joyce8/EMBER2024-capa huggingface dataset:
Function at 0x516ce0
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
mov eax, edi
and edx, 1
shl edx, 4
mov esi, edx
or esi, 0x400
and al, 2
mov eax, edi
cmove esi, edx
mov ecx, esi
or ecx, 0x100
and al, 4
mov eax, edi
cmove ecx, esi
mov edx, ecx
or edx, 0x200
and al, 8
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000000
and al, 0x10
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and al, 0x20
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x8000
and al, 0x40
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x400000
and al, 0x80
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x10000
and eax, 0x100
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 8
and eax, 0x200
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x20000000
and eax, 0x400
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x40
and eax, 0x800
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 2
and eax, 0x1000
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 4
and eax, 0x2000
cmove edx, ecx
mov eax, edx
or eax, 1
and edi, 0x4000
pop edi
cmove eax, edx
pop esi
ret

Function at 0x517390
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59815c
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
push esi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x61a268], 1
jne 0x517416
cmp dword [0x61a250], 3
jg 0x517416
mov eax, dword [esi + 4]
cmp dword [eax + 0x84], ebx
jne 0x517416
push 3
push 0x1d
push str.f:my_lab_tabexplorerextab_masterlibrary_viewcontrols_native_native_view_host_win.cpp
lea ecx, [ebp - 0xc0]
call fcn.0046c100
mov dword [ebp - 4], ebx
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_host___native_view__.
mov dword [ebp - 0x10], ebx
call fcn.00403840
mov edx, str.Impossible_detatched_tab_case__See_crbug.com_6316
mov ecx, eax
call fcn.00403840
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x51742d
lea ecx, [ebp - 0xc0]
call fcn.0046c520
mov eax, dword [esi + 4]
push 0
push dword [eax + 0x84]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [esi + 4]
mov edx, eax
mov ecx, dword [ecx + 0x84]
call fcn.00509c40
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x517520
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x84]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x517558
mov eax, dword [esi + 4]
push 0
push dword [eax + 0x84]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push dword [eax + 0x84]
call dword [sym.imp.USER32.dll_SetParent]
pop esi
ret
Function at 0x520c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aca28
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x60f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0047da10
cmp dword [eax], 3
jl 0x520d97
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 4
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
push eax
push 0
push str.EnableLUA
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x520d52
mov eax, dword [ebp - 0x34]
cmp eax, 4
je 0x520d15
cmp eax, 3
jne 0x520d52
cmp dword [ebp - 0x38], 4
jne 0x520d52
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
setne bl
test eax, eax
je 0x520d3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x520d4c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x520d97
jmp 0x520d7c
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x520d6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x520d7c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 4]
movzx eax, byte [eax + 0xf5]
push eax
push 0
push 0x160c
push dword [esi - 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x28]
add eax, 0xdc
push eax
call fcn.00405a50
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [esi - 0x2c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x28]
call fcn.00405c10
mov byte [esi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550156
mov esp, ebp
pop ebp
ret
Function at 0x521ff0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acbe0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0
push 0
push 0xe
push dword [ebx - 0x20]
mov dword [ebp - 0x44], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea edi, [eax + 1]
xor eax, eax
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.00471750
mov eax, dword [ebp - 0x18]
lea ecx, [edi - 1]
cmp ecx, eax
ja 0x522075
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x522082
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00472d40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebx - 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00405a50
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x5220bf
push eax
mov ecx, esi
call fcn.00405a50
jmp 0x522150
mov ebx, dword [ebp - 0x2c]
xor edi, edi
cmp ebx, 8
mov ecx, 0x202a
cmovae eax, dword [ebp - 0x40]
movzx eax, word [eax]
cmp ax, cx
je 0x5220f6
mov ecx, 0x202b
cmp ax, cx
je 0x5220f6
mov ecx, 0x202d
cmp ax, cx
je 0x5220f6
mov ecx, 0x202e
cmp ax, cx
jne 0x5220fb
mov edi, 1
cmp ebx, 8
lea eax, [ebp - 0x40]
mov ebx, 0x202c
lea ecx, [edx - 1]
cmovae eax, dword [ebp - 0x40]
cmp word [eax + ecx*2], bx
mov ebx, dword [ebp - 0x2c]
jne 0x522119
lea ecx, [edx - 2]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
cmp edx, edi
jb 0x522180
sub ecx, edi
lea eax, [ebp - 0x40]
inc ecx
sub edx, edi
cmp edx, ecx
cmovb ecx, edx
cmp ebx, 8
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [eax + edi*2]
push ecx
mov ecx, esi
call fcn.00405c70
lea ecx, [ebp - 0x40]
call fcn.00405c10
lea ecx, [ebp - 0x28]
call fcn.00405c10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550156
mov esp, ebp
pop ebp
ret 4
call fcn.0040b610
int3
Function at 0x5232f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
lea eax, [esi + 0x44]
push edi
mov dword [eax + 0x10], 0
jb 0x52330f
mov eax, dword [eax]
push dword [ebp + 0x10]
xor ecx, ecx
push dword [ebp + 0xc]
mov word [eax], cx
push dword [ebp + 8]
push dword [esi + 4]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp byte [esi + 0x7c], 0
mov dword [esp + 0xc], eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
je 0x5233ae
push dword [esi + 4]
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov edi, eax
test edi, edi
je 0x5233ae
lea eax, [esp + 0x10]
push eax
push 0
push 0x434
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x80
push edi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
js 0x52338b
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov dword [esi + 0x80], ecx
push 0
push 0
push 8
push edi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
js 0x5233a4
shr eax, 1
mov dword [esi + 0x84], eax
push edi
push dword [esi + 4]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
push 0
mov ecx, esi
call fcn.00523ff0
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5233d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acdd0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov di, word [ebp + 8]
movzx eax, di
add eax, 0xfffffff3
cmp eax, 0xd8
ja case.0x52341f.18
movzx eax, byte [eax + 0x5235c0]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0x10]
jmp dword [eax*4 + 0x5235a8]
test ecx, 0x2000
jne case.0x52341f.18
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
cmp di, 0x58
sete al
add eax, 0x10
push eax
call ebx
test ax, ax
jns case.0x52341f.18
xor eax, eax
cmp di, 0x58
setne al
add eax, 0x10
push eax
call ebx
test ax, ax
js case.0x52341f.13
mov ecx, esi
call fcn.00524390
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00521a00
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00523f80
push 0
push 0
push 0x300
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, esi
call fcn.00523ff0
lea ecx, [ebp - 0x14]
call fcn.00521a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ecx, 0x2000
jne case.0x52341f.18
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jns case.0x52341f.18
push 0x10
call edi
test ax, ax
js case.0x52341f.13
push 0
push 0
push 0x301
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ecx, 0x2000
jne case.0x52341f.18
push 0x10
call ebx
test ax, ax
js 0x52352a
push 0x11
call ebx
test ax, ax
jns case.0x52341f.13
mov ecx, dword [ebp + 0x10]
test ecx, 0x2000
jne case.0x52341f.18
xor eax, eax
cmp di, 0x56
sete al
add eax, 0x10
push eax
call ebx
test ax, ax
jns case.0x52341f.18
xor eax, eax
cmp di, 0x56
setne al
add eax, 0x10
push eax
call ebx
test ax, ax
js case.0x52341f.13
mov ecx, esi
call fcn.00524390
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00521a00
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00523f80
push 0
push 0
push 0x302
jmp 0x523490
mov ecx, esi
call fcn.00523e10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x523e10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aceb8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x10], eax
call fcn.00524390
mov esi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
test esi, esi
je 0x523e5d
mov ecx, dword [esi]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [ecx + 0x48]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x523eb3
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x5c]
sub esp, 0x1c
mov edx, esp
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [edx + 0x10], xmm0
mov dword [edx + 0x18], eax
call fcn.0050c790
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x5c]
push edx
push dword [edi + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x523f40
mov ecx, edi
call fcn.00523f80
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
cmp ecx, 0x24
je 0x523edf
cmp ecx, 0x23
je 0x523edf
push dword [eax + 0xc]
push ecx
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x523f0d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
push 8
push esi
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov esi, dword [ebp - 0x18]
push 0
push 0
push 0x479
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 1
je 0x523f37
and eax, 0xfffffffe
push eax
push 0
push 0x478
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, edi
call fcn.00523ff0
mov dword [ebp - 4], 1
test esi, esi
je 0x523f64
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [eax + 0x4c]
cmp dword [ebp - 0x18], 0
jne 0x523f64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x525a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
cmp eax, 0x205
jne 0x525b93
cmp byte [ebx + 0x13c], 0
je 0x525c2b
mov byte [ebx + 0x13c], 0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp + 0x10]
lea esi, [ebx + 0x1c]
movsx eax, cx
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 0x10
mov ecx, esi
cwde
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [esi]
push 0
mov dword [esp + 0x18], esi
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esi]
push ecx
push 0
push 0x84
mov ecx, esi
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 2
je 0x525b0d
cmp edi, 3
jne 0x525c2e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
and eax, 0x3ff
dec eax
cmp eax, 0x5f
ja case.0x525b25.2
movzx eax, byte [eax + 0x525c50]
jmp dword [eax*4 + 0x525c48]
mov ebx, 0x10a
jmp 0x525b38
mov ebx, 0x102
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov edi, dword [esp + 0xc]
mov esi, eax
push 0
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0x28]
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebx
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
test eax, eax
je 0x525c3c
push 0
push eax
mov eax, dword [edi]
mov ecx, edi
push 0x112
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 0xa1
jne 0x525c05
mov eax, dword [ebx + 0xfc]
lea ecx, [ebx + 0xfc]
call dword [eax + 8]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x525bbb
cmp ecx, 2
sete al
jmp 0x525bcb
mov ecx, dword [eax + 0x98]
mov eax, dword [ecx]
mov eax, dword [eax + 0x88]
call eax
test al, al
jne 0x525c2b
mov edi, dword [ebp + 0xc]
cmp edi, 8
jb 0x525c2e
cmp edi, 9
jbe 0x525be1
cmp edi, 0x14
jne 0x525c2e
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
and eax, 0x80
shr eax, 4
push 0x10
or edi, eax
call esi
and eax, 0x80
shr eax, 5
or edi, eax
jmp 0x525c2e
cmp eax, 0xa4
jne 0x525c2b
mov edi, dword [ebp + 0xc]
cmp edi, 2
je 0x525c19
cmp edi, 3
jne 0x525c2e
mov eax, dword [ebx + 0x1c]
lea ecx, [ebx + 0x1c]
mov byte [ebx + 0x13c], 1
call dword [eax + 0x54]
jmp 0x525c2e
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, ebx
push edi
push dword [ebp + 8]
call fcn.005077e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x526780
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab228
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x60f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x1c]
mov eax, dword [eax + 0xf0]
call eax
mov ebx, dword [ebp + 8]
mov esi, ebx
and esi, 0xfff0
test al, al
je 0x5267eb
cmp esi, 0xf000
je 0x52695b
cmp esi, 0xf010
je 0x52695b
cmp esi, 0xf030
je 0x52695b
mov eax, dword [edi + 0xfc]
lea ecx, [edi + 0xfc]
mov dword [ebp - 0x10], ecx
call dword [eax + 8]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x52680f
cmp ecx, 2
sete al
jmp 0x52681f
mov ecx, dword [eax + 0x98]
mov eax, dword [ecx]
mov eax, dword [eax + 0x88]
call eax
test al, al
jne 0x52688f
cmp esi, 0xf020
je 0x52686c
cmp esi, 0xf030
je 0x52686c
cmp esi, 0xf120
je 0x52686c
cmp esi, 0xf010
je 0x52684b
cmp esi, 0xf000
jne 0x52688f
cmp byte [edi + 0x125], 0
je 0x52688f
push dword [edi + 0x128]
mov ecx, edi
push 0xfffffffffffffff0
call fcn.00503c60
mov byte [edi + 0x125], 0
jmp 0x52688f
mov eax, dword [edi + 0xfc]
lea ecx, [edi + 0xfc]
call dword [eax + 8]
mov eax, dword [eax + 0xa0]
mov ecx, dword [eax + 0x88]
mov eax, dword [ecx]
call dword [eax + 0x1a4]
cmp esi, 0xf100
jne 0x526926
cmp dword [ebp + 0xc], 0
jne 0x526926
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
movzx ebx, ax
push 0x10
shr ebx, 0xf
call esi
shr eax, 0xf
mov ecx, 2
and al, 1
mov dword [ebp - 0x1c], vtable.view::Accelerator.0
mov eax, 0
mov dword [ebp - 0x18], 0x12
cmovne eax, ecx
mov dword [ebp - 0x14], eax
and bl, 1
je 0x5268e7
or eax, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x98]
mov ecx, eax
call fcn.004e2dd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x100]
push ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test al, al
jne 0x52695b
movzx edx, word [ebp + 0x10]
lea ecx, [edi + 0x1c]
movzx eax, word [ebp + 0xc]
shl edx, 0x10
or edx, eax
mov eax, dword [ecx]
push edx
push ebx
push 0x112
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52c4b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
push 0x10
mov esi, ecx
call fcn.00550175
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
mov dword [edi], vtable.._AV__RunnableMethod_VInitialTimer_AeroTooltipManager_view__P8123_AEXXZUTuple0____.0
mov dword [edi + 4], esi
mov dword [edi + 8], 0x52c510
inc dword [esi]
call fcn.0046fec0
mov ecx, eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.0046e2e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x531610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5adc70
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x60f074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0x4c]
mov edi, dword [ebp + 8]
push ecx
mov ecx, ebx
mov dword [ebp - 0x2c], edi
call dword [eax + 0x18]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebx + 0x30]
sub eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x4c]
sub eax, ecx
mov edx, dword [ebx + 0x2c]
sub edx, dword [ebp - 0x40]
mov esi, dword [edi]
push eax
mov eax, dword [ebp - 0x48]
sub edx, eax
push edx
push ecx
push eax
mov ecx, edi
call dword [esi + 0x14]
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x30]
sub eax, dword [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebx + 0x84]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
mov dword [ebp - 0x3c], 0xff000000
call dword [eax + 0xc]
mov esi, eax
test esi, esi
js 0x5316ba
mov ecx, dword [ebx + 0x8c]
mov ecx, dword [ecx + 0x88]
mov edx, dword [ecx]
call dword [edx + 4]
cmp esi, eax
jle 0x5316bc
xor esi, esi
mov eax, dword [ebx + 0x8c]
lea edx, [ebp - 0x28]
push esi
push edx
mov ecx, dword [eax + 0x88]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 0
call fcn.004e43c0
mov edi, eax
mov esi, dword [edi]
push esi
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004e4840
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [edi + 0x20]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x3c]
push dword [ebp - 0x30]
mov edx, dword [ecx]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
call dword [edx + 0x54]
push dword [ebx + 0x2c]
mov esi, dword [ebx + 0x30]
lea ecx, [ebp - 0x58]
call fcn.004d63a0
mov ebx, dword [ebp - 0x58]
xor eax, eax
test esi, esi
push 7
cmovns eax, esi
mov dword [ebp - 0x30], eax
lea esi, [ebx - 0xb]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
push 4
lea ecx, [edi - 9]
push ecx
push esi
push dword [ebp - 0x2c]
call fcn.005314b0
push 0xfffffffffffffff9
push 0xfffffffffffffffc
lea eax, [edi + 9]
mov edi, dword [ebp - 0x2c]
push eax
push esi
push edi
call fcn.005314b0
mov eax, dword [ebp - 0x30]
lea edx, [ebx - 0x15]
mov esi, dword [edi]
add eax, 0xfffffffc
push eax
push edx
push 4
push edx
push 0x5c56d8
mov ecx, edi
call dword [esi + 0x38]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
lea ecx, [ebp - 0x28]
call fcn.00405c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550156
mov esp, ebp
pop ebp
ret 4
Function at 0x533fc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x534038
call fcn.00533390
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0xc], eax
test eax, eax
je 0x534033
mov ecx, dword [esi + 4]
xor ebx, ebx
sub ecx, dword [esi]
sar ecx, 4
test ecx, ecx
je 0x534033
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [esi]
mov ecx, dword [edi + ecx + 0xc]
call fcn.00533e30
mov ecx, dword [esi]
lea eax, [ecx + 8]
add eax, edi
push eax
push dword [ecx + edi + 4]
push dword [ecx + edi]
mov ecx, dword [esp + 0x18]
call fcn.00532d10
mov eax, dword [esi + 4]
inc ebx
sub eax, dword [esi]
add edi, 0x10
sar eax, 4
cmp ebx, eax
jb 0x534000
mov eax, dword [esi]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret