joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411cc0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x56e37f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x5d2724]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edi
mov ecx, dword [0x5d76ac]
mov dword [esp + 0x124], 0
test ecx, ecx
je 0x411d17
call fcn.0040e520
mov ecx, dword [0x5d76ac]
test ecx, ecx
je 0x411d17
mov edx, dword [ecx]
push 1
call dword [edx]
push 0x9c
call fcn.0054dd66
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x124], 1
je 0x411d3d
mov ecx, eax
call fcn.0040d2f0
jmp 0x411d3f
xor eax, eax
mov ebp, dword [esp + 0x12c]
mov ecx, eax
push ebp
push 0x186a0
push edi
push 0x411b80
mov byte [esp + 0x134], 0
mov dword [0x5d76ac], eax
call fcn.0040d500
test al, al
je 0x411e94
push ebx
lea eax, [esp + 0x20]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x411df9
mov edx, dword [esi + 0xc]
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call ebx
push eax
lea ecx, [esp + 0x14]
call fcn.00552b04
mov edx, dword [esi + 0xc]
movsx eax, word [esi + 0xa]
mov ecx, dword [edx]
add ecx, eax
mov eax, dword [esi]
cmp ecx, eax
jae 0x411df9
xor edi, edi
push 0x5c18fc
lea ecx, [esp + 0x14]
call fcn.00552b04
mov edx, dword [esi + 0xc]
add edi, 4
mov eax, dword [edx + edi]
mov ecx, dword [eax]
push ecx
call ebx
push eax
lea ecx, [esp + 0x14]
call fcn.00552b04
mov edx, dword [esi + 0xc]
movsx eax, word [esi + 0xa]
mov ecx, dword [edx + edi]
add ecx, eax
mov eax, dword [esi]
cmp ecx, eax
jb 0x411dbd
mov edi, dword [esp + 0x1c]
mov eax, dword [0x5d2724]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea esi, [edi + 0x49c]
push str.Send:_0.00_kb_s_Recv:_0.00_kb_s
push 1
mov ecx, esi
mov byte [esp + 0x130], 3
call fcn.004342b0
push ebp
lea edx, [esp + 0x18]
push 0x5c1978
push edx
call fcn.0054b3fa
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, esi
push eax
push 2
call fcn.004342b0
mov ecx, dword [esp + 0x10]
push ebp
push ecx
lea edx, [esp + 0x20]
push 0x5c1960
push edx
call fcn.0054b3fa
mov eax, dword [esp + 0x28]
mov ecx, dword [0x5d765c]
add esp, 0x10
push 0
push 0
push eax
call fcn.004109a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x128], 2
call fcn.00552728
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 0
call fcn.00552728
pop ebx
jmp 0x411edd
push ebp
lea ecx, [esp + 0x10]
push 0x5c1948
push ecx
call fcn.0054b3fa
mov edx, dword [esp + 0x18]
add esp, 0xc
lea esi, [edi + 0x49c]
push edx
push 1
mov ecx, esi
call fcn.004342b0
push 0x5c193c
push 2
mov ecx, esi
call fcn.004342b0
mov eax, dword [esp + 0xc]
mov ecx, dword [0x5d765c]
push 1
push 0
push eax
call fcn.004109a0
push 0x5c1930
push 4
mov ecx, esi
call fcn.004342b0
mov ecx, dword [edi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [esp + 0xc]
mov dword [esp + 0x124], 0xffffffff
call fcn.00552728
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x11c
ret 8
Function at 0x413ed0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, 0x55555556
push esi
lea ecx, [ebp*4]
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 4]
push ecx
call fcn.005339bd
add esp, 4
mov esi, eax
test eax, eax
jne 0x413f02
pop esi
or eax, 0xffffffff
pop ebp
ret
xor ecx, ecx
push edi
test ebp, ebp
jle 0x413f8f
mov edi, dword [esp + 0x10]
push ebx
xor edx, edx
mov dl, byte [ecx + edi]
inc ecx
shl edx, 8
cmp ecx, ebp
jge 0x413f26
xor ebx, ebx
mov bl, byte [ecx + edi]
add edx, ebx
inc ecx
shl edx, 8
cmp ecx, ebp
jge 0x413f35
xor ebx, ebx
mov bl, byte [ecx + edi]
add edx, ebx
mov ebx, edx
inc ecx
sar ebx, 0x12
and ebx, 0x3f
mov bl, byte [ebx + 0x5c1a90]
mov byte [esi], bl
mov ebx, edx
sar ebx, 0xc
and ebx, 0x3f
mov bl, byte [ebx + 0x5c1a90]
mov byte [esi + 1], bl
mov ebx, edx
sar ebx, 6
and ebx, 0x3f
and edx, 0x3f
cmp ecx, ebp
mov bl, byte [ebx + 0x5c1a90]
mov byte [esi + 2], bl
mov dl, byte [edx + 0x5c1a90]
mov byte [esi + 3], dl
jle 0x413f7c
mov byte [esi + 3], 0x3d
lea edx, [ebp + 1]
cmp ecx, edx
jle 0x413f87
mov byte [esi + 2], 0x3d
add esi, 4
cmp ecx, ebp
jl 0x413f12
pop ebx
mov ecx, dword [esp + 0x18]
mov byte [esi], 0
mov edi, eax
mov dword [ecx], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop esi
mov eax, ecx
pop ebp
ret

Function at 0x414000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.00533c20
mov ecx, dword [esp + 0x1004]
lea eax, [esp + 0x1008]
push eax
push ecx
lea edx, [esp + 8]
push 0x1000
push edx
call fcn.005340e1
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add esp, 0x1000
ret
Function at 0x41a330
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41a395
push ebx
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0x10]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41a38d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
ret 8

Function at 0x41a3a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 8
push esi
mov dword [esp + 8], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41a443
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x41a3d5
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
add esp, 8
ret
push ebx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ebx, eax
push esi
inc ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov esi, eax
call fcn.0054dd66
lea ecx, [ebx - 1]
mov ebp, eax
mov eax, ecx
add esp, 4
lea edi, [ebp + 1]
mov byte [ebp], 0x19
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov edx, dword [eax + 0x154]
mov ecx, dword [eax + 0x158]
push edx
call fcn.0040dc80
push ebp
call fcn.0054dd8f
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x421c60
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push edi
push eax
xor edi, edi
push 0x8004667e
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test esi, esi
jle 0x421ca5
mov ebp, dword [esp + 0x18]
push 0
lea ecx, [edi + ebp]
push esi
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x421ca5
sub esi, eax
add edi, eax
test esi, esi
jg 0x421c8b
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x421cb0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x2104
call fcn.00533c20
mov eax, dword [esp + 0x2108]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x5d992c]
test al, al
je 0x421dd2
mov edi, dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 1
xor eax, eax
lea ecx, [esp + 0x14]
cmp dword [ecx], ebx
je 0x421d17
inc eax
add ecx, 4
cmp eax, 1
jb 0x421d0a
cmp eax, 1
jne 0x421d28
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 2
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x421dd2
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x421d84
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jle 0x421dd2
lea eax, [esp + 0x114]
push esi
push eax
push ebx
call fcn.00421c60
add esp, 0xc
test eax, eax
je 0x421dd2
cmp eax, esi
jne 0x421dd2
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x421dc5
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebx
call edi
mov esi, eax
test esi, esi
jle 0x421dd2
lea eax, [esp + 0x114]
push esi
push eax
push ebp
call fcn.00421c60
add esp, 0xc
test eax, eax
je 0x421dd2
cmp eax, esi
jne 0x421dd2
mov al, byte [0x5d992c]
test al, al
jne 0x421cf8
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2104
ret 4
Function at 0x427c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56fd99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00551f8a
mov eax, dword [0x5d2724]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x50], eax
mov ecx, dword [0x5d2724]
mov dword [esi + 0x54], ecx
mov dword [esi + 0x68], 0x584d40
mov dword [esi + 0x6c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov ecx, esi
mov byte [esp + 0x14], 3
mov dword [esi], 0x584ce8
call fcn.0056b168
lea edx, [esi + 0x40]
or eax, 0xffffffff
push edx
mov dword [esi + 0x30], 1
mov dword [esi + 0x2c], 1
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x64], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42ba10
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x24
push esi
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x42ba4b
mov edi, dword [esp + 0x30]
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
push 0x42b960
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
pop edi
mov al, 1
pop esi
add esp, 0x24
ret 4
mov ecx, 9
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x42bad7
mov eax, dword [esp + 0x14]
cmp eax, 3
ja case.default.0x42ba7a
jmp dword [eax*4 + 0x42bb14]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
pop edi
pop esi
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 8], edx
mov al, 1
add esp, 0x24
ret 4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0xc], edx
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
pop edi
mov al, 1
pop esi
add esp, 0x24
ret 4
mov esi, dword [esp + 0x30]
push 0
push esi
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
je 0x42bb09
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
sub eax, 0x96
sub ecx, 0x1e
mov dword [esi], eax
mov dword [esi + 4], ecx
pop edi
mov al, 1
pop esi
add esp, 0x24
ret 4
pop edi
xor al, al
pop esi
add esp, 0x24
ret 4
Function at 0x42c380
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
lea ebx, [edi + 0x3c]
push ecx
mov ecx, ebx
call fcn.00429530
mov edx, dword [esp + 0x18]
mov esi, eax
push edx
mov ecx, esi
call fcn.00427e80
mov ebp, dword [esp + 0x1c]
mov ecx, esi
push ebp
call fcn.00427fc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x42c3ca
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 4]
test ebp, ebp
je 0x42c3d7
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42c3ef
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x42c3ef
push 0
mov ecx, ebx
call fcn.004297b0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x437b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x570e39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0054e858
mov eax, dword [0x5d2724]
lea edi, [esi + 0x3c]
mov dword [esp + 0x14], 0
mov dword [edi], eax
mov edx, dword [0x5d2724]
lea ecx, [esi + 0x40]
mov dword [ecx], edx
mov eax, dword [0x5d2724]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov byte [esp + 0x18], 3
mov dword [esi], method.CWnd.virtual_0
mov dword [esi + 0x48], edx
call fcn.005528b1
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x4c], edx
mov ecx, edi
mov dword [esi + 0x50], eax
call fcn.005526b3
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edx
mov dword [esi + 0x58], 1
mov dword [esi + 0x64], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x438e70
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
cmp dword [eax + 0x5c], 2
je 0x438fc4
mov ecx, dword [esp + 0x14]
cmp ecx, 0x60
jb 0x438e9c
cmp ecx, 0x69
ja 0x438e9c
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x438fc4
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x438fc4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
mov ebp, eax
push ebp
call fcn.00436f00
mov esi, eax
mov eax, dword [edi + 0x80]
add esp, 4
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ebp
test eax, eax
jle 0x438f12
push ebx
mov ecx, edi
call fcn.00439840
mov ebp, eax
mov eax, dword [ebp + 0x88]
test eax, eax
jne 0x438f10
mov ecx, dword [edi + 0x70]
test byte [ecx + 0x5c], 1
je 0x438f03
test esi, esi
jne 0x438f03
push ebp
call fcn.00436f00
add esp, 4
test eax, eax
je 0x438f03
mov esi, ebp
mov eax, dword [edi + 0x80]
inc ebx
cmp ebx, eax
jl 0x438ed3
jmp 0x438f12
mov esi, ebp
test esi, esi
je 0x438fc4
push esi
call fcn.00436f00
add esp, 4
test eax, eax
je 0x438fc4
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x170]
test eax, eax
je 0x438f4a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
push esi
call fcn.00438c00
mov ebp, eax
test ebp, ebp
je 0x438fc4
mov esi, dword [ebp + 0xbc]
mov ebx, dword [ebp + 0x3c]
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x438f78
mov ecx, edi
call fcn.00438e40
push 1
mov ecx, edi
call fcn.00438a20
mov dword [edi + 0x40], 1
mov edx, dword [esi]
push 1
push 0
push 1
mov ecx, esi
call dword [edx + 0xbc]
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0xc4]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x438fb8
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xac]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x438fd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
cmp dword [edi + 4], 0x104
jne 0x43908c
mov eax, dword [edi + 0xc]
shr eax, 0x10
test ah, 0x20
je 0x43908c
call fcn.00438af0
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x43908c
push 0
mov ecx, esi
call fcn.00438af0
mov ecx, eax
call fcn.0049b5e0
test eax, eax
jne 0x43908c
mov ecx, esi
call fcn.00438af0
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x439030
mov eax, dword [eax + 0x1c]
push eax
call fcn.0049b290
add esp, 4
test eax, eax
je 0x43908c
cmp dword [edi + 8], 0x12
jne 0x439057
push 1
mov ecx, esi
call fcn.00438a20
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x43906b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x43908c
mov eax, dword [edi + 8]
test eax, eax
je 0x43908c
push eax
mov ecx, esi
call fcn.00438e70
test eax, eax
je 0x43908c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x105
je 0x43909d
cmp eax, 0x101
jne 0x4390cd
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x4390cd
mov eax, dword [esi + 0xac]
test eax, eax
je 0x4390cd
push 0
mov ecx, esi
call fcn.00438af0
mov ecx, eax
call fcn.0049b5e0
test eax, eax
jne 0x4390cd
push eax
mov ecx, esi
call fcn.00438a20
mov eax, dword [edi + 4]
cmp eax, 0x7b
je 0x4390dc
cmp eax, 0x105
jne 0x43911e
push 0
mov ecx, esi
call fcn.00438af0
mov ecx, eax
call fcn.0049b5e0
test eax, eax
je 0x43911e
push 0x43ac10
mov ecx, 0x5da4a4
call fcn.00567d84
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x7b
mov ecx, eax
call fcn.004ac780
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
cmp dword [edi + 4], 0x20a
jne 0x4391db
push 0x43ac10
mov ecx, 0x5da4a4
call fcn.00567d84
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jle 0x43916d
push 0x43ac10
mov ecx, 0x5da4a4
call fcn.00567d84
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
push 0x20a
mov ecx, eax
call fcn.004ac780
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
lea ecx, [esp + 0xc]
mov ebx, eax
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
test ebx, ebx
je 0x4391db
cmp dword [ebx + 0xa0], 3
jne 0x4391db
mov edx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], edx
call fcn.0043f500
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
pop ebp
je 0x4391db
mov edx, dword [edi + 8]
xor eax, eax
shr edx, 0x10
test dx, dx
setle al
push eax
mov ecx, ebx
call fcn.004b1130
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
mov eax, dword [edi + 4]
cmp eax, 0x100
jb 0x43904c
cmp eax, 0x108
ja 0x43904c
push edi
mov ecx, esi
call fcn.00437440
mov ecx, eax
call fcn.0044b010
test eax, eax
je 0x43904c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 4
Function at 0x43ba20
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
push ebp
mov ecx, dword [esi + 0xa4]
push eax
call fcn.00494b70
mov ebx, eax
mov eax, dword [esi + 0x78]
cmp eax, 0xffffffff
je 0x43ba7e
cmp dword [esi + 0xa8], 5
jne 0x43ba7e
cmp dword [esi + 0xa0], 1
jne 0x43ba7e
test ebx, ebx
je 0x43ba60
cmp dword [ebx + 0x3c], eax
je 0x43ba7e
cmp eax, dword [esi + 0x74]
jne 0x43ba73
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 0xc4]
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0043bde0
test ebx, ebx
mov ecx, esi
je 0x43bb4d
call fcn.0043dd70
test eax, eax
jne 0x43bb36
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x130]
test eax, eax
je 0x43bb36
push esi
push 0x5c63b0
call fcn.005537d6
add esp, 8
test eax, eax
je 0x43bb36
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x43bb36
mov ecx, esi
call fcn.0043dd40
mov edi, eax
test edi, edi
je 0x43bb36
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x43bb36
mov ecx, dword [edi + 0x70]
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x43bb36
push 1
mov ecx, edi
call fcn.00439c20
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.0043bde0
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
mov ecx, esi
call dword [edx + 0xc4]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx]
push ebp
push ecx
mov ecx, ebx
call dword [eax + 0x108]
push 0
mov ecx, edi
call fcn.00439c20
mov edx, dword [edi]
push 0
mov ecx, edi
call dword [edx + 0x54]
mov ecx, edi
call fcn.00438e40
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx]
push ebp
push ecx
mov ecx, ebx
call dword [eax + 0xec]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
call fcn.0054ebea
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x44bcb0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x572157
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
mov ebx, dword [esp + 0x138]
push ebp
push esi
cmp ebx, 0x60
push edi
jb 0x44bcf9
cmp ebx, 0x69
ja 0x44bcf9
movsx eax, byte [esp + 0x140]
add ebx, 0xffffffd0
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
jmp 0x44bee9
push 2
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test al, al
je 0x44bec0
mov edx, dword [esp + 0x140]
push edx
call fcn.0044c040
mov cl, byte [esp + 0x144]
add esp, 4
cmp cl, bl
mov byte [esp + 0x13], al
je 0x44bee4
cmp al, bl
je 0x44bee4
mov ebp, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor esi, esi
push esi
push esi
call ebp
mov edi, eax
cmp edi, 1
jl 0x44bec0
xor ebx, ebx
mov dword [esp + 0x18], 0x587290
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
cmp edi, esi
mov dword [esp + 0x138], esi
jne 0x44bd7b
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
jmp 0x44bda2
lea eax, [edi*4]
push eax
call fcn.0054dd66
add esp, 4
mov dword [esp + 0x1c], eax
push edi
push eax
call fcn.0043aed0
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
push ebx
push edi
call ebp
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x44bdcd
mov dword [esp + 0x18], method.CCommandLineInfo.virtual_0
mov dword [esp + 0x138], 1
jmp 0x44beb3
cmp edi, esi
mov dword [esp + 0x2c], esi
jle 0x44bea0
mov ebp, dword [sym.imp.USER32.dll_ToAsciiEx]
mov esi, ebx
mov dword [esp + 0x14], 0
mov edx, dword [esi]
push edx
mov edx, dword [esp + 0x148]
lea eax, [esp + 0x18]
push 0
lea ecx, [esp + 0x38]
push eax
push ecx
push 0
push edx
call ebp
cmp eax, 1
jne 0x44be31
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x140]
cmp cl, al
je 0x44bec4
push eax
call fcn.0044c040
mov cl, byte [esp + 0x17]
add esp, 4
cmp cl, al
je 0x44bec4
mov bl, byte [esp + 0x40]
mov byte [esp + 0x40], 0x81
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x148]
push 0
lea edx, [esp + 0x38]
push ecx
push edx
push 0
push eax
call ebp
cmp eax, 1
jne 0x44be82
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x140]
cmp cl, al
je 0x44bf02
push eax
call fcn.0044c040
mov cl, byte [esp + 0x17]
add esp, 4
cmp cl, al
je 0x44bf02
mov eax, dword [esp + 0x2c]
add esi, 4
inc eax
mov byte [esp + 0x40], bl
mov ebx, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x2c], eax
jl 0x44bde1
xor esi, esi
mov dword [esp + 0x18], method.CCommandLineInfo.virtual_0
mov dword [esp + 0x138], 4
cmp ebx, esi
je 0x44bec0
push ebx
call fcn.0054dd8f
add esp, 4
xor eax, eax
jmp 0x44bee9
mov dword [esp + 0x18], method.CCommandLineInfo.virtual_0
test ebx, ebx
mov dword [esp + 0x138], 2
je 0x44bee4
push ebx
call fcn.0054dd8f
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret
mov dword [esp + 0x18], method.CCommandLineInfo.virtual_0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x138], 3
test eax, eax
je 0x44bee4
push eax
jmp 0x44bedc