx + 0x14], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], eax
je 0x4c8ec0
call fcn.004c9828
test al, al
jne 0x4c8f18
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp dword [edx + 8], 0
jle 0x4c8ed1
push edx
call dword [eax + 0x44]
jmp 0x4c8ed7
push dword [ebp + 0x10]
call dword [eax + 0x4c]
test al, al
je 0x4c8f18
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [eax + edi]
cmp dword [esp + 0xc], ecx
jle 0x4c8f18
mov edx, edi
sub edx, eax
add edx, ebx
cmp dword [esp + 0xc], edx
jge 0x4c8f18
mov ecx, dword [ebp + 8]
and dword [esi + 0xc], 0
call fcn.004c887e
add eax, dword [esp + 0x18]
mov dword [esi], eax
lea eax, [edi + ebx]
mov dword [esi + 4], eax
jmp 0x4c8f9f
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, edi
cmp dword [esp + 0xc], eax
jle 0x4c8f90
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
add dword [esi + 4], eax
mov ecx, dword [esi + 8]
call fcn.004c9f23
mov edi, dword [esp + 0x18]
test al, al
je 0x4c8f8b
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4c8f8b
cmp dword [ecx + 8], 0
je 0x4c8f8b
cmp dword [esi], edi
jg 0x4c8f8b
push 1
lea eax, [esp + 0x3c]
mov dword [esi + 8], ecx
push eax
call fcn.004c99db
mov edi, dword [eax]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4c8f75
xor eax, eax
jmp 0x4c8f7e
push eax
add ecx, 0xc
call fcn.0041e52e
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 8]
call fcn.004c9f23
jmp 0x4c8f3e
inc dword [esi + 0xc]
jmp 0x4c8f94
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 8]
mov dword [esi], edi
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cc8ed
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50873e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x54d894]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esp + 0x10]
call fcn.004cc6ea
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
or dword [esp + 0x1c], 0xffffffff
mov ecx, esi
or dword [esp + 0x20], 0xffffffff
push eax
call fcn.004cc72d
and dword [esi + 0x28], 0
lea ecx, [esp + 0x18]
mov bl, al
call fcn.0042db44
lea ecx, [esp + 0xc]
call fcn.0042ff71
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d17b6
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
push 0x10
call edi
shr eax, 0xf
push 1
test al, 1
pop eax
push 0x11
cmovne esi, eax
call edi
shr eax, 0xf
test al, 1
je 0x4d17dd
or esi, 2
push 0x12
call edi
shr eax, 0xf
test al, 1
je 0x4d17eb
or esi, 4
push 0xa5
call edi
shr eax, 0xf
test al, 1
je 0x4d17fc
and esi, 0xfffffff9
mov eax, dword [0x555b68]
and eax, 0x70
or eax, esi
pop edi
mov dword [0x555b68], eax
pop esi
ret

Function at 0x4d180e
Capabilities:
Log keystrokes via polling

Disassembly:
xor edx, edx
test cl, 1
push 0x10
pop eax
cmovne edx, eax
test cl, 2
je 0x4d1821
or edx, 0x20
test cl, 0x10
je 0x4d1829
or edx, 0x40
mov eax, dword [0x555b68]
and eax, 0xffffff8f
or eax, edx
mov dword [0x555b68], eax
jmp fcn.004d17b6
Function at 0x4d30d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x54d894]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x134], esi
call fcn.004d17b6
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, 0x5d
ja 0x4d31d6
cmp ebx, 0x5b
jae 0x4d3207
cmp ebx, 0x10
jb 0x4d3145
cmp ebx, 0x12
jbe 0x4d3207
cmp ebx, 0x14
je 0x4d3207
cmp ebx, 0x20
jbe 0x4d3145
cmp ebx, 0x28
jbe 0x4d3226
cmp ebx, 0x2c
jbe 0x4d3145
cmp ebx, 0x2e
jbe 0x4d3226
push 1
mov ecx, esi
call fcn.004cbfef
push edi
push 0x103
push 0x102
push dword [esi + 0x38]
mov byte [ebp - 0x12d], al
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4d3293
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push ebx
call esi
push edi
push ebx
mov dword [ebp - 0x138], eax
call esi
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x26]
mov word [ebp - 0x28], ax
rep stosd dword es:[edi], eax
push 0
push 8
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x12c]
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
je 0x4d3266
xor eax, eax
mov word [ebp - 0x28], ax
jmp 0x4d326a
cmp ebx, 0x70
jb 0x4d3145
cmp ebx, 0x7f
jbe 0x4d3226
cmp ebx, 0x8f
jbe 0x4d3145
cmp ebx, 0x91
jbe 0x4d3207
lea eax, [ebx - 0xa0]
cmp eax, 5
ja 0x4d3145
mov eax, dword [0x555b68]
cmp dword [0x555a88], eax
je 0x4d329d
mov ecx, esi
mov dword [0x555a88], eax
call fcn.004cc0b8
jmp 0x4d329d
push 1
mov ecx, esi
call fcn.004cbfef
push edi
or ebx, 0x10000
mov byte [ebp - 0x12d], al
push ebx
mov ecx, esi
call fcn.004cbe86
test al, al
jne 0x4d3250
cmp byte [ebp - 0x12d], al
je 0x4d329d
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004db457
mov esp, ebp
pop ebp
ret 4
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp - 0x134]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x138]
movzx eax, ax
push eax
call fcn.004cbe86
test al, al
jne 0x4d328f
cmp byte [ebp - 0x12d], al
je 0x4d329d
mov al, 1
jmp 0x4d3299
mov al, byte [ebp - 0x12d]
test al, al
jne 0x4d3250
call fcn.0049197b
test eax, eax
jne 0x4d3250
jmp 0x4d3253

Function at 0x4d32a8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov dword [ebp - 4], ecx
call fcn.004d17b6
mov edi, dword [ebp + 8]
mov ebx, edi
mov edx, dword [ebp + 0xc]
sar edx, 0x10
and edx, 0xff
lea eax, [edi - 0x30]
cmp eax, 9
ja 0x4d32f4
cmp edx, 0x47
jl 0x4d3320
cmp edx, 0x49
jle 0x4d32ec
cmp edx, 0x4a
jle 0x4d3320
cmp edx, 0x4d
jle 0x4d32ec
lea eax, [edx - 0x4f]
cmp eax, 3
ja 0x4d3320
add edi, 0x10030
jmp 0x4d3320
push 1
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
test eax, eax
cmovne edi, eax
cmp ebx, 0x20
jae 0x4d3320
test byte [0x555b68], 6
push 0
pop eax
cmovne ebx, eax
mov ecx, dword [ebp - 4]
push ebx
push edi
call fcn.004cbe86
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d430f
Capabilities:
Log keystrokes via input method manager

Disassembly:
push 8
mov eax, 0x508f13
call fcn.004e2dc9
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov edi, eax
test edi, edi
jle 0x4d4377
push esi
mov dword [ebp - 4], esi
call fcn.004dc624
mov eax, edi
shr eax, 1
inc eax
push 2
push eax
call fcn.004dcc29
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x14], esi
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [eax], esi
call fcn.0043d896
push esi
call fcn.004dc624
pop ecx
pop ecx
jmp 0x4d4384
mov ecx, dword [ebp + 8]
push 0x54e85c
call fcn.0042db52
mov eax, dword [ebp + 8]
call fcn.004e2d97
ret 0xc

Function at 0x4d438f
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test byte [ebp + 0x10], 0x10
mov esi, edi
je 0x4d4409
push ebx
push edi
push edi
push 0x10
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ebx, eax
test ebx, ebx
jle 0x4d4408
push ebx
call fcn.004dc65c
pop ecx
push ebx
mov esi, eax
push esi
push 0x10
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test ebx, ebx
jle 0x4d43e0
mov al, byte [esi + edi]
cmp al, 1
je 0x4d43e0
cmp al, 3
je 0x4d43e0
inc edi
cmp edi, ebx
jl 0x4d43d0
mov dword [ebp + 0xc], edi
mov eax, edi
cmp edi, ebx
jge 0x4d43fe
mov cl, byte [esi + eax]
cmp cl, 1
je 0x4d43f6
cmp cl, 3
jne 0x4d43fb
inc eax
cmp eax, ebx
jl 0x4d43e9
mov dword [ebp + 0xc], eax
push esi
call fcn.004dc624
mov esi, dword [ebp + 0xc]
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
cmp edi, esi
mov eax, dword [ebp + 8]
mov edx, edi
cmovl edx, esi
mov ecx, dword [ecx]
add edx, ecx
add ecx, edi
cmp ecx, edx
mov dword [eax], ecx
pop edi
cmovl ecx, edx
mov dword [eax + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d4483
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
test ebx, ebx
je 0x4d4578
test byte [ebp + 0x10], 0x20
je 0x4d4578
push eax
push eax
push 0x20
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov dword [ebp + 0x10], eax
test eax, eax
jle 0x4d4578
shr eax, 2
mov dword [ebp + 0xc], eax
shl eax, 2
push eax
call fcn.004dc65c
pop ecx
push dword [ebp + 0x10]
mov esi, eax
push esi
push 0x20
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jle 0x4d4571
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], ebx
jbe 0x4d4571
mov ecx, esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
lea eax, [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp + 0xc], eax
mov eax, ecx
mov edi, dword [ebp + 0xc]
cmp ecx, dword [edi]
cmovl eax, dword [edi]
mov edi, dword [ebp + 8]
add eax, edx
add edx, ecx
cmp edx, eax
mov dword [ebp + 0x10], edx
mov ecx, edx
cmovl ecx, eax
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 8]
inc ecx
cmp ecx, dword [edi + 4]
jle 0x4d454c
mov eax, ecx
add ecx, 8
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov ecx, edi
and eax, 0xfffffff8
push eax
call fcn.00412c22
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi + 8]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov eax, dword [edi]
lea eax, [eax + ecx*8]
test eax, eax
je 0x4d4566
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
inc ebx
cmp ebx, esi
jb 0x4d44fe
mov esi, dword [ebp - 0xc]
push esi
call fcn.004dc624
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d473d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.004d17b6
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
push 1
call ebx
shr eax, 0xf
push 0x10
test al, 1
pop eax
push 2
cmovne esi, eax
call ebx
shr eax, 0xf
test al, 1
je 0x4d476c
or esi, 0x20
push 4
call ebx
shr eax, 0xf
test al, 1
je 0x4d477a
or esi, 0x40
mov eax, dword [0x555b68]
and eax, 0xffffff8f
or eax, esi
mov dword [edi], eax
mov dword [0x555b68], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret