joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472d56
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x472db9
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x472db2
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret

Function at 0x472dbd
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4cfce8]
push esi
push 1
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x472e11
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x472e11
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x472e0b
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x472e0b
push eax
lea ecx, [ebp - 4]
call fcn.00402e2b
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 8]
cmp dword [ecx - 0xc], 0
lea eax, [ecx - 0xc]
jl 0x472e2b
push eax
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x472e3a
mov eax, dword [0x4cfce8]
push ecx
mov ecx, esi
mov dword [esi], eax
call fcn.00402e2b
lea ecx, [ebp - 4]
call fcn.004010b4
mov eax, esi
pop esi
leave
ret
Function at 0x47ac23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8100
call fcn.004c5de0
mov eax, dword [0x4cfce8]
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 0xc], ebx
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
je 0x47ad76
lea eax, [ebp - 0x8100]
mov esi, 0x80e8
push eax
push esi
mov byte [ebp - 0x8100], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x8100]
test eax, eax
je 0x47ac7b
lea eax, [ebp - 0x8100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x8100]
push ecx
push eax
lea ecx, [edi + 0x790]
call fcn.00402d62
lea eax, [ebp - 0x8100]
push esi
push eax
push str._WINDIR_
mov byte [ebp - 0x8100], bl
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x8100], bl
je 0x47acc7
lea eax, [ebp - 0x8100]
lea ecx, [ebp - 0xc]
push eax
mov dword [ebp - 4], 1
call fcn.00402d0c
jmp 0x47acdc
lea eax, [ebp + 0xc]
mov ecx, 0x4d8e00
push eax
mov dword [ebp - 4], 2
call fcn.004127ba
push eax
lea ecx, [ebp - 8]
call fcn.00402dbe
test byte [ebp - 4], 2
je 0x47acf7
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp + 0xc]
call fcn.004010b4
test byte [ebp - 4], 1
je 0x47ad05
lea ecx, [ebp - 0xc]
call fcn.004010b4
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x47ad85
cmp dword [edi + 0x30], ebx
je 0x47ad85
cmp dword [edi + 0x684], ebx
je 0x47ad85
test byte [edi + 0x620], 4
jne 0x47ad2e
mov ecx, dword [esi + 0x48]
call fcn.004c62ba
test eax, eax
je 0x47ad85
push 1
push 0x7f02
push 1
lea ecx, [ebp - 0x18]
call fcn.00402bd9
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
call dword [eax + 8]
push ebx
push dword [eax]
mov eax, dword [edi + 0x30]
push 0x803b
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp + 0xc]
call fcn.004010b4
cmp byte [ebp - 0x10], bl
je 0x47ad85
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x47ad85
add edi, 0x790
lea ecx, [ebp - 8]
push edi
call fcn.00402dbe
mov eax, dword [ebp - 8]
cmp dword [eax - 8], ebx
jne 0x47ad91
xor esi, esi
jmp 0x47ada0
push eax
call dword [sym.imp.MSVCRT.dll__chdir]
mov esi, eax
pop ecx
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 8]
call fcn.004010b4
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47ae6f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov esi, ecx
jne 0x47ae88
xor eax, eax
jmp 0x47af7d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x70]
and eax, 0x8000
cmp dword [ecx - 8], edi
je 0x47aebd
test byte [esi + 0x620], 1
jne 0x47aebd
cmp dword [ebp + 0xc], edi
mov dword [ebp - 0xc], 1
je 0x47aec3
xor ecx, ecx
cmp eax, edi
sete cl
mov eax, ecx
jmp 0x47aec3
push 1
mov dword [ebp - 0xc], edi
pop eax
xor ebx, ebx
cmp eax, edi
je 0x47af63
cmp dword [ebp + 0xc], edi
lea eax, [esi + 0x68]
jne 0x47aed8
lea eax, [esi + 0x6c]
push eax
lea ecx, [ebp - 8]
call fcn.00402c35
mov eax, dword [ebp - 8]
cmp dword [eax - 8], edi
jne 0x47af03
cmp dword [ebp - 0xc], edi
jne 0x47aefe
push str.notepad
lea ecx, [ebp - 8]
call fcn.00402e2b
mov eax, dword [ebp - 8]
cmp dword [eax - 8], edi
je 0x47af5b
push dword [ebp + 8]
mov ecx, dword [0x4cfce8]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 4]
push str._1___2_
push eax
call fcn.0047af84
add esp, 0x10
lea ecx, [ebp - 4]
push edi
call fcn.0040303d
push eax
call fcn.004710a5
pop ecx
mov ebx, eax
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.004030a4
cmp ebx, edi
lea ecx, [ebp - 4]
je 0x47af56
call fcn.004010b4
lea ecx, [ebp - 8]
call fcn.004010b4
push 1
pop eax
jmp 0x47af7d
call fcn.004010b4
lea ecx, [ebp - 8]
call fcn.004010b4
cmp dword [ebp - 0xc], edi
je 0x47af7b
push edi
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047afd4
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x47f208
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x47f238
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
jne 0x47f23f
xor eax, eax
jmp 0x47f301
push esi
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x47f2fe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x47f2f5
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x47f2f5
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x47f2ec
mov ecx, edi
mov edi, eax
mov eax, ecx
mov dword [ebp + 0x10], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebp + 0x10], ebx
je 0x47f2e3
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push dword [ebp + 0x10]
call fcn.0046bb57
cmp eax, ebx
jne 0x47f2d2
lea eax, [ebp - 4]
push 0xffffff
push eax
push dword [ebp + 0xc]
call fcn.0046bad5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp + 0xc]
call fcn.0046ba1f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x47fa48
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
je 0x47fae9
mov di, word [esp + 0x10]
cmp di, 0x82d1
jne 0x47fa73
cmp byte [esi + 0xb8], 0
jne 0x47fa73
call fcn.0047fdd6
cmp dword [esi + 0x88], 0
je 0x47fae9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x47faae
cmp di, 0x82d1
jne 0x47fa94
fld1
jmp 0x47fa9a
fld dword [esi + 0xcc]
push 1
add esi, 0x20
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.00481a97
mov ecx, esi
jmp 0x47fae4
cmp di, 0x82d1
jne 0x47fabd
fld dword [0x4c9048]
jmp 0x47fac3
fld dword [0x4c9044]
fld dword [esi + 0x78]
fld st(1)
fadd dword [0x4c9040]
push 1
push ecx
fmulp st(1)
lea edi, [esi + 0x20]
mov ecx, edi
fstp dword [esp]
fstp st(0)
call fcn.00481a97
mov ecx, edi
call fcn.00481d21
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x47faf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0xbc], 0
je 0x47fc3e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x47fc3e
cmp edi, 0x6b
jne 0x47fb4d
cmp byte [esi + 0xb8], 0
jne 0x47fb30
mov ecx, esi
call fcn.0047fdd6
cmp dword [esi + 0x88], 0
je 0x47fceb
fld dword [esi + 0x78]
fmul dword [0x4c9050]
lea edi, [esi + 0x20]
push 1
jmp 0x47fb9e
cmp edi, 0x43
jne 0x47fb5e
mov ecx, esi
call fcn.0047fcf3
jmp 0x47fceb
cmp edi, 0x26
je 0x47fc13
cmp edi, 0x28
je 0x47fc13
cmp edi, 0x25
je 0x47fbb5
cmp edi, 0x27
je 0x47fbb5
cmp dword [esi + 0x88], 0
je 0x47fc3e
cmp edi, 0x6d
jne 0x47fc3e
fld dword [esi + 0x78]
fmul dword [0x4c904c]
lea edi, [esi + 0x20]
push 1
push ecx
mov ecx, edi
fstp dword [esp]
call fcn.00481a97
mov ecx, edi
call fcn.00481d21
jmp 0x47fceb
cmp dword [0x4d8f54], 0
je 0x47fceb
push 1
push 0x7f02
push 1
lea ecx, [ebp - 0xc]
call fcn.00402bd9
mov eax, dword [esi + 0xbc]
cmp edi, 0x25
sete cl
push ecx
push eax
call fcn.0047f475
pop ecx
test eax, eax
pop ecx
je 0x47fbfb
mov cl, byte [esi + 0xb8]
push ecx
push eax
mov ecx, esi
call fcn.0047f751
cmp byte [ebp - 4], 0
je 0x47fceb
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x47fceb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
xor ecx, ecx
cmp edi, 0x26
sete cl
add ecx, 0x8106
push 0
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x47fceb
cmp edi, 0x25
ja 0x47fcbc
je 0x47fcb2
sub edi, 9
je 0x47fc97
sub edi, 0x12
je 0x47fc6e
sub edi, 6
je 0x47fc64
dec edi
jne 0x47fcc7
lea ecx, [esi + 0x20]
call fcn.00481dae
jmp 0x47fceb
lea ecx, [esi + 0x20]
call fcn.00481dd1
jmp 0x47fceb
fld dword [esi + 0x78]
lea ecx, [esi + 0xcc]
fcomp dword [ecx]
fnstsw ax
sahf
je 0x47fc97
fld dword [ecx]
push 1
add esi, 0x20
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.00481a97
mov ecx, esi
jmp 0x47fbab
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x8019
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x47fceb
lea ecx, [esi + 0x20]
call fcn.00481e14
jmp 0x47fceb
sub edi, 0x26
je 0x47fce3
dec edi
je 0x47fcd9
dec edi
je 0x47fccf
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x47fceb
lea ecx, [esi + 0x20]
call fcn.00481d68
jmp 0x47fceb
lea ecx, [esi + 0x20]
call fcn.00481df4
jmp 0x47fceb
lea ecx, [esi + 0x20]
call fcn.00481d8b
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x47fcf3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0xbc], esi
je 0x47fd0e
push dword [edi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47fd12
xor eax, eax
jmp 0x47fd48
mov edi, dword [edi + 0xbc]
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.USER32.dll_CopyImage]
mov edi, eax
cmp edi, esi
je 0x47fd40
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
ret
Function at 0x47fe53
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0xb8], 0
jne 0x47fe6b
call fcn.0047fdd6
cmp dword [esi + 0x88], 3
jne 0x47ff34
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x20]
movsx edi, ax
shr eax, 0x10
movsx ebx, ax
push ebx
push edi
mov dword [ebp + 0x10], ecx
call fcn.00481cde
test eax, eax
je 0x47ff3a
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
mov dword [ebp - 4], ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x300000
je 0x47ff02
push dword [ebp - 4]
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DragDetect]
test eax, eax
je 0x47ff02
push dword [esi + 4]
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], ebx
mov byte [esi + 0xae], 1
call dword [sym.imp.USER32.dll_SetCapture]
mov esi, dword [esi + 0xd0]
test esi, esi
je 0x47ff3a
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x47ff3a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x47ff13
fld1
jmp 0x47ff1c
fld dword [esi + 0x78]
fmul dword [0x4c9050]
push ecx
mov ecx, dword [ebp + 0x10]
fstp dword [esp]
push ebx
push edi
call fcn.00481a0c
mov ecx, dword [ebp + 0x10]
call fcn.00481d21
jmp 0x47ff3a
mov eax, dword [ebp + 0x14]
and dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x47ff43
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, ecx
push eax
push dword [esi + 0xd0]
call edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call ebx
test eax, eax
jne 0x47ffdb
push 0xffffffffffffffec
push dword [esi + 0xd0]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x80000
je 0x47ffa7
push 2
push 0x7f
push 0
push dword [esi + 0xd0]
call dword [0x4cf530]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47ffcd
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call ebx
test eax, eax
jne 0x47ffdb
push 0
push dword [esi + 0xd0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x14]
and byte [esi + 0xfc], 0
pop edi
pop esi
and dword [eax], 0
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x48ab48
Capabilities:
Check internet connectivity via wininet
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
add ecx, 0xffffffcc
push edi
neg esi
sbb esi, esi
xor edi, edi
and esi, ecx
cmp word [ebp + 0xc], 0x80fe
je 0x48ab97
lea eax, [ebp - 8]
push edi
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x48ab97
mov eax, dword [0x4e9e94]
mov ecx, dword fs:[0x2c]
push 0x27c8
push 0x30
mov eax, dword [ecx + eax*4]
push dword [eax + 4]
call fcn.0047a0bd
add esp, 0xc
mov eax, dword [0x4cfce8]
cmp word [ebp + 0xc], 0x8088
mov dword [ebp - 4], eax
jne 0x48abe1
push edi
push 2
lea eax, [ebp - 8]
push edi
push eax
mov ecx, 0x4d8e00
call fcn.0040f8d3
push dword [eax]
lea eax, [ebp - 4]
push str.http:__zabkat.com_chkupd.php_v_sp_dx64_d
push eax
call fcn.00404f20
add esp, 0x14
lea ecx, [ebp - 8]
call fcn.004010b4
push 0x4d95a8
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x48ac2f
cmp dword [eax - 8], edi
jne 0x48ac15
movzx eax, word [ebp + 0xc]
lea ecx, [ebp - 8]
push dword [eax*4 + 0x4b5fd4]
call fcn.00402d0c
push dword [ebp - 8]
lea eax, [ebp - 4]
push str.http:__zabkat.com__s.htm
push eax
call fcn.00404f20
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.004010b4
cmp word [ebp + 0xc], 0x80fe
jne 0x48ac2f
push str..php_i1
push str..htm
lea ecx, [ebp - 4]
call fcn.004033b6
push 1
push edi
push edi
push dword [ebp - 4]
push edi
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp word [ebp + 0xc], 0x80fe
jne 0x48ac5c
push edi
push 0xe141
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp - 4]
call fcn.004010b4
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x48b9d2
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
jne 0x48ba0d
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [ebp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
cmp edi, 0x21
mov esi, eax
jb 0x48ba0d
cmp edi, 0x28
jbe 0x48ba07
cmp edi, 0x2c
jbe 0x48ba0d
cmp edi, 0x2e
ja 0x48ba0d
or esi, 0x100
mov eax, dword [0x4cfce8]
push 0x50
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x10], eax
call fcn.0040303d
mov edi, eax
push 0x4f
shl esi, 0x10
push edi
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, 1
jle 0x48ba4f
push edi
call dword [sym.imp.USER32.dll_CharNextA]
sub esi, eax
add esi, edi
push esi
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.004030a4
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp dword [ecx - 0xc], 0
lea eax, [ecx - 0xc]
jl 0x48ba73
push eax
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x48ba82
mov eax, dword [0x4cfce8]
push ecx
mov ecx, esi
mov dword [esi], eax
call fcn.00402e2b
lea ecx, [ebp + 0x10]
call fcn.004010b4
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x48fb49
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
push ecx
mov eax, esp
and dword [eax], 0
call fcn.004912ee
lea ecx, [esi + 0x50]
call fcn.004c25a9
mov eax, dword [ebp + 8]
mov ecx, dword fs:[0x2c]
and dword [esi + 0xb0], 0xfffffffe
mov dword [esi + 0xac], eax
mov eax, dword [0x4e9e94]
mov edx, dword [esi + 0xb0]
mov dword [esi], 0x4c939c
and edx, 0xfffffffd
mov ecx, dword [ecx + eax*4]
mov ebx, 0x100
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x620]
shr eax, 0x11
and eax, 2
or eax, edx
mov dword [esi + 0xb0], eax
mov edx, dword [ecx + 4]
and eax, 0xfffdffff
mov edx, dword [edx + 0x620]
shr edx, 0xd
and edx, 0x20000
or edx, eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xb0], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0xb4], eax
mov eax, edx
not eax
mov edi, edx
and eax, 0x400
and edi, 0x800
or eax, edi
mov edi, edx
shr eax, 4
and edi, ebx
and edx, 0x40
or eax, edi
mov edi, 0x80
shr eax, 3
or eax, edx
mov edx, dword [esi + 0xb0]
shr eax, 1
and edx, 0xffffffc3
or eax, edx
xor edx, edx
mov dword [esi + 0xb0], eax
cmp dword [0x4d58e4], edx
setne dl
and edx, 1
and al, 0xbf
shl edx, 6
or edx, eax
mov dword [esi + 0xb0], edx
mov eax, dword [ecx + 4]
and dl, 0x7f
mov eax, dword [eax + 0x620]
shr eax, 8
and eax, edi
or eax, edx
mov dword [esi + 0xb0], eax
mov edx, dword [ecx + 4]
and ah, 0xfe
mov edx, dword [edx + 0x620]
shr edx, 0xc
and edx, ebx
or edx, eax
mov dword [esi + 0xb0], edx
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x620]
shr eax, 0xe
and eax, 0x1000
and dh, 0xef
xor ebx, ebx
or eax, edx
push ebx
mov dword [esi + 0xb0], eax
mov ecx, dword [ecx + 4]
and ah, 0xfd
push ebx
mov ecx, dword [ecx + 0x620]
push 0x1037
shr ecx, 0xc
and ecx, 0x200
or ecx, eax
mov dword [esi + 0xb0], ecx
mov eax, dword [0x4d9120]
and eax, 0x20
and ch, 0xdf
shl eax, 8
or eax, ecx
mov dword [esi + 0xb0], eax
mov ecx, dword [0x4d9120]
and ecx, edi
mov edi, dword [ebp + 0x18]
shl ecx, 0xb
and eax, 0xfffbffff
or ecx, eax
mov dword [esi + 0xb0], ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0xb0]
mov edx, dword [ebp + 0x14]
shr eax, 0xb
and eax, 0x4000
and ch, 0xbf
or eax, ecx
mov dword [esi + 0xb0], eax
mov ecx, dword [edi + 0x74]
shr ecx, 1
and ecx, 0x8000
and ah, 0x7f
or ecx, eax
mov dword [esi + 0xb0], ecx
mov eax, dword [edi + 0x74]
not eax
shr eax, 3
and eax, 0x10000
and ecx, 0xfffeffff
or eax, ecx
xor ecx, ecx
mov dword [esi + 0xb0], eax
cmp dword [0x4d9ad4], ebx
pop edi
setne cl
and edx, 1
and ecx, 1
shl edx, 1
or ecx, edx
and ah, 0xf3
shl ecx, 0xa
or ecx, eax
mov eax, esi
mov dword [esi + 0xb0], ecx
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4947be
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ecx
push ebx
push esi
mov eax, dword [0x4e9e94]
mov esi, ecx
add ecx, 0xffffffcc
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ecx
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 4]
cmp dword [eax + 0x40], ebx
je 0x494868
cmp dword [0x4cf52c], ebx
je 0x494868
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x808b
push 0x111
mov dword [0x4cf52c], ebx
push dword [esi + 4]
call edi
push ebx
mov ebx, 0x8030
push 0x2d25
push ebx
push dword [esi + 4]
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d9b98]
push eax
call fcn.0047c594
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push 1
call fcn.00474dc3
call ebp
sub eax, dword [esp + 0x14]
cmp eax, 0x3e8
jbe 0x494842
push 0
push 0
push ebx
push dword [esi + 4]
call edi
pop edi
xor ebx, ebx
pop ebp
mov eax, dword [esp + 0x20]
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop ecx
pop ecx
ret 0x10

Function at 0x495148
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x409
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0xe001
mov ecx, esi
call fcn.00495178
pop esi
ret

Function at 0x498067
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, ecx
mov ebx, ebp
neg ebx
lea eax, [ebp - 0x34]
sbb ebx, ebx
and ebx, eax
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x498153
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov esi, edi
neg esi
sbb esi, esi
and esi, 4
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x3c], 0
je 0x498133
push 0xeaff
mov ecx, ebx
call fcn.004a58e2
test eax, eax
mov dword [esp + 0x10], eax
je 0x4980e0
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.0049ef55
test eax, eax
je 0x4980e0
push esi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x498133
xor esi, esi
push esi
push esi
push 0x40c
push dword [ebp + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
cmp dword [esp + 0x10], esi
setne cl
sub eax, ecx
dec eax
mov ecx, eax
dec eax
test ecx, ecx
je 0x498133
lea esi, [ebp + eax*4 + 0x33c]
lea ebp, [eax + 1]
mov eax, dword [esi]
add eax, 4
push dword [eax]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x49812b
mov ecx, dword [esi]
call fcn.004a3aca
dec ebp
sub esi, 4
test ebp, ebp
ja 0x498113
add ebx, 0x5b4
push 0
push edi
push 0xe800
mov ecx, ebx
call fcn.00427ea4
push 1
mov ecx, ebx
call fcn.00483a99
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
pop ecx
ret 0x10
Function at 0x49815c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
add ecx, 0xffffffcc
neg esi
sbb esi, esi
and esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4981b0
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov eax, edi
neg eax
sbb eax, eax
and eax, 4
push eax
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_ShowWindow]
add esi, 0x5b4
push 0
push edi
push 0xe801
mov ecx, esi
call fcn.00427ea4
push 1
mov ecx, esi
call fcn.00483a99
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x49820b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x248], 0
lea eax, [ecx + 0x248]
push ebx
push esi
push edi
je 0x498274
and dword [ebp - 4], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
movzx eax, word [ebx]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 8]
jne 0x498268
push 0x10
xor edi, edi
call esi
test ah, 0x80
je 0x498246
push 4
pop edi
push 0x11
call esi
test ah, 0x80
je 0x498252
or edi, 8
push 0x12
call esi
test ah, 0x80
je 0x49825e
or edi, 0x10
mov eax, dword [ebx]
shr eax, 0x10
cmp ax, di
je 0x49827d
inc dword [ebp - 4]
add ebx, 4
cmp dword [ebp - 4], 2
jl 0x49822d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp - 4]
add eax, 0x82f5
jmp 0x498276