joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac34d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6244f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 2
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x47024a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47024a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x47024a
mov ebx, dword [esi + 8]
xor eax, eax
imul ebx, dword [esi + 4]
mov dword [ebp - 0x14], eax
shl ebx, 2
cmp word [esi + 0xe], 0x20
jne 0x47024c
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x47024a
lea ecx, [ebp - 0x2c]
call fcn.0054579f
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005460a8
push 0x34
call fcn.00574fb6
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x47025e
lea ecx, [ebp - 0x2c]
call fcn.005458b1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov edi, eax
mov dword [ebp - 0x10], 0
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x10]
mov dword [eax + 0x14], ebx
push ecx
push 0
push eax
push dword [ebp - 0x28]
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov esi, eax
test esi, esi
je 0x4702cb
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4702cb
mov eax, dword [ebp - 0x18]
add eax, 0x28
test ebx, ebx
je 0x4702c8
push ebx
test eax, eax
je 0x4702ad
push eax
push ecx
call fcn.00570860
add esp, 0xc
jmp 0x4702c8
push 0
push ecx
call fcn.00570de0
add esp, 0xc
call fcn.0057524b
mov dword [eax], 0x16
call fcn.00574b40
mov dword [ebp - 0x14], esi
push dword [ebp - 0x1c]
call fcn.00574f9b
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.005458b1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac9d5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x6244f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xe
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47249e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x472488
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x472488
xor eax, eax
xor esi, esi
cmp ax, word [ebx + 4]
jae 0x472467
lea ecx, [ebp - 0x38]
call fcn.0046b530
mov edx, dword [ebp + 0x14]
movzx ecx, si
mov dword [ebp - 4], 0
lea eax, [ecx*8]
sub eax, ecx
movzx ecx, byte [ebx + eax*2 + 6]
movzx edi, byte [ebx + eax*2 + 7]
lea eax, [ebx + eax*2]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], ecx
cmp edx, ecx
jne 0x472410
cmp eax, edi
je 0x472418
test edx, edx
jne 0x47244d
test eax, eax
jne 0x47244d
mov eax, dword [ebp + 0xc]
push 0
push edi
push ecx
movzx eax, word [eax + 0x12]
lea ecx, [ebp - 0x38]
push eax
push dword [ebp + 8]
call fcn.0046d820
test eax, eax
je 0x472480
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x38]
push edi
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push eax
call fcn.00471d30
test eax, eax
je 0x472480
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0046b950
inc esi
cmp si, word [ebx + 4]
jb 0x4723d4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x38]
call fcn.0046b950
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x38]
call fcn.0046b530
push 0
push dword [ebp + 0x18]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
push dword [ebp + 0x14]
push esi
push ebx
call fcn.0046d820
test eax, eax
jne 0x4724c7
xor esi, esi
jmp 0x4724e0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x38]
mov ecx, edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.00471d30
mov esi, eax
lea ecx, [ebp - 0x38]
call fcn.0046b950
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x474c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acda0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6244f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x30]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CXTPResize.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0x5bbe20
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00404b51
lea ecx, [esi + 0x38]
mov dword [ebp - 4], 0
call fcn.00474d80
lea ecx, [esi + 0xc0]
call fcn.00474c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x47d6c0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0x74]
cmp dword [ecx + 0x60], 2
je 0x47d805
mov edx, dword [ebp + 8]
lea eax, [edx - 0x60]
cmp eax, 9
ja 0x47d6ee
cmp dword [ecx + 0x80], 0
je 0x47d805
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x47d805
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x50]
mov esi, eax
push esi
call fcn.0047d5f0
add esp, 4
neg eax
sbb edi, edi
and edi, esi
xor esi, esi
cmp dword [ebx + 0x84], esi
jle 0x47d75e
push esi
mov ecx, ebx
call fcn.0047cea0
mov dword [ebp - 4], eax
cmp dword [eax + 0xc8], 0
jne 0x47d75c
mov ecx, dword [ebx + 0x74]
test byte [ecx + 0x60], 1
je 0x47d751
test edi, edi
jne 0x47d751
push eax
call fcn.0047d5f0
add esp, 4
test eax, eax
cmovne edi, dword [ebp - 4]
inc esi
cmp esi, dword [ebx + 0x84]
jl 0x47d721
jmp 0x47d75e
mov edi, eax
test edi, edi
je 0x47d805
push edi
call fcn.0047d5f0
add esp, 4
test eax, eax
je 0x47d805
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call dword [eax + 0x220]
test eax, eax
jne 0x47d7f7
lea eax, [ebp - 4]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0047c900
mov esi, eax
test esi, esi
je 0x47d805
mov edi, dword [esi + 0xc0]
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], eax
cmp dword [edi + 0xc8], 0
jne 0x47d7b8
mov ecx, ebx
call fcn.0047bfb0
push 1
mov ecx, ebx
call fcn.0047e9a0
push 1
mov dword [ebx + 0x44], 1
mov ecx, edi
mov eax, dword [edi]
push 0
push 1
call dword [eax + 0x168]
mov eax, dword [edi]
mov ecx, edi
push 1
push dword [ebp + 8]
call dword [eax + 0x170]
cmp dword [ebp - 4], 0
jne 0x47d7f7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb0]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47ddc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [edi + 4], 0x104
jne 0x47de69
mov eax, 0x2000
test word [edi + 0xe], ax
je 0x47de69
call fcn.0047d1a0
cmp dword [eax + 4], 0
jg 0x47de69
push 0
mov ecx, esi
call fcn.0047d1a0
mov ecx, eax
call fcn.004dc6c0
test eax, eax
jne 0x47de69
mov ecx, esi
call fcn.0047d1a0
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x47de19
mov eax, dword [eax + 0x20]
push eax
call fcn.004dc6b0
add esp, 4
test eax, eax
je 0x47de69
cmp dword [edi + 8], 0x12
jne 0x47de3d
push 1
mov ecx, esi
call fcn.0047e9a0
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
cmp dword [esi + 0x24], 0
je 0x47de52
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jb 0x47de69
mov eax, dword [edi + 8]
test eax, eax
je 0x47de69
push eax
mov ecx, esi
call fcn.0047d6c0
test eax, eax
jne 0x47def1
mov eax, dword [edi + 4]
cmp eax, 0x105
je 0x47de7a
cmp eax, 0x101
jne 0x47dea8
cmp dword [esi + 0xc8], 0
je 0x47dea8
cmp dword [esi + 0xb0], 0
je 0x47dea8
push 0
mov ecx, esi
call fcn.0047d1a0
mov ecx, eax
call fcn.004dc6c0
test eax, eax
jne 0x47dea8
push eax
mov ecx, esi
call fcn.0047e9a0
mov eax, dword [edi + 4]
cmp eax, 0x7b
je 0x47deb7
cmp eax, 0x105
jne 0x47defc
push 0
mov ecx, esi
call fcn.0047d1a0
mov ecx, eax
call fcn.004dc6c0
test eax, eax
je 0x47defc
push 0x47c3f0
mov ecx, 0x62d1d8
call fcn.00550c7e
test eax, eax
je 0x47dfa9
push dword [edi + 0xc]
mov ecx, eax
push dword [edi + 8]
push 0x7b
call fcn.004dc1a0
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
cmp dword [edi + 4], 0x20a
jne 0x47df7d
push 0x47c3f0
mov ecx, 0x62d1d8
call fcn.00550c7e
test eax, eax
je 0x47dfa9
cmp dword [eax + 0x1c], 0
jle 0x47df4d
push 0x47c3f0
mov ecx, 0x62d1d8
call fcn.00550c7e
test eax, eax
je 0x47dfa9
push dword [edi + 0xc]
mov ecx, eax
push dword [edi + 8]
push 0x20a
call fcn.004dc1a0
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
test eax, eax
je 0x47df7d
cmp dword [eax + 0xe0], 3
jne 0x47df7d
mov edx, dword [eax]
xor ecx, ecx
cmp word [edi + 0xa], cx
setle cl
push ecx
mov ecx, eax
call dword [edx + 0x254]
test eax, eax
jne 0x47def1
mov eax, dword [edi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x47dfa1
push edi
mov ecx, esi
call fcn.0047d2c0
mov ecx, eax
call fcn.004907c0
test eax, eax
jne 0x47def1
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
call fcn.00538fe6
int3
Function at 0x484a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
movzx edi, cx
mov ecx, dword [eax + 0xe4]
mov dword [ebp - 8], eax
call fcn.00488570
test edi, edi
je 0x484bbb
call fcn.00545615
mov esi, dword [eax + 0xc]
test esi, esi
je 0x484bbb
push 0xf1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x484bbb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x484bbb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x484bbb
movzx eax, word [edi + 6]
xor ecx, ecx
mov edx, 4
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00538f33
movzx edx, word [edi + 6]
xor esi, esi
add esp, 4
xor ecx, ecx
mov ebx, eax
mov eax, edx
cmp si, dx
jae 0x484b44
lea edx, [edi + 8]
mov edi, edi
movzx eax, word [edx]
lea edx, [edx + 2]
mov dword [ebx + ecx*4], eax
inc ecx
movzx esi, word [edi + 6]
cmp ecx, esi
jl 0x484b30
mov eax, esi
mov esi, dword [ebp - 8]
mov ecx, esi
movzx eax, ax
push eax
push ebx
call fcn.004860d0
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x484ba6
mov ecx, esi
call fcn.004a2790
movzx ecx, word [edi + 4]
mov esi, eax
movzx edx, word [edi + 2]
movzx eax, word [edi + 6]
push 0
push ecx
push edx
push eax
push ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.004729d0
neg eax
sbb eax, eax
and dword [ebp - 4], eax
movzx eax, word [edi + 2]
cmp eax, 0x10
je 0x484ba6
mov edx, dword [ebp - 8]
mov ecx, eax
movzx eax, word [edi + 4]
mov dword [edx + 0xf4], ecx
mov dword [edx + 0xf8], eax
push ebx
call fcn.00538f2e
mov eax, dword [ebp - 4]
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x48e1f0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae4e0
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x60
jb 0x48e23e
cmp edi, 0x69
ja 0x48e23e
movzx ecx, word [ebp + 8]
lea edx, [edi - 0x30]
xor eax, eax
cmp ecx, edx
sete al
jmp 0x48e3e7
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
test ax, ax
jne 0x48e256
xor eax, eax
jmp 0x48e3e7
mov ebx, dword [ebp + 8]
push ebx
call fcn.00490670
movzx ecx, ax
add esp, 4
movzx eax, di
mov dword [ebp - 0x120], ecx
cmp bx, ax
je 0x48e3e2
cmp cx, ax
je 0x48e3e2
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov dword [ebp - 0x11c], eax
cmp eax, 1
jl 0x48e24f
lea ecx, [ebp - 0x134]
call fcn.0048d600
push 0xffffffffffffffff
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.00469d30
push dword [ebp - 0x130]
push dword [ebp - 0x11c]
call esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
test eax, eax
je 0x48e3d3
mov dword [ebp - 0x118], 0
test esi, esi
js 0x48e403
cmp esi, dword [ebp - 0x12c]
jge 0x48e403
mov eax, dword [ebp - 0x130]
push dword [eax + esi*4]
lea eax, [ebp - 0x118]
push 0
push 1
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x48e34d
mov eax, dword [ebp - 0x118]
cmp bx, ax
je 0x48e3ce
push eax
call fcn.00490670
add esp, 4
cmp word [ebp - 0x120], ax
je 0x48e3ce
mov al, byte [ebp - 0x100]
mov byte [ebp - 0x111], al
mov eax, dword [ebp - 0x130]
mov byte [ebp - 0x100], 0x81
push dword [eax + esi*4]
lea eax, [ebp - 0x118]
push 0
push 1
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x48e3a6
mov eax, dword [ebp - 0x118]
cmp bx, ax
je 0x48e3ce
push eax
call fcn.00490670
add esp, 4
cmp word [ebp - 0x120], ax
je 0x48e3ce
mov al, byte [ebp - 0x111]
inc esi
mov byte [ebp - 0x100], al
cmp esi, dword [ebp - 0x11c]
jl 0x48e2e1
lea ecx, [ebp - 0x134]
call fcn.0048d940
xor eax, eax
jmp 0x48e3e7
mov esi, 1
lea ecx, [ebp - 0x134]
call fcn.0048d940
mov eax, esi
jmp 0x48e3e7
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret
call fcn.00538fe6
int3
Function at 0x496540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aef35
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CFont.0
push 0x58
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push 0x5cf664
push eax
push 0x60
push 0x50
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005488bf
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [edi]
mov ecx, edi
push ebx
push esi
mov dword [ebp - 0x30], eax
call dword [edx + 0x70]
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [esi]
push ebx
call dword [eax + 0x74]
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0xb0]
sub eax, 0x10
push eax
call fcn.00405d05
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 0x80]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x88]
push 0x25
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x8c]
push ecx
mov dword [ebp - 0x14], eax
mov ecx, edi
push dword [esi - 0xc]
mov eax, dword [edi]
push esi
mov byte [ebp - 4], 1
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x496648
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x30]
call dword [eax + 0x28]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CFont.0
call fcn.0040c42b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret 8

Function at 0x49e920
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 8
je 0x49e95d
cmp esi, 0x21
jb 0x49e93c
cmp esi, 0x2e
jbe 0x49e95d
cmp esi, 0x43
je 0x49e950
cmp esi, 0x56
je 0x49e950
cmp esi, 0x58
je 0x49e950
cmp esi, 0x5a
jne 0x49e98f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x49e98f
mov eax, dword [edi + 0x20]
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], esi
call fcn.00540fb8
test eax, eax
je 0x49e98f
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x49f170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x49f307
mov eax, dword [edi + 0x134]
test eax, eax
je 0x49f307
cmp dword [eax + 0x20], 0
je 0x49f307
cmp dword [eax + 0x80], 0
je 0x49f1b0
pop edi
mov eax, 2
pop esi
pop ebp
ret 8
mov esi, dword [ebp + 8]
cmp esi, 0xd
je 0x49f307
cmp esi, 9
je 0x49f307
cmp esi, 0x1b
jne 0x49f1f9
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.0049fef0
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
test ax, ax
jns 0x49f234
push 0x11
call ebx
test ax, ax
js 0x49f234
mov ecx, dword [edi + 0xc0]
call fcn.004a26f0
test eax, eax
je 0x49f234
movzx ecx, si
push ecx
mov ecx, eax
call fcn.0047d6c0
test eax, eax
jne 0x49f2ef
mov ecx, edi
call fcn.0048bf50
test eax, eax
je 0x49f2c6
cmp dword [edi + 0x16c], 0
je 0x49f2c6
cmp esi, 0x26
je 0x49f256
cmp esi, 0x28
jne 0x49f2c6
mov ecx, edi
call fcn.0049e580
test eax, eax
jne 0x49f2c6
mov edx, dword [edi]
cmp esi, 0x26
mov ecx, edi
sete al
lea eax, [eax*2 - 1]
push eax
push 1
call dword [edx + 0x16c]
mov esi, dword [edi + 0x134]
test esi, esi
je 0x49f2ef
mov esi, dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x49f2ef
mov edi, dword [edi + 0x134]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [edi + 0x20]
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
mov ecx, dword [edi + 0x160]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x49f2de
push ebx
push esi
call fcn.004e40d0
test eax, eax
jne 0x49f2ef
mov ecx, dword [edi + 0x134]
push ebx
push esi
call fcn.0049e920
test eax, eax
je 0x49f2fb
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop ebx
pop edi
mov eax, 2
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4a3c80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov ecx, dword [esi + 0xe4]
call fcn.00488300
mov edi, eax
mov eax, dword [esi + 0xbc]
cmp eax, 0xffffffff
je 0x4a3ce1
cmp dword [esi + 0xe8], 5
jne 0x4a3ce1
cmp dword [esi + 0xe0], 1
jne 0x4a3ce1
test edi, edi
je 0x4a3cc0
cmp dword [edi + 0x40], eax
je 0x4a3ce9
cmp eax, dword [esi + 0xb8]
jne 0x4a3cd6
mov eax, dword [esi]
mov ecx, esi
push 0
push 0xffffffffffffffff
call dword [eax + 0x170]
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004a4da0
test edi, edi
je 0x4a3daf
push ebx
mov ecx, esi
call fcn.004a29c0
test eax, eax
jne 0x4a3d98
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd8]
test eax, eax
je 0x4a3d98
push esi
push 0x623784
call fcn.0054abdb
add esp, 8
test eax, eax
je 0x4a3d98
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4a3d98
mov ecx, esi
call fcn.004a26f0
mov ebx, eax
test ebx, ebx
je 0x4a3d98
cmp dword [ebx + 0x60], 0
je 0x4a3d98
mov ecx, dword [ebx + 0x74]
cmp dword [ecx + 0x44], 0
je 0x4a3d98
push 1
mov ecx, ebx
call fcn.0047e820
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004a4da0
mov eax, dword [esi]
mov ecx, esi
push 0
push 0xffffffffffffffff
call dword [eax + 0x170]
push dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
call dword [eax + 0x110]
push 0
mov ecx, ebx
call fcn.0047e820
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0x54]
mov ecx, ebx
call fcn.0047bfb0
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
call dword [eax + 0xf4]
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, esi
call fcn.0053ba16
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4ab0a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x4ab020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4ab0ed
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ab100
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x4ab185
push edi
push dword [esi + 0x14]
mov dword [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [esi + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4ab174
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4ab140
cmp dword [ebp - 4], 0x103
jne 0x4ab173
mov eax, dword [esi + 0xc]
inc edi
cmp edi, 0xa
ja 0x4ab16a
push 0x64
push eax
call ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x4ab140
jmp 0x4ab173
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4acd10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a41a0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6244f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
mov dword [esi], vtable.CXTPPropExchangeIniFile.0
jne 0x4acd58
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], 0
je 0x4acd58
cmp dword [esi + 0x4c], 0
je 0x4acd58
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 0x48]
or edi, 0xffffffff
sub edx, 0x10
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4acd75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x44]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4acd8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.004acca0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret