joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f2e3361
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x7f30b094]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [0x7f30bacc], esi
push edi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], ecx
je 0x7f2e33a3
push ecx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
jmp 0x7f2e3455
mov eax, dword [0x7f30b088]
mov ebx, dword [ebp + 0xc]
imul eax, ebx
push eax
call fcn.7f2d55af
test eax, eax
mov edi, dword [0x7f30b088]
je 0x7f2e33d4
mov eax, edi
imul eax, ebx
cmp eax, esi
je 0x7f2e33d4
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov esi, esp
test ebx, ebx
jbe 0x7f2e33f3
xor eax, eax
test esi, esi
je 0x7f2e3455
mov ecx, edi
imul ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
push eax
push eax
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x114]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x7f30b088]
imul eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x7f2e3447
push ebx
push dword [ebp - 0x110]
push esi
call fcn.7f2d65a2
test eax, eax
je 0x7f2e3455
dec eax
jmp 0x7f2e3455
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x7f2e3455
and word [ecx], 0
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.7f2fed53
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2e3769
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f30bacc], ebx
push esi
push edi
je 0x7f2e3796
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
jmp 0x7f2e3957
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x7f2e37ff
push eax
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e37db
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e37db
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp - 4], esp
jmp 0x7f2e37de
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x7f2e3807
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp - 4]
push edi
push dword [ebp + 8]
push ebx
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e3802
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x7f2e3813
cmp dword [ebp + 8], ebx
je 0x7f2e3813
xor eax, eax
jmp 0x7f2e3957
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2e387c
push eax
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e3858
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e3858
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp + 8], esp
jmp 0x7f2e385b
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
je 0x7f2e3884
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push ebx
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e387f
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
jne 0x7f2e3889
cmp dword [ebp + 0xc], ebx
jne 0x7f2e380c
cmp dword [ebp + 0x18], 0xffff
jbe 0x7f2e3925
push dword [ebp + 0x18]
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e38d0
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e38d0
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
xor eax, eax
cmp ebx, eax
je 0x7f2e392c
cmp dword [0x7f30bacc], eax
mov dword [ebp + 0xc], eax
jne 0x7f2e38e9
cmp byte [0x7f30b08d], al
je 0x7f2e38ee
mov eax, 0x400
imul esi, edi
lea ecx, [ebp + 0xc]
push ecx
push 0x7f2d2cc0
push esi
push ebx
push edi
push dword [ebp + 0x18]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp + 0xc], 0
jne 0x7f2e3921
test eax, eax
je 0x7f2e3921
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2e3928
push 0x7b
jmp 0x7f2e3919
mov ebx, dword [ebp + 0x18]
test ebx, ebx
jne 0x7f2e3936
cmp dword [ebp + 0x18], 0
jne 0x7f2e380c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7f2e380c
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7f2e4184
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f30bacc], edi
je 0x7f2e41a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x7f2e4208
mov eax, dword [0x7f30b088]
mov ebx, dword [ebp + 0xc]
imul eax, ebx
inc eax
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e41d7
mov eax, esi
imul eax, ebx
inc eax
cmp eax, edi
je 0x7f2e41d7
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov edi, esp
test edi, edi
jne 0x7f2e41df
xor eax, eax
jmp 0x7f2e4208
imul esi, ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x7f2e4208
push ebx
push dword [ebp + 8]
inc eax
push eax
push edi
push 0
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e4208
dec eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e44cb
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2e44ed
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x7f2e4593
mov eax, dword [0x7f30b088]
imul eax, dword [ebp + 8]
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2e451c
mov eax, dword [0x7f30b088]
imul eax, dword [ebp + 8]
test eax, eax
je 0x7f2e451c
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
jmp 0x7f2e451e
xor ebx, ebx
test ebx, ebx
jne 0x7f2e452b
cmp dword [ebp + 8], ebx
jbe 0x7f2e452b
xor eax, eax
jmp 0x7f2e4593
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
push 0x104
call esi
mov edi, eax
cmp edi, dword [ebp + 8]
jbe 0x7f2e454a
push 0
push 0
call esi
mov esi, eax
jmp 0x7f2e4591
xor esi, esi
cmp edi, esi
jbe 0x7f2e4591
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2e4564
mov eax, dword [0x7f30b084]
push dword [ebp + 8]
lea ecx, [edi + 1]
push dword [ebp + 0xc]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x7f2e4580
dec esi
jmp 0x7f2e4591
mov esi, dword [0x7f30b088]
push 0x7a
imul esi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e49b9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f30bacc], edi
je 0x7f2e49d9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x7f2e4a47
mov eax, dword [0x7f30b088]
mov ebx, dword [ebp + 0xc]
imul eax, ebx
inc eax
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e4a0c
mov eax, esi
imul eax, ebx
inc eax
cmp eax, edi
je 0x7f2e4a0c
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov edi, esp
test edi, edi
jne 0x7f2e4a14
xor eax, eax
jmp 0x7f2e4a47
imul esi, ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x7f2e4a47
cmp dword [ebp + 8], 0
je 0x7f2e4a47
test ebx, ebx
je 0x7f2e4a47
push ebx
push dword [ebp + 8]
inc eax
push eax
push edi
push 0
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e4a47
dec eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x7f2e5128
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x7f30b094]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [0x7f30bacc], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
je 0x7f2e5160
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x7f2e5220
push esi
push edi
call fcn.7f2daf04
mov esi, 0x104
cmp eax, esi
pop ecx
ja 0x7f2e5215
push edi
call fcn.7f2daf04
cmp eax, esi
pop ecx
ja 0x7f2e5215
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2e5198
mov eax, dword [0x7f30b084]
cmp dword [0x7f30bacc], ebx
mov dword [ebp - 0x218], eax
jne 0x7f2e51b4
cmp byte [0x7f30b08d], bl
mov dword [ebp - 0x21c], ebx
je 0x7f2e51be
mov dword [ebp - 0x21c], 0x400
push ebx
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0x21c]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x218]
call edi
push ebx
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
push dword [ebp - 0x218]
call edi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x7f2e521f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.7f2fed53
leave
ret 8
Function at 0x7f2e5692
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2e56ae
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x7f2e5724
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e5713
push ebx
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2e56f3
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e56f3
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
jmp 0x7f2e56f5
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2e5717
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x7f2e571d
cmp dword [ebp + 8], 0
jne 0x7f2e5724
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x7f2e5843
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f30bacc], ebx
push esi
push edi
je 0x7f2e586b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x7f2e59aa
mov eax, dword [0x7f30b088]
imul eax, dword [ebp + 0x10]
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2e589b
mov eax, dword [0x7f30b088]
imul eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x7f2e589b
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp - 4], esp
jmp 0x7f2e589e
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
cmp edi, 0xffff
jbe 0x7f2e594f
push edi
and al, 4
cmp byte [edx + 3], 1
jne 0x7f2e595b
lea eax, [edx + 4]
ret
lea eax, [edx + 4]
push ebx
mov ecx, eax
mov bl, byte [edx + 2]
test bl, bl
je 0x7f2e596a
xor byte [ecx], bl
mov bl, byte [ecx]
not bl
test bl, bl
mov byte [ecx], bl
je 0x7f2e5977
inc ecx
jmp 0x7f2e5961
mov byte [edx + 3], 1
pop ebx
ret
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x7f2e599f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x7f2e59b0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x7f2e59ba
inc edi
add eax, 0x28
cmp edi, esi
jb 0x7f2e5995
invalid

Function at 0x7f2e597d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x7f2e59b8
Function at 0x7f2e5d1d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.7f2e594d
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.7f2e5902
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.7f2e594d
push eax
push esi
push dword [ebp + 8]
call fcn.7f2e5902
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.7f2e593d
pop ecx
sub al, 0xb7
js 0x7f2e5d48
popfd
jl 0x7f2e5dc2
invalid
invalid

Function at 0x7f2e65ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x7f2e6631
cmp dword [ebp - 0x398], 0
je 0x7f2e67fb
cmp dword [ebp + 0xc], 1
je 0x7f2e67fb
cmp dword [ebp + 0xc], 8
jne 0x7f2e67c3
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
invalid
test dword [esi - 7], edx
invalid

Function at 0x7f2e68c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x11fffffc]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.7f2e594d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.7f2e5902
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.7f2e593d
scasb al, byte es:[edi]
pop edx
pop eax
add dword [eax + 4], ebp
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x7f2e6d59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x7f2e6d3d
Function at 0x7f2eab75
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
je 0x7f2eab8c
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0xc], 0
push esi
je 0x7f2eac56
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x7f2eac56
mov eax, dword [0x7f30b088]
imul eax, esi
inc eax
je 0x7f2eabc1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
jmp 0x7f2eabc3
xor ebx, ebx
xor eax, eax
test ebx, ebx
je 0x7f2eac60
mov ecx, dword [0x7f30b088]
imul ecx, esi
inc ecx
push edi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x7f30b088]
imul eax, esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x7f2eac22
push dword [ebp + 0x10]
inc esi
push dword [ebp + 0xc]
push esi
push ebx
push edi
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, edi
je 0x7f2eac42
dec esi
jmp 0x7f2eac42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7f2eac3c
cmp byte [ebx], 0
je 0x7f2eac3c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
jmp 0x7f2eac0b
mov eax, dword [ebp + 0xc]
mov word [eax], di
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
jmp 0x7f2eac60
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x7f2eac6b
Capabilities:
Get graphical window text

Disassembly:
push 0x14
push 0x7f2d2ff8
call fcn.7f2ffcbc
xor edi, edi
push dword [ebp + 8]
cmp dword [0x7f30bacc], edi
je 0x7f2eac8f
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
jmp 0x7f2ead32
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x7f2ead30
mov eax, dword [0x7f30bac8]
cmp eax, 0x3a4
je 0x7f2eacd1
cmp eax, 0x3b5
je 0x7f2eacd1
cmp eax, 0x3b6
je 0x7f2eacd1
cmp eax, 0x3a8
je 0x7f2eacd1
cmp eax, 0x551
je 0x7f2eacd1
cmp eax, 0xd698
jne 0x7f2ead30
mov dword [ebp - 4], edi
inc esi
mov dword [ebp - 0x24], esi
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x20], eax
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x7f2ead27
push edi
push edi
push esi
push dword [ebp - 0x20]
push edi
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x7f2ead27
dec dword [ebp - 0x1c]
jmp 0x7f2ead27
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
jmp 0x7f2ead32
mov eax, esi
lea esp, [ebp - 0x30]
call fcn.7f2ffcf7
ret 4
Function at 0x7f2eb7ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10
push 0x7f2d3008
call fcn.7f2ffcbc
cmp dword [0x7f30bacc], 0
je 0x7f2eb7d7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x7f2eb875
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x7f2eb873
mov edi, dword [ebp + 0x14]
mov eax, edi
dec edi
test eax, eax
je 0x7f2eb873
push 6
movzx eax, word [ebp + 0xc]
shr eax, 4
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x7f2eb867
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x7f2eb867
and dword [ebp - 4], esi
and dword [ebp + 0xc], 0xf
movzx esi, word [eax]
mov dword [ebp - 0x1c], esi
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test ecx, ecx
jne 0x7f2eb84a
cmp esi, edi
jle 0x7f2eb83b
mov esi, edi
mov dword [ebp - 0x1c], esi
push esi
push eax
push dword [ebp + 0x10]
call fcn.7f2dafcc
add esp, 0xc
jmp 0x7f2eb863
lea eax, [eax + esi*2]
mov dword [ebp - 0x20], eax
jmp 0x7f2eb81d
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
and word [eax + esi*2], 0
mov eax, esi
jmp 0x7f2eb875
xor eax, eax
call fcn.7f2ffcf7
ret 0x10

Function at 0x7f2eb882
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
je 0x7f2eb897
pop ebp
jmp dword [sym.imp.USER32.dll_MapVirtualKeyW]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
jne 0x7f2eb940
test eax, eax
je 0x7f2eb940
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push eax
call fcn.7f2d42d2
cmp eax, 0x3a4
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
je 0x7f2eb928
cmp eax, 0x3b5
je 0x7f2eb928
cmp eax, 0x3b6
je 0x7f2eb928
cmp eax, 0x3a8
je 0x7f2eb928
cmp eax, 0x551
je 0x7f2eb928
cmp eax, 0xd698
je 0x7f2eb928
and ecx, 0xffff
push 1
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
je 0x7f2eb93d
or byte [ebp + 0xf], 0x80
jmp 0x7f2eb93d
push 1
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
pop ebp
ret 8
Function at 0x7f2eb949
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
je 0x7f2eb95e
pop ebp
jmp dword [sym.imp.USER32.dll_MapVirtualKeyExW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, dword [ebp + 0x10]
jne 0x7f2eb97b
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.unicows.dll_MapVirtualKeyW
jmp 0x7f2eba20
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
cmp dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
jne 0x7f2eba20
test eax, eax
je 0x7f2eba20
movzx eax, word [ebp + 0x10]
push eax
call fcn.7f2d42d2
cmp eax, 0x3a4
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
je 0x7f2eba08
cmp eax, 0x3b5
je 0x7f2eba08
cmp eax, 0x3b6
je 0x7f2eba08
cmp eax, 0x3a8
je 0x7f2eba08
cmp eax, 0x551
je 0x7f2eba08
cmp eax, 0xd698
je 0x7f2eba08
and ecx, 0xffff
push 1
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
je 0x7f2eba1d
or byte [ebp + 0xf], 0x80
jmp 0x7f2eba1d
push 1
lea ecx, [ebp + 0xc]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
pop ebp
ret 0xc

Function at 0x7f2ed425
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x7f30bacc], 0
je 0x7f2ed442
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_VkKeyScanExW]
jmp 0x7f2ed471
movzx eax, word [ebp + 0xc]
push eax
call fcn.7f2d42d2
push 0
push 0
push 2
lea ecx, [ebp - 4]
push ecx
push 1
lea ecx, [ebp + 8]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanExA]
leave
ret 8