joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412470
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x432a0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 8
call fcn.0042a859
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x4124bd
mov ecx, dword [ebx + 0x808]
mov edx, dword [0x46233c]
push ecx
push edx
mov ecx, eax
call fcn.0040c8a0
jmp 0x4124bf
xor eax, eax
test eax, eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [ebx + 0x80c], eax
jne 0x4124e4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
lea ebp, [ebx + 0x400]
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x41250d
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
and ecx, 0xffff
mov al, byte [ecx + ebx + 0x400]
lea ecx, [ecx + ebx + 0x400]
cmp al, 0x5c
jne 0x412536
mov byte [ecx], 0
or ecx, 0xffffffff
mov edi, 0x43a668
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.AI5WIN.INI
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
push 0
push 0
push 1
push 0
mov dword [0x462328], eax
call esi
mov dword [0x46232c], eax
mov eax, dword [0x462328]
test eax, eax
jne 0x4125e6
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x462320
push 0
push 0
push 0x413110
push 0
push 0
mov dword [0x43a61c], 1
call fcn.00420150
add esp, 0x18
mov dword [0x462324], eax
test eax, eax
jne 0x412626
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebx
push 0
push str.bDEBUG
push str.Config
call esi
push ebx
push 0
push str.bDEBUG
push str.Config
mov dword [ebx + 0x800], eax
call esi
mov ecx, dword [esp + 0x14]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
inc eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret

Function at 0x412680
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 0xc
Function at 0x4126a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x14

Function at 0x4127c0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov eax, ecx
and eax, 0xffff
cmp eax, 0xe141
jg case.0x4127ed.40002
je 0x412a15
add eax, 0xffff63bf
cmp eax, 0x1f
ja case.0x4127ed.40002
jmp dword [eax*4 + 0x412a40]
mov ecx, esi
call fcn.00413240
pop esi
ret 4
mov eax, dword [0x46233c]
mov ecx, dword [eax + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040c900
pop esi
ret 4
mov ecx, dword [0x46233c]
mov ecx, dword [ecx + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040c9b0
pop esi
ret 4
mov edx, dword [0x46233c]
mov ecx, dword [edx + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040c9e0
pop esi
ret 4
mov eax, dword [0x46233c]
mov ecx, dword [eax + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040ca10
pop esi
ret 4
mov ecx, dword [0x46233c]
mov ecx, dword [ecx + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040ca40
pop esi
ret 4
mov edx, dword [0x46233c]
mov ecx, dword [edx + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040ca70
pop esi
ret 4
mov eax, dword [0x46233c]
mov ecx, dword [eax + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040caa0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 1
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 2
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 3
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 4
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 5
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 6
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 7
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 8
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
push 9
mov ecx, esi
call fcn.00412bc0
pop esi
ret 4
mov ecx, dword [0x46233c]
push 0
mov edx, dword [ecx + 0x2ff0]
mov eax, dword [edx + 0x9c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x46233c]
mov ecx, dword [ecx + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x80c]
push eax
call fcn.0040c8e0
pop esi
ret 4
mov ecx, dword [0x46233c]
push 0
call fcn.00416d80
pop esi
ret 4
mov ecx, dword [0x46233c]
push 1
call fcn.00416d80
pop esi
ret 4
mov ecx, dword [0x46233c]
push 0
call fcn.00416f40
pop esi
ret 4
mov ecx, dword [0x46233c]
push 1
call fcn.00416f40
pop esi
ret 4
push ecx
mov ecx, dword [0x46233c]
call fcn.00417010
pop esi
ret 4
push ecx
mov ecx, dword [0x46233c]
call fcn.00417140
pop esi
ret 4
push ecx
mov ecx, dword [0x46233c]
call fcn.00417230
pop esi
ret 4
mov edx, dword [0x46233c]
push 0
push 0xf060
push 0x112
mov ecx, dword [edx + 0x2ff0]
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
ret 4
Function at 0x4135c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
lea edx, [ecx + 0x410]
push ebx
mov dword [esp + 4], edx
push esi
mov edx, 0xffffe3fc
mov esi, 0xffffe3f8
and eax, 0xff
sub edx, ecx
sub esi, ecx
mov dword [ecx + 0x2008], eax
push edi
lea eax, [ecx + 0x1c08]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x100
jmp 0x413612
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea edi, [edx + eax]
mov edx, dword [ecx + 0x400]
add esi, eax
xor ebx, ebx
mov dl, byte [edx + edi]
mov byte [eax + 2], dl
mov edx, dword [ecx + 0x400]
add eax, 4
mov dl, byte [edx + esi + 6]
mov byte [eax - 4], dl
mov edx, dword [ecx + 0x400]
mov dl, byte [edx + esi + 5]
mov byte [eax - 3], dl
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + edi]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
fild dword [esp + 0x1c]
add edi, 0x18
mov dword [esp + 0xc], edi
fstp qword [edi - 0x20]
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + esi + 5]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
fild dword [esp + 0x1c]
fstp qword [edi - 0x18]
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + esi + 6]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebx
dec edx
fild dword [esp + 0x1c]
mov dword [esp + 0x10], edx
fstp qword [edi - 0x10]
jne 0x41360a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4136b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov edx, 0xffffe3fc
mov esi, 0xffffe3f8
push edi
lea eax, [ecx + 0x410]
sub edx, ecx
mov edi, 0x100
sub esi, ecx
mov dword [esp + 0xc], eax
mov dword [ecx + 0x2008], edi
lea eax, [ecx + 0x1c08]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
jmp 0x4136fb
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea edi, [edx + eax]
mov edx, dword [ecx + 0x400]
add esi, eax
xor ebx, ebx
mov dl, byte [edx + edi]
mov byte [eax + 2], dl
mov edx, dword [ecx + 0x400]
add eax, 4
mov dl, byte [edx + esi + 6]
mov byte [eax - 4], dl
mov edx, dword [ecx + 0x400]
mov dl, byte [edx + esi + 5]
mov byte [eax - 3], dl
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + edi]
mov edi, dword [esp + 0xc]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
fild dword [esp + 0x1c]
add edi, 0x18
mov dword [esp + 0xc], edi
fstp qword [edi - 0x20]
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + esi + 5]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
fild dword [esp + 0x1c]
fstp qword [edi - 0x18]
mov edx, dword [ecx + 0x400]
mov bl, byte [edx + esi + 6]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebx
dec edx
fild dword [esp + 0x1c]
mov dword [esp + 0x10], edx
fstp qword [edi - 0x10]
jne 0x4136f3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415d00
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x432ac6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x520
call fcn.0042a859
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x415d57
mov ecx, dword [esi + 0x2ffc]
mov edx, dword [esi + 0x2ff0]
push ecx
mov ecx, dword [esi + 0x2ff4]
push edx
push ecx
mov ecx, eax
call fcn.0041d280
jmp 0x415d59
xor eax, eax
or edi, 0xffffffff
mov dword [esi + 0x3008], eax
test eax, eax
mov dword [esp + 0x1c], edi
jne 0x415d7d
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, eax
call fcn.0041d430
push 0x1c
mov dword [esi + 0xfc8], eax
call fcn.0042a859
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 1
je 0x415dad
mov ecx, eax
call fcn.0040dae0
jmp 0x415daf
xor eax, eax
test eax, eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x3014], eax
jne 0x415dd0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, dword [esi + 0x2ff0]
call fcn.0041f250
mov ecx, dword [esi + 0x3014]
push eax
call fcn.0040db10
test eax, eax
jne 0x415e1f
mov ecx, dword [esi + 0x2ff0]
push eax
push 0x45e54c
push str.DirectDraw
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esi + 0x2ff4]
push 0
push str.SCREEN
push str.Config
call fcn.004126d0
mov ecx, dword [esi + 0x2ff0]
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0xe
push edi
call ebx
push 0xc
push edi
mov dword [esp + 0x18], eax
call ebx
mov ecx, dword [esi + 0x2ff0]
push edi
mov ebp, eax
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
imul ebp, dword [esp + 0x10]
push 8
push edi
mov dword [esi + 0xfe0], ebp
call ebx
push 0xa
push edi
call ebx
mov ecx, dword [esi + 0x2ff4]
push 1
push str.SCREEN
push str.Config
call fcn.00412680
test eax, eax
je 0x415edd
mov ecx, dword [esi + 0x2ff0]
push 0
push 0
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0x2ff4]
push 0
push str.SCREEN
push str.Config
call fcn.004126d0
mov ecx, dword [esi + 0x2ff0]
push 3
call fcn.0041f250
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x2ff8]
mov dword [edx + 0x490], 0x28
mov ecx, dword [esi + 0x2ff8]
call fcn.00410a50
test eax, eax
jne 0x415eff
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, dword [esi + 0x3004]
call fcn.00401b10
mov ecx, dword [esp + 0x14]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
mov dword fs:[0], ecx
neg eax
pop ebx
add esp, 0x10
ret
Function at 0x41ce30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x348]
test eax, eax
je 0x41ce96
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call ebx
test ax, ax
jne 0x41cf4e
mov edi, dword [esi + 0x18]
mov ecx, dword [esi + 0x2ff4]
shr edi, 2
call fcn.00412af0
mov ecx, dword [esi + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41cf4e
mov ecx, dword [esi + 0x2ff4]
call fcn.00412b00
cmp eax, edi
jae 0x41cf4e
push 0x10
call ebx
test ax, ax
je 0x41ce63
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esi + 0x2ff0]
push 7
call fcn.0041f470
cmp eax, 1
jne 0x41ceb9
mov ecx, dword [esi + 0x3008]
push 2
call fcn.0041d7d0
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esi + 0x2ff0]
push 0
call fcn.0041f470
cmp eax, 1
je 0x41cefe
mov ecx, dword [esi + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41cefe
mov ecx, dword [esi + 0x2ff0]
push 7
call fcn.0041f470
cmp eax, 1
je 0x41cf52
mov ecx, dword [esi + 0x2ff0]
push 0
call fcn.0041f470
cmp eax, 1
jne 0x41cecb
mov ecx, dword [esi + 0x3008]
push 2
call fcn.0041d7d0
mov ecx, dword [esi + 0x2ff0]
push 0
call fcn.0041f470
test eax, eax
je 0x41cf4e
mov ecx, dword [esi + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41cf4e
mov ecx, dword [esi + 0x2ff0]
push 7
call fcn.0041f470
cmp eax, 1
je 0x41cf4e
mov ecx, dword [esi + 0x2ff0]
push 0
call fcn.0041f470
test eax, eax
jne 0x41cf1c
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esi + 0x3008]
push 2
call fcn.0041d7d0
pop edi
pop esi
pop ebx
ret
Function at 0x41ea70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
lea eax, [esp + 0x50]
push 0
push eax
lea ecx, [esp + 0x24]
push 0xc
push ecx
push esi
call ebx
cmp dword [esp + 0x1c], 0x46464952
jne 0x41ebb1
cmp dword [esp + 0x24], 0x45564157
jne 0x41ebb1
mov edx, dword [esp + 0x20]
lea eax, [ebp + edx - 4]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x50]
push 0
push ecx
lea edx, [esp + 0x1c]
push 8
push edx
push esi
call ebx
push 1
push 0
push 0
push esi
call edi
mov ebp, eax
mov eax, dword [esp + 0x14]
cmp eax, 0x20746d66
je 0x41eb4f
cmp eax, 0x61746164
je 0x41eb28
cmp eax, 0x6c706d73
jne 0x41eb6b
lea eax, [esp + 0x50]
push 0
push eax
lea ecx, [esp + 0x30]
push 0x24
push ecx
push esi
call ebx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x41eb6b
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x50]
push 0
push edx
push 0x18
jmp 0x41eb67
mov eax, dword [esp + 0x58]
test eax, eax
je 0x41eb3f
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [esp + 0x58]
mov dword [ecx], eax
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41eb6b
mov edx, dword [esp + 0x18]
mov dword [eax], edx
jmp 0x41eb6b
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41eb6b
cmp dword [esp + 0x18], 0xe
jb 0x41ebb1
lea ecx, [esp + 0x50]
push 0
push ecx
push 0x12
push eax
push esi
call ebx
mov edx, dword [esp + 0x18]
push 0
inc edx
push 0
and edx, 0xfffffffe
add edx, ebp
push edx
push esi
call edi
push 1
push 0
push 0
push esi
call edi
cmp dword [esp + 0x10], eax
ja 0x41eacb
mov eax, dword [esp + 0x58]
cmp dword [eax], 0
je 0x41ebb1
mov ecx, dword [esp + 0x5c]
cmp dword [ecx], 0
je 0x41ebb1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret 0x14
Function at 0x41f160
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
lea eax, [esp]
push esi
push edi
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x24]
push 1
push str.SCREEN
push str.Config
mov ecx, dword [eax + 0x2ff4]
call fcn.00412680
test eax, eax
je 0x41f239
mov eax, dword [esi + 0xb0]
test eax, eax
jne 0x41f239
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x41f222
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xf
call edi
cmp dword [esp + 0xc], eax
jge 0x41f222
mov edx, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esi + 0x9c]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x40
push 0xf
call edi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esi + 0x9c]
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
add esp, 0x18
ret 4
mov ecx, dword [esi + 0x9c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x18
ret 4
mov edx, dword [esi + 0x9c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x18
ret 4

Function at 0x41f360
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
cmp eax, 0x11
mov esi, ecx
ja 0x41f388
je 0x41f37b
cmp eax, 0xd
je 0x41f437
pop esi
ret 4
and word [esi + 0xac], 0xefff
pop esi
ret 4
cmp eax, 0x20
ja 0x41f3ba
je 0x41f437
cmp eax, 0x1b
jne case.default.0x41f3cd
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl case.default.0x41f3cd
and word [esi + 0xac], 0xbfff
pop esi
ret 4
cmp eax, 0x62
ja 0x41f3e1
je case.0x41f3cd.40
add eax, 0xffffffdb
cmp eax, 3
ja case.default.0x41f3cd
jmp dword [eax*4 + 0x41f454]
and word [esi + 0xac], 0xffdf
pop esi
ret 4
cmp eax, 0xa2
ja 0x41f420
je 0x41f437
sub eax, 0x64
je case.0x41f3cd.37
sub eax, 2
je case.0x41f3cd.39
sub eax, 2
jne case.default.0x41f3cd
and word [esi + 0xac], 0xfff7
pop esi
ret 4
and word [esi + 0xac], 0xfdff
pop esi
ret 4
and word [esi + 0xac], 0xff7f
pop esi
ret 4
sub eax, 0xa5
je 0x41f444
sub eax, 0x15d
je 0x41f437
sub eax, 3
je 0x41f444
pop esi
ret 4
and word [esi + 0xac], 0xdfff
pop esi
ret 4
and word [esi + 0xac], 0xbfff
pop esi
ret 4
Function at 0x41f470
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
cmp eax, 9
ja case.default.0x41f480
jmp dword [eax*4 + 0x41f5ac]
mov cx, word [ecx + 0xac]
test cl, 1
jne 0x41f5a1
test cl, 2
jne 0x41f5a1
test ch, 0x20
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
mov cx, word [ecx + 0xac]
test cl, 4
jne 0x41f5a1
test ch, 0x40
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
mov cx, word [ecx + 0xac]
test cl, 8
jne 0x41f5a1
test cl, 0x10
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
mov cx, word [ecx + 0xac]
test cl, 0x20
jne 0x41f5a1
test cl, 0x40
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
mov cx, word [ecx + 0xac]
test cl, 0x80
jne 0x41f5a1
test ch, 1
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
mov cx, word [ecx + 0xac]
test ch, 2
jne 0x41f5a1
test ch, 4
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
test byte [ecx + 0xad], 0x10
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
test byte [ecx + 0xad], 0x20
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4
test byte [ecx + 0xad], 0x40
je case.default.0x41f480
mov esi, 1
mov eax, esi
pop esi
ret 4

Function at 0x420150
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x74
push 1
xor edi, edi
call fcn.00422cc0
mov esi, eax
add esp, 8
test esi, esi
je 0x4201b0
push esi
call fcn.00422a50
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x14]
push eax
push esi
push 0x4201d0
push ecx
push edx
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4201c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.00420730
add esp, 4
test edi, edi
je 0x4201c6
push edi
call fcn.00421680
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x420850
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436058
push 0x422fc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x5669e0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x5669dc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x5669d8], ecx
shr eax, 0x10
mov dword [0x5669d4], eax
call fcn.00424960
test eax, eax
jne 0x4208ba
push 0x1c
call fcn.00420a30
add esp, 4
call fcn.004229f0
test eax, eax
jne 0x4208cd
push 0x10
call fcn.00420a30
add esp, 4
mov dword [ebp - 4], 0
call fcn.004257e0
call fcn.00421f60
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x5680f0], eax
call fcn.00425680
mov dword [0x5669c4], eax
test eax, eax
je 0x420900
mov eax, dword [0x5680f0]
test eax, eax
jne 0x42090a
push 0xffffffffffffffff
call fcn.00421290
add esp, 4
call fcn.004253d0
call fcn.004252e0
call fcn.00421260
mov esi, dword [0x5680f0]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x4209e9
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x420951
test al, al
je 0x420951
and eax, 0xff
push eax
call fcn.00425280
add esp, 4
test eax, eax
je 0x42092b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x42092b
cmp byte [esi], 0x22
jne 0x42095a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x42096a
cmp al, 0x20
ja 0x42096a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x42095a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x42098b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x420990
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00421290
jmp 0x4209ce
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x42095a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4209e9

Function at 0x420a30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x5669cc], 1
jne 0x420a3e
call fcn.004259f0
mov eax, dword [esp + 4]
push eax
call fcn.00425a30
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]