joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db80
Capabilities:
Create process on windows

Disassembly:
push 0xa
push 0
push 0
push str.charmap.exe
push str.open
push dword [0x4527bc]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x40e5a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetControlNlsCodePage
push 0x80000002
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e6aa
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x46cf20
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 8]
push eax
mov edi, 0x4710c0
push edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, 0x400
jmp 0x40e685
inc dword [ebp - 0xc]
cmp byte [0x46cf20], 0
je 0x40e66e
push 0
push edi
call fcn.004013dd
test eax, eax
pop ecx
pop ecx
jle 0x40e66e
cmp eax, 0x10000
jge 0x40e66e
cmp eax, dword [0x45367c]
je 0x40e66e
cmp eax, dword [0x453888]
je 0x40e66e
cmp eax, 0x4b0
je 0x40e66e
cmp eax, 0x4b1
je 0x40e66e
cmp eax, 0xfde9
je 0x40e66e
cmp eax, 0xfde8
je 0x40e66e
cmp eax, 0x2ee0
je 0x40e66e
cmp eax, 0x2ee1
je 0x40e66e
mov ecx, dword [0x4538a4]
mov dword [ecx + eax*4], 1
inc dword [0x453b08]
lea eax, [ebp - 4]
push eax
push 0x46cf20
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov byte [0x46cf20], 0
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call ebx
test eax, eax
je 0x40e600
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f5dc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
jne 0x40f5f7
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
je 0x40f5fb
xor eax, eax
jmp 0x40f639
push esi
mov esi, dword [eax + 0x78]
add esi, edi
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40f638
and dword [ebp + 8], 0
cmp dword [esi + 0x18], 0
push ebx
lea ebx, [eax + edi]
jbe 0x40f634
mov eax, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
push dword [ebp + 0x10]
add eax, edi
push eax
call dword [ebp + 0xc]
test eax, eax
je 0x40f634
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x40f616
xor eax, eax
inc eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f63c
Capabilities:
Log keystrokes

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xc8
push ebx
mov bx, word [ebp + 0x78]
xor eax, eax
cmp bx, ax
push esi
mov esi, dword [ebp + 0x7c]
mov word [esi], ax
mov word [ebp - 0x58], ax
je 0x40f6d7
cmp dword [0x4714c4], eax
push eax
movzx eax, bl
push eax
je 0x40f673
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
jmp 0x40f679
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shr bx, 8
shl eax, 0x10
test bl, 8
je 0x40f68a
or eax, 0x1000000
push 0x64
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.00403724
add esp, 0xc
test bl, 4
mov eax, 0x44d7e0
mov edx, str.Alt_
jne 0x40f6aa
mov edx, eax
test bl, 1
mov ecx, str.Shift_
jne 0x40f6b6
mov ecx, eax
test bl, 2
je 0x40f6c0
mov eax, str.Ctrl_
push edi
lea edi, [ebp - 0x58]
push edi
push edx
push ecx
push eax
push str._s_s_s_s
push esi
call fcn.00401644
add esp, 0x18
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret

Function at 0x410982
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov cx, word [eax]
push 2
pop edx
add eax, edx
cmp cx, 0x22
mov cx, word [eax]
jne 0x4109b7
jmp 0x4109a5
test cx, cx
je 0x4109cb
add eax, edx
mov cx, word [eax]
cmp cx, 0x22
jne 0x41099b
jmp 0x4109bd
test cx, cx
je 0x4109cb
add eax, edx
mov cx, word [eax]
cmp cx, 0x20
jne 0x4109ad
cmp word [eax], 0
je 0x4109cb
add eax, edx
cmp word [eax], 0x20
je 0x4109c3
ret

Function at 0x41181b
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0xffffffff
push edi
movzx ebx, si
je 0x411874
push ebp
xor ebp, ebp
cmp dword [0x452534], ebp
push ebp
je 0x41185e
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayout]
call esi
movzx edi, ax
cmp edi, ebx
je 0x411873
push ebp
push 1
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
push ebp
call esi
movzx eax, ax
cmp eax, edi
je 0x411873
cmp eax, ebx
jne 0x411845
jmp 0x411873
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
cmp eax, ebx
je 0x411873
push ebp
push esi
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x416f58
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41711d
cmp dword [0x4714c4], ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
jne 0x41704b
push 0xd
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x41704b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, ebx
je 0x417115
push esi
call fcn.0042e475
cmp dword [ebp + 0xc], ebx
pop ecx
jle 0x416fc1
cmp eax, dword [ebp + 0xc]
jle 0x416fb9
mov eax, dword [ebp + 0xc]
lea ecx, [esi + eax*2]
mov dword [ebp - 4], ecx
jmp 0x416fc5
or dword [ebp - 4], 0xffffffff
inc eax
push eax
call fcn.004125b5
mov edi, eax
test edi, edi
pop ecx
je 0x41710c
cmp esi, dword [ebp - 4]
mov ecx, edi
mov eax, esi
jae 0x417028
mov dx, word [eax]
cmp dx, 0xd
jne 0x41700f
mov word [ecx], dx
lea edx, [eax + 2]
mov bx, word [edx]
cmp bx, 0xd
jne 0x417005
lea esi, [eax + 4]
cmp word [esi], 0xa
jne 0x417005
mov eax, esi
jmp 0x41701f
cmp bx, 0xa
jne 0x41701f
mov eax, edx
jmp 0x41701f
cmp dx, 0xa
jne 0x41701c
mov word [ecx], 0xd
jmp 0x41701f
mov word [ecx], dx
inc eax
inc eax
inc ecx
inc ecx
cmp eax, dword [ebp - 4]
jb 0x416fe0
and word [ecx], 0
push edi
xor ebx, ebx
inc ebx
push ebx
push 0xc2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call fcn.004125cd
pop ecx
jmp 0x41710c
push 1
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x417115
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp esi, ebx
je 0x417115
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp + 0xc], ebx
jle 0x417087
cmp eax, dword [ebp + 0xc]
jle 0x41707f
mov eax, dword [ebp + 0xc]
lea ecx, [eax + esi]
mov dword [ebp - 4], ecx
jmp 0x41708b
or dword [ebp - 4], 0xffffffff
inc eax
push eax
push ebx
push dword [0x470e7c]
call fcn.00412555
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41710c
cmp esi, dword [ebp - 4]
mov ecx, edi
mov eax, esi
jae 0x4170e5
mov dl, byte [eax]
cmp dl, 0xd
jne 0x4170d2
lea esi, [eax + 1]
mov byte [ecx], dl
mov bl, byte [esi]
cmp bl, dl
jne 0x4170c9
lea edx, [eax + 2]
cmp byte [edx], 0xa
jne 0x4170c9
mov eax, edx
jmp 0x4170de
cmp bl, 0xa
jne 0x4170de
mov eax, esi
jmp 0x4170de
cmp dl, 0xa
jne 0x4170dc
mov byte [ecx], 0xd
jmp 0x4170de
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, dword [ebp - 4]
jb 0x4170ab
push edi
xor ebx, ebx
inc ebx
push ebx
push 0xc2
push dword [ebp + 8]
mov byte [ecx], 0
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0
push dword [0x470e7c]
call fcn.004125a2
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x41a50b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x44]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
mov dword [edi], eax
mov dword [ebx], eax
mov dword [ebp - 8], eax
mov dword [ecx], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0x14], eax
je 0x41a5f9
push eax
push 0
push dword [0x470e7c]
call fcn.00412555
add esp, 0xc
test eax, eax
mov dword [ebp + 0x18], eax
je 0x41a5f9
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41a5e6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x44e68c
push dword [ebp + 0x18]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41a5be
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov edx, dword [eax + 8]
mov ecx, 0xffff
and edx, ecx
mov dword [ebx], edx
movzx edx, word [eax + 0xe]
mov dword [edi], edx
mov eax, dword [eax + 0xc]
and eax, ecx
mov dword [esi], eax
mov dword [ebp - 8], 1
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x41a5e6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push dword [ebp + 0x18]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41a5e6
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov dword [esi], eax
push dword [ebp + 0x18]
push 0
push dword [0x470e7c]
call fcn.004125a2
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a601
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x44]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
mov dword [edi], eax
mov dword [ebx], eax
mov dword [ebp - 8], eax
mov dword [ecx], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp + 0x14], eax
je 0x41a6ef
push eax
push 0
push dword [0x470e7c]
call fcn.00412555
add esp, 0xc
test eax, eax
mov dword [ebp + 0x18], eax
je 0x41a6ef
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41a6dc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x44e6c4
push dword [ebp + 0x18]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41a6b4
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov edx, dword [eax + 8]
mov ecx, 0xffff
and edx, ecx
mov dword [ebx], edx
movzx edx, word [eax + 0xe]
mov dword [edi], edx
mov eax, dword [eax + 0xc]
and eax, ecx
mov dword [esi], eax
mov dword [ebp - 8], 1
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x41a6dc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x44e690
push dword [ebp + 0x18]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41a6dc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov dword [esi], eax
push dword [ebp + 0x18]
push 0
push dword [0x470e7c]
call fcn.004125a2
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a6f7
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
je 0x41a828
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [ebp + 8]
jne 0x41a828
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.0042ce6c
test eax, eax
pop ecx
pop ecx
je 0x41a751
lea eax, [ebp - 0x20]
push eax
call fcn.0042cf78
cmp eax, ebx
pop ecx
jl 0x41a751
push eax
call fcn.004117f1
add esp, 4
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x41a776
push dword [ebp + 0xc]
call fcn.0042cf78
cmp eax, ebx
pop ecx
jl 0x41a828
push eax
call fcn.004117f1
add esp, 4
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x41a828
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push ebx
push ebx
call esi
mov edi, eax
cmp edi, 1
jle 0x41a826
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x41a826
push eax
push edi
call esi
xor eax, eax
cmp edi, ebx
jle 0x41a81d
mov esi, 0x3ff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx + eax*4]
mov dx, word [ecx]
and dx, si
cmp dx, 9
jne 0x41a7cc
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
jmp 0x41a7d6
cmp dword [ebp - 0xc], ebx
jne 0x41a7d6
mov ecx, dword [ecx]
mov dword [ebp - 0xc], ecx
inc eax
cmp eax, edi
jl 0x41a7b3
cmp dword [ebp - 4], ebx
je 0x41a81d
push ebx
push ebx
push 0xbe7
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
and eax, esi
xor esi, esi
inc esi
cmp dword [ebp - 8], esi
jne 0x41a805
cmp eax, 9
je 0x41a81d
push ebx
push dword [ebp - 4]
jmp 0x41a814
cmp dword [ebp - 8], 2
jne 0x41a81d
cmp eax, 9
jne 0x41a81d
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret
Function at 0x41a82e
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
xor ebx, ebx
cmp eax, ebx
jne 0x41a83f
xor eax, eax
pop ebx
ret
mov ecx, dword [0x4527bc]
cmp eax, ecx
jne 0x41a84b
xor eax, eax
cmp eax, ebx
jne 0x41a85d
mov dword [0x452e70], ebx
mov dword [0x452e84], ebx
jmp 0x41a893
cmp eax, dword [0x452e74]
jne 0x41a884
mov eax, dword [0x452e78]
cmp eax, ebx
jne 0x41a87c
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4527bc]
pop ebx
ret
mov dword [0x452e84], ebx
jmp 0x41a88e
mov dword [0x452e84], 1
mov dword [0x452e70], eax
push esi
push 0x452e70
push 0x4118d6
mov dword [0x452e88], ebx
mov dword [0x452e74], ebx
mov dword [0x452e78], ebx
mov dword [0x452e7c], ebx
mov dword [0x452e80], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x452e88], ebx
je 0x41a903
cmp dword [0x452e84], ebx
je 0x41a8ea
mov esi, dword [0x452e78]
mov eax, dword [0x452e7c]
mov dword [0x452e74], esi
mov dword [0x452e78], eax
jmp 0x41a8f0
mov esi, dword [0x452e74]
test esi, esi
jne 0x41a8fa
mov esi, dword [0x4527bc]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x41a958
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, ebx
je 0x41a94a
push edi
call fcn.00410e7b
test eax, eax
pop ecx
mov esi, 0x45280c
jne 0x41a936
cmp edi, dword [0x452ce0]
je 0x41a936
push 1
push edi
push esi
call fcn.0040fe94
add esp, 0xc
mov ebx, eax
push dword [esp + 0x10]
push ebx
push esi
call fcn.0040fed4
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41a950
mov esi, dword [0x4527bc]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41de0f
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
cmp eax, 0x201
push edi
mov edi, 0x203
je 0x41df1f
cmp eax, edi
je 0x41df1f
cmp eax, 0x200
jne 0x41de8c
test byte [0x4527c4], 1
je 0x41e00e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x452e98]
