joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov al, byte [esi + 4]
test al, al
je 0x40809e
mov eax, dword [esi + 0x38]
test eax, eax
jle 0x40809e
mov bl, byte [esi + 0x15]
test bl, bl
jne 0x407eff
sub eax, dword [0x4a02e0]
mov dword [esi + 0x38], eax
mov eax, dword [0x4a02e0]
mov ecx, dword [esi + 0x2c]
neg eax
shl eax, 2
add ecx, eax
mov dword [esi + 0x2c], ecx
jns 0x407f35
mov edx, dword [esi + 0x30]
mov al, byte [esi + 0x34]
add ecx, edx
test bl, bl
je 0x407f25
inc al
and al, 0xf
jmp 0x407f2b
cmp al, 0xf
jae 0x407f2e
inc al
mov byte [esi + 0x34], al
test ecx, ecx
jl 0x407f16
mov dword [esi + 0x2c], ecx
mov eax, dword [esi + 0xc]
cmp eax, 8
jl 0x40809e
mov bl, byte [esi + 0x23]
test bl, bl
jne 0x407f51
cmp eax, dword [esi + 0x24]
jg 0x40809e
mov al, byte [esi + 0x20]
push ebp
test al, al
push edi
je 0x407fb4
mov cl, byte [esi + 0x21]
test cl, cl
je 0x407fb4
mov edx, dword [0x4a02e0]
mov eax, dword [esi + 0x18]
neg edx
add edx, edx
add eax, edx
mov dword [esi + 0x18], eax
mov edx, eax
jns 0x407fb4
mov edi, dword [esi + 0x1c]
and ecx, 0xff
add edx, edi
test bl, bl
je 0x407fa1
mov al, byte [esi + 0x28]
cmp al, 1
mov eax, dword [esi + 0xc]
mov ebp, eax
jne 0x407f98
sar ebp, cl
not ebp
jmp 0x407fa8
sar ebp, cl
sub eax, ebp
mov dword [esi + 0xc], eax
jmp 0x407fad
mov eax, dword [esi + 0xc]
mov ebp, eax
sar ebp, cl
add ebp, eax
mov dword [esi + 0xc], ebp
test edx, edx
jl 0x407f80
mov dword [esi + 0x18], edx
mov al, byte [esi + 0x14]
test al, al
je 0x407fc6
xor eax, eax
mov ah, byte [esi + 0x16]
mov dword [esp + 0x1c], eax
jmp 0x407fd5
xor ecx, ecx
mov cl, byte [esi + 0x34]
xor ecx, 0xf
shl ecx, 8
mov dword [esp + 0x1c], ecx
mov edx, dword [esi + 8]
mov eax, dword [0x52f910]
mov dword [esp + 0x10], edx
mov edi, dword [eax + 0x18e78]
fild dword [esp + 0x10]
mov dword [esp + 0x10], edi
fild dword [esp + 0x10]
fstp qword [esp + 0x10]
fcom qword [esp + 0x10]
fnstsw ax
and eax, 0x4100
jne 0x40800a
fstp st(0)
fld qword [esp + 0x10]
mov cl, byte [esi + 0x3c]
mov ebp, dword [esi + 0x40]
mov eax, ecx
and eax, 0xff
cmp eax, ebp
jl 0x40801d
fchs
mov eax, edx
sub eax, edi
mov dword [esi + 8], eax
jns 0x408066
mov edx, dword [esi + 0xc]
inc edx
shl edx, 0x10
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
add eax, edx
inc cl
and cl, 0xf
mov dword [esp + 0x10], eax
test eax, eax
fld st(0)
jle 0x40804a
fisub dword [esp + 0x10]
mov edi, ecx
and edi, 0xff
cmp edi, ebp
jl 0x408058
fchs
test eax, eax
faddp st(2)
jl 0x408035
fstp st(0)
mov dword [esi + 8], eax
mov byte [esi + 0x3c], cl
fild dword [esp + 0x1c]
mov ecx, dword [0x52f910]
sub esp, 8
fmul st(1)
fidiv dword [ecx + 0x18e78]
fadd qword [0x497518]
fstp qword [esp]
fstp st(0)
call fcn.0048b09d
add esp, 8
call fcn.0048ae50
pop edi
mov dword [esi + 0x10], eax
pop ebp
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x10]
pop esi
pop ebx
add esp, 8
ret
Function at 0x40ea40
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x51479b]
sub esp, 0x14
test al, al
jne 0x40ec16
mov cl, byte [0x514796]
mov al, byte [0x514794]
mov byte [esp + 0xa], cl
mov cl, byte [0x514795]
mov byte [esp + 9], al
mov al, cl
and al, 0x80
mov dl, byte [0x514797]
mov byte [esp + 6], al
mov al, cl
and al, 0x10
push ebx
mov byte [esp + 9], al
mov al, cl
and al, 8
mov byte [esp + 0xf], dl
mov byte [esp + 8], al
mov al, cl
mov dl, cl
mov bl, cl
not al
and cl, 1
push esi
mov esi, dword [0x514790]
and bl, 4
shr al, 1
mov byte [esp + 0xb], cl
mov cl, byte [0x514798]
and dl, 0x40
and al, 1
test bl, bl
mov dword [esp + 0x18], esi
mov byte [esp + 0xf], dl
mov byte [esp + 0x10], al
mov byte [esp + 0x14], cl
jne 0x40eb90
mov bl, byte [esp + 0x14]
mov ecx, esi
mov esi, dword [0x514798]
push edi
mov edi, dword [0x5167ac]
and esi, 0xff
shr ecx, 8
dec bl
mov byte [esi + edi], cl
mov esi, dword [0x5167ac]
mov byte [esp + 0x18], bl
mov ecx, dword [esp + 0x18]
mov bl, byte [esp + 0x1c]
and ecx, 0xff
push 0xfffe
mov byte [esp + 0x15], 0
mov byte [ecx + esi], bl
mov cl, byte [esp + 0x1c]
mov bl, byte [esp + 0x13]
dec cl
test bl, bl
mov byte [esp + 0x1c], cl
setne cl
test al, al
setne al
dec al
mov bl, byte [esp + 0x1c]
and eax, 2
or cl, al
mov al, byte [esp + 0x16]
neg dl
sbb dl, dl
and edx, 0x40
or cl, dl
mov dl, byte [esp + 0x14]
neg dl
sbb dl, dl
and al, 0xa0
and edx, 8
or cl, dl
mov edx, dword [esp + 0x1c]
or cl, al
mov eax, dword [0x5167ac]
or cl, 0x20
and edx, 0xff
dec bl
mov byte [esp + 0x1c], bl
mov byte [edx + eax], cl
mov bl, 1
call fcn.0040a3e0
mov dl, byte [esp + 0x17]
mov ecx, eax
mov eax, dword [0x5147a0]
add esp, 4
add eax, 7
mov dword [0x5147a0], eax
mov al, byte [esp + 0x14]
pop edi
jmp 0x40eb94
mov ecx, dword [esp + 0x18]
mov dword [0x514790], ecx
mov cl, byte [esp + 0x11]
mov byte [0x514794], cl
mov cl, byte [esp + 0x12]
mov byte [0x514796], cl
mov cl, byte [esp + 0x13]
mov byte [0x514797], cl
mov cl, byte [esp + 0xb]
test cl, cl
setne cl
test al, al
setne al
dec al
pop esi
and eax, 2
or cl, al
mov al, byte [esp + 8]
neg dl
sbb dl, dl
and edx, 0x40
or cl, dl
neg bl
sbb bl, bl
and ebx, 4
or cl, bl
pop ebx
neg al
sbb al, al
and eax, 8
or cl, al
mov al, byte [esp + 5]
neg al
sbb al, al
and eax, 0x10
or cl, al
mov al, byte [esp + 6]
and al, 0xa0
or cl, al
or cl, 0x20
mov byte [0x514795], cl
mov cl, byte [esp + 0xc]
mov byte [0x514798], cl
add esp, 0x14
ret
Function at 0x40ec20
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [0x51479b]
sub esp, 0x14
test al, al
jne 0x40edfd
mov cl, byte [0x514796]
mov al, byte [0x514794]
mov byte [esp + 0xa], cl
mov cl, byte [0x514795]
mov byte [esp + 9], al
mov al, cl
and al, 0x80
mov dl, byte [0x514797]
mov byte [esp + 6], al
mov al, cl
and al, 0x10
push ebx
mov byte [esp + 9], al
mov al, cl
and al, 8
mov byte [esp + 0xf], dl
mov byte [esp + 8], al
mov al, cl
mov dl, cl
mov bl, cl
not al
and cl, 1
push esi
mov esi, dword [0x514790]
and bl, 4
shr al, 1
mov byte [esp + 0xb], cl
mov cl, byte [0x514798]
and dl, 0x40
and al, 1
test bl, bl
mov dword [esp + 0x18], esi
mov byte [esp + 0xf], dl
mov byte [esp + 0x10], al
mov byte [esp + 0x14], cl
jne 0x40ed70
mov bl, byte [esp + 0x14]
mov ecx, esi
mov esi, dword [0x514798]
push edi
mov edi, dword [0x5167ac]
and esi, 0xff
shr ecx, 8
dec bl
mov byte [esi + edi], cl
mov esi, dword [0x5167ac]
mov byte [esp + 0x18], bl
mov ecx, dword [esp + 0x18]
mov bl, byte [esp + 0x1c]
and ecx, 0xff
push 0xfffe
mov byte [esp + 0x15], 0
mov byte [ecx + esi], bl
mov cl, byte [esp + 0x1c]
mov bl, byte [esp + 0x13]
dec cl
test bl, bl
mov byte [esp + 0x1c], cl
setne cl
test al, al
setne al
dec al
mov bl, byte [esp + 0x1c]
and eax, 2
or cl, al
mov al, byte [esp + 0x16]
neg dl
sbb dl, dl
and edx, 0x40
or cl, dl
mov dl, byte [esp + 0x14]
neg dl
sbb dl, dl
and al, 0xa0
and edx, 8
or cl, dl
mov edx, dword [esp + 0x1c]
or cl, al
mov eax, dword [0x5167ac]
or cl, 0x20
and edx, 0xff
dec bl
mov byte [esp + 0x1c], bl
mov byte [edx + eax], cl
mov bl, 1
call fcn.0040a3e0
mov dl, byte [esp + 0x17]
mov ecx, eax
mov eax, dword [0x5147a0]
add esp, 4
add eax, 7
mov dword [0x5147a0], eax
mov al, byte [esp + 0x14]
pop edi
jmp 0x40ed7b
mov ecx, dword [esp + 0x18]
mov byte [0x51479a], 1
mov dword [0x514790], ecx
mov cl, byte [esp + 0x11]
mov byte [0x514794], cl
mov cl, byte [esp + 0x12]
mov byte [0x514796], cl
mov cl, byte [esp + 0x13]
mov byte [0x514797], cl
mov cl, byte [esp + 0xb]
test cl, cl
setne cl
test al, al
setne al
dec al
pop esi
and eax, 2
or cl, al
mov al, byte [esp + 8]
neg dl
sbb dl, dl
and edx, 0x40
or cl, dl
neg bl
sbb bl, bl
and ebx, 4
or cl, bl
pop ebx
neg al
sbb al, al
and eax, 8
or cl, al
mov al, byte [esp + 5]
neg al
sbb al, al
and eax, 0x10
or cl, al
mov al, byte [esp + 6]
and al, 0xa0
or cl, al
or cl, 0x20
mov byte [0x514795], cl
mov cl, byte [esp + 0xc]
mov byte [0x514798], cl
add esp, 0x14
ret
Function at 0x418ba0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 2
jne 0x418bbc
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x418bbc
or byte [esi + 0x21329], 4
pop esi
ret

Function at 0x418bc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
xor eax, eax
push esi
mov esi, ecx
mov byte [esi + 0x21838], al
mov dword [esi + 0x2183c], eax
cmp byte [esi + 0xa], 2
jne 0x418cde
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x418bf1
mov byte [esi + 0x21838], 2
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x21350]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0x21350]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
fild dword [esp + 4]
fild dword [esp + 0x14]
fmul dword [0x497748]
fdivp st(1)
call fcn.0048ae50
cmp eax, 0xb0
jle 0x418c43
mov eax, 0xb0
jmp 0x418c4d
cmp eax, 0x20
jge 0x418c4d
mov eax, 0x20
mov ecx, 0x20
push edi
sub ecx, eax
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*2]
mov eax, 0x38e38e39
lea ecx, [ecx + edx*2]
shl ecx, 2
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
sub dl, 0x53
mov byte [esp + 8], dl
mov eax, dword [esp + 8]
and eax, 0xff
mov ecx, eax
mov edx, eax
and ecx, 1
and edx, 2
shl ecx, 2
or ecx, edx
mov edx, eax
shl ecx, 2
and edx, 4
mov edi, eax
or ecx, edx
mov edx, eax
shl ecx, 2
and edx, 8
or ecx, edx
mov edx, eax
and edx, 0x40
add ecx, ecx
shr edi, 2
or edx, edi
mov edi, eax
shr edx, 2
and edi, 0x20
and eax, 0x10
or edx, edi
pop edi
shr edx, 2
or edx, eax
mov eax, dword [esi + 0x2183c]
shr edx, 1
or ecx, edx
or eax, ecx
mov dword [esi + 0x2183c], eax
pop esi
add esp, 0x18
ret 4

Function at 0x419090
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0xa]
mov byte [esi + 0x21843], 0
cmp al, 6
jne 0x41911d
mov al, byte [esp + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 2
je 0x4190e1
push 0x44
call edi
test ah, ah
js 0x4190bf
or byte [esi + 0x21843], 0x10
push 0x45
call edi
test ah, ah
js 0x4190ce
or byte [esi + 0x21843], 8
push 0x53
call edi
test ah, ah
js 0x4190dd
or byte [esi + 0x21843], 4
push 0x57
jmp 0x419110
push 0x52
call edi
test ah, ah
js 0x4190f0
or byte [esi + 0x21843], 0x10
push 0x46
call edi
test ah, ah
js 0x4190ff
or byte [esi + 0x21843], 8
push 0x41
call edi
test ah, ah
js 0x41910e
or byte [esi + 0x21843], 4
push 0x51
call edi
test ah, ah
js 0x41911d
or byte [esi + 0x21843], 2
pop edi
pop esi
ret 4
Function at 0x4196a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov al, byte [esi + 0xa]
mov byte [esi + 0x21850], 0
cmp al, 8
jne 0x419784
test bl, 4
jne 0x419702
push 0x52
call edi
test ah, ah
js 0x4196d5
or byte [esi + 0x21850], 0x10
push 0x45
call edi
test ah, ah
js 0x4196e4
or byte [esi + 0x21850], 8
push 0x57
call edi
test ah, ah
js 0x4196f3
or byte [esi + 0x21850], 4
push 0x51
call edi
test ah, ah
js 0x419702
or byte [esi + 0x21850], 2
test bl, 2
jne 0x419743
push 0x46
call edi
test ah, ah
js 0x419716
or byte [esi + 0x21850], 0x10
push 0x44
call edi
test ah, ah
js 0x419725
or byte [esi + 0x21850], 8
push 0x53
call edi
test ah, ah
js 0x419734
or byte [esi + 0x21850], 4
push 0x41
call edi
test ah, ah
js 0x419743
or byte [esi + 0x21850], 2
test bl, 1
jne 0x419784
push 0x56
call edi
test ah, ah
js 0x419757
or byte [esi + 0x21850], 0x10
push 0x43
call edi
test ah, ah
js 0x419766
or byte [esi + 0x21850], 8
push 0x58
call edi
test ah, ah
js 0x419775
or byte [esi + 0x21850], 4
push 0x5a
call edi
test ah, ah
js 0x419784
or byte [esi + 0x21850], 2
cmp byte [esi + 0xa], 9
jne 0x419851
test bl, 4
jne 0x4197cf
push 0x51
call edi
test ah, ah
js 0x4197a2
or byte [esi + 0x21850], 0x10
push 0x57
call edi
test ah, ah
js 0x4197b1
or byte [esi + 0x21850], 8
push 0x45
call edi
test ah, ah
js 0x4197c0
or byte [esi + 0x21850], 4
push 0x52
call edi
test ah, ah
js 0x4197cf
or byte [esi + 0x21850], 2
test bl, 2
jne 0x419810
push 0x41
call edi
test ah, ah
js 0x4197e3
or byte [esi + 0x21850], 0x10
push 0x53
call edi
test ah, ah
js 0x4197f2
or byte [esi + 0x21850], 8
push 0x44
call edi
test ah, ah
js 0x419801
or byte [esi + 0x21850], 4
push 0x46
call edi
test ah, ah
js 0x419810
or byte [esi + 0x21850], 2
test bl, 1
jne 0x419851
push 0x5a
call edi
test ah, ah
js 0x419824
or byte [esi + 0x21850], 0x10
push 0x58
call edi
test ah, ah
js 0x419833
or byte [esi + 0x21850], 8
push 0x43
call edi
test ah, ah
js 0x419842
or byte [esi + 0x21850], 4
push 0x56
call edi
test ah, ah
js 0x419851
or byte [esi + 0x21850], 2
pop edi
pop esi
pop ebx
ret 4
Function at 0x419900
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0xa]
mov dword [esi + 0x21854], 0
cmp al, 0xb
jne 0x419af5
mov al, byte [esp + 0xc]
and al, 6
cmp al, 2
jne 0x41999e
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x4a
call edi
test ah, ah
jns 0x41993f
mov eax, dword [esi + 0x21854]
or al, 4
mov dword [esi + 0x21854], eax
push 0x48
call edi
test ah, ah
jns 0x419955
mov eax, dword [esi + 0x21854]
or al, 8
mov dword [esi + 0x21854], eax
push 0x47
call edi
test ah, ah
jns 0x41996b
mov eax, dword [esi + 0x21854]
or al, 0x10
mov dword [esi + 0x21854], eax
push 0x46
call edi
test ah, ah
jns 0x419981
mov eax, dword [esi + 0x21854]
or al, 0x20
mov dword [esi + 0x21854], eax
push 0x44
call edi
test ah, ah
jns 0x419997
mov eax, dword [esi + 0x21854]
or al, 0x40
mov dword [esi + 0x21854], eax
push 0x53
jmp 0x419ae1
cmp al, 4
jne 0x419a4d
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x41
call edi
test ah, ah
jns 0x4199c2
mov eax, dword [esi + 0x21854]
or al, 1
mov dword [esi + 0x21854], eax
push 0x55
call edi
test ah, ah
jns 0x4199d8
mov eax, dword [esi + 0x21854]
or al, 2
mov dword [esi + 0x21854], eax
push 0x59
call edi
test ah, ah
jns 0x4199ee
mov eax, dword [esi + 0x21854]
or al, 4
mov dword [esi + 0x21854], eax
push 0x54
call edi
test ah, ah
jns 0x419a04
mov eax, dword [esi + 0x21854]
or al, 8
mov dword [esi + 0x21854], eax
push 0x52
call edi
test ah, ah
jns 0x419a1a
mov eax, dword [esi + 0x21854]
or al, 0x10
mov dword [esi + 0x21854], eax
push 0x45
call edi
test ah, ah
jns 0x419a30
mov eax, dword [esi + 0x21854]
or al, 0x20
mov dword [esi + 0x21854], eax
push 0x57
call edi
test ah, ah
jns 0x419a46
mov eax, dword [esi + 0x21854]
or al, 0x40
mov dword [esi + 0x21854], eax
push 0x51
jmp 0x419ae1
cmp al, 6
jne 0x419af5
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x4d
call edi
test ah, ah
jns 0x419a71
mov eax, dword [esi + 0x21854]
or al, 2
mov dword [esi + 0x21854], eax
push 0x4e
call edi
test ah, ah
jns 0x419a87
mov eax, dword [esi + 0x21854]
or al, 4
mov dword [esi + 0x21854], eax
push 0x42
call edi
test ah, ah
jns 0x419a9d
mov eax, dword [esi + 0x21854]
or al, 8
mov dword [esi + 0x21854], eax
push 0x56
call edi
test ah, ah
jns 0x419ab3
mov eax, dword [esi + 0x21854]
or al, 0x10
mov dword [esi + 0x21854], eax
push 0x43
call edi
test ah, ah
jns 0x419ac9
mov eax, dword [esi + 0x21854]
or al, 0x20
mov dword [esi + 0x21854], eax
push 0x5a
call edi
test ah, ah
jns 0x419adf
mov eax, dword [esi + 0x21854]
or al, 0x40
mov dword [esi + 0x21854], eax
push 0x58
call edi
test ah, ah
jns 0x419af5
mov eax, dword [esi + 0x21854]
or al, 0x80
mov dword [esi + 0x21854], eax
pop edi
pop esi
ret 4
Function at 0x419b20
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0xc
jne 0x419d35
mov al, byte [esp + 0x28]
push ebx
test al, 1
jne 0x419cbc
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
xor edi, edi
push 1
mov byte [esi + 0x21858], 0
mov dword [esi + 0x2185c], edi
call ebp
test ah, ah
jns 0x419b6a
mov eax, dword [esi + 0x2185c]
or al, 1
mov dword [esi + 0x2185c], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x21350]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0x21350]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x518028], edi
je 0x419bb1
mov edx, dword [0x518024]
mov eax, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x2c], eax
mov al, byte [0x528bba]
mov ebx, 2
test al, al
jne 0x419bd1
mov eax, dword [esi + 0xd0]
cmp byte [eax + 4], bl
je 0x419bd1
mov eax, 8
jmp 0x419bd3
xor eax, eax
fild dword [esp + 0x14]
fild dword [esp + 0x2c]
lea ecx, [eax + eax]
mov edx, 0xf0
sub edx, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
fidiv dword [esp + 0x18]
fdivp st(1)
call fcn.0048ae50
fild dword [esp + 0x10]
fild dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x14], edi
fmul dword [0x497748]
fdivp st(1)
call fcn.0048ae50
push 1
mov dword [esp + 0x14], eax
call ebp
cmp edi, 0x30
jle 0x419c3c
test ah, ah
jns 0x419c32
mov eax, dword [esi + 0x2185c]
or al, 1
mov dword [esi + 0x2185c], eax
mov eax, dword [esi + 0x2185c]
or eax, ebx
jmp 0x419c48
test ah, ah
jns 0x419c4e
mov eax, dword [esi + 0x2185c]
or al, 3
mov dword [esi + 0x2185c], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 4
cdq
and edx, 0xff
add eax, edx
mov ecx, eax
sar ecx, 8
add ecx, 8
jns 0x419c70
xor ecx, ecx
mov edi, dword [esp + 0x14]
mov eax, 0x88888889
shl edi, 8
imul edi
add edx, edi
pop edi
sar edx, 7
mov eax, edx
pop ebp
shr eax, 0x1f
lea eax, [edx + eax - 0xc]
test eax, eax
jge 0x419c94
xor eax, eax
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x2185c]
shl ecx, 2
or eax, ecx
mov cl, byte [esp + 0x2c]
mov dword [esi + 0x2185c], eax
mov byte [esi + 0x21860], cl
pop ebx
pop esi
add esp, 0x20
ret 4
mov al, byte [esi + 0x21860]
mov ebx, 2
test bl, al
jne 0x419cdf
test byte [esp + 0x2c], bl
je 0x419ce5
mov eax, dword [esi + 0x2185c]
add eax, eax
mov dword [esi + 0x2185c], eax
test byte [esp + 0x2c], bl
jne 0x419cfe
mov cl, byte [esp + 0x2c]
mov byte [esi + 0x21858], 4
mov byte [esi + 0x21860], cl
pop ebx
pop esi
add esp, 0x20
ret 4
test dword [esi + 0x2185c], 0x40000
je 0x419d23
mov cl, byte [esp + 0x2c]
mov byte [esi + 0x21858], 0
mov byte [esi + 0x21860], cl
pop ebx
pop esi
add esp, 0x20
ret 4
mov cl, byte [esp + 0x2c]
mov byte [esi + 0x21858], 8
mov byte [esi + 0x21860], cl
pop ebx
pop esi
add esp, 0x20
ret 4
Function at 0x419d44
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
cmp byte [esi + 0xa], 0xd
jne 0x419e9c
push 1
mov bl, 8
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x419d64
mov bl, 0x18
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x21350]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0x21350]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x518028]
test eax, eax
je 0x419dac
mov edx, dword [0x518024]
mov eax, dword [esp + 0x28]
sub eax, edx
mov dword [esp + 0x28], eax
mov al, byte [0x528bba]
test al, al
jne 0x419dc8
mov eax, dword [esi + 0xd0]
cmp byte [eax + 4], 2
je 0x419dc8
mov eax, 8
jmp 0x419dca
xor eax, eax
fild dword [esp + 0x18]
fild dword [esp + 0x28]
lea ecx, [eax + eax]
mov edx, 0xf0
sub edx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
fidiv dword [esp + 0xc]
fdivp st(1)
call fcn.0048ae50
fild dword [esp + 0x14]
fild dword [esp + 0x24]
mov edi, eax
mov dword [esp + 0x18], edi
fmul dword [0x497748]
fdivp st(1)
call fcn.0048ae50
test eax, eax
mov dword [esp + 0x14], eax
jle 0x419e9c
cmp eax, 0xff
jge 0x419e9c
test edi, edi
jle 0x419e9c
cmp edi, 0xef
jge 0x419e9c
mov ecx, edi
mov edx, dword [esi + 0xe4]
shl ecx, 4
add ecx, edi
mov edi, dword [esi + 0xdc]
shl ecx, 4
add ecx, edi
mov al, byte [ecx + eax + 0x96e4]
mov ecx, dword [edx + 0x18]
and al, 0x3f
cmp ecx, 0xbc1dce96
mov byte [esp + 0xc], al
jne 0x419e91
mov eax, dword [esp + 0xc]
and eax, 0xff
lea ecx, [esi + eax*2]
add ecx, eax
mov dl, byte [ecx + 0xd]
test dl, dl
jbe 0x419e9c
mov dl, byte [ecx + 0xe]
test dl, dl
jne 0x419e9c
lea edx, [esi + eax*2 + 0xa]
mov cl, byte [eax + edx + 5]
test cl, cl
jbe 0x419e9c
and bl, 0xf7
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x20
ret
cmp al, 0x20
je 0x419e99
cmp al, 0x30
jne 0x419e9c
and bl, 0xf7
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x419f10
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0xa]
mov byte [esi + 0x21861], 0
cmp al, 0xe
jne 0x419ff5
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
mov bl, byte [esp + 0x10]
test bl, 4
jne 0x419f72
push 0x52
call edi
test ah, ah
js 0x419f45
or byte [esi + 0x21861], 0x10
push 0x45
call edi
test ah, ah
js 0x419f54
or byte [esi + 0x21861], 8
push 0x57
call edi
test ah, ah
js 0x419f63
or byte [esi + 0x21861], 4
push 0x51
call edi
test ah, ah
js 0x419f72
or byte [esi + 0x21861], 2
test bl, 2
jne 0x419fb3
push 0x46
call edi
test ah, ah
js 0x419f86
or byte [esi + 0x21861], 0x10
push 0x44
call edi
test ah, ah
js 0x419f95
or byte [esi + 0x21861], 8
push 0x53
call edi
test ah, ah
js 0x419fa4
or byte [esi + 0x21861], 4
push 0x41
call edi
test ah, ah
js 0x419fb3
or byte [esi + 0x21861], 2
test bl, 1
pop ebx
jne 0x419ff5
push 0x56
call edi
test ah, ah
js 0x419fc8
or byte [esi + 0x21861], 0x10
push 0x43
call edi
test ah, ah
js 0x419fd7
or byte [esi + 0x21861], 8
push 0x58
call edi
test ah, ah
js 0x419fe6
or byte [esi + 0x21861], 4
push 0x5a
call edi
test ah, ah
js 0x419ff5
or byte [esi + 0x21861], 2
pop edi
pop esi
ret 4