joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450a50
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fae60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x675978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.00452580
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
mov dword [esi + 0x10], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x64e420
mov byte [ecx], 0
call fcn.00403eb0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x450af0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fae60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x675978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.00452600
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
mov dword [esi + 0x10], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x64e420
mov byte [ecx], 0
call fcn.00403eb0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x451480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x451568
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x451557
jg 0x4514c0
test edx, edx
je 0x451557
nop dword [eax]
call fcn.004040b0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x451514
jg 0x4514d7
test esi, esi
je 0x451514
cmp ebx, eax
jg 0x4514e7
jl 0x4514e1
cmp edi, esi
jae 0x4514e7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004867d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x45153b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x451551
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4514c0
jl 0x451551
test edi, edi
jne 0x4514c0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45158a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x45158c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x45160a
jg 0x45159f
test esi, esi
je 0x45160a
test eax, eax
jl 0x4515e4
jg 0x4515a9
test ebx, ebx
je 0x4515e4
cmp edi, eax
jg 0x4515b9
jl 0x4515b3
cmp esi, ebx
jae 0x4515b9
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004867d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4515e7
mov edx, dword [ebp + 8]
test edi, edi
jl 0x45160a
jg 0x4515f1
test esi, esi
je 0x45160a
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x45160a
push eax
push esi
push 1
push edx
call fcn.005c6c26
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x451620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x45170b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4516fa
jg 0x451660
test edx, edx
je 0x4516fa
nop dword [eax]
call fcn.004040d0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4516b7
jg 0x451677
test esi, esi
je 0x4516b7
cmp ebx, eax
jg 0x451687
jl 0x451681
cmp edi, esi
jae 0x451687
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.004867d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x4516dc
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4516f4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x451660
jl 0x4516f4
test edi, edi
jne 0x451660
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45172d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x45172f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4517e5
jg 0x45174a
test esi, esi
je 0x4517e5
test eax, eax
jl 0x451793
jg 0x451754
test ebx, ebx
je 0x451793
cmp edi, eax
jg 0x451764
jl 0x45175e
cmp esi, ebx
jae 0x451764
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004867d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x45179a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4517e5
jg 0x4517a4
test esi, esi
je 0x4517e5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x4517e5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x4517d0
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.005c7045
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x451b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x675978]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x451b90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x451bcc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x451bcc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x451cb3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x451bf4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x451c27
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005ccfe9
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x451cb3
cmp eax, 1
jle 0x451c86
cmp eax, 3
jne 0x451cb3
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0044d040
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x451ca3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005c6c26
add esp, 0x10
cmp edi, eax
jne 0x451cb3
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x451bb7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b6a10
mov esp, ebp
pop ebp
ret 4
Function at 0x452840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x675978]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4528e3
cmp byte [esi + 0x3d], 0
je 0x4528e3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x452899
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4528ab
sub eax, 1
je 0x4528af
sub eax, 2
je 0x4528e3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4528cc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005c6c26
add esp, 0x10
cmp edi, eax
jne 0x452899
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a10
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005b6a10
mov esp, ebp
pop ebp
ret

Function at 0x474950
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 4
jb 0x474988
mov esi, eax
shr esi, 2
nop
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x474970
mov dword [esp + 0x24], eax
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
mov dword [esp + 0x10], esi
test eax, eax
je 0x474a77
cmp eax, 8
jb 0x474a58
mov ebx, eax
mov esi, edi
and ebx, 0xfffffff8
xorps xmm4, xmm4
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
mov ecx, edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm2, dword [eax + ecx]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edi + ebp + 4]
add ebp, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, ebx
jb 0x4749e0
mov eax, dword [esp + 0x24]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x474a77
sub edi, edx
lea ebx, [edx + ebp]
sub eax, ebp
movzx edx, byte [ebx + edi]
lea ebx, [ebx + 1]
movzx ecx, byte [ebx - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x474a63
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x479510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.1.1.0
push dword [ebp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_at:_https:__gitlab.com_bzip2_bzip2___issues_nIf_this_happened_when_you_were_using_some_program_which_uses_nlibbzip2_as_a_component__you_should_also_report_this_bug_to_nthe_author_s__of_that_program._nPlease_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
push 2
call fcn.005c453f
add esp, 4
push eax
call fcn.004795e0
add esp, 0x10
cmp dword [ebp + 8], 0x3ef
jne 0x479554
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.005c453f
add esp, 4
push eax
call fcn.004795e0
add esp, 8
push 3
call fcn.005cfda1
int3

Function at 0x48b330
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
call fcn.004aeef0
add esp, 8
mov ebx, eax
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
neg esi
push 1
sbb esi, esi
neg esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [ebp + 8]
mov ecx, 0x8000
test cx, ax
jne 0x48b37a
push 0
push 1
push edi
push esi
push ebx
push 0
call fcn.0048b5b0
add esp, 0x18
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b39d
push 0
push 3
push edi
push esi
push ebx
push 0
call fcn.0048b5b0
add esp, 0x18
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b3c0
push 0
push 2
push edi
push esi
push ebx
push 0
call fcn.0048b5b0
add esp, 0x18
push 5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b3e3
push 0
push 4
push edi
push esi
push ebx
push 0
call fcn.0048b5b0
add esp, 0x18
push 6
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48b406
push 0
push 5
push edi
push esi
push ebx
push 0
call fcn.0048b5b0
add esp, 0x18
mov dword [edi + 0x28], 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48ba50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov edi, eax
cmp dword [0x670aa4], esi
je 0x48bb01
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x1c]
push 1
push esi
push esi
push esi
push eax
call ebx
test eax, eax
je 0x48bb01
mov ecx, dword [0x67a5dc]
test ecx, ecx
je 0x48baaa
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [0x67a5e0]
call ecx
add esp, 0x1c
cmp dword [ebp - 0x18], 0x200
jne 0x48bacb
mov eax, dword [0x67bcfc]
test eax, eax
je 0x48bacb
sub eax, dword [ebp - 0xc]
jns 0x48baef
mov dword [0x67bcfc], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [edi + 1]
sub eax, dword [ebp - 0xc]
test eax, eax
jg 0x48baef
inc esi
cmp esi, 3
jg 0x48bb01
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call ebx
test eax, eax
jne 0x48ba84
push 0
call fcn.004a7730
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, eax
add esp, 4
mov ebx, 0x8000
cmp byte [esi + 0xe1], 1
jne 0x48bb3c
push 0xa0
call edi
test bx, ax
jne 0x48bb3c
push 0xe1
push 0
call fcn.004a79e0
add esp, 8
cmp byte [esi + 0xe5], 1
jne 0x48bb60
push 0xa1
call edi
test bx, ax
jne 0x48bb60
push 0xe5
push 0
call fcn.004a79e0
add esp, 8
call fcn.004a7720
test eax, eax
je 0x48bb72
test dword [eax + 0x30], 0x100000
jne 0x48bbb4
cmp byte [esi + 0xe3], 1
jne 0x48bb93
push 0x5b
call edi
test bx, ax
jne 0x48bb93
push 0xe3
push 0
call fcn.004a79e0
add esp, 8
cmp byte [esi + 0xe7], 1
jne 0x48bbb4
push 0x5c
call edi
test bx, ax
jne 0x48bbb4
push 0xe7
push 0
call fcn.004a79e0
add esp, 8
call fcn.0048bc40
call fcn.0048bea0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48bca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xa4]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.004a7720
xor ebx, ebx
cmp eax, esi
sete bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [ebp - 4]
sete cl
cmp ebx, ecx
je 0x48be96
cmp ecx, dword [ebp + 0xc]
jne 0x48be96
test ecx, ecx
je 0x48be2c
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, eax
neg esi
push 1
sbb esi, esi
neg esi
call ebx
mov edx, 4
lea ecx, [edx - 3]
test ax, ax
je 0x48bd1c
test esi, esi
mov eax, edx
cmove eax, ecx
or byte [edi + 0x44], al
push 2
call ebx
test ax, ax
je 0x48bd37
test esi, esi
mov eax, 1
mov ecx, 4
cmove eax, ecx
or byte [edi + 0x44], al
push 4
call ebx
test ax, ax
je 0x48bd44
or byte [edi + 0x44], 2
push 5
call ebx
test ax, ax
je 0x48bd51
or byte [edi + 0x44], 8
push 6
call ebx
test ax, ax
je 0x48bd5e
or byte [edi + 0x44], 0x10
mov ebx, dword [ebp + 8]
push ebx
call fcn.004a7d50
add esp, 4
call fcn.004aeed0
cmp dword [eax + 0x54], 0
jne 0x48bdba
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [edi]
call fcn.004d0a40
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push 0
push ebx
call fcn.004afb60
add esp, 0x20
push edi
call fcn.0048b330
push ebx
call fcn.004d19f0
push dword [edi + 0x7c]
call fcn.004cc590
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.004a7fc0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.004a7fc0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.004a7fc0
push 1
push dword [edi]
call fcn.004d1cb0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov dword [edi + 0x58], 1
call fcn.004a7d50
add esp, 4
call fcn.004aeed0
cmp dword [eax + 0x54], 0
je 0x48be52
push 0
call fcn.004afef0
add esp, 4
call fcn.004ce500
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x48be8f
push 0x10
lea esi, [edi + 0x5c]
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00487f10
add esp, 0xc
test eax, eax
jne 0x48be8f
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
push 0x10
push 0
push esi
call fcn.004bf140
add esp, 0xc
mov dword [edi + 0x58], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48bea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.004a7720
test eax, eax
je 0x48bfe4
test dword [eax + 0x30], 0x4000
je 0x48bfe4
push edi
mov edi, dword [eax + 0xa4]
mov dword [ebp - 4], edi
cmp dword [edi + 0x74], 0
jne 0x48bfe3
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x48bfe3
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x48bfe3
push ebx
push esi
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
call fcn.004aeed0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax + 0x28]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
push eax
push dword [edi]
mov dword [ebp - 8], ecx
call fcn.004d0a40
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push ebx
push dword [edi]
call fcn.004afb60
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 0x20
test esi, esi
setne al
lea eax, [eax*2 + 1]
push eax
push 1
call edi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
mov eax, dword [ebp - 4]
push ebx
push dword [eax]
call fcn.004afb40
add esp, 0x10
test esi, esi
sete al
lea eax, [eax*2 + 1]
push eax
push 2
call edi
mov esi, dword [ebp - 4]
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push ebx
push dword [esi]
call fcn.004afb40
add esp, 0x10
push 2
push 4
call edi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push ebx
push dword [esi]
call fcn.004afb40
add esp, 0x10
push 4
push 5
call edi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push ebx
push dword [esi]
call fcn.004afb40
add esp, 0x10
push 5
push 6
call edi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push ebx
push dword [esi]
call fcn.004afb40
add esp, 0x10
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret