joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409070
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp byte [0x4d4bbe], 0
push ebx
mov bh, dl
mov edx, ecx
push esi
mov dword [esp + 8], edx
je 0x40910b
mov al, byte [0x4d4ba2]
cmp al, 0xa0
je 0x409095
cmp al, 0x10
jne 0x40910b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d4bc0]
cmp eax, 0x16
jae 0x409107
mov edx, dword [esp + 0x10]
mov cl, bh
call fcn.00409350
cmp byte [0x4d4ba3], 0
jne 0x4090d1
xor eax, eax
nop dword [eax]
cmp byte [eax + 0x4d4bc8], 0
jne 0x4090dc
inc eax
cmp eax, 0x16
jl 0x4090c0
jmp 0x409107
cmp byte [esp + 0x14], 0
je 0x4090e5
test al, al
je 0x409107
mov byte [0x4d4ba1], 1
jmp 0x4090e9
test al, al
je 0x409107
mov al, byte [0x4d4bbf]
mov byte [0x4d2015], al
mov al, byte [0x4d4bc4]
mov byte [0x4d2028], al
mov al, byte [0x4d4bc5]
mov byte [0x4d20b8], al
mov edx, dword [esp + 8]
mov al, byte [0x4d2015]
mov byte [0x4d4bbf], al
mov al, byte [0x4d2028]
movzx esi, bh
mov byte [0x4d4bc4], al
mov al, byte [0x4d20b8]
mov byte [0x4d4bc5], al
mov eax, dword [0x4d4bb4]
lea ecx, [esi + esi*8]
shl ecx, 5
mov bl, byte [ecx + eax + 4]
test bl, bl
je 0x409259
mov ecx, dword [esp + 8]
push edi
mov edi, dword [edx + 0x10]
mov dl, bh
push dword [esp + 0x18]
mov ecx, dword [ecx + 8]
call fcn.004092d0
add esp, 4
cmp byte [esp + 0x18], 0
je 0x409201
cmp byte [esp + 0x1c], 0
jne 0x409186
mov cl, bl
not cl
and byte [0x4d2017], cl
cmp edi, 0xffc3d44f
je 0x409186
and byte [0x4d2016], cl
test al, al
je case.default.0x409238
not bl
mov byte [esi + 0x4d2018], 0
and byte [0x4d2015], bl
add esi, 0xffffff60
cmp esi, 5
ja case.default.0x409238
jmp dword [esi*4 + 0x409298]
mov al, byte [0x4d20b9]
mov byte [0x4d2028], al
jmp case.default.0x409238
mov al, byte [0x4d20b8]
mov byte [0x4d2028], al
jmp case.default.0x409238
mov al, byte [0x4d20bb]
mov byte [0x4d2029], al
jmp case.default.0x409238
mov al, byte [0x4d20ba]
mov byte [0x4d2029], al
jmp case.default.0x409238
mov al, byte [0x4d20bd]
mov byte [0x4d202a], al
jmp case.default.0x409238
mov al, byte [0x4d20bc]
mov byte [0x4d202a], al
jmp case.default.0x409238
cmp byte [esp + 0x1c], 0
jne 0x40921c
or byte [0x4d2017], bl
cmp edi, 0xffc3d44f
je 0x40921c
or byte [0x4d2016], bl
test al, al
je case.default.0x409238
or byte [0x4d2015], bl
mov byte [esi + 0x4d2018], 0x80
add esi, 0xffffff60
cmp esi, 5
ja case.default.0x409238
jmp dword [esi*4 + 0x4092b0]
mov byte [0x4d2028], 0x80
jmp case.default.0x409238
mov byte [0x4d2029], 0x80
jmp case.default.0x409238
mov byte [0x4d202a], 0x80
pop edi
mov eax, dword [esp + 0x10]
mov dl, bh
mov word [0x4d4bbc], ax
mov eax, dword [esp + 0x14]
mov byte [0x4d4ba3], al
push eax
mov eax, dword [esp + 0xc]
mov byte [0x4d4ba2], bh
mov ecx, dword [eax + 8]
call fcn.004092d0
add esp, 4
mov byte [0x4d4bbe], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
mov dword [0x4d4bc0], eax
pop ebx
pop ecx
ret
Function at 0x4092d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
test cl, 0x10
jne 0x409307
cmp dl, 0xa0
je 0x4092df
cmp dl, 0x10
jne 0x40933a
cmp byte [esp + 4], 0
jne 0x40933a
cmp byte [0x4d4ba1], 0
je 0x40930a
xor eax, eax
cmp byte [eax + 0x4d4bc8], 0
jne 0x40930a
inc eax
cmp eax, 0x16
jl 0x4092f1
mov byte [0x4d4ba1], 0
xor al, al
ret
cmp byte [0x4d4ba3], 0
je 0x40933a
mov dx, word [0x4d4bbc]
mov cl, byte [0x4d4ba2]
call fcn.00409350
test al, al
je 0x40933a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d4bc0]
cmp eax, 0x16
jb 0x409307
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4d4b7c], eax
mov al, 1
ret
Function at 0x40a1a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
mov al, dl
mov byte [esp + 0xa], cl
xor dl, dl
mov byte [esp + 9], al
cmp dword [0x4d16a0], 0
movzx ebx, dl
mov edx, 1
push ebp
push esi
cmovne ebx, edx
cmp dword [0x4d169c], 0
push edi
je 0x40a1d7
or bl, 2
cmp cl, bl
je 0x40a3e1
test bl, bl
jne 0x40a220
test al, al
jne 0x40a220
push 0x4d2130
push 0
push 0
push 0x40a450
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4d562c], eax
test eax, eax
je 0x40a2b9
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, byte [esp + 0x15]
mov cl, byte [esp + 0x16]
movzx edi, al
xor esi, esi
xor edi, 1
movzx ebp, cl
nop dword [eax + eax]
push edi
push ebp
push 0x417
push dword [0x4d2130]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x40a255
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x40a230
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor al, al
mov byte [esp + 0x17], al
call esi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, eax
mov cl, byte [esp + 0x16]
mov al, byte [esp + 0x15]
test cl, cl
je 0x40a2c6
push 1
push 0x417
push 0x417
push 0
lea eax, [esp + 0x2c]
push eax
call ebp
test eax, eax
je 0x40a2fb
cmp dword [esp + 0x24], 0
je 0x40a2d3
mov byte [esp + 0x17], 1
call fcn.0040a830
test al, al
jne 0x40a2d3
mov al, byte [esp + 0x15]
test al, al
jne 0x40a3b4
xor cl, cl
mov byte [esp + 0x16], cl
jmp 0x40a273
call fcn.0040a850
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
je 0x40a2e0
call fcn.0040a830
test al, al
jne 0x40a2fb
cmp byte [esp + 0x15], 0
jne 0x40a3ad
jmp 0x40a32e
lea eax, [esp + 0x18]
push eax
push dword [0x4d562c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x18], 0x103
jne 0x40a313
call esi
sub eax, edi
cmp eax, 0x1f4
ja 0x40a2d3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a26b
push dword [0x4d562c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4d562c], 0
call fcn.0040a850
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov al, bl
and al, 1
cmp dword [0x4d16a0], 0
je 0x40a357
test al, al
jne 0x40a371
push str._sp4dl23sus
push 0
push 0
call esi
mov dword [0x4d4b94], eax
jmp 0x40a371
test al, al
je 0x40a371
push dword [0x4d4b94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4d4b94], 0
and bl, 2
cmp dword [0x4d169c], 0
je 0x40a393
test bl, bl
jne 0x40a3ad
push str._wk3Rn2rm4f
push 0
push 0
call esi
mov dword [0x4d4b98], eax
jmp 0x40a3ad
test bl, bl
je 0x40a3ad
push dword [0x4d4b98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4d4b98], 0
cmp byte [esp + 0x17], 0
je 0x40a3e1
push 0
push 0
xorps xmm3, xmm3
mov dword [0x4ce8c0], 0
mov edx, 0x10000
mov ecx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.00477540
add esp, 8
mov dword [0x4ce8c0], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b650
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
mov eax, ecx
push edi
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor dl, dl
xor cl, cl
call fcn.0040a1a0
mov eax, dword [0x4d1668]
test eax, eax
je 0x40b67b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor eax, eax
xor edi, edi
cmp ax, word [0x4d30f4]
jae 0x40b6fc
mov ebp, dword [sym.imp.USER32.dll_UnregisterHotKey]
mov edx, dword [0x4d3e4c]
mov ebx, dword [0x4d3e50]
nop word [eax + eax]
mov esi, dword [edi*4 + 0x4d2150]
test esi, esi
je 0x40b6f0
cmp byte [esi + 0x1a], 0
je 0x40b6d1
movzx eax, word [esi]
push eax
push dword [0x4d1684]
call ebp
mov edx, dword [0x4d3e4c]
test eax, eax
mov ebx, dword [0x4d3e50]
sete al
mov byte [esi + 0x1a], al
cmp esi, edx
jne 0x40b6f0
test edx, edx
je 0x40b6f0
mov eax, dword [ebx + 4]
mov ecx, eax
sub ecx, edx
add dword [ebx + 8], ecx
sub eax, ecx
xor edx, edx
mov dword [ebx + 4], eax
mov dword [0x4d3e4c], edx
movzx eax, word [0x4d30f4]
inc edi
cmp edi, eax
jl 0x40b6a0
push dword [esp + 0x10]
call fcn.00492d0a
int3
Function at 0x40f390
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov al, byte [ebp + 0xc]
or byte [ebp + 8], al
push ebx
mov bl, cl
mov dword [esp + 8], edx
mov al, bl
sub al, 1
push esi
push edi
cmp al, 5
ja 0x40f3b5
cmp bl, 3
jne 0x40f3bd
mov al, bl
add al, 0x66
cmp al, 5
ja 0x40f3c1
mov bh, 1
jmp 0x40f3c3
xor bh, bh
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x1c]
test edi, edi
jle 0x40f4db
cmp dword [0x4d4c54], 0
jne 0x40f437
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4ce8c8]
sub eax, dword [0x4d49c4]
cmp eax, dword [ecx + 0xd8]
jbe 0x40f437
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40f42c
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4d49c4], eax
cmp byte [ebp + 0x18], 0
jne 0x40f47b
cmp dword [0x4d4c54], 0
je 0x40f44d
mov al, byte [0x4d4bdf]
jmp 0x40f454
xor cl, cl
call fcn.00411ce0
mov ecx, dword [0x4ce8c8]
mov edx, 0xffc3d44d
movzx ecx, byte [ecx + 0xf6]
sub edx, ecx
mov cl, byte [ebp + 8]
push edx
push 1
push 0
push esi
mov dl, al
call fcn.00411650
add esp, 0x10
test bh, bh
je 0x40f4aa
test esi, esi
jne 0x40f4aa
push dword [ebp + 0x28]
mov eax, dword [0x4ce8c8]
mov cl, bl
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
movzx eax, byte [eax + 0xef]
push eax
push 1
push dword [ebp + 0x24]
call fcn.004107c0
add esp, 0x14
jmp 0x40f4d2
mov eax, dword [0x4ce8c8]
mov ecx, 0xffc3d44d
mov dl, bl
movzx eax, byte [eax + 0xf6]
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x14]
push 1
push esi
push dword [esp + 0x1c]
call fcn.0040f910
add esp, 0x10
sub edi, 1
jne 0x40f3d1
cmp byte [ebp + 0x18], 0
jne 0x40f51c
cmp dword [0x4d4c54], 0
je 0x40f4f1
mov al, byte [0x4d4bdf]
jmp 0x40f4f8
xor cl, cl
call fcn.00411ce0
mov cl, al
xor cl, byte [ebp + 0xc]
and cl, al
and cl, 0xcc
je 0x40f51c
push 0xffc3d44d
push 0
not cl
mov dl, al
push 1
push esi
and cl, al
call fcn.00411650
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f530
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov ebp, ecx
mov ebx, edx
push edi
movzx edi, bp
mov esi, edi
and esi, 0xffffff80
je 0x40f54f
mov eax, 0x30
mov word [esp + 0x2c], ax
lea ecx, [esp + 0x2e]
test esi, esi
lea eax, [esp + 0x2c]
push 0xa
cmovne eax, ecx
push eax
push edi
call fcn.0048f17a
add esp, 0xc
test ebx, ebx
jle 0x40f61c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
nop dword [eax]
cmp dword [0x4d4c54], 0
jne 0x40f5da
call esi
mov ecx, dword [0x4ce8c8]
sub eax, dword [0x4d49c4]
cmp eax, dword [ecx + 0xd8]
jbe 0x40f5da
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
je 0x40f5d3
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
call esi
mov dword [0x4d49c4], eax
cmp dword [0x4d4c54], 2
je 0x40f5ef
or edx, 0xffffffff
mov ecx, ebp
call fcn.0040e120
jmp 0x40f5f8
lea ecx, [esp + 0x2c]
call fcn.0040f630
cmp dword [0x4d4c54], 2
mov eax, dword [0x4ce8c8]
jne 0x40f60b
mov ecx, dword [eax + 0x60]
jmp 0x40f60e
mov ecx, dword [eax + 0x5c]
call fcn.00411350
sub ebx, 1
jne 0x40f580
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x410be0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
mov ecx, dword [edi]
cmp ecx, 0x80000000
je 0x410d9e
mov eax, dword [ebp]
cmp eax, 0x80000000
je 0x410d9e
cmp dword [0x4d4c54], 2
jne 0x410c4b
mov bl, byte [esp + 0x2c]
xor edx, edx
push eax
push ecx
movzx ecx, bl
shl ecx, 0x1f
or ecx, 1
call fcn.00410f90
add esp, 8
call fcn.004113b0
test bl, bl
je 0x410d9e
mov dword [edi], SysReAllocString
mov dword [ebp], SysStringLen
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x24]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
or dword [eax], 0x8001
cmp byte [esp + 0x2c], 0
je 0x410ca9
cmp dword [0x4d4c54], 1
jne 0x410c93
mov eax, dword [0x4d4c48]
cmp eax, 0x80000000
jne 0x410c85
push 0x4d4c48
call ebx
mov ecx, dword [edi]
mov eax, dword [0x4d4c48]
add eax, ecx
mov dword [edi], eax
mov eax, dword [0x4d4c4c]
add dword [ebp], eax
jmp 0x410cb5
lea eax, [esp + 0x18]
push eax
call ebx
mov eax, dword [esp + 0x18]
add dword [edi], eax
mov eax, dword [esp + 0x1c]
add dword [ebp], eax
jmp 0x410cb5
push 2
mov ecx, edi
call fcn.00474000
add esp, 4
cmp dword [0x4d4c54], 1
jne 0x410ccd
mov eax, dword [edi]
mov dword [0x4d4c48], eax
mov eax, dword [ebp]
mov dword [0x4d4c4c], eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov dword [esp + 0x14], eax
call esi
mov ecx, dword [edi]
mov esi, eax
mov eax, ecx
mov dword [esp + 0x14], esi
shl eax, 0x10
cdq
idiv dword [esp + 0x10]
sar ecx, 0x1f
and ecx, 0xfffffffe
inc ecx
add eax, ecx
mov dword [edi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv esi
sar ecx, 0x1f
and ecx, 0xfffffffe
inc ecx
add ecx, eax
mov eax, dword [esp + 0x28]
mov dword [ebp], ecx
test eax, eax
js 0x410d87
mov esi, 0x64
cmp eax, esi
cmovle esi, eax
test esi, esi
je 0x410d87
cmp dword [0x4d4c54], 1
je 0x410d87
lea eax, [esp + 0x18]
push eax
call ebx
push esi
mov esi, dword [esp + 0x20]
xor ecx, ecx
mov eax, esi
shl eax, 0x10
cdq
idiv dword [esp + 0x18]
push dword [ebp]
test esi, esi
mov esi, dword [esp + 0x20]
push dword [edi]
mov edi, eax
setns cl
mov eax, esi
shl eax, 0x10
cdq
idiv dword [esp + 0x1c]
lea edi, [edi + ecx*2]
xor ecx, ecx
test esi, esi
lea edx, [edi - 1]
setns cl
lea eax, [eax + ecx*2]
lea ecx, [eax - 1]
call fcn.00453890
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push ecx
push dword [edi]
xor edx, edx
mov ecx, 0x8001
call fcn.00410db0
add esp, 8
call fcn.004113b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x411200
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0xc
cmp dword [0x4d4c54], 1
push ebx
push esi
mov byte [esp + 0xf], dl
mov esi, ecx
jne 0x4112be
xor al, al
cmp dword [0x4d16a0], 0
movzx ebx, al
mov eax, 1
cmovne ebx, eax
cmp dword [0x4d169c], 0
mov dword [esp + 0x10], ebx
je 0x411240
or ebx, 2
mov dword [esp + 0x10], ebx
test bl, bl
je 0x411255
mov cl, byte [0x4d4c50]
mov dl, al
not cl
and cl, bl
call fcn.0040a1a0
push 0x1c
push dword [0x4d3100]
push dword [0x4d4c3c]
call dword [0x4d4b80]
test bl, bl
je 0x41133c
mov al, byte [0x4d4c50]
and al, bl
test al, 1
je 0x4112b0
mov cl, 1
call fcn.00411ce0
mov bl, al
xor bl, byte [esp + 0xf]
mov dl, bl
and bl, al
and dl, byte [esp + 0xf]
not dl
and dl, byte [0x4d2015]
or dl, bl
mov byte [0x4d2015], dl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [esp + 0x10]
mov dword [0x4d1800], eax
mov dl, 1
mov cl, bl
pop esi
pop ebx
add esp, 0xc
jmp fcn.0040a1a0
push 0
push dword [0x4d16c4]
mov dword [0x4d4c44], 0
push 0x40f6c0
push 1
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4d1668], eax
test eax, eax
je 0x41133c
mov byte [0x4d2014], 1
nop dword [eax]
mov edx, 1
mov dword [0x4ce8c0], 0
mov ecx, 0x8000012f
call fcn.00401e60
cmp dword [0x4d1668], 0
mov dword [0x4ce8c0], 1
jne 0x4112f0
mov eax, dword [0x4cffb8]
mov byte [0x4d2014], 0
mov ecx, dword [eax]
mov eax, dword [0x4d4c3c]
cmp dword [ecx + eax*8 - 8], 0
jne 0x41133c
mov eax, dword [ecx + eax*8 - 4]
mov dword [esi], eax
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x411420
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [0x4d1694]
test edi, edi
je 0x411532
mov ax, word [esp + 8]
push esi
imul esi, dword [0x4d16d0], 0xd4
mov byte [esi + edi + 6], cl
mov byte [esi + edi], dl
mov word [esi + edi + 2], ax
mov eax, 0x69
mov word [esi + edi + 4], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [0x4d1694]
mov ecx, edx
mov dword [0x4d16cc], edx
sub ecx, dword [0x4d4b78]
mov dword [0x4d4b78], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4c96f0]
imul ecx, dword [0x4d16d0], 0xd4
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4c9624]
movss dword [ecx + eax + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x4114f5
mov eax, dword [0x4d1694]
cmp edi, dword [0x4d16c8]
je 0x4114e0
imul edx, dword [0x4d16d0], 0xd4
push 0x64
add edx, 0xc
add eax, edx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [0x4d16d0]
jmp 0x411519
mov esi, dword [0x4d16d0]
imul ecx, esi, 0xd4
xor edx, edx
mov word [ecx + eax + 0xc], dx
jmp 0x411519
mov esi, dword [0x4d16d0]
mov ecx, dword [0x4d1694]
mov eax, dword [0x4beecc]
imul edx, esi, 0xd4
mov dword [edx + ecx + 0xc], eax
mov eax, dword [0x4beed0]
mov dword [edx + ecx + 0x10], eax
inc esi
mov dword [0x4d16c8], edi
xor eax, eax
cmp esi, dword [0x4ce8cc]
cmovge esi, eax
mov dword [0x4d16d0], esi
pop esi
pop edi
ret
Function at 0x411540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov bl, cl
push edi
movzx ebp, bl
mov edi, edx
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp edi, 1
je 0x41156a
cmp edi, 2
jne 0x411641
cmp esi, edi
je 0x411641
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x41159d
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.0040f910
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 2
call fcn.0040f910
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4d3e6c]
sete bh
jne 0x4115f2
mov edx, 1
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
cmp bl, 0x14
jne 0x411641
cmp edi, 2
jne 0x411641
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x411641
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, edi
call fcn.0040f910
add esp, 0x10
test bh, bh
je 0x411641
lea edx, [edi - 1]
mov dword [0x4ce8c0], 0
or ecx, 0xffffffff
call fcn.00401e60
mov dword [0x4ce8c0], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x411ce0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4d16a0], 0
je 0x411cf5
test cl, cl
jne 0x411cf5
mov al, byte [0x4d2017]
pop ecx
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0xa0
call esi
mov bx, ax
shr bx, 0xb
push 0xa1
and bl, 0x10
call esi
mov cl, bl
mov edi, 0x8000
or cl, 0x20
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa2
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 1
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa3
cmove ebx, ecx
call esi
mov cl, bl
or cl, 2
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa4
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 4
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa5
cmove ebx, ecx
call esi
mov cl, bl
or cl, 8
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0x5b
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 0x40
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0x5c
cmove ebx, ecx
call esi
mov cl, bl
or cl, 0x80
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dword [0x4d16a0], 0
mov dword [esp + 0xc], edx
je 0x411e15
mov bl, byte [0x4d2017]
mov cl, dl
not cl
and cl, bl
je 0x411e15
mov dl, byte [0x4d2015]
not cl
and byte [0x4d2016], cl
and dl, cl
and bl, cl
mov byte [0x4d2015], dl
mov ecx, 0x4d2018
mov byte [0x4d2017], bl
call fcn.00411e20
mov edx, dword [esp + 0xc]
pop edi
pop esi
mov al, dl
pop ebx
pop ecx
ret
Function at 0x412410
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov bl, cl
xor edi, edi
cmp byte [edi*8 + 0x4ce944], bl
je 0x41258d
inc edi
cmp edi, 0x6d
jl 0x412420
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [ebx - 0x41]
mov esi, eax
cmp cl, 0x19
ja 0x41251d
push pe_nt_image_headers32
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.0048ce40
add esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
push esi
push eax
push 2
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 2
jne 0x412489
movzx eax, word [esp + 0x18]
mov dword [esp + 0x14], eax
push esi
push 0
push 2
lea eax, [esp + 0x24]
movzx edi, bl
push eax
lea eax, [esp + 0x38]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [esp + 0x24], eax
test eax, eax
jns 0x4124c5
push esi
push 0
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov eax, dword [esp + 0x14]
test ax, ax
je 0x41250b
push esi
lea edx, [esp + 0x17]
mov ecx, eax
call fcn.00412730
mov bh, al
add esp, 4
test bh, bh
je 0x41250b
mov dl, byte [esp + 0x13]
lea ecx, [esp + 0x28]
call fcn.00411e20
push esi
push 0
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
push 0
movzx eax, bh
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp dword [esp + 0x24], 0
je 0x412519
movzx eax, word [esp + 0x18]
jmp 0x41252d
xor eax, eax
jmp 0x41252d
push esi
push 2
movzx edi, bl
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
movzx eax, ax
mov word [ebp], ax
test ax, ax
je 0x412549
pop edi
xor eax, eax
mov word [ebp + 2], ax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
cmp byte [esp + 0x130], 0
je 0x41257a
test bl, bl
je 0x41257a
push edi
push str.vk_02X
push dword [esp + 0x134]
push ebp
call fcn.00472ce0
add esp, 0x10
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
pop edi
xor eax, eax
mov word [ebp], ax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
mov esi, dword [esp + 0x12c]
dec esi
push esi
push dword [edi*8 + 0x4ce940]
push ebp
call fcn.00497e59
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2], ax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret