joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411980
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
push 1
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp fcn.0041145b

Function at 0x4119f0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]
Function at 0x411d40
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
dec edi
sti
mov dword [esp + 0x60], ebx
mov byte [esp + 0x22], bl
cmp ecx, 4
ja case.default.0x411d53
jmp dword [ecx*4 + 0x40294c]
cmp dword [esp + 0x14], ebx
je fcn.0041145b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x44], ecx
test ecx, ecx
jne 0x411e72
test byte [eax + 5], 1
je fcn.0041145b
mov eax, dword [esp + 0x10]
call fcn.00468280
jmp fcn.0041145b
test byte [eax + 5], 4
jne fcn.0041145b
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x22], 1
jmp fcn.00412034
add dword [eax], eax
invalid

Function at 0x411d70
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
add edx, 0x32
mov dword [esp + 0x60], edx
jmp fcn.00412034

Function at 0x411da0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov al, byte [ecx]
jmp fcn.00412034

Function at 0x411e10
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
push ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
mov dword [esp + 0x24], eax
cmp eax, ebx
jne 0x411e93
cmp esi, ebx
je fcn.0041145b
push esi
call dword [sym.imp.SHELL32.dll_DragFinish]
mov edx, dword [esp + 0x10]
mov dword [edx + 0x6c], 0
jmp fcn.0041145b
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov esi, dword [esp + 0x2c]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
jmp fcn.00412034

Function at 0x411e90
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add dword [eax], eax
add byte [ebx - 0x74bbdbbc], cl
dec eax
add al, 0x8b
je 0x411ec1
sub al, 0x8a
add dword [ebx - 0x16e3dba4], ecx
mov eax, dword [ecx]
add byte [eax], al
mov edx, dword [esp + 0x34]
mov eax, 0x4a2c18
call fcn.00411310
mov dword [esp + 0x64], eax
cmp eax, ebx
je fcn.0041145b
invalid
mov edx, eax
mov eax, dword [edx + 0xc]
test eax, eax
je fcn.0041145b
mov eax, dword [eax + 4]
mov al, byte [eax]
mov ebx, dword [esp + 0x1c]
jmp fcn.00412034
Function at 0x411f30
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
je fcn.0041145b
mov ecx, edi
mov al, byte [ecx + 0x24]
cmp al, 1
je 0x411f4b
cmp al, 3
je 0x411f4b
mov dword [esp + 0x50], 0
mov edi, ecx
mov edx, dword [esp + 0x34]
push edx
call fcn.0041bb00
mov eax, dword [edi + 8]
cmp byte [eax], 0
jne fcn.0041145b
mov eax, dword [esp + 0x4c]
mov cl, byte [eax + 0x2e]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
neg cl
sbb cl, cl
and cl, byte [esp + 0x34]
mov byte [0x4a30c8], cl
mov edx, dword [eax]
mov eax, dword [edx + 4]
mov al, byte [eax]
jmp fcn.00412034

Function at 0x412060
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
mov ecx, dword [0x4a0b94]
mov edx, dword [0x49d334]
mov byte [esp + 0x54], al
cmp ecx, edx
jl 0x412081
add edx, 2
cmp ecx, edx
jge 0x41206f
cmp al, 0xd8
je 0x412081
cmp al, 0xc4
je 0x412081
cmp al, 0xd2
je 0x412081
cmp al, 0xd3
je 0x412081
cmp al, 0xce
je 0x412081
cmp al, 0xcf
je 0x412081
cmp al, 0xd0
je 0x412081
cmp al, 0xd1
je 0x412081
mov eax, dword [esp + 0x68]
test eax, eax
je fcn.0041145b
push eax
invalid
cmpsd dword [esi], dword es:[edi]
add dword [eax], eax
Function at 0x4120b0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
pop esp
and al, 0x1c
xor edi, edi
jmp 0x41220d
mov ecx, dword [0x49d3c8]
cmp edi, dword [ecx + 0x2c]
jge 0x41223e
cmp dword [esp + 0x68], 0
je fcn.0041145b
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.SHELL32.dll_DragFinish]
mov eax, dword [esp + 0x10]
mov dword [eax + 0x6c], 0
jmp fcn.0041145b
mov byte [esp + 0x18], 1
cmp esi, 0x402
je 0x4122b4
cmp esi, 0x413
jbe 0x41225f
cmp esi, 0x415
jbe 0x4122f3
mov ecx, dword [0x4a3088]
mov edx, dword [0x4a30c0]
mov dword [0x4a308c], ecx
mov dword [0x4a30c4], edx
cmp esi, 0x401
jne 0x41229a
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [0x4a3088], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a30c0], eax
jmp 0x4122f3
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
mov dword [0x4a3088], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a30c0], eax
jmp 0x4122f3
mov esi, dword [esp + 0x64]
mov edx, dword [esi]
push 0x104
push edx
push 0x4a2e7c
call fcn.0048a8e0
mov byte [0x4a2f80], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
add esp, 0xc
push 0x104
push ecx
push 0x4a2f81
call fcn.0048a8e0
add esp, 0xc
mov byte [0x4a3085], 0
mov ecx, dword [0x4a13a4]
mov esi, 1
push esi
call fcn.00411230
push 0x7f
push eax
lea edx, [esp + 0xc8]
push edx
call fcn.0048a8e0
mov eax, dword [esp + 0x60]
add esp, 0xc
push eax
push 0
push edi
mov al, 1
mov byte [esp + 0x14b], 0
call fcn.00412fb0
mov edi, dword [0x49d3c8]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a3104], eax
mov dword [0x4a3100], eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffbff
cmp eax, 0x14
ja case.default.0x412360
movzx ecx, byte [eax + 0x4029a0]
jmp dword [ecx*4 + 0x40298c]
mov ecx, dword [esp + 0x5c]
mov al, byte [ecx + 0x12]
cmp al, 0x9c
jb 0x412782
cmp al, 0x9f
ja 0x412782
mov edx, dword [esp + 0x34]
mov dword [edi + 0x38], edx
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x50]
push ecx
mov dword [edi + 0xa0], eax
call fcn.004199f0
mov ecx, dword [0x4a13a4]
dec dword [0x4a0b94]
sub dword [0x49d3c8], 0xd8
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0xcc]
push edx
call fcn.004768b0
push 0
mov eax, 0x4a2c18
call fcn.00424620
cmp dword [ebp + 0xc], 0
je fcn.0041145b
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x6c]
mov esi, dword [ebp + 8]
push eax
push ecx
call fcn.004129e0
add esp, 8
test eax, eax
je fcn.0041145b
mov byte [esp + 0x1a], 1
mov byte [esp + 0x58], 1
jmp fcn.0041145b

Function at 0x4120f0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
or cl, byte [edx]
je 0x41220d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x41280e
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x41280e
push 0x20
Function at 0x412120
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
lea edx, [esp + 0xa4]
push edx
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [esp + 0xa0]
push str.32770
push eax
call fcn.00486dcc
add esp, 8
test eax, eax
jne 0x41280e
mov eax, dword [0x49d3c8]
lea edx, [esp + 0x28]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
push edx
push edi
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x412801
cmp dword [0x4a0bbc], 0
je 0x41218a
push 0x4a13a8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 0
jmp fcn.0041145b
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
mov eax, dword [0x4a0a4c]
test eax, eax
je 0x412831
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [0x4a0a38]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne fcn.0041145b
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push edx
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
jmp fcn.0041145b
Function at 0x4159f0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]
Function at 0x4199f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x41d440
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne dl
mov byte [0x4a0b7a], dl
mov byte [esp + 0x23], 0
mov byte [esp + 0x1a], 0
Function at 0x41d980
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
push 1
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp fcn.0041d45b

Function at 0x41d9f0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x41db10
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add al, 0x81
inc dword [ebx + edx + 0x4a]
add byte [edi - 0x75], bh
je 0x41db40
sub al, 0x81
invalid
dec ebx
jne case.default.0x41dc9a
mov dword [0x4a0b70], 0
mov byte [esp + 0x1a], 1
jmp fcn.0041d45b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x41e80e
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x41e80e
push 0x20
lea edx, [esp + 0xa4]
push edx
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [esp + 0xa0]
push str.32770
push eax
call 0x492dcc
add esp, 8
test eax, eax
jne 0x41e80e
mov eax, dword [0x49d3c8]
lea edx, [esp + 0x28]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
push edx
push edi
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x41e801
cmp dword [0x4a0bbc], 0
je 0x41e18a
push 0x4a13a8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 0
jmp fcn.0041d45b
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
mov eax, dword [0x4a0a4c]
test eax, eax
je 0x41e831
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [0x4a0a38]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne fcn.0041d45b
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push edx
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
jmp fcn.0041d45b

Function at 0x4217a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x42183a
Function at 0x4219f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x4257a0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x42583a
Function at 0x4259f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]
Function at 0x4297a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x42983a

Function at 0x429900
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
ror byte [edi], 0x84
inc esp
add dword [eax], eax
add byte [ebx + 0x48d6141d], cl
add byte [esi - 1], dl
ror dword [ebx - 0x72efdbac], cl
js 0x429914

Function at 0x429980
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
push 1
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x42945b

Function at 0x4299f0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x42a4d0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
cmp ecx, 8
jne 0x42a5d7
mov eax, dword [esp + 0x74]
mov dword [edi + 0x3c], eax

Function at 0x42a560
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
stc
dec ecx
jne 0x42a5cb
lea eax, [esp + 0x7c]
test ecx, 0x100
je 0x42a577
test ecx, 0x200
je 0x42a588
mov byte [esp + 0x7c], 0x73

Function at 0x42a570
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
mov ecx, dword [esp + 0x24]
mov eax, dword [0x4a13a4]
push 0x18
push 0
push ecx
call fcn.004290d0
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov esi, dword [esp + 0x70]
mov dword [edi + 0xa0], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x44], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x24]
mov dword [edi + 0x38], eax
mov eax, dword [esp + 0x60]
mov dword [edi + 0x4c], edx
mov dword [edi + 0x48], esi
xor edi, edi
cmp eax, edi
je 0x42a5fe
mov byte [eax], 1
jmp 0x42a60d
mov byte [esp + 0x7c], 0x53
jmp 0x42a584
lea eax, [esp + 0x7d]
test ecx, 0x400
je 0x42a595
mov byte [eax], 0x46
jmp 0x42a5a0
test ecx, 0x800
je 0x42a5a2
mov byte [eax], 0x66
add eax, esi
test ecx, 0x1000
je 0x42a5af
mov byte [eax], 0x43
jmp 0x42a5ba
test ecx, 0x2000
je 0x42a5bc
mov byte [eax], 0x63
add eax, esi
mov byte [eax], 0
invalid

Function at 0x42a5c0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
inc esp
and al, 0x48
dec ecx
add byte [eax], al
add byte [ebx - 0x76b7dbb4], cl
dec edi
xor al, 0x83
stc
or byte [edi], cl
test byte [ecx], cl
invalid
Function at 0x42a600
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
and al, 0x22
add byte [eax + ecx - 0x75], dh
inc esp
and al, 0x14
or byte [eax + 5], 4
mov ecx, dword [esp + 0x44]
inc esp
call fcn.00429290
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx*4 + 0x4a11b8]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x42a796
cmp esi, dword [eax + 0xc]
Function at 0x42a690
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ecx + 0x168b6c7e], cl
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x10
push eax
mov eax, dword [esi]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x42a796

Function at 0x42a740
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
adc eax, sym.imp.USER32.dll_CountClipboardFormats
test eax, eax
je 0x42a73d
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call esi
test eax, eax
jne 0x42a736
push 0xf
call esi
test eax, eax
jne 0x42a736
mov eax, 2
jmp 0x42a73f
mov eax, 1
jmp 0x42a73f
xor eax, eax
push 0x18
push 0
mov dword [edi + 0x38], eax
push eax
mov eax, dword [0x4a13a4]
call fcn.004290d0
mov ecx, dword [0x4a3098]
mov byte [0x4a3094], 1
call fcn.00429290
jmp 0x42a761
inc esi
add eax, 0x4a3094
add bl, ch
invalid

Function at 0x42d7a0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x42d83a
Function at 0x42d9f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x4317a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x43183a
Function at 0x4319f0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x432410
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
add byte [eax], al
add byte [ecx + 0x8c2494], cl
add byte [eax], al
mov edx, dword [esi]
push ecx
push edx
mov dword [esp + 0x98], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi]
lea eax, [esp + 0x8c]
push eax
push 0
push 0x1111
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x43246e
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov esi, ebx
call 0x495290
mov ecx, dword [esp + 0x48]
jmp 0x4325ce
mov ecx, dword [esp + 0x24]
mov eax, dword [0x4a13a4]
push 0x18
push 0
push ecx
call fcn.004310d0
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov esi, dword [esp + 0x70]
mov dword [edi + 0xa0], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x44], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x24]
mov dword [edi + 0x38], eax
mov eax, dword [esp + 0x60]
mov dword [edi + 0x4c], edx
mov dword [edi + 0x48], esi
xor edi, edi
cmp eax, edi
je 0x4325fe
mov byte [eax], 1
jmp 0x43260d
cmp ecx, 8
je 0x4324e0
cmp ecx, 5
je 0x4324e0
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push eax
call 0x4968b0
jmp 0x4324f3
cmp byte [esp + 0x22], 0
je 0x43260d
mov eax, dword [esp + 0x14]
or byte [eax + 5], 4
mov ecx, dword [esp + 0x44]
call fcn.00431290
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx*4 + 0x4a11b8]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x432796
cmp esi, dword [eax + 0xc]
jae 0x432641
mov eax, dword [eax + 0x14]
lea edx, [esi + esi*4]
lea ecx, [eax + edx*4]
mov dword [esp + 0x14], ecx
jmp 0x432645
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x48]
add eax, 0xfffffffb
cmp eax, 4
ja case.default.0x432651
jmp dword [eax*4 + 0x4029cc]
cmp dword [esp + 0x14], edi
je 0x432796
mov eax, dword [esp + 0x14]
and byte [eax + 5], 0xfb
jmp 0x432796
mov ecx, dword [0x4a13a4]
dec dword [0x4a0b94]
sub dword [0x49d3c8], 0xd8
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0xcc]
push edx
call 0x4968b0
push 0
mov eax, 0x4a2c18
call fcn.00444620
cmp dword [ebp + 0xc], 0
je 0x43145b
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x6c]
mov esi, dword [ebp + 8]
push eax
push ecx
call fcn.004329e0
add esp, 8
test eax, eax
je 0x43145b
mov byte [esp + 0x1a], 1
mov byte [esp + 0x58], 1
jmp 0x43145b

Function at 0x4357a0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x43583a
Function at 0x4359f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x4397a0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x43983a
Function at 0x4399f0
Capabilities:
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
add byte [ebx + 0x75db85d8], cl
adc dword [edx], esi
fucomi st(0)
add bl, byte [ebp + eax - 0x7a277500]
fisttp dword [edi]
test byte [esi - 0x7c000002], ah
jmp dword [edx]

Function at 0x43d7a0
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x43d83a