joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3060
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bef92
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
call fcn.005467aa
mov eax, dword [ebp - 0x208]
lea esi, [eax + 0x44]
mov dword [ebp - 4], 0
lea edi, [eax + 0x98]
mov dword [eax], vtable.CXTPToolTipContext.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CFont.0
lea ebx, [eax + 0xa0]
mov dword [ebx + 4], 0
mov dword [ebx], vtable.CFont.0
push 0
mov byte [ebp - 4], 2
mov dword [eax + 0x60], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x208]
cdq
sub eax, edx
sar eax, 1
push 0x2c
mov dword [ecx + 0x3c], eax
lea eax, [ecx + 0x64]
push 0
push eax
call fcn.0057e5f0
add esp, 0xc
call fcn.004b8250
mov ecx, eax
call fcn.004b7800
mov ecx, dword [ebp - 0x208]
push 0
push 0
push 0
push 0
push esi
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x90], 0xffffffff
mov dword [ecx + 0x94], 0xffffffff
mov dword [ecx + 0x38], 1
mov dword [ecx + 0x40], 2
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x208]
push 0x1f0
push 0
mov dword [eax + 0x58], 0xffffffff
mov dword [eax + 0x54], 0xffffffff
mov dword [eax + 0x5c], 0xffffffff
lea eax, [ebp - 0x200]
push eax
call fcn.0057e5f0
add esp, 0xc
mov dword [ebp - 0x204], 0x1f4
lea eax, [ebp - 0x204]
push 0
push eax
push 0x1f4
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0xb8], 0x190
call fcn.004c2f60
mov ecx, eax
call fcn.004c2700
mov esi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0xc8]
push eax
call esi
push eax
mov ecx, edi
call fcn.005532aa
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0x2bc
push eax
call esi
push eax
mov ecx, ebx
call fcn.005532aa
mov ecx, dword [ebp - 0x208]
mov eax, ecx
mov dword [ecx + 0xa8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
Function at 0x4c5140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 1
call esi
test ax, ax
js 0x4c524d
push 2
call esi
test ax, ax
js 0x4c524d
push 4
call esi
test ax, ax
js 0x4c524d
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x88]
xor esi, esi
test eax, eax
jle 0x4c524d
lea ebx, [ebx]
test esi, esi
js 0x4c5273
cmp esi, eax
jge 0x4c5273
mov eax, dword [ebx + 0x84]
mov edi, dword [eax + esi*4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c523e
push dword [edi + 0x20]
call fcn.00548f8f
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
test byte [edi + 8], 1
push eax
je 0x4c520d
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4c5212
call fcn.005532d6
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4c523e
test byte [edi + 8], 1
jne 0x4c5260
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
push 0
call fcn.004c69e0
cmp eax, dword [edi + 0x20]
je 0x4c5260
mov eax, dword [ebx + 0x88]
inc esi
cmp esi, eax
jl 0x4c51b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
call fcn.005461a6
int3

Function at 0x4c6c10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push edi
mov ecx, 7
lea edi, [ebp - 0x24]
mov esi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
push 0
push 0x410
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebx + 0x14]
add ecx, 0xfffffe00
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
cmp ecx, 0xd
ja 0x4c6c6d
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
movzx ecx, si
movzx eax, dx
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x407
push dword [edi + 0x20]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cffa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bf99d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x10]
call fcn.00485480
lea eax, [esi + 0x20]
mov dword [esi], vtable.CXTPMarkupPathGeometry.0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
push eax
mov dword [ebp - 4], 0
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
test edi, edi
jle 0x4d00e4
xor ecx, ecx
mov eax, edi
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005460f3
lea edx, [edi*8]
mov dword [esi + 0x14], eax
add esp, 4
test edx, edx
je 0x4d0068
test eax, eax
jne 0x4d008c
call fcn.00582661
mov dword [eax], 0x16
call fcn.00582350
push edi
call fcn.005460f3
add esp, 4
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4d00d4
mov ecx, dword [ebp + 0xc]
push edi
test ecx, ecx
je 0x4d00c9
push ecx
push eax
call fcn.0057e070
add esp, 0xc
jmp 0x4d00e4
mov ecx, dword [ebp + 8]
push edx
test ecx, ecx
je 0x4d00a6
push ecx
push eax
call fcn.0057e070
push edi
call fcn.005460f3
add esp, 0x10
jmp 0x4d0071
push 0
push eax
call fcn.0057e5f0
call fcn.00582661
mov dword [eax], 0x16
call fcn.00582350
push edi
call fcn.005460f3
add esp, 0x10
jmp 0x4d0071
push 0
push eax
call fcn.0057e5f0
add esp, 0xc
call fcn.00582661
mov dword [eax], 0x16
call fcn.00582350
mov ecx, esi
call fcn.004d3250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d90e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x100]
test esi, esi
je 0x4d9168
mov eax, dword [ebp + 8]
shr eax, 8
push ebx
mov ebx, dword [esi + 0x34]
cmp al, 2
jne 0x4d9167
test ebx, ebx
je 0x4d9167
push dword [ebp + 0x10]
lea eax, [esi + 4]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d911c
mov ecx, dword [ebx + 0x2c]
jmp 0x4d9140
mov eax, dword [esi + 0x34]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x40]
cmp dword [eax + 0x58], 0
cmovne edx, dword [ebp + 0x10]
add edx, dword [esi + 0x1c]
cmp edx, ecx
jl 0x4d9140
mov eax, dword [ebx + 0x3c]
add eax, ecx
mov ecx, edx
cmp edx, eax
cmovge ecx, eax
push ecx
mov ecx, edi
call fcn.004d7e10
cmp dword [ebp + 8], 0x202
je 0x4d915e
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4d9167
push 0
mov ecx, edi
call fcn.004d78d0
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4e5540
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0dad
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x634b28]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.005467aa
mov dword [ebp - 4], 0
mov dword [edi], vtable.CXTPMenuBarMDIMenuInfo.0
call fcn.0054671f
mov ecx, eax
test ecx, ecx
je 0x4e5678
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 1
call fcn.0054671f
mov ecx, eax
test ecx, ecx
je 0x4e5678
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x28], eax
push 0x44
mov byte [ebp - 4], 2
call fcn.005460b6
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4e55d9
mov ecx, eax
call fcn.00493520
jmp 0x4e55db
xor eax, eax
push dword [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [edi + 0x20], eax
call fcn.004954e0
mov ebx, dword [ebp + 0xc]
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], 0
call fcn.005527d5
call fcn.005527d5
mov ecx, dword [eax + 0xc]
movzx eax, bx
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [edi + 0x2c], eax
call fcn.005527d5
mov ecx, dword [eax + 4]
call fcn.00551beb
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4e5662
call fcn.005527d5
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
call fcn.00551c0c
mov esi, eax
cmp ebx, dword [esi + 0x54]
je 0x4e5648
cmp dword [ebp - 0x10], 0
jne 0x4e5628
jmp 0x4e5662
mov eax, dword [esi]
lea ecx, [edi + 0x24]
push 1
push ecx
mov ecx, esi
call dword [eax + 0x64]
mov eax, dword [esi]
lea ecx, [edi + 0x28]
push 6
push ecx
mov ecx, esi
call dword [eax + 0x64]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00404d7e
int3
Function at 0x4e5fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
cmp edi, 0x220
ja 0x4e6100
je 0x4e5feb
cmp edi, 0x47
ja 0x4e6057
je 0x4e5fe0
mov eax, edi
sub eax, 2
je 0x4e601b
sub eax, 3
jne 0x4e6000
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x12c]
jne 0x4e6000
push 0
push 0x2fbf
push 0x113
push dword [esi - 0x60]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.004b0740
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [esi + 0x130], 0
je 0x4e6000
lea ecx, [esi - 0x80]
call fcn.004af870
test eax, eax
jne 0x4e6034
xor ecx, ecx
jmp 0x4e6037
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
cmp eax, ecx
jne 0x4e6000
push dword [esi + 0x130]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x130], 0
jmp 0x4e6000
cmp edi, 0x112
jne 0x4e6000
lea ebx, [esi - 0x80]
mov ecx, ebx
call fcn.00491930
test eax, eax
je 0x4e6000
push 0x489360
mov ecx, 0x63da70
call fcn.0055d9ce
test eax, eax
je 0x4e61e6
cmp dword [eax + 4], 0
jg 0x4e6000
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4e6000
mov ecx, ebx
call fcn.004af950
test eax, eax
jne 0x4e6000
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x4e6000
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x4e6000
mov eax, dword [ebx]
mov ecx, ebx
push 0x12
call dword [eax + 0x220]
test eax, eax
jne 0x4e60f4
mov ecx, ebx
call fcn.004af680
test eax, eax
je 0x4e60f4
push 0
push ebx
mov ecx, eax
call fcn.0048b7f0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x14
mov eax, edi
sub eax, 0x221
je 0x4e5feb
sub eax, 1
je 0x4e5feb
sub eax, 0xe
jne 0x4e6000
mov eax, dword [esi - 0x80]
lea ecx, [esi - 0x80]
call dword [eax + 0x188]
lea ecx, [esi - 0x80]
test eax, eax
je 0x4e61bd
call fcn.004af950
test eax, eax
je 0x4e6165
lea ecx, [esi - 0x80]
call fcn.004af870
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
test dword [esi + 0x54], 0x400
mov edi, dword [ebp + 0x10]
jne 0x4e6192
mov eax, dword [edi]
test eax, eax
jne 0x4e6189
cmp dword [esi + 0x130], eax
je 0x4e6192
test eax, eax
jne 0x4e6189
mov eax, dword [esi + 0x130]
push eax
lea ecx, [esi - 0x80]
call fcn.004e6d70
lea ecx, [esi - 0x80]
call fcn.004af870
push 0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x70]
lea ecx, [esi - 0x80]
call fcn.004e6220
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
call fcn.004af870
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
jne 0x4e6000
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x14
call fcn.005461a6
int3
Function at 0x4e92c0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
je 0x4e92f9
cmp dword [edi + 4], 0
jne 0x4e930e
push esi
call fcn.005527d5
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x4e90f0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop esi
mov dword [edi + 4], eax
pop edi
pop ebp
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4e930e
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [edi + 4], 0
pop edi
pop ebp
ret 4
Function at 0x4ecc70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jne 0x4ecdbf
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0xc0]
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x160]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x84]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x8c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x15c]
push 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ecd3c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4ecd1c
sub eax, dword [ebp - 0x18]
cdq
idiv dword [esi + 0x14c]
lea ecx, [eax + 1]
mov eax, dword [esi + 0x13c]
cmp eax, ecx
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1c]
jl 0x4ecd3c
sub eax, dword [ebp - 0x20]
cdq
idiv dword [esi + 0x150]
lea edi, [eax + 1]
mov eax, dword [esi + 0x140]
cmp eax, edi
cmovl edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x15c]
jne 0x4ecd6c
cmp edi, dword [esi + 0x160]
jne 0x4ecd6c
push 0
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004ecde0
jmp 0x4ecdbf
push 1
push dword [esi + 0x148]
mov ecx, esi
mov dword [esi + 0x15c], eax
push dword [esi + 0x144]
mov dword [esi + 0x160], edi
call fcn.004ecde0
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0x164], 1
mov eax, dword [ecx]
call dword [eax + 0x1a4]
push dword [ebp - 8]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0xc]
mov dword [esi + 0x164], 0
call dword [eax + 0x104]
push dword [ebp + 8]
mov ecx, esi
call fcn.00499b00
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4efb20
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x4efb30
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4f10e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 8], 0
je 0x4f1159
mov edi, dword [ebp + 8]
cmp edi, 0x26
je 0x4f1107
cmp edi, 0x28
je 0x4f1107
cmp edi, 0x22
je 0x4f1107
cmp edi, 0x21
jne 0x4f1159
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4f1159
push 5
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 8]
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x4f1159
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f1820
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x4f187b
mov esi, dword [ebp + 8]
cmp esi, 0x2e
je 0x4f1842
cmp esi, 8
je 0x4f1842
xor eax, eax
jmp 0x4f1847
mov eax, 1
mov dword [edi + 0x170], eax
mov eax, dword [edi + 0x144]
test eax, eax
je 0x4f1864
cmp dword [eax + 0x80], 0
jne 0x4f19e0
cmp esi, 9
jne 0x4f1884
cmp dword [edi + 0x194], 0
je 0x4f187b
test byte [edi + 0x174], 8
jne 0x4f18d9
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
cmp esi, 0xd
je 0x4f187b
cmp esi, 0x1b
jne 0x4f18d9
mov ecx, dword [edi + 0x138]
mov eax, dword [ecx]
call dword [eax + 0x1a8]
push dword [edi + 0x150]
mov ecx, edi
call fcn.004f2a20
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.004f2da0
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x4f191d
cmp dword [eax + 0x20], 0
je 0x4f191d
push 0x12
call ebx
test ax, ax
jns 0x4f191d
push 0x11
call ebx
test ax, ax
js 0x4f191d
mov ecx, dword [edi + 0xc0]
call fcn.004af680
test eax, eax
je 0x4f191d
movzx ecx, si
push ecx
mov ecx, eax
call fcn.0048a5d0
test eax, eax
jne 0x4f19b6
cmp esi, 0x73
jne 0x4f1993
push 0x12
call ebx
test ax, ax
jns 0x4f19a6
mov ecx, dword [edi + 0x194]
test ecx, ecx
je 0x4f1942
push dword [ebp + 0xc]
push esi
call fcn.004f10e0
test eax, eax
jne 0x4f19b6
cmp dword [edi + 0x144], 0
je 0x4f1968
cmp esi, 0x26
je 0x4f195f
cmp esi, 0x28
je 0x4f195f
cmp esi, 0x22
je 0x4f195f
cmp esi, 0x21
jne 0x4f19c2
push 0x12
call ebx
test ax, ax
js 0x4f19c2
mov ecx, edi
call fcn.004f1180
test eax, eax
je 0x4f19c2
mov ecx, dword [edi + 0x138]
mov edx, dword [ebp + 0xc]
push edx
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x258]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
cmp esi, 0x26
je 0x4f199d
cmp esi, 0x28
jne 0x4f192b
push 0x12
call ebx
test ax, ax
jns 0x4f192b
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
push 0
call dword [eax + 0xd4]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, dword [edi + 0x144]
test ecx, ecx
je 0x4f19e0
cmp dword [ecx + 0x20], 0
je 0x4f19e0
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.004ab8b0
test eax, eax
jne 0x4f19b6
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 8
Function at 0x4f2770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x240]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x144], 0
je 0x4f27c9
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4f28ad
mov eax, dword [ebp + 0xc]
cmp eax, 0x26
je 0x4f27be
cmp eax, 0x28
je 0x4f27be
cmp eax, 0x21
je 0x4f27be
cmp eax, 0x22
jne 0x4f28ad
push dword [ebp + 0x10]
push eax
push 0x100
jmp 0x4f282f
mov edi, dword [ebp + 0xc]
cmp edi, 0x73
jne 0x4f288e
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f28ad
mov eax, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
push 1
push 0x102
push 0x102
push dword [esi + 0x20]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4f2836
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x102
mov ecx, esi
call fcn.00548b7d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x240]
cmp dword [ebp - 4], eax
je 0x4f2880
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
mov edi, dword [ebx + 0x144]
test edi, edi
je 0x4f2880
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4f2880
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x26
je 0x4f289c
cmp edi, 0x28
jne 0x4f27e6
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f27e6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f5b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c1125
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x1c]
mov ecx, edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 0x24], esi
call fcn.004a7900
push eax
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00556ae4
mov esi, dword [ebp + 0x18]
mov ecx, edi
sub esi, dword [ebp + 0x10]
push 0x34
call fcn.004a7900
push eax
mov eax, dword [ebp + 0x1c]
push 1
push esi
mov esi, dword [ebp - 0x24]
dec eax
push eax
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00556a84
lea eax, [edi + 0x114]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.004718c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0xfffffffffffffff6
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_InflateRect]
mov esi, dword [esi]
mov ecx, edi
push 0x2c
call fcn.004a7900
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0x2c]
sub eax, 0x10
push eax
call fcn.00405ecf
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push 0x8024
push ecx
push dword [esi - 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
push esi
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f5c9b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x34]
call fcn.00471c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret 0x18