joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40223d
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push 8
mov dword [ebp - 8], ebx
xor edi, edi
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x402284
lea eax, [ebp - 8]
push eax
push 8
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402370
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push 3
push eax
mov dword [ebp - 0x18], eax
call esi
cmp eax, ebx
jne 0x4022e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402370
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x402370
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 3
push dword [ebp - 0x18]
call esi
cmp eax, ebx
je 0x402370
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x30]
push eax
push 0x46dfa0
push ebx
call esi
test eax, eax
je 0x402370
lea eax, [ebp - 0x24]
push eax
push str.SeIncreaseQuotaPrivilege
push ebx
mov dword [ebp - 0x28], ebx
call esi
test eax, eax
je 0x402370
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
cmp dword [edi], ebx
jbe 0x402355
lea eax, [edi + 4]
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x28]
mov dword [ebp - 0x18], 2
push 8
lea eax, [esi - 8]
push eax
push dword [ebp - 0x10]
call fcn.00455853
add esp, 0xc
test eax, eax
jne 0x40233f
mov dword [esi], 1
add esi, 0xc
dec dword [ebp - 0x18]
jne 0x402324
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], 0xc
cmp eax, dword [edi]
jb 0x40231a
mov byte [ebp - 1], 1
xor ecx, ecx
lea eax, [ebp - 0x28]
cmp dword [eax], ebx
je 0x40236d
inc ecx
add eax, 0xc
cmp ecx, 2
jb 0x40235e
jmp 0x402370
mov byte [ebp - 1], bl
cmp dword [ebp - 8], ebx
je 0x40237e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x402391
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40261a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
xor edi, edi
test byte [ebp + 0x14], 1
mov esi, eax
je 0x402633
inc edi
jmp 0x40263c
test byte [ebp + 0x14], 2
je 0x40263c
push 2
pop edi
xor bl, bl
test byte [ebp + 0x14], 4
je 0x40267c
and dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 1
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
push dword [ebp + 0x14]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x4026a9
push dword [ebp + 0x24]
or esi, 0x400
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push esi
push dword [ebp + 0x18]
push 0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
cmp dword [ebp - 4], 0
je 0x4026b8
push dword [ebp - 4]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x20

Function at 0x40283f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov edi, eax
push 0
push edi
call esi
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
push 2
push 0
push 0
lea eax, [edi + 8]
push eax
call esi
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call esi
push eax
call ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edi + 4], eax
xor eax, eax
push eax
push eax
push edi
push 0x4028b0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x402e40
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
push 1
push dword [esi]
call fcn.00404b93
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor eax, eax
push eax
push 0x25
cmp dword [ebp + 8], eax
jge 0x402e96
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
push eax
push 0x25
push pe_nt_image_headers32
push dword [esi]
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x402ec9
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
push eax
push 0x27
push pe_nt_image_headers32
push dword [esi]
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esi]
push edi
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x403326
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0xb0
push dword [edi]
call esi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x403350
xor al, al
jmp 0x4033cd
push ebx
push 0
push 0
push 0xe
push dword [edi]
call esi
mov ebx, eax
test ebx, ebx
je 0x4033ca
cmp ebx, dword [ebp - 8]
jb 0x4033ca
cmp ebx, dword [ebp - 4]
jb 0x4033ca
xor ecx, ecx
push 2
pop edx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455447
pop ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebx + 1]
push eax
push 0xd
push dword [edi]
call esi
test eax, eax
je 0x4033c6
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4033a5
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*2]
push eax
push dword [ebp + 8]
call fcn.0040206d
mov bl, 1
push dword [ebp - 0xc]
call fcn.0045504c
pop ecx
mov al, bl
jmp 0x4033cc
xor bl, bl
jmp 0x4033b9
xor al, al
pop ebx
pop esi
leave
ret 4
Function at 0x404827
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0xc]
push 0x46df98
call fcn.00402172
mov edi, dword [ebp + 8]
push 1
push edi
call fcn.004049c1
call dword [sym.imp.USER32.dll_GetFocus]
xor ebx, ebx
mov dword [esi + 0xd8], eax
cmp eax, ebx
je 0x40490a
push edi
push eax
call fcn.0040499c
test eax, eax
je 0x40490a
push dword [esi + 0xd8]
call fcn.0040427f
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
push eax
push dword [esi + 0xd8]
mov dword [esi + 0xd4], edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x204]
push eax
lea eax, [esi + 0x8c]
call fcn.00402172
and dword [esi + 0x130], ebx
push esi
push 0x40492a
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
push dword [esi + 0x130]
lea eax, [ebp - 0x204]
push dword [esi + 0x8c]
push str._s_d
push eax
call fcn.0045710b
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00402172
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov al, 1
jmp 0x404923
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4049c1
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x4049ec
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x404a07
push 1
jmp 0x4049ee
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x405820
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x405840
mov eax, dword [ebp + 8]
cmp byte [eax + 5], 1
jne 0x4058d7
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xe
push dword [ebp + 0xc]
call edi
mov esi, eax
test esi, esi
jne 0x40585c
mov esi, 0x7fff
push ebx
xor ecx, ecx
push 2
lea ebx, [esi + 1]
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455447
pop ecx
push eax
push ebx
push 0xd
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call edi
mov edi, dword [ebp - 4]
xor ecx, ecx
mov word [edi + esi*2], cx
pop ebx
test eax, eax
jg 0x40589f
xor esi, esi
inc esi
push edi
call fcn.0045504c
pop ecx
mov eax, esi
jmp 0x4058da
mov esi, dword [ebp + 8]
cmp byte [esi + 0xc], cl
jne 0x4058b6
push edi
call fcn.00455031
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [esi + 0x24]
push edi
call fcn.0045732d
pop ecx
pop ecx
test eax, eax
je 0x4058d0
mov byte [esi + 0xe8], 1
xor esi, esi
jmp 0x405894
push edi
call fcn.0045504c
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8
Function at 0x408f77
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, eax
push ebx
push edi
mov edi, dword [ecx]
add eax, 4
mov dword [esi], eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455447
mov ecx, dword [esi]
add ecx, dword [ebp + 8]
lea ebx, [edi + edi]
push ebx
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.00454cd0
mov eax, dword [ebp - 4]
add dword [esi], ebx
xor ecx, ecx
add esp, 0x10
mov word [ebx + eax], cx
test edi, edi
jle 0x408fd0
xor word [eax + ecx*2], di
inc ecx
cmp ecx, edi
jl 0x408fc7
pop edi
pop ebx
leave
ret 4
Function at 0x409e0e
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, esi
call fcn.00409dcd
mov word [esi + 8], dx
test dx, dx
jne 0x409e21
xor al, al
ret
push edx
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
cmp ax, 0xffff
je 0x409e1e
push ebx
mov ebx, eax
mov byte [esi], al
movzx eax, al
push 0
push eax
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [esi + 7], al
mov al, 1
test al, bl
je 0x409e51
mov byte [esi + 1], al
test bl, 2
je 0x409e59
mov byte [esi + 3], al
test bl, 4
pop ebx
je 0x409e62
mov byte [esi + 4], al
ret

Function at 0x409f19
Capabilities:
Log keystrokes

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 5
xor ebx, ebx
pop eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], bx
push ebx
mov dword [esi + 0x1a], ebx
mov word [esi + 0x1e], bx
push 0x5b
mov dword [esi + 0xc], 4
call edi
push ebx
push 0x10
mov byte [esi + 0x29], al
call edi
push ebx
push 0xa0
mov byte [esi + 0x26], al
call edi
push ebx
push 0xa1
mov byte [esi + 0x27], al
call edi
push ebx
push 0x11
mov byte [esi + 0x28], al
call edi
push ebx
push 0x12
mov byte [esi + 0x24], al
call edi
pop edi
mov byte [esi + 0x25], al
pop ebx
ret

Function at 0x40a1a2
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx ebx, byte [ebp + 8]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
mov byte [ebp - 1], al
cmp byte [ebp + 0xc], al
je 0x40a22c
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push ebx
call esi
test byte [edi + 0xc], 4
mov byte [ebp + 0xc], al
push 0
je 0x40a1e0
push dword [ebp + 0xc]
mov cl, byte [ebp + 8]
call fcn.0040b30d
jmp 0x40a1ee
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, edi
call fcn.0040b2eb
push 0
push ebx
call esi
test byte [edi + 0xc], 4
mov byte [ebp + 0xc], al
je 0x40a212
mov cl, byte [ebp + 8]
push 2
push dword [ebp + 0xc]
call fcn.0040b30d
jmp 0x40a222
push 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, edi
call fcn.0040b2ca
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 8
Function at 0x40a86e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp byte [eax], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x40a885
mov byte [edi + 0x14], 1
cmp byte [eax + 2], 0
je 0x40a88f
mov byte [edi + 0x16], 1
cmp byte [eax + 3], 0
je 0x40a899
mov byte [edi + 0x17], 1
cmp byte [edi + 0x14], 0
je 0x40a8a9
cmp byte [edi + 0x1a], 0
je 0x40a8a9
mov byte [edi + 0x14], 0
cmp byte [edi + 0x15], 0
je 0x40a8b9
cmp byte [edi + 0x1b], 0
je 0x40a8b9
mov byte [edi + 0x15], 0
cmp byte [edi + 0x16], 0
je 0x40a8c9
cmp byte [edi + 0x1c], 0
je 0x40a8c9
mov byte [edi + 0x16], 0
cmp byte [edi + 0x17], 0
je 0x40a8d9
cmp byte [edi + 0x1d], 0
je 0x40a8d9
mov byte [edi + 0x17], 0
cmp byte [edi + 0x18], 0
je 0x40a8e9
cmp byte [edi + 0x1e], 0
je 0x40a8e9
mov byte [edi + 0x18], 0
cmp dword [edi + 0x20], 0
je 0x40a954
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [edi + 0x1a]
test cl, cl
jne 0x40a906
mov byte [ebp - 0x70], cl
mov al, byte [edi + 0x1b]
test al, al
jne 0x40a910
mov byte [ebp - 0x6f], al
test cl, cl
jne 0x40a91e
test al, al
jne 0x40a91e
mov byte [ebp - 0x100], al
cmp byte [edi + 0x1c], 0
jne 0x40a92b
mov byte [ebp - 0xff], 0
cmp byte [edi + 0x1d], 0
jne 0x40a938
mov byte [ebp - 0xfe], 0
test cl, cl
jne 0x40a942
mov byte [ebp - 0xb5], cl
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x40aa67
xor eax, eax
mov esi, 0xa0
push esi
mov word [ebp - 4], ax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 8], eax
mov byte [ebp - 2], al
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x8000
test bx, ax
jne 0x40a989
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x40a9a0
cmp byte [edi + 0x1a], 0
jne 0x40a9a0
mov dl, 0xa0
lea esi, [ebp - 0xc]
call fcn.00409deb
mov eax, esi
call fcn.0040b184
mov esi, 0xa1
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x40a9bd
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x40a9d4
cmp byte [edi + 0x1b], 0
jne 0x40a9d4
mov dl, 0xa1
lea esi, [ebp - 0xc]
call fcn.00409deb
mov eax, esi
call fcn.0040b184
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x40a9ee
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x40aa05
cmp byte [edi + 0x1c], 0
jne 0x40aa05
mov dl, 0x11
lea esi, [ebp - 0xc]
call fcn.00409deb
mov eax, esi
call fcn.0040b184
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x40aa1f
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x40aa36
cmp byte [edi + 0x1d], 0
jne 0x40aa36
mov dl, 0x12
lea esi, [ebp - 0xc]
call fcn.00409deb
mov eax, esi
call fcn.0040b184
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
jne 0x40aa50
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
je 0x40aa67
cmp byte [edi + 0x1e], 0
jne 0x40aa67
mov dl, 0x5b
lea esi, [ebp - 0xc]
call fcn.00409deb
mov eax, esi
call fcn.0040b184
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aa6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebx + 0x20], 0
mov dword [edi], 0
mov word [edi + 4], 0
je 0x40aafe
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, 0x80
cmp byte [ebp - 0x60], al
je 0x40aaa3
cmp byte [ebp - 0xf0], al
jne 0x40aaac
cmp byte [ebx + 0x1a], 0
jne 0x40aaac
mov byte [edi], 1
cmp byte [ebp - 0x5f], al
jne 0x40aabb
cmp byte [ebx + 0x1b], 0
jne 0x40aabb
mov byte [edi + 1], 1
cmp byte [ebp - 0xef], al
jne 0x40aacd
cmp byte [ebx + 0x1c], 0
jne 0x40aacd
mov byte [edi + 2], 1
cmp byte [ebp - 0xee], al
jne 0x40aadf
cmp byte [ebx + 0x1d], 0
jne 0x40aadf
mov byte [edi + 3], 1
cmp byte [ebp - 0xa5], al
jne 0x40abc4
cmp byte [ebx + 0x1e], 0
jne 0x40abc4
mov byte [edi + 4], 1
jmp 0x40abc4
push esi
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
test si, ax
jne 0x40ab24
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x40ab2d
cmp byte [ebx + 0x1a], 0
jne 0x40ab2d
mov byte [edi], 1
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x40ab4d
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x40ab57
cmp byte [ebx + 0x1b], 0
jne 0x40ab57
mov byte [edi + 1], 1
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x40ab71
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x40ab7b
cmp byte [ebx + 0x1c], 0
jne 0x40ab7b
mov byte [edi + 2], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x40ab95
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x40ab9f
cmp byte [ebx + 0x1d], 0
jne 0x40ab9f
mov byte [edi + 3], 1
push 0x5b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
jne 0x40abb9
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x40abc3
cmp byte [ebx + 0x1e], 0
jne 0x40abc3
mov byte [edi + 4], 1
pop esi
mov eax, edi
leave
ret
Function at 0x40abc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp byte [edi], 0
push ebx
jne 0x40abf3
cmp byte [edi + 1], 0
jne 0x40abf3
cmp byte [edi + 2], 0
jne 0x40abf3
cmp byte [edi + 3], 0
jne 0x40abf3
cmp byte [edi + 4], 0
je 0x40adf6
mov eax, dword [esi + 0x20]
test eax, eax
je 0x40ad17
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x40ad17
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp byte [edi], 0
mov al, 0x80
je 0x40ac2a
or byte [ebp - 0xf8], al
or byte [ebp - 0x68], al
cmp byte [edi + 1], 0
je 0x40ac39
or byte [ebp - 0xf8], al
or byte [ebp - 0x67], al
cmp byte [edi + 2], 0
je 0x40ac45
or byte [ebp - 0xf7], al
cmp byte [edi + 3], 0
je 0x40ac51
or byte [ebp - 0xf6], al
cmp byte [edi + 4], 0
je 0x40ac5d
or byte [ebp - 0xad], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x40ac7b
cmp byte [edi + 1], 0
je 0x40ac92
movzx eax, byte [esi + 0x26]
shl eax, 0x10
or eax, 1
push eax
push 0x10
push pe_nt_image_headers32
push dword [esi + 0x20]
call ebx
cmp byte [edi + 2], 0
je 0x40acaf
movzx eax, byte [esi + 0x24]
shl eax, 0x10
or eax, 1
push eax
push 0x11
push pe_nt_image_headers32
push dword [esi + 0x20]
call ebx
mov al, byte [edi + 3]
test al, al
je 0x40acf3
cmp byte [edi + 2], 0
jne 0x40acd8
cmp byte [esi + 0x1c], 0
jne 0x40acd8
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x40acee
test al, al
je 0x40acf3
movzx eax, byte [esi + 0x25]
shl eax, 0x10
or eax, 1
push eax
push 0x12
push pe_nt_image_headers32
push dword [esi + 0x20]
call ebx
cmp byte [edi + 4], 0
je 0x40adef
movzx eax, byte [esi + 0x29]
shl eax, 0x10
or eax, 1
push eax
push 0x5b
push pe_nt_image_headers32
push dword [esi + 0x20]
jmp 0x40aded
cmp byte [edi], 0
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
je 0x40ad48
test byte [esi + 0xc], 4
mov al, byte [esi + 0x27]
mov byte [ebp - 4], al
push 0
je 0x40ad3c
push dword [ebp - 4]
mov cl, 0xa0
call fcn.0040b30d
jmp 0x40ad48
push 0
push dword [ebp - 4]
push 0xa0
call ebx
cmp byte [edi + 1], 0
je 0x40ad74
test byte [esi + 0xc], 4
mov al, byte [esi + 0x28]
mov byte [ebp - 4], al
push 0
je 0x40ad68
push dword [ebp - 4]
mov cl, 0xa1
call fcn.0040b30d
jmp 0x40ad74
push 0
push dword [ebp - 4]
push 0xa1
call ebx
cmp byte [edi + 2], 0
je 0x40ad9d
test byte [esi + 0xc], 4
mov al, byte [esi + 0x24]
mov byte [ebp - 4], al
push 0
je 0x40ad94
push dword [ebp - 4]
mov cl, 0x11
call fcn.0040b30d
jmp 0x40ad9d
push 0
push dword [ebp - 4]
push 0x11
call ebx
cmp byte [edi + 3], 0
je 0x40adc6
test byte [esi + 0xc], 4
mov al, byte [esi + 0x25]
mov byte [ebp - 4], al
push 0
je 0x40adbd
push dword [ebp - 4]
mov cl, 0x12
call fcn.0040b30d
jmp 0x40adc6
push 0
push dword [ebp - 4]
push 0x12
call ebx
cmp byte [edi + 4], 0
je 0x40adef
test byte [esi + 0xc], 4
mov al, byte [esi + 0x29]
mov byte [ebp - 4], al
push 0
je 0x40ade6
push dword [ebp - 4]
mov cl, 0x5b
call fcn.0040b30d
jmp 0x40adef
push 0
push dword [ebp - 4]
push 0x5b
call ebx
mov ecx, esi
call fcn.0040b2eb
pop ebx
leave
ret
Function at 0x40b03c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov al, byte [esi]
mov cl, byte [esi + 7]
mov edx, dword [edi + 0x20]
push ebx
mov bl, al
mov byte [ebp - 4], cl
movzx ecx, word [esi + 8]
mov byte [ebp - 8], bl
test edx, edx
je 0x40b10b
cmp bl, 0x14
je 0x40b10b
cmp bl, 0x90
je 0x40b10b
cmp bl, 0x91
je 0x40b10b
cmp al, 0xff
je 0x40b0fa
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx ebx, bl
or byte [ebp + ebx - 0x128], 0x80
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
movzx ecx, byte [ebp - 4]
shl ecx, 0x10
mov eax, esi
or ecx, 1
call fcn.00409e63
cmp al, 1
jne 0x40b0c1
or ecx, 0x1000000
cmp byte [edi + 0x17], 0
jne 0x40b0d3
cmp byte [edi + 0x1d], 0
jne 0x40b0d3
cmp byte [ebp - 8], 0x12
jne 0x40b0ee
cmp byte [edi + 0x16], 0
jne 0x40b0ee
cmp byte [edi + 0x1c], 0
jne 0x40b0ee
or ecx, 0x20000000
push ecx
push ebx
push 0x104
jmp 0x40b0f5
push ecx
push ebx
push pe_nt_image_headers32
push dword [edi + 0x20]
jmp 0x40b103
push 1
push ecx
push 0x102
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40b17a
cmp al, 0xff
je 0x40b14e
mov eax, esi
call fcn.00409e63
cmp al, 1
jne 0x40b12a
test byte [edi + 0xc], 4
je 0x40b124
push 1
jmp 0x40b132
push 0
push 1
jmp 0x40b140
test byte [edi + 0xc], 4
push 0
je 0x40b13e
push dword [ebp - 4]
mov cl, bl
call fcn.0040b30d
jmp 0x40b17a
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x40b17a
xor eax, eax
and dword [ebp - 0x18], eax
and dword [ebp - 0x14], eax
mov word [ebp - 0x20], ax
push 0x1c
lea eax, [ebp - 0x24]
push eax
push 1
mov dword [ebp - 0x24], 1
mov word [ebp - 0x1e], cx
mov dword [ebp - 0x1c], 4
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, edi
call fcn.0040b2eb
pop ebx
leave
ret