joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fec4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov al, byte [0x42b598]
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov byte [ebp - 0x404], al
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x403]
rep stosd dword es:[edi], eax
mov edi, 0x400
lea eax, [ebp - 0x404]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x17d8]
mov dword [esi + 0x17d4], ebx
dec eax
je 0x40ffa7
dec eax
je 0x40ffed
dec eax
je 0x40ffd7
dec eax
jne 0x410005
mov eax, dword [esi + 0x17b8]
push 0xa
push str.classname
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x40ff60
lea eax, [ebp - 0x404]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [esi + 0x17b8]
add eax, 0xa
push eax
jmp 0x40ffdd
mov eax, dword [esi + 0x17b8]
push 7
push str.handle
push eax
call fcn.004204b0
add esp, 0xc
test eax, eax
jne 0x40ffa7
push ebx
lea eax, [ebp - 0x404]
push 0x427188
push eax
call fcn.00417b44
mov eax, dword [esi + 0x17b8]
add eax, 7
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004203e0
add esp, 0x14
jmp 0x40ffc4
mov eax, dword [esi + 0x17bc]
mov ecx, dword [esi + 0x17b8]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
call fcn.00418880
add esp, 0xc
test eax, eax
jne 0x410005
mov ecx, esi
call fcn.0041000f
cmp al, 1
jne 0x410005
xor eax, eax
jmp 0x410008
push dword [esi + 0x17b8]
lea eax, [ebp - 0x404]
push eax
call fcn.004178e0
pop ecx
pop ecx
jmp 0x40ffc4
push dword [esi + 0x17b8]
lea eax, [ebp - 0x404]
push eax
call fcn.00418800
pop ecx
test eax, eax
pop ecx
jne 0x40ffc8
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x410078
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000
call fcn.00417db0
and byte [ebp - 0x8000], 0
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4100a5
cmp byte [esi + 0x17e4], 1
jne 0x410107
cmp dword [esi + 0x17dc], 2
jne 0x4100c5
lea eax, [ebp - 0x8000]
push 0x7fff
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4100dc
lea eax, [ebp - 0x8000]
push eax
push 0x7fff
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
and byte [ebp - 1], 0
test eax, eax
je 0x410107
push dword [esi + 0x17c4]
lea eax, [ebp - 0x8000]
push eax
call fcn.00418800
pop ecx
test eax, eax
pop ecx
je 0x410107
mov byte [esi + 0x17d0], 1
xor eax, eax
jmp 0x41010a
push 1
pop eax
pop esi
leave
ret 8
Function at 0x41043a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x1801], 0
je 0x4104e1
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x100
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edi, dword [esi + 0x17f0]
lea eax, [ebp - 0x404]
push eax
call fcn.00417850
push eax
lea eax, [ebp - 0x404]
push eax
push edi
call fcn.00418880
add esp, 0x10
test eax, eax
jne 0x410521
inc dword [esi + 0x17fc]
push dword [esi + 0x17fc]
lea eax, [esi + 0x17fc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x404]
push str._s_u
push eax
call fcn.00417b44
push dword [esi + 0x17f0]
lea eax, [ebp - 0x404]
push eax
call fcn.004178e0
add esp, 0x18
test eax, eax
jne 0x410521
mov dword [esi + 0x1804], ebx
jmp 0x410516
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x400
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x17f0]
lea ecx, [ebp - 0x404]
push ecx
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
jne 0x410521
mov dword [esi + 0x1804], edi
mov byte [esi + 0x1800], 1
xor eax, eax
jmp 0x410524
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4108e2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8000
call fcn.00417db0
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push 0x42b598
call fcn.00401af4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0040fd62
mov ecx, esi
call fcn.0040fe01
test al, al
jne 0x41091b
push 1
jmp 0x410940
mov ecx, dword [ebp + 8]
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
mov ecx, esi
push dword [esi + 0x17d4]
call fcn.004103b2
test al, al
push 1
jne 0x410949
mov ecx, esi
call fcn.00402b3b
jmp 0x41099d
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
lea eax, [ebp - 0x8000]
pop ecx
push eax
push 0x7fff
push 0xd
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jg 0x41097f
push 1
mov ecx, esi
call fcn.00402b3b
jmp 0x41098e
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x8000]
push eax
call fcn.00401af4
push 0
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
pop esi
leave
ret 0xc

Function at 0x410cb9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fd62
mov ecx, esi
call fcn.0040fe01
test al, al
je 0x410cf8
mov ecx, dword [ebp + 8]
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
mov ecx, esi
push dword [esi + 0x17d4]
call fcn.004103b2
test al, al
jne 0x410d04
mov ecx, dword [ebp + 0x10]
push 0
call fcn.00401aa7
jmp 0x410d30
push 1
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
push 4
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
pop esi
pop ebp
ret 0xc
Function at 0x410d35
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fd62
mov ecx, esi
call fcn.0040fe01
test al, al
je 0x410d74
mov ecx, dword [ebp + 8]
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018ad
push eax
mov ecx, esi
push dword [esi + 0x17d4]
call fcn.004103b2
test al, al
jne 0x410d80
mov ecx, dword [ebp + 0x10]
push 0
call fcn.00401aa7
jmp 0x410dac
push 1
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
push 0
push dword [esi + 0x1804]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x17d4]
call fcn.00416118
pop ecx
pop ecx
pop esi
pop ebp
ret 0xc
Function at 0x411958
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00417db0
push ebx
push esi
push edi
push 1
mov edi, ecx
pop esi
mov ecx, dword [ebp + 0x10]
push 0x42b598
mov dword [ebp - 4], esi
call fcn.00401af4
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0040fd62
mov ecx, edi
call fcn.0040fe01
test al, al
je 0x411b21
push str.msctls_statusbar321
mov ecx, edi
push dword [edi + 0x17d4]
call fcn.004103b2
test al, al
je 0x411b21
cmp dword [ebp + 0xc], 3
jne 0x4119cd
mov ecx, dword [ebp + 8]
push 2
call fcn.00402301
mov ecx, eax
call fcn.004018d3
mov dword [ebp - 4], eax
xor ebx, ebx
push ebx
push ebx
push 0x406
push dword [edi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 4], esi
jl 0x411b21
cmp dword [ebp - 4], eax
jg 0x411b21
cmp byte [0x433c6c], bl
je 0x411ab1
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1804]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push ebx
push 0x38
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push str.VirtualAllocEx
push str.kernel32.dll
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 4
mov esi, 0xfff
push 0x3000
push esi
push ebx
push dword [ebp + 0xc]
call eax
mov dword [ebp + 8], eax
push eax
mov eax, dword [ebp - 4]
dec eax
push eax
push 0x402
push dword [edi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
lea eax, [ebp - 0x1008]
push esi
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x1008]
push eax
call fcn.00401af4
push str.VirtualFreeEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x8000
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call eax
push dword [ebp + 0xc]
jmp 0x411b19
mov esi, 0xfff
push ebx
push esi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
push ebx
push ebx
push ebx
push 0xf001f
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov ebx, eax
mov eax, dword [ebp - 4]
dec eax
push ebx
push eax
push 0x402
push dword [edi + 0x1804]
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
lea eax, [ebp - 0x1008]
push ebx
push eax
call fcn.00418ae0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
lea eax, [ebp - 0x1008]
push eax
call fcn.00401af4
push ebx
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x411b29
push esi
mov ecx, edi
call fcn.00402b3b
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
Function at 0x411ffd
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov esi, ecx
call fcn.004121ba
cmp byte [esi], 1
jne 0x41202a
push 0xffffffffffffffff
mov edi, 0x4307c0
push dword [esi + 4]
mov ecx, edi
push 1
call fcn.00413389
jmp 0x412058
lea ebx, [esi + 0x10]
mov edi, 0x4307c0
push ebx
mov ecx, edi
call fcn.00413586
test al, al
je 0x41207a
lea eax, [esi + 0x118]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x104
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
mov ecx, edi
call fcn.00413551
lea eax, [esi + 0x10]
mov ebx, 0x431c00
push eax
mov ecx, ebx
call fcn.00402ab6
test eax, eax
je 0x412086
mov ecx, edi
call fcn.0041343a
mov dword [0x433c7c], 1
jmp 0x4120c3
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov ecx, esi
call fcn.004120c8
mov ecx, esi
call fcn.00412145
push 1
mov ecx, ebx
call fcn.00402b48
mov ecx, edi
call fcn.0041343a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413136
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
lea eax, [ebp - 0x94]
push esi
mov esi, ecx
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [ebp - 0x90]
mov dword [esi], eax
mov eax, dword [ebp - 0x8c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 8], eax
lea eax, [ebp - 0x80]
push eax
call fcn.00417850
xor ebx, ebx
pop ecx
cmp eax, ebx
jle 0x4131bc
dec eax
cmp eax, ebx
jle 0x413198
cmp byte [ebp + eax - 0x80], 0x20
lea ecx, [ebp + eax - 0x80]
jne 0x413198
mov byte [ecx], bl
jmp 0x413184
xor ecx, ecx
cmp eax, ebx
jle 0x4131aa
cmp byte [ebp + ecx - 0x80], 0x20
jne 0x4131aa
inc ecx
cmp ecx, eax
jl 0x41319e
lea eax, [ebp + ecx - 0x80]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.00417750
pop ecx
pop ecx
jmp 0x4131bf
mov byte [esi + 0xc], bl
cmp dword [ebp - 0x84], 2
mov byte [esi + 0x10c], bl
mov byte [esi + 0x10d], bl
mov byte [esi + 0x10e], bl
mov byte [esi + 0x10f], bl
mov byte [esi + 0x112], bl
mov byte [esi + 0x113], bl
mov byte [esi + 0x110], bl
mov byte [esi + 0x111], bl
mov byte [esi + 0x114], bl
mov byte [esi + 0x115], bl
mov byte [esi + 0x116], bl
mov byte [esi + 0x117], bl
mov byte [esi + 0x118], bl
mov byte [esi + 0x119], bl
jne 0x41326d
mov eax, dword [esi]
mov byte [esi + 0x10c], 1
sub eax, 4
je 0x41325d
dec eax
jne 0x4132c4
cmp dword [esi + 4], ebx
mov byte [esi + 0x10f], 1
mov byte [esi + 0x113], 1
jne 0x41324d
mov byte [esi + 0x112], 1
jmp 0x4132c4
mov byte [esi + 0x111], 1
mov byte [esi + 0x110], 1
jmp 0x4132c4
mov byte [esi + 0x10f], 1
mov byte [esi + 0x10e], 1
jmp 0x4132c4
movzx eax, word [ebp - 0x88]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
cmp eax, ebx
mov byte [esi + 0x10d], 1
mov byte [esi + 0x117], 1
je 0x4132bd
cmp eax, 0xa
je 0x4132ad
cmp eax, 0x5a
jne 0x4132c4
mov byte [esi + 0x115], 1
mov byte [esi + 0x119], 1
mov byte [esi + 0x118], 1
jmp 0x4132c4
mov byte [esi + 0x115], 1
mov byte [esi + 0x114], 1
jmp 0x4132c4
mov byte [esi + 0x116], 1
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4136cf
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, ecx
push ebx
push 0x5b
mov dword [esi], 5
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov byte [esi + 0xc], 1
mov byte [esi + 0xd], bl
call edi
push ebx
push 0x10
mov dword [esi + 0x20], eax
call edi
push ebx
push 0x11
mov dword [esi + 0x1c], eax
call edi
push ebx
push 0x12
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push 1
pop esi
mov al, byte [esi + 0x4276f4]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x41374d
lea eax, [ebp - 6]
push 0x427a38
push eax
call fcn.004178e0
pop ecx
test eax, eax
pop ecx
jne 0x413754
mov byte [esi + 0x4276f4], 0x20
inc esi
cmp esi, 7
jle 0x413726
lea eax, [ebp - 6]
push 0x427a34
push eax
call fcn.004178e0
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
jne 0x413778
mov byte [0x4276f8], 0x20
leave
ret

Function at 0x4139c5
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
mov bx, ax
and bl, 1
cmp byte [esp + 0x14], bl
jne 0x4139e7
mov al, bl
jmp 0x413a24
push ebp
xor eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push eax
push eax
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
push eax
push esi
call ebp
mov ecx, dword [esp + 0x10]
call fcn.004139b6
push 0
push 2
push 0
push esi
call edi
push eax
push esi
call ebp
mov ecx, dword [esp + 0x10]
call fcn.004139a8
pop edi
mov al, bl
pop ebp
pop esi
pop ebx
pop ecx
ret 8

Function at 0x413a2a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
mov edi, ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ebx, ax
cmp ebx, 0xffffffff
jne 0x413a4d
push dword [esp + 0xc]
mov ecx, edi
call fcn.00413abd
jmp 0x413a80
push ebx
mov ecx, edi
call fcn.00413d9d
mov ecx, edi
call fcn.0041404a
cmp dword [esp + 0x10], 0
je 0x413a79
push esi
movzx esi, bl
mov ebx, dword [esp + 0x14]
push 0
push esi
mov ecx, edi
call fcn.004142da
dec ebx
jne 0x413a6b
pop esi
mov ecx, edi
call fcn.00414189
pop edi
pop ebx
ret 8
Function at 0x413d9d
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
test ah, 2
push ebx
push esi
mov esi, ecx
je 0x413db4
or dword [esi + 8], 4
test ah, 4
je 0x413dbd
or dword [esi + 8], 1
test ah, 1
je 0x413dc6
or dword [esi + 8], 2
mov eax, dword [esi + 8]
test al, 4
je 0x413dd7
test al, 0x40
je 0x413dd7
xor eax, 4
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test al, 1
je 0x413de8
test al, 0x10
je 0x413de8
xor eax, 1
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test al, 2
je 0x413df9
test al, 0x20
je 0x413df9
xor eax, 2
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test al, 8
je 0x413e0a
test al, 0x80
je 0x413e0a
xor eax, 8
mov dword [esi + 8], eax
cmp dword [esi + 0x10], 0
je 0x413e52
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 8]
test al, 0x40
jne 0x413e27
and byte [esp + 0x19], 0
test al, 0x10
jne 0x413e30
and byte [esp + 0x1a], 0
test al, 0x20
jne 0x413e39
and byte [esp + 0x18], 0
test al, 0x80
jne 0x413e42
and byte [esp + 0x63], 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x413f17
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x80000000
movsx eax, ax
test ebp, eax
jne 0x413e79
push 0x11
call ebx
test ah, 0x80
je 0x413e91
test byte [esi + 8], 0x40
jne 0x413e91
push 0
push 0x11
mov ecx, esi
call fcn.004143bd
mov ecx, esi
call fcn.004139a8
push 0x12
call edi
movsx eax, ax
test ebp, eax
jne 0x413ea5
push 0x12
call ebx
test ah, 0x80
je 0x413ebd
test byte [esi + 8], 0x10
jne 0x413ebd
push 0
push 0x12
mov ecx, esi
call fcn.004143bd
mov ecx, esi
call fcn.004139a8
push 0x10
call edi
movsx eax, ax
test ebp, eax
jne 0x413ed1
push 0x10
call ebx
test ah, 0x80
je 0x413ee9
test byte [esi + 8], 0x20
jne 0x413ee9
push 0
push 0x10
mov ecx, esi
call fcn.004143bd
mov ecx, esi
call fcn.004139a8
push 0x5b
call edi
movsx eax, ax
pop edi
test ebp, eax
pop ebp
jne 0x413eff
push 0x5b
call ebx
test ah, 0x80
je 0x413f17
test byte [esi + 8], 0x80
jne 0x413f17
push 0
push 0x5b
mov ecx, esi
call fcn.004143bd
mov ecx, esi
call fcn.004139a8
pop esi
pop ebx
add esp, 0x100
ret 4
Function at 0x41404a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x4140ac
test byte [esi + 8], 8
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x414075
mov al, byte [esi + 0x20]
push ebx
push ebx
push eax
push 0x5b
call edi
test byte [esi + 8], 2
je 0x414085
mov al, byte [esi + 0x1c]
push ebx
push ebx
push eax
push 0x10
call edi
test byte [esi + 8], 4
je 0x414095
mov al, byte [esi + 0x14]
push ebx
push ebx
push eax
push 0x11
call edi
test byte [esi + 8], 1
je 0x41417d
mov al, byte [esi + 0x18]
push ebx
push ebx
push eax
push 0x12
jmp 0x41417b
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 8]
test al, 8
je 0x4140c7
or byte [ebp - 0xa5], 0x80
test al, 2
je 0x4140d2
or byte [ebp - 0xf0], 0x80
test al, 4
je 0x4140dd
or byte [ebp - 0xef], 0x80
test al, 1
je 0x4140e8
or byte [ebp - 0xee], 0x80
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
test byte [esi + 8], 8
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, 0x100
je 0x414117
mov eax, dword [esi + 0x20]
shl eax, 0x10
or al, 1
push eax
push 0x5b
push ebx
push dword [esi + 0x10]
call edi
test byte [esi + 8], 2
je 0x41412e
mov eax, dword [esi + 0x1c]
shl eax, 0x10
or al, 1
push eax
push 0x10
push ebx
push dword [esi + 0x10]
call edi
test byte [esi + 8], 4
je 0x414145
mov eax, dword [esi + 0x14]
shl eax, 0x10
or al, 1
push eax
push 0x11
push ebx
push dword [esi + 0x10]
call edi
mov eax, dword [esi + 8]
mov ecx, eax
and ecx, 1
je 0x414168
test al, 4
jne 0x414168
mov eax, dword [esi + 0x18]
shl eax, 0x10
or eax, 0x20000001
push eax
push 0x12
push 0x104
jmp 0x414178
test ecx, ecx
je 0x41417d
mov eax, dword [esi + 0x18]
shl eax, 0x10
or al, 1
push eax
push 0x12
push ebx
push dword [esi + 0x10]
call edi
mov ecx, esi
call fcn.004139b6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414189
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x4141f1
test byte [esi + 8], 1
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x4141b5
mov al, byte [esi + 0x18]
push ebx
push 2
push eax
push 0x12
call edi
test byte [esi + 8], 4
je 0x4141c6
mov al, byte [esi + 0x14]
push ebx
push 2
push eax
push 0x11
call edi
test byte [esi + 8], 2
je 0x4141d7
mov al, byte [esi + 0x1c]
push ebx
push 2
push eax
push 0x10
call edi
test byte [esi + 8], 8
je 0x4142ce
mov al, byte [esi + 0x20]
push ebx
push 2
push eax
push 0x5b
call edi
jmp 0x4142ce
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, eax
mov ebx, 0x101
and ecx, 1
je 0x41422c
test al, 4
jne 0x41422c
mov eax, dword [esi + 0x18]
shl eax, 0x10
or eax, 0xe0000001
push eax
push 0x12
push 0x105
jmp 0x41423f
test ecx, ecx
je 0x414244
mov eax, dword [esi + 0x18]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x12
push ebx
push dword [esi + 0x10]
call edi
test byte [esi + 8], 4
je 0x41425e
mov eax, dword [esi + 0x14]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x11
push ebx
push dword [esi + 0x10]
call edi
test byte [esi + 8], 2
je 0x414278
mov eax, dword [esi + 0x1c]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x10
push ebx
push dword [esi + 0x10]
call edi
test byte [esi + 8], 8
je 0x414292
mov eax, dword [esi + 0x20]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x5b
push ebx
push dword [esi + 0x10]
call edi
mov eax, dword [esi + 8]
test al, 8
je 0x4142a0
xor byte [ebp - 0xa5], 0x80
test al, 2
je 0x4142ab
xor byte [ebp - 0xf0], 0x80
test al, 4
je 0x4142b6
xor byte [ebp - 0xef], 0x80
test al, 1
je 0x4142c1
xor byte [ebp - 0xee], 0x80
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov ecx, esi
call fcn.004139a8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4143bd
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0
mov esi, ecx
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp dword [esi + 0x10], 0
mov edi, eax
je 0x41443a
cmp ebx, 0x14
je 0x41443a
cmp ebx, 0x90
je 0x41443a
cmp ebx, 0x91
je 0x41443a
shl edi, 0x10
or edi, 0xc0000001
cmp byte [esp + 0x14], 1
je 0x414408
push ebx
mov ecx, esi
call fcn.00413f22
cmp al, 1
jne 0x41440e
or edi, 0x1000000
mov eax, dword [esi + 8]
test al, 1
je 0x414431
test al, 4
jne 0x414431
or edi, 0x20000000
push edi
push ebx
push 0x105
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41445f
push edi
push ebx
push 0x101
jmp 0x414426
cmp byte [esp + 0x14], 1
je 0x414453
push ebx
mov ecx, esi
call fcn.00413f22
cmp al, 1
je 0x414453
push 0
push 2
jmp 0x414457
push 0
push 3
push edi
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
pop ebx
ret 8
Function at 0x4148f3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x1c]
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
push edi
and byte [esi], 0
and byte [eax], 0
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push edi
and byte [eax], 0
and byte [ebx], 0
mov byte [ebp - 1], 1
call fcn.00417850
inc eax
push eax
call fcn.00417840
pop ecx
mov dword [ebp + 0x10], eax
pop ecx
mov eax, dword [ebp - 8]
mov al, byte [eax + edi]
cmp al, 0x2b
je 0x414952
cmp al, 0x5e
je 0x41494e
cmp al, 0x21
je 0x41494e
cmp al, 0x23
jne 0x414978
cmp al, 0x2b
jne 0x414957
mov byte [ebx], 1
jmp 0x414973
cmp al, 0x5e
jne 0x414963
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
jmp 0x414973
cmp al, 0x21
jne 0x41496c
mov eax, dword [ebp + 0x18]
jmp 0x41495e
cmp al, 0x23
jne 0x414973
mov byte [esi], 1
inc dword [ebp - 8]
jmp 0x414938
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov al, byte [eax + edi]
inc dword [ebp - 8]
cmp al, 0x7b
mov byte [ebp + 8], al
jne 0x4149e6
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push edi
push 0x7d
call fcn.0041489d
test eax, eax
jne 0x4149d5
mov edi, 0x4273ac
push dword [ebp + 0x10]
push dword [edi]
call fcn.004203e0
pop ecx
test eax, eax
pop ecx
je 0x4149c4
inc dword [ebp - 0xc]
add edi, 4
cmp edi, 0x427520
jl 0x4149a6
mov eax, dword [ebp - 0xc]
cmp eax, 0x5d
je 0x4149d5
cmp byte [eax + 0x427520], 0
je 0x4149db
and byte [ebp - 1], 0
jmp 0x414a14
mov eax, dword [eax*4 + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [esi], eax
jmp 0x414a14
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx eax, ax
test ah, 2
mov dword [esi], eax
je 0x4149ff
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
test byte [esi + 1], 4
je 0x414a0b
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
test byte [esi + 1], 1
je 0x414a14
mov byte [ebx], 1
and dword [esi], 0xff
mov esi, dword [esi]
cmp esi, 0x41
jb 0x414a42
cmp esi, 0x5a
ja 0x414a42
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
jne 0x414a42
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
jne 0x414a42
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
jne 0x414a42
and byte [ebp - 1], 0
push dword [ebp + 0x10]
call fcn.004178cb
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18