sub eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040e23d
mov eax, dword [0x452e9c]
sub eax, dword [ebp - 4]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040e30a
mov eax, dword [ebp - 8]
mov dword [0x452e98], eax
mov eax, dword [ebp - 4]
add esp, 0x18
mov dword [0x452e9c], eax
jmp 0x41e00e
cmp eax, 0x202
je 0x41def9
cmp eax, 0x215
je 0x41def9
cmp eax, 2
je 0x41def9
cmp eax, 5
jne 0x41debc
cmp dword [ebp + 0x14], 0
je 0x41e00e
push dword [ebp + 8]
call fcn.00415b50
pop ecx
jmp 0x41e00e
cmp eax, 0x114
jne 0x41ded4
movzx eax, word [ebp + 0x10]
push 0
push eax
push dword [ebp + 8]
call fcn.0040e23d
jmp 0x41deee
cmp eax, 0x115
jne 0x41e00e
movzx eax, word [ebp + 0x10]
push 0
push eax
push dword [ebp + 8]
call fcn.0040e30a
xor eax, eax
add esp, 0xc
inc eax
jmp 0x41e010
test byte [0x4527c4], 1
je 0x41e00e
push 1
call fcn.004117d4
pop ecx
push dword [0x46c6dc]
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x41e00e
test byte [0x4527c4], 1
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
jne 0x41df51
push 1
push dword [ebp + 8]
call fcn.004117b6
pop ecx
pop ecx
push dword [0x453af8]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x452e98
call esi
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x41e00d
push 0x64
pop edi
cmp dword [0x46cf00], edi
jne 0x41df7e
push 0
push 0xffffffffffffffff
push 0x498
push dword [0x452904]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41e00d
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [0x46cf00]
mov eax, dword [0x471cf8]
mov ecx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
add eax, ecx
push eax
push edi
call esi
sub eax, dword [ebp - 8]
push dword [0x46cf00]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x471cfc]
add eax, ecx
push eax
push edi
call esi
sub eax, dword [ebp - 4]
push 1
push edi
push 0x498
push dword [0x452904]
mov dword [ebp - 4], eax
mov dword [0x46c6ec], 1
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 8]
and dword [0x46c6ec], 0
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040e23d
push dword [ebp - 4]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040e30a
add esp, 0x18
pop esi
xor eax, eax
pop edi
leave
ret 0x10
Function at 0x4229b3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
cmp eax, 0x104
mov dword [ebp - 4], esi
mov byte [ebp + 0xb], 0
je 0x4229df
cmp eax, 0x100
je 0x4229df
xor eax, eax
jmp 0x422a54
test byte [edi + 0xf], 1
je 0x4229e9
mov byte [ebp + 0xb], 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
test al, al
jns 0x4229fc
or byte [ebp + 0xb], 2
push 0x12
call ebx
test al, al
jns 0x422a08
or byte [ebp + 0xb], 4
push 0x10
call ebx
test al, al
jns 0x422a14
or byte [ebp + 0xb], 1
xor eax, eax
mov ah, byte [ebp + 0xb]
xor ebx, ebx
mov al, byte [edi + 8]
mov edi, eax
jmp 0x422a30
cmp word [esi + 0x31c], di
je 0x422a58
mov esi, dword [esi]
mov dword [ebp - 4], esi
cmp esi, ebx
jne 0x422a22
lea eax, [ebp + 0xc]
push eax
movzx eax, di
push eax
push 0x439
push dword [0x4527bc]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
leave
ret
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
add esi, 0x110
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00422613
add esp, 0xc
test al, 8
jne 0x422a34
xor eax, eax
inc eax
jmp 0x422a53
Function at 0x423228
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
xor ebp, ebp
cmp word [0x46ebcc], bp
je 0x42345f
mov eax, dword [0x46edd8]
push ebx
mov ebx, dword [esp + 0x10]
test ebx, eax
je 0x42345e
test al, 1
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, 0x4529a4
je 0x42325e
test bl, 1
jne 0x423270
test al, 2
je 0x423267
test bl, 2
jne 0x423270
test al, 4
je 0x4232a2
test bl, 4
je 0x4232a2
push edi
call fcn.0042cf78
cmp eax, 0xfffffffb
pop ecx
mov dword [esi + 0xbf4], eax
jg 0x423293
cmp eax, 0xfffffff8
jl 0x423293
mov dword [esi + 0xbf4], 0xd
jmp 0x4232a2
cmp eax, 0xfffffffc
jne 0x4232a2
mov dword [esi + 0xbf4], 0xffff
test byte [0x46edd8], 8
je 0x4232c1
test bl, 8
je 0x4232c1
push edi
push dword [esi + 0xc]
call fcn.0040ed0e
pop ecx
pop ecx
mov dword [esi + 0xbec], eax
test byte [0x46edd8], 0x10
je 0x4232e7
test bl, 0x10
je 0x4232e7
push ebp
push 3
push edi
push ebp
push dword [esi + 0xc]
call fcn.0040eca9
add esp, 0x14
neg eax
mov dword [esi + 0xbf0], eax
test byte [0x46edd8], 0x20
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
je 0x423320
test bl, 0x20
je 0x423320
test byte [0x46ebc8], 2
jne 0x42330e
cmp dword [esi + 0x34], ebp
je 0x42330e
push ebp
push 0xb
jmp 0x423310
push ebp
push ebp
push 0xc39
push dword [esi + 0xc]
call edi
mov dword [esi + 0xc00], eax
mov ecx, dword [0x46edd8]
test cl, 0x40
je 0x423330
test bl, 0x40
jne 0x423345
test cl, cl
jns 0x423338
test bl, bl
js 0x423345
mov eax, 0x100
test eax, ecx
je 0x4233be
test eax, ebx
je 0x4233be
mov eax, dword [0x45298c]
cmp dword [0x4529a4], eax
jne 0x423372
mov eax, dword [esi + 0xbf8]
inc eax
mov dword [esi + 0xc08], eax
push dword [0x452998]
push dword [0x452088]
call fcn.0040ed3c
jmp 0x42338b
push eax
push dword [0x452088]
call fcn.0040ed3c
inc eax
mov dword [esi + 0xc08], eax
mov eax, dword [esi + 0xbf8]
pop ecx
pop ecx
inc eax
push 0x452998
mov dword [esi + 0xc0c], eax
call fcn.0042cfdb
test eax, eax
mov eax, dword [esi + 0xc0c]
pop ecx
je 0x4233b1
sub eax, dword [esi + 0xc08]
jmp 0x4233b8
sub eax, dword [esi + 0xc08]
inc eax
mov dword [esi + 0xc04], eax
mov eax, 0x200
test dword [0x46edd8], eax
je 0x4233de
test eax, ebx
je 0x4233de
push dword [esi + 0xc]
call fcn.0040edb9
pop ecx
mov dword [esi + 0xc10], eax
mov eax, 0x400
test dword [0x46edd8], eax
je 0x423402
test eax, ebx
je 0x423402
push ebp
push 3
push 0xc74
push dword [esi + 0xc]
call edi
mov dword [esi + 0xc14], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov eax, 0x80000
test dword [0x46edd8], eax
je 0x42342c
test eax, ebx
je 0x42342c
push 0x14
call edi
and al, 1
dec al
neg al
sbb eax, eax
inc eax
mov dword [esi + 0xc18], eax
mov eax, 0x100000
test dword [0x46edd8], eax
je 0x423453
test eax, ebx
je 0x423453
push 0x90
call edi
and al, 1
dec al
neg al
sbb eax, eax
inc eax
mov dword [esi + 0xc1c], eax
push ebx
push esi
call fcn.0042117d
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4368ec
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
lea ebx, [esi + 0xc74]
xor edi, edi
lea ebp, [esi + 0xc68]
push ebx
push ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.0042cb8c
test eax, eax
pop ecx
pop ecx
je 0x436a89
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x436a89
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 1
push dword [esi + 0xcc4]
push 2
push edi
push edi
push ebx
push ebp
push esi
call fcn.004360db
mov ebx, eax
add esp, 0x20
cmp ebx, edi
je 0x436a0c
lea eax, [ebx + ebx]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x436a0c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
cmp ebp, edi
je 0x4369f0
push 1
push dword [esi + 0xcc4]
lea eax, [esi + 0xc74]
push 2
push 0xffffffffffffffff
push ebp
push eax
lea eax, [esi + 0xc68]
push eax
push esi
call fcn.004360db
push edi
push edi
push edi
push edi
push ebx
push ebp
push edi
push edi
call fcn.0042ebde
add esp, 0x40
push eax
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x4369e6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x4369e6
push edi
push edi
push dword [esp + 0x1c]
push eax
push ebx
push ebp
push edi
push edi
call fcn.0042ebde
add esp, 0x20
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SetClipboardData]
push 0xd
call ebp
cmp dword [esp + 0x10], edi
je 0x436a0c
push dword [esp + 0x10]
push 1
call ebp
cmp dword [esi + 0xcc4], edi
je 0x436a21
push edi
push dword [0x453660]
call dword [sym.imp.USER32.dll_SetClipboardData]
push 0x18
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, edi
je 0x436a7c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, edi
je 0x436a6f
mov ecx, dword [esp + 0x14]
mov edx, ecx
dec ecx
neg edx
sbb edx, edx
and edx, ecx
mov ecx, ebx
dec ebx
neg ecx
sbb ecx, ecx
and ecx, ebx
mov dword [eax + 0x10], ecx
mov ecx, edx
mov dword [eax + 0x14], edi
mov dword [eax], ecx
mov ecx, dword [eax + 0x10]
push eax
mov dword [eax + 8], edx
mov dword [eax + 0xc], edi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push dword [0x453664]
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret