joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454bf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x56cee8
mov eax, dword [ebx + 4]
test eax, eax
je 0x454dae
cmp byte [eax], 0x2d
jne 0x454dae
push 0x6f
push eax
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454c30
push 1
push dword [esi]
call fcn.0051e0d8
jmp 0x454c4a
push 0x70
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454c4a
push 0
push dword [esi]
call fcn.0051e0d8
push 0x6e
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454ca8
mov ebx, dword [0x55d830]
xor eax, eax
mov dword [0x55d830], eax
mov edi, dword [0x55d828]
xor eax, eax
mov dword [0x55d828], eax
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
cmp dword [0x55d82c], 0
je 0x454c97
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
mov dword [0x55d830], ebx
mov dword [0x55d828], edi
jmp 0x454dae
push 0x78
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454ce3
push 2
call fcn.0041b199
push 3
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x454dae
push 0x73
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454d1e
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x454dae
push 0x72
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454d5f
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push 9
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x454dae
push 0x74
push dword [ebx + 4]
call fcn.0054c230
add esp, 8
test eax, eax
je 0x454dae
mov ebx, dword [0x55d830]
mov dword [0x55d830], 1
cmp dword [0x55d828], 0
je 0x454d9f
push 1
call fcn.0041b199
test eax, eax
je 0x454d9f
push 0
push dword [esi]
call sub.USER32.dll_ShowWindow
jmp 0x454da8
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
mov dword [0x55d830], ebx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x455e18
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x455e4f
mov byte [0x583410], 0
push dword [0x56cee8]
call fcn.00489f0f
test eax, eax
jne 0x455e45
call fcn.0042cf0e
mov eax, 1
jmp 0x455f8b
mov eax, dword [ebx + 4]
cmp byte [eax], 0x40
jne 0x455f0b
push dword [ebp + 0x14]
push eax
call fcn.00412db7
mov edi, eax
test edi, edi
jne 0x455e7c
push 7
push 0
push dword [ebx]
push 0
call fcn.00479c10
jmp 0x455f8b
lea eax, [edi + 8]
cmp dword [edi + 0x700], 0
je 0x455e89
inc eax
push eax
push 0x560b3d
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
push esi
push 2
call fcn.004e45c5
push 0xf
push esi
call fcn.0050cc40
push dword [edi]
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esi
call fcn.0054c2d0
pop ecx
cmp ebx, eax
jne 0x455ef9
push 0x3b5
push dword [ebp + 0x10]
push dword [edi]
call sub.USER32.dll_GetWindowTextA
mov eax, esi
mov edx, dword [ebp + 0x10]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x455ef9
test cl, cl
je 0x455eed
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x455ef9
add eax, 2
add edx, 2
test cl, cl
jne 0x455ed1
jne 0x455ef9
mov eax, 1
jmp 0x455f8b
push esi
push dword [edi]
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x455f8b
push 0x560b42
push dword [ebx + 4]
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x455f26
mov eax, 2
jmp 0x455f2b
mov eax, 1
cmp dword [ebx + eax*4], 0
je 0x455f6b
mov byte [esi], 0
push ebx
push esi
push eax
call fcn.004e45c5
mov byte [esi + 0xfa], 0
push esi
mov edi, esi
mov esi, 0x583410
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x455f72
mov byte [0x583410], 0
push dword [0x56cee8]
call fcn.00489f0f
test eax, eax
jne 0x455f86
call fcn.0042cf0e
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x45898a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00412773
test eax, eax
je 0x458c4f
push dword [ebx]
call fcn.0051dd0a
mov esi, eax
test esi, esi
je 0x458c4f
mov edi, dword [ebx + 