joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d9a1
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push esi
mov esi, ecx
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x42da38
mov ecx, esi
call fcn.00431300
mov ebp, eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42da38
mov ecx, esi
call fcn.0042d8a0
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x42da27
mov ecx, dword [esi + 0xba8]
test ecx, ecx
je 0x42da27
push ebx
push edi
push 0
push eax
call fcn.004e0650
add esp, 8
mov ecx, esi
mov edi, eax
mov ebx, 0x140
call fcn.004317f0
xor edx, edx
push eax
xor ecx, ecx
push ebx
push edx
push ecx
push edi
mov ecx, esi
call fcn.0042ee70
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop ebx
test eax, eax
jne 0x42da27
mov ecx, esi
call fcn.0042fdf0
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebp, ebp
je 0x42da38
mov ecx, esi
call fcn.0042ed50
pop esi
pop ebp
ret

Function at 0x42e690
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
cmp eax, 0x8000
jne 0x42e6cb
mov eax, dword [esi + 0x3ad4]
mov ecx, esi
neg eax
sbb eax, eax
and al, 0xfc
add eax, 4
mov dword [esi + 0x3ad4], eax
call fcn.0042d820
pop esi
add esp, 8
ret
mov ecx, dword [0x63fd4c]
push ebx
call fcn.00451b90
mov ecx, dword [0x63fd4c]
call fcn.00449d90
mov eax, dword [esi + 0x67c]
xor ebx, ebx
cmp eax, ebx
je 0x42e7a9
mov eax, dword [esi + 0xf4c]
cmp eax, 0x64
jle 0x42e7a9
fld qword [0x5daf40]
mov ecx, eax
cmp ecx, ebx
mov dword [esp + 8], ecx
je 0x42e727
cmp ecx, ebx
jle 0x42e723
mov eax, dword [esi + 0xf40]
fadd qword [eax]
add eax, 8
dec ecx
jne 0x42e71b
fidiv dword [esp + 8]
fdiv qword [esi + 0xf7d48]
fst qword [esp + 8]
fsub qword [0x5dab78]
fabs
fcomp qword [0x5db088]
fnstsw ax
test ah, 1
je 0x42e77c
mov ecx, esi
call fcn.00430560
fld qword [esi + 0xb58]
fmul qword [esp + 8]
mov ecx, esi
fstp qword [esi + 0xb58]
fld qword [esi + 0xb58]
fmul qword [esi + 0xb88]
fdivr qword [0x5dcc28]
fstp qword [esi + 0xf7d40]
call fcn.0042d820
mov ecx, dword [esi + 0xf44]
push edi
mov edi, dword [esi + 0xf40]
xor eax, eax
shl ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 0xf48], ebx
mov dword [esi + 0xf4c], ebx
pop edi
mov eax, dword [esi + 0xf7d28]
mov ecx, 1
cmp eax, 0xc8
jle 0x42e7c1
mov dword [esi + 0xfa0], ecx
cmp eax, 0x100
jl 0x42e7d4
mov dword [esi + 0xf74], 3
jmp 0x42e7da
mov dword [esi + 0xf74], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0xdc8]
call fcn.00440540
mov dword [esi + 0xf7d30], ebx
mov dword [esi + 0xf60], ebx
mov dword [esi + 0xf64], ebx
mov dword [esi + 0xf6c], ebx
mov dword [esi + 0xf98], ebx
mov dword [esi + 0xf7d2c], ebx
mov dword [esi + 0xf7d28], ebx
mov dword [esi + 0xf7d24], ebx
mov dword [esi + 0xf7d34], ebx
mov dword [esi + 0xf94], ebx
pop ebx
pop esi
add esp, 8
ret
Function at 0x42fc70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
fld qword [esp + 0x10]
fdiv qword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x14], ebp
fadd qword [0x5daf38]
call fcn.00573170
mov ebx, eax
lea esi, [ebx*4]
push esi
call fcn.0058ecf8
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x14], edi
mov esi, 0xf423f
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, ebx
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
imul edx, ecx
sub eax, edx
add eax, 0xf423f
cdq
idiv esi
test ecx, ecx
mov esi, edx
jle 0x42fda3
mov dword [esp + 0x28], ecx
xor edi, edi
test ebx, ebx
mov dword [esp + 0x1c], edi
jle 0x42fd94
mov cl, byte [esi + ebp + 0x3ad8]
mov eax, dword [ebp + 0xb80]
inc esi
mov byte [esp + 0x30], cl
test eax, eax
je 0x42fd12
or al, 0xff
sub al, cl
mov cl, al
mov byte [esp + 0x30], cl
mov eax, esi
mov esi, 0xf423f
cdq
idiv esi
cmp cl, 0x28
mov dword [esp + 0x20], edx
jae 0x42fd83
cmp cl, 0x18
jbe 0x42fd34
mov dl, 0x28
sub dl, cl
mov byte [esp + 0x30], dl
jmp 0x42fd3e
cmp cl, 0x10
jbe 0x42fd3e
mov byte [esp + 0x30], 0x10
mov esi, dword [esp + 0x30]
mov ecx, 1
and esi, 0xff
sub ecx, esi
cmp ecx, esi
jge 0x42fd83
lea ebp, [ecx + edi]
add ebp, ebx
mov eax, ebp
cdq
idiv ebx
mov eax, dword [esp + 0x10]
lea edi, [eax + edx*4]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, esi
sub edx, eax
mov eax, dword [edi]
add eax, edx
inc ecx
inc ebp
cmp ecx, esi
mov dword [edi], eax
jl 0x42fd58
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
inc edi
cmp edi, ebx
mov dword [esp + 0x1c], edi
jl 0x42fcf2
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jne 0x42fce4
mov ebp, dword [esp + 0x10]
xor edi, edi
xor eax, eax
mov edx, dword [ebp]
test ebx, ebx
jle 0x42fdc6
mov esi, ebp
mov ecx, dword [esi]
cmp ecx, edx
jle 0x42fdbe
mov edx, ecx
mov edi, eax
inc eax
add esi, 4
cmp eax, ebx
jl 0x42fdb4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42fdd0
mov dword [eax], edx
push ebp
call fcn.0058ed21
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x1c

Function at 0x42fe30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x42fe3f
xor eax, eax
pop ebx
ret 0xc
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
jle 0x42fe96
push ebp
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov ebx, 0xf423f
add eax, esi
mov ebp, 0xf423f
cdq
idiv ebx
xor eax, eax
mov al, byte [edx + ecx + 0x3ad8]
mov ebx, eax
mov eax, esi
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ecx + 0x3ad8]
sub eax, ebx
inc esi
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x42fe50
mov ebx, dword [esp + 0x1c]
pop ebp
mov eax, edi
pop edi
cdq
idiv ebx
pop esi
pop ebx
ret 0xc
Function at 0x445180
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x44522c
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [ebx + 0x194], 0
mov esi, 1
call edi
test ah, 0x80
je 0x4451b7
mov esi, 5
push 0x10
call edi
test ah, 0x80
je 0x4451c2
add esi, esi
mov ecx, dword [ebx + 0x98]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0xd
call dword [eax + 4]
test esi, esi
mov dword [esp + 0xc], eax
jle 0x445218
push ebp
mov ebp, esi
cmp eax, 1
jle 0x445214
fild dword [esp + 0x10]
mov edi, eax
fdivr qword [0x5dd9a8]
call fcn.00573170
mov esi, eax
inc esi
mov dword [esp + 0x10], esi
fild dword [esp + 0x10]
fdivr qword [0x5dd9a8]
call fcn.00573170
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x4451f8
dec ebp
jne 0x4451e0
pop ebp
mov ecx, dword [ebx + 0x98]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0xe
call dword [edx + 4]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x445230
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x4452dc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [ebx + 0x194], 0
mov esi, 1
call edi
test ah, 0x80
je 0x445267
mov esi, 5
push 0x10
call edi
test ah, 0x80
je 0x445272
add esi, esi
mov ecx, dword [ebx + 0x98]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0xd
call dword [eax + 4]
test esi, esi
mov dword [esp + 0xc], eax
jle 0x4452c8
push ebp
mov ebp, esi
cmp eax, 0x64
jg 0x4452c4
fild dword [esp + 0x10]
mov edi, eax
fdivr qword [0x5dd9a8]
call fcn.00573170
mov esi, eax
dec esi
mov dword [esp + 0x10], esi
fild dword [esp + 0x10]
fdivr qword [0x5dd9a8]
call fcn.00573170
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x4452a8
dec ebp
jne 0x445290
pop ebp
mov ecx, dword [ebx + 0x98]
push 0
push 0
push eax
mov edx, dword [ecx]
push 0xe
call dword [edx + 4]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44f390
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bac48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ecx + 0xa64c]
mov edx, dword [eax + 0x30e7c]
test edx, edx
je 0x44f3cc
push 1
call fcn.0044f2f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [eax + 0x100]
cmp eax, 0xffffffff
je 0x44f429
mov ecx, dword [0x639698]
mov dword [esp], ecx
push eax
lea edx, [esp + 4]
push str.sndvol32.exe__D__i
push edx
mov dword [esp + 0x18], 0
call fcn.0058aded
mov eax, dword [esp + 0xc]
add esp, 0xc
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 5
push str.sndvol32.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44f450
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bac68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ecx + 0xa64c]
mov edx, dword [eax + 0x30e7c]
test edx, edx
je 0x44f48c
push 0
call fcn.0044f2f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [eax + 0xfc]
cmp eax, 0xffffffff
je 0x44f4e9
mov ecx, dword [0x639698]
mov dword [esp], ecx
push eax
lea edx, [esp + 4]
push str.sndvol32.exe__R__D__i
push edx
mov dword [esp + 0x18], 0
call fcn.0058aded
mov eax, dword [esp + 0xc]
add esp, 0xc
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 5
push str.sndvol32.exe__R
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x451ca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push str.OnEscape
call fcn.004781b0
mov eax, 1
mov dword [esi + 0xaa10], eax
mov dword [0x63fd90], eax
mov eax, dword [esi + 0xaa14]
test eax, eax
jne 0x451d1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
sub eax, dword [esi + 0xaa0c]
cmp eax, 0x1f4
sbb edi, edi
neg edi
call ebx
test edi, edi
pop edi
mov dword [esi + 0xaa0c], eax
pop ebx
je 0x451d1c
mov ecx, dword [esi + 0x9fac]
call fcn.004a4290
mov ecx, dword [esi + 0xa648]
test ecx, ecx
je 0x451d4d
mov eax, dword [ecx]
push 0
push 0
push 0
push 0x2d
call dword [eax + 4]
mov dword [0x63fd90], 0
pop esi
ret
lea ecx, [esi + 0x8514]
mov dword [esi + 0x8510], 0
call fcn.00593666
mov ecx, esi
call fcn.00458d10
mov ecx, esi
call fcn.00451b90
mov ecx, esi
call fcn.0044aaf0
mov ecx, esi
call fcn.0044f510
mov dword [0x63fd90], 0
pop esi
ret
Function at 0x476b30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c184d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x47c]
lea eax, [esp + 0x28]
mov edi, 1
push eax
push ecx
mov dword [esp + 0x478], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0058d50f
xor eax, eax
cmp ebx, 0xffffffff
setne al
test eax, eax
mov byte [esp + 0x470], 2
jne 0x476bb0
mov esi, dword [esp + 0x478]
push 0x63f7e8
mov ecx, esi
call fcn.00593749
mov dword [esp + 0xc], edi
jmp 0x476cec
mov edi, dword [esp + 0x480]
push ebp
test dword [esp + 0x2c], 0x1356
jne 0x476c56
test edi, edi
je 0x476c43
lea edx, [esp + 0x16c]
lea eax, [esp + 0x36c]
push edx
lea ecx, [esp + 0x270]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x64]
push edx
push eax
call fcn.005746ca
mov al, byte [esp + 0x180]
add esp, 0x14
cmp al, 0x2e
lea ebp, [esp + 0x16c]
jne 0x476c0d
lea ebp, [esp + 0x16d]
mov eax, dword [edi + 8]
xor esi, esi
test eax, eax
jle 0x476c56
mov ecx, dword [edi + 4]
push ebp
lea eax, [ecx + esi*4]
mov eax, dword [ecx + esi*4]
push eax
call fcn.00574f06
add esp, 8
test eax, eax
je 0x476c37
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jl 0x476c16
jmp 0x476c56
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x58]
push edx
push eax
jmp 0x476c4d
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x58]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.0058d6eb
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x476bb8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
jne 0x476c97
mov esi, dword [esp + 0x478]
push 0x63f7e8
mov ecx, esi
call fcn.00593749
mov dword [esp + 0xc], 1
jmp 0x476cec
mov edi, 1
cmp eax, edi
jne 0x476ca6
mov ecx, dword [esp + 0x14]
jmp 0x476cd9
mov esi, eax
call fcn.00574188
cdq
idiv esi
cmp edx, dword [0x62f7e4]
jne 0x476ccc
mov esi, dword [esp + 0x18]
call fcn.00574188
cdq
idiv esi
cmp edx, dword [0x62f7e4]
je 0x476cb8
mov eax, dword [esp + 0x14]
mov dword [0x62f7e4], edx
lea ecx, [eax + edx*4]
mov esi, dword [esp + 0x478]
push ecx
mov ecx, esi
call fcn.00593450
mov dword [esp + 0xc], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x470], 1
call fcn.0058d542
lea ecx, [esp + 0x47c]
mov byte [esp + 0x470], 0
call fcn.005936db
mov ecx, dword [esp + 0x468]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x468
ret
Function at 0x484380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c306e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor eax, eax
lea ecx, [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esp + 0x18], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov eax, dword [0x639698]
mov dword [ecx], eax
mov edx, dword [0x639698]
lea ebx, [esi + 0x18]
mov dword [ebx], edx
mov edi, dword [esp + 0x20]
mov dword [esi], 0x5e2058
mov byte [esp + 0x18], 2
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
lea edx, [edi + 0x14]
mov dword [esi + 0x10], eax
push edx
call fcn.00593814
lea eax, [edi + 0x18]
mov ecx, ebx
push eax
call fcn.00593814
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x486360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c3616
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 8]
sub esp, 0x38
xor eax, eax
mov esi, esp
mov dword [esp + 0x48], esp
mov dword [esp + 0x54], eax
mov dword [esp + 0x48], esi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov eax, dword [0x639698]
lea ecx, [esi + 0x14]
mov dword [ecx], eax
mov edx, dword [0x639698]
lea ebx, [esi + 0x18]
mov dword [ebx], edx
mov dword [esi], 0x5e2058
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov eax, dword [esp + 0x6c]
lea edx, [esp + 0x70]
mov byte [esp + 0x54], 3
push edx
mov dword [esi + 0x10], eax
call fcn.00593814
lea eax, [esp + 0x74]
mov ecx, ebx
push eax
call fcn.00593814
mov ecx, dword [esp + 0x78]
push ebp
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x80]
mov dword [esi + 0x20], edx
mov eax, dword [esp + 0x84]
mov dword [esi + 0x24], eax
mov ecx, dword [esp + 0x88]
mov dword [esi + 0x28], ecx
mov edx, dword [esp + 0x8c]
mov dword [esi + 0x2c], edx
mov eax, dword [esp + 0x90]
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0x94]
mov dword [esi + 0x34], ecx
mov edx, dword [esp + 0x64]
mov ecx, edi
mov dword [esi + 4], edx
mov byte [esp + 0x58], 0
call fcn.004865f0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005148b0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x38
Function at 0x489780
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x63fe48]
push esi
xor esi, esi
cmp eax, esi
je 0x48979b
mov eax, dword [eax + 0x28]
cmp eax, esi
je 0x48979b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x63fe3c]
mov dword [0x63fe48], esi
cmp eax, esi
je 0x4897b1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x63fe3c], esi
mov dword [0x63fe40], esi
mov dword [0x63fe44], esi
mov eax, 1
pop esi
ret

Function at 0x48a770
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5c3978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x9b94]
call fcn.00492340
mov ebx, eax
test ebx, ebx
jne 0x48a7e9
mov eax, dword [esi + 0x8f44]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x48a7e9
mov ecx, dword [esi + 0x8fb0]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x48a7e9
mov edx, dword [esi + 0x8fb4]
mov eax, dword [edx - 8]
test eax, eax
jne 0x48a7e9
mov eax, dword [esi + 0x8fa0]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x48a7e9
mov ecx, dword [esi + 0x8fa4]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x48a7e9
mov edx, dword [esi + 0x8fb8]
mov eax, dword [edx - 8]
test eax, eax
je 0x48a85e
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ah, 0x80
jne 0x48a806
push 0x11
call edi
test ah, 0x80
jne 0x48a806
xor eax, eax
jmp 0x48a80b
mov eax, 1
test ebx, ebx
pop edi
je 0x48a857
test eax, eax
jne 0x48a857
lea eax, [esp + 8]
push 0xcd7f
push eax
call fcn.004ec350
add esp, 8
mov eax, dword [eax]
push 0x31
push 0
push eax
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.005913a9
cmp eax, 1
lea ecx, [esp + 8]
setne bl
mov dword [esp + 0x14], 0xffffffff
call fcn.005936db
test bl, bl
jne 0x48a85e
mov ecx, esi
call fcn.0048a870
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x48e690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c40c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00595172
mov eax, dword [esp + 0x30]
push 0
push 0
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.005951e7
test eax, eax
je 0x48e76e
mov eax, dword [0x639698]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov byte [esp + 0x28], 2
push ecx
lea ecx, [esp + 0x10]
call fcn.005953ca
test eax, eax
je 0x48e73d
lea edx, [esp + 4]
push 0x62619c
lea eax, [esp + 0x34]
push edx
push eax
call fcn.00593970
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00593af3
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call fcn.005936db
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x10]
call fcn.005953ca
test eax, eax
jne 0x48e6fa
lea ecx, [esp + 0xc]
call fcn.00595517
mov edx, dword [esp + 8]
mov ecx, esi
push edx
call fcn.0048e5d0
lea ecx, [esp + 4]
mov byte [esp + 0x28], 1
call fcn.005936db
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.005936db
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005951a4
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x4b0a30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x6178]
test eax, eax
jne 0x4b0b87
call fcn.004b17f0
test eax, eax
jne 0x4b0b4d
cmp dword [esi + 0x61a0], 0xffffffff
jne 0x4b0b4d
mov eax, dword [0x63fd4c]
mov ecx, dword [eax + 0x9678]
mov eax, dword [ecx + 0x88]
test eax, eax
jne 0x4b0b8e
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [esi + 0x1c]
jne 0x4b0b8e
mov edx, dword [0x63fd4c]
push 0x10
mov esi, dword [edx + 0xa350]
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
xor ecx, ecx
cmp eax, 0x8000
sete cl
xor ecx, esi
je 0x4b0b1b
mov edx, dword [0x63fd4c]
mov ecx, dword [edx + 0xa648]
test ecx, ecx
je 0x4b0b1b
mov eax, dword [ecx]
push 0
push 0
push 0
push 0x56
call dword [eax + 4]
test eax, eax
je 0x4b0b1b
mov ecx, dword [0x63fd4c]
mov eax, dword [ecx + 0xa248]
test eax, eax
je 0x4b0b07
call fcn.005aa82c
call fcn.005aa82c
mov eax, dword [eax + 0xc]
push 0x538
jmp 0x4b0b80
call fcn.005aa82c
call fcn.005aa82c
mov eax, dword [eax + 0xc]
push 0xb4
jmp 0x4b0b80
mov edx, dword [0x63fd4c]
mov eax, dword [edx + 0xa248]
test eax, eax
je 0x4b0b3f
call fcn.005aa82c
call fcn.005aa82c
mov eax, dword [eax + 0xc]
push 0x536
jmp 0x4b0b80
call fcn.005aa82c
push 0x7f00
push 0
jmp 0x4b0b81
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4b0b6e
call fcn.005aa82c
call fcn.005aa82c
mov eax, dword [eax + 0xc]
push 0xbb
jmp 0x4b0b80
call fcn.005aa82c
call fcn.005aa82c
mov eax, dword [eax + 0xc]
push 0xba
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
add esp, 8
ret 0xc
Function at 0x4b12f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
push 0
call fcn.00591501
add eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6098]
fild dword [esp + 0x18]
test eax, eax
fstp dword [esp + 0x18]
jle 0x4b132b
lea ecx, [eax + 1]
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr dword [esp + 0x18]
fstp dword [esp + 0x18]
jge 0x4b1337
fld dword [esp + 0x18]
fadd st(0), st(0)
fstp dword [esp + 0x18]
mov ecx, esi
call fcn.004b1210
test eax, eax
je 0x4b14ef
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa5
call edi
test ah, 0x80
jne 0x4b14ef
push 0xa4
call edi
test ah, 0x80
jne 0x4b14ef
mov eax, dword [esi + 0x60d4]
cmp eax, 0xffffffff
je 0x4b1520
mov edx, dword [0x63fd4c]
mov ecx, dword [edx + eax*4 + 0xa654]
test ecx, ecx
je 0x4b1520
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
call fcn.004b07c0
mov ecx, dword [esi + 0x60d4]
mov edx, dword [0x63fd4c]
fstp dword [esp + 0x18]
mov ecx, dword [edx + ecx*4 + 0xa654]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0x3e
call dword [eax + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
fild qword [esp + 8]
fmul dword [esp + 0x18]
fmul qword [0x5daff8]
call fcn.00573170
mov ecx, dword [esi + 0x60d4]
mov edx, dword [0x63fd4c]
push 0
mov edi, eax
mov ecx, dword [edx + ecx*4 + 0xa654]
push 0
push 0
push 0x2e
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x4b144a
mov ecx, dword [esi + 0x60d4]
mov edx, dword [0x63fd4c]
push 0
push 0
mov ecx, dword [edx + ecx*4 + 0xa654]
push 0
push 0x30
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x4b144a
mov ecx, dword [esi + 0x60d4]
mov edx, dword [0x63fd4c]
push 0
push 0
mov ecx, dword [edx + ecx*4 + 0xa654]
push edi
push 0x31
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, eax
mov ecx, dword [esi + 0x60d4]
mov edx, dword [0x63fd4c]
push 0
push 0
mov eax, dword [edx + ecx*4 + 0xa654]
mov ecx, dword [esi + 0x60b0]
push edi
push 0x43
mov dword [eax + 0x1c], ecx
mov edx, dword [esi + 0x60d4]
mov eax, dword [0x63fd4c]
mov ecx, dword [eax + edx*4 + 0xa654]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esi + 0x60d4]
mov ecx, dword [0x63fd4c]
push 0
push 0
mov ecx, dword [ecx + eax*4 + 0xa654]
push 0
push 0x3a
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
jne 0x4b14dd
mov eax, dword [esp + 0x14]
xor ecx, ecx
and eax, 4
cmp al, 4
mov eax, dword [0x63fd4c]
sete cl
xor ecx, dword [eax + 0xa350]
je 0x4b14dd
mov edx, dword [esi + 0x60d4]
push 0
push 0
push 0
mov ecx, dword [eax + edx*4 + 0xa654]
push 0x57
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + 0x60d4], 0xffffffff
pop edi
pop esi
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x18]
push 0
push ecx
mov ecx, esi
call fcn.004b07c0
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.004afee0
call fcn.00573170
mov edx, dword [0x63fd4c]
mov ecx, esi
mov dword [edx + 0xa5fc], eax
call fcn.004b0ff0
pop edi
pop esi
add esp, 8
ret 0xc