joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417584
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x54048b
call fcn.0051e9fa
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
call fcn.004075d5
xor ebx, ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [esi + 0x84], ebx
je 0x4175e3
call fcn.004075d5
push 5
push dword [esi + 0x84]
mov edi, dword [eax + 0xc]
push edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x4175f3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
jmp 0x4175f6
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x417602
or eax, 0xffffffff
jmp 0x41774a
mov ecx, esi
call fcn.00417a93
mov edi, eax
mov dword [ebp - 0x30], edi
call fcn.0040e51d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
test edi, edi
je 0x41767a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x41767a
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41767a
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00407b64
mov dword [ebp - 0x18], eax
test eax, eax
je 0x41767a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x150]
test eax, eax
je 0x41767a
mov ecx, dword [ebp - 0x18]
call fcn.0040cf60
test eax, eax
je 0x41767a
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.0040cdc6
mov dword [ebp - 0x28], 1
push esi
mov dword [ebp - 4], ebx
call fcn.0040e1d6
push edi
call fcn.0040f6a3
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.00417525
test eax, eax
jne 0x4176c2
cmp dword [esi + 0x9c], ebx
jne 0x4176c2
call fcn.004075d5
push edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0040f6a3
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.00417525
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x9c], ebx
jmp 0x4176f3
cmp dword [ebp - 0x28], 0
je 0x417703
mov ecx, dword [ebp - 0x18]
push 1
call fcn.0040cdc6
cmp dword [ebp - 0x2c], 0
je 0x417712
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x417728
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x417728
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00417a4a
cmp dword [esi + 0x84], ebx
je 0x417747
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x68]
call fcn.0051e958
ret
Function at 0x41920c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x419226
mov edi, dword [esi + 0xc]
jmp 0x419266
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41923f
call fcn.0040ac4d
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x419254
call fcn.0040ac4d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x419266
call fcn.0040ac4d
call fcn.004075d5
cmp dword [eax + 0x3c], 0
je 0x41927b
push edi
mov ecx, ebx
call fcn.00418979
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0041944f
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4192a4
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4192b0
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b226
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x59bf74]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, edx
je 0x42b44b
test esi, esi
je 0x42b44b
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x868], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x860], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
sub eax, ebx
je 0x42b41c
sub eax, 1
je 0x42b2be
sub eax, 1
je 0x42b384
sub eax, 1
jne 0x42b436
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x20c]
push eax
push dword [edx + 4]
call edi
test eax, eax
je 0x42b417
push ebx
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004066e1
test eax, eax
je 0x42b417
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x42b37c
push ebx
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004066e1
test eax, eax
je 0x42b37c
cmp dword [ebp + 0x10], 1
jne 0x42b3dc
test byte [ebp - 0x854], 0x10
jne 0x42b417
test byte [ebp - 0x624], 0x10
jne 0x42b37c
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x858], ecx
ja 0x42b37c
jb 0x42b417
cmp dword [ebp - 0x85c], eax
jb 0x42b417
cmp dword [ebp - 0x858], ecx
jb 0x42b436
ja 0x42b37c
cmp dword [ebp - 0x85c], eax
jbe 0x42b436
xor ebx, ebx
inc ebx
jmp 0x42b436
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0xddc]
push 0x408
push 0x2b4
push eax
push ebx
push dword [edx + 4]
call edi
test eax, eax
je 0x42b436
push 0x408
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push ebx
push dword [esi + 4]
call edi
test eax, eax
je 0x42b436
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
jmp 0x42b436
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.0042a95e
test al, al
jne 0x42b417
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.0042a97d
xor ebx, ebx
test al, al
setne bl
jmp 0x42b436
or ebx, 0xffffffff
jmp 0x42b436
push dword [esi + 8]
mov eax, dword [edx]
push dword [edx + 8]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x42b433
xor eax, eax
jmp 0x42b438
movsx ebx, ax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e947
mov esp, ebp
pop ebp
ret 0xc
call fcn.004052aa
int3
Function at 0x42b9c5
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x5413bc
call fcn.0051e9c3
mov edi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x704], ebx
setne al
test eax, eax
jne 0x42b9f4
call fcn.004052aa
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x42bb22
sub eax, 1
je 0x42ba4c
sub eax, 1
je 0x42ba24
sub eax, 1
je 0x42ba4c
push 0x54dcc0
mov ecx, esi
call fcn.004021d4
mov eax, esi
call fcn.0051e96d
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x42ba0e
lea eax, [ebp - 0x4e8]
push eax
jmp 0x42ba13
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42ba0e
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
call fcn.004066e1
test eax, eax
je 0x42ba0e
call fcn.004061c2
push eax
lea ecx, [ebp - 0x700]
call fcn.0040214a
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
jne 0x42bae2
test byte [ebp - 0x428], 0x18
jne 0x42bafa
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov ecx, edi
push dword [ebp - 0x430]
call dword [eax + 0x1a0]
jmp 0x42bafa
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov ecx, edi
call dword [eax + 0x1a4]
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.00402c47
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.00403953
jmp 0x42ba1a
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x42ba0e
lea eax, [ebp - 0x6f0]
jmp 0x42ba49

Function at 0x42bd04
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00475477
call fcn.00407623
cmp dword [eax + 0x14], 0
jne 0x42bd1f
mov ecx, esi
pop esi
jmp fcn.0042b0fb
pop esi
ret

Function at 0x42cae3
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.0042e437
call fcn.00407623
cmp dword [eax + 0x14], 0
jne 0x42cafe
mov ecx, esi
pop esi
jmp fcn.0042c3c0
pop esi
ret
Function at 0x42e169
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x42e1ae
test edi, edi
js 0x42e1ae
cmp eax, 0x20
je 0x42e1a3
cmp bx, 0x71
jne 0x42e1ae
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x459219
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov edx, 0x104
xor ecx, ecx
mov eax, dword [edi + 4]
cmp eax, edx
ja 0x4593c2
je 0x4593ec
cmp eax, 0xa1
jb 0x45942f
cmp eax, 0xa2
jbe 0x4593ec
cmp eax, 0xa3
jbe 0x45942f
cmp eax, 0xa5
jbe 0x4593ec
cmp eax, 0xa6
jbe 0x45942f
cmp eax, 0xa8
jbe 0x4593ec
cmp eax, 0x100
jne 0x45942f
cmp dword [esi + 0xc0], 0xffffffff
je 0x4593ec
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4593ea
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x45934a
sub eax, 1
jne 0x4593ea
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0xbc]
add eax, ecx
lea edi, [ecx + 1]
jmp 0x4592fd
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x459303
mov eax, dword [esi + 0xbc]
inc edi
add eax, dword [esi + 0xc0]
cmp edi, eax
jl 0x4592d3
jmp 0x459342
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.0040d059
mov edx, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [edx + 0x270]
and dword [esi + 0x24c], 0
xor eax, eax
inc eax
jmp 0x459455
mov ecx, dword [esi + 0xc0]
lea edi, [ecx - 1]
add edi, dword [esi + 0xbc]
cmp edi, ecx
jle 0x459342
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x459385
dec edi
cmp edi, dword [esi + 0xc0]
jg 0x45935d
jmp 0x459342
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.0040d059
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [eax + 0x270]
jmp 0x45933b
cmp eax, 0x200
jb 0x45942f
cmp eax, 0x202
jbe 0x4593ec
cmp eax, 0x203
jbe 0x45942f
cmp eax, 0x205
jbe 0x4593ec
add eax, 0xfffffdf9
cmp eax, 1
ja 0x45942f
jmp 0x4593ec
xor ecx, ecx
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x45940c
cmp dword [eax + 0x20], 0
je 0x45940c
push edi
push ecx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x45942d
cmp dword [eax + 0x20], 0
je 0x45942d
push edi
push 0
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp dword [edi + 4], 0x203
jne 0x45944d
lea eax, [esi + 0x2250]
test eax, eax
je 0x459445
mov ecx, dword [eax + 0x20]
cmp dword [edi], ecx
je 0x459342
push edi
mov ecx, esi
call fcn.00451cda
pop edi
pop esi
pop ebp
ret 4
Function at 0x461d44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x59bf74]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
jne 0x461d67
xor eax, eax
jmp 0x461e3d
cmp dword [ebp + 0xc], 0
je 0x461d60
xor ebx, ebx
call fcn.004075d5
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x461d60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x461d60
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x461e53
push eax
call fcn.00527620
inc eax
pop ecx
mov dword [ebp - 8], eax
lea edx, [eax + eax]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x461e0b
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
and eax, ecx
lea ecx, [edx + 8]
cmp eax, 0x400
ja 0x461ded
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.0051f290
mov esi, esp
test esi, esi
je 0x461e53
mov dword [esi], 0xcccc
jmp 0x461e06
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00523f4c
mov esi, eax
pop ecx
test esi, esi
je 0x461e53
mov dword [esi], 0xdddd
add esi, 8
jmp 0x461e0d
mov esi, ebx
test esi, esi
je 0x461e53
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.004061ab
test eax, eax
je 0x461e2d
mov ecx, dword [ebp - 0x10]
push eax
call fcn.004636e8
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call fcn.00463704
pop ecx
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e947
mov esp, ebp
pop ebp
ret 8
call fcn.004052aa
int3
Function at 0x46cb1e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x59bf74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040ce91
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
push 0x20
mov ebx, eax
call esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.0040f2ee
mov edi, dword [ebp - 0x18]
mov esi, eax
test edi, 0x1000
je 0x46cb96
cmp esi, 3
jne 0x46cb85
push 2
pop esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46cb96
xor eax, eax
jmp 0x46cbeb
cmp esi, 0xa
jl 0x46cba0
cmp esi, 0x11
jle 0x46cba5
cmp esi, 4
jne 0x46cbe9
test edi, 0x800
je 0x46cbb2
push 2
pop eax
jmp 0x46cbeb
mov eax, dword [ebp - 0x1c]
neg ebx
push ebx
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test edi, 0x200
je 0x46cbe9
mov eax, esi
sub eax, 4
je 0x46cc36
sub eax, 9
je 0x46cc22
sub eax, 1
je 0x46cc12
dec eax
sub eax, 1
je 0x46cbfe
sub eax, 1
je 0x46cc36
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e947
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setle al
dec eax
and eax, 5
add eax, 0xa
jmp 0x46cbeb
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
add eax, 0xb
jmp 0x46cbeb
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
lea eax, [eax*2 + 0xa]
jmp 0x46cbeb
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setg al
lea eax, [eax*4 + 0xb]
jmp 0x46cbeb
Function at 0x475ae0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x59bf74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x475b12
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x475b3d
cmp dword [0x5a294c], 0
jne 0x475b3d
lea ecx, [esi - 0x41]
cmp ecx, 0x19
jbe 0x475b30
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x475b34
mov eax, esi
jmp 0x475bb0
push esi
call fcn.00530d95
pop ecx
jmp 0x475bb0
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005211b0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x475bc2
call fcn.00409ecd
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e947
mov esp, ebp
pop ebp
ret 4
call fcn.004052aa
int3
Function at 0x476028
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x544343
call fcn.0051e9fa
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
call fcn.00447576
test eax, eax
je 0x4761c9
lea ecx, [ebp - 0x1c]
xor edi, edi
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x1c], edi
push ecx
lea ecx, [ebx + 4]
call fcn.004488ce
test eax, eax
je 0x47606b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004061c2
push eax
lea ecx, [ebp - 0x18]
call fcn.0040214a
mov esi, 0x104
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.0040354b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040396b
call fcn.004061c2
push eax
lea ecx, [ebp - 0x14]
call fcn.0040214a
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040354b
mov esi, dword [ebp - 0x18]
push eax
push edi
push 0x55ed54
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0040396b
push edi
push 0x4000100
push 2
push edi
push edi
mov edi, dword [ebp - 0x14]
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x476103
lea ecx, [edi - 0x10]
call fcn.00403953
lea ecx, [esi - 0x10]
jmp 0x4761c4
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00403ff0
push 0
push 0x1000
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.00408d11
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [ebx + 0x20], 1
push edx
mov byte [ebp - 4], 4
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.0040930b
and dword [ebx + 0x20], 0
lea ecx, [ebp - 0x88]
call fcn.00408e21
lea ecx, [ebp - 0x40]
call fcn.004040e7
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
call fcn.00444a43
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [edi - 0x10]
call fcn.00403953
lea ecx, [esi - 0x10]
call fcn.00403953
xor eax, eax
inc eax
jmp 0x4761cb
call fcn.00403953
xor eax, eax
call fcn.0051e958
ret 8
Function at 0x4c9875
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x59b6ec], 0
push esi
je 0x4c9956
cmp dword [0x59ba48], 0xfffffffe
jne 0x4c9943
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x4c9956
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5a5920]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5a49b0]
cmp eax, dword [ecx + 4]
jle 0x4c98ed
mov ebx, 0x5a49b0
push ebx
call fcn.0051ed99
cmp dword [0x5a49b0], 0xffffffff
pop ecx
jne 0x4c98ed
mov ecx, 0x5a4990
call fcn.0040222c
push 0x54c69a
call fcn.0051e932
push ebx
call fcn.0051ed5a
pop ecx
pop ecx
mov ebx, 0x5a4998
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5a497c], 0
jne 0x4c9959
push 0
push 0
push 0x4c995f
call fcn.00529c16
add esp, 0xc
mov dword [0x5a497c], eax
test eax, eax
je 0x4c9932
cmp eax, 0xffffffff
je 0x4c9932
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x59ba48], esi
jmp 0x4c9939
and dword [0x5a497c], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
jmp 0x4c9956
mov eax, dword [ebp + 8]
mov dword [0x59ba48], eax
inc eax
neg eax
sbb eax, eax
and dword [0x5a497c], eax
pop esi
pop ebp
ret
call fcn.004052aa
int3
Function at 0x4cffd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1b8]
test al, al
jns 0x4cffef
or ecx, 0xffffffff
jmp 0x4cfff5
mov ecx, dword [0x59b884]
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x2b4]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x59bb1c
call fcn.00405d23
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x4d0099
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4d0099
test edi, edi
je 0x4d004a
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x228]
push eax
push 0x59b8d0
call fcn.00405d23
pop ecx
pop ecx
mov ebx, eax
jmp 0x4d004c
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x4d00a4
test ebx, ebx
je 0x4d0085
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c0]
test al, 0x40
je 0x4d0099
cmp dword [ebp - 4], 0
je 0x4d0085
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x24c]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x4d009b
mov eax, dword [esi]
mov ecx, esi
push 5
push 0
push edi
call dword [eax + 0x1f8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 3
jne 0x4d0099
test edi, edi
je 0x4d0099
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x184]
test eax, eax
je 0x4d0099
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18c]
test eax, eax
je 0x4d0099
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x240]
mov eax, dword [esi]
mov ecx, esi
push 0
push 1
push 5
push edi
call dword [eax + 0x34c]
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x4d009b
Function at 0x4d1e77
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x5a5920]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov ebx, ecx
mov eax, dword [0x5a4acc]
cmp eax, dword [edx + 4]
jle 0x4d1ed2
mov esi, 0x5a4acc
push esi
call fcn.0051ed99
cmp dword [0x5a4acc], 0xffffffff
pop ecx
jne 0x4d1ed2
call fcn.004061c2
push eax
mov ecx, 0x5a4ac8
call fcn.0040214a
push 0x54c6b2
call fcn.0051e932
push esi
call fcn.0051ed5a
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4d1f74
mov eax, dword [ebx + 0x34c]
test eax, eax
je 0x4d1f6b
cmp dword [eax + 0x20], 0
je 0x4d1f6b
test eax, eax
je 0x4d1ef8
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4d1f6b
mov eax, dword [edi + 4]
sub eax, 1
je 0x4d1f3f
sub eax, 1
je 0x4d1f15
sub eax, 1
jne 0x4d1f6b
mov esi, 0x428e
jmp 0x4d1f44
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4d1f44
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x340]
test eax, eax
je 0x4d1f44
add esi, 3
jmp 0x4d1f44
mov esi, 0x3ea0
push esi
call fcn.00405e5b
test eax, eax
je 0x4d1f74
push esi
push eax
mov ecx, 0x5a4ac8
call fcn.004031f4
test eax, eax
je 0x4d1f74
mov eax, dword [0x5a4ac8]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4d1f6d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.004052aa
int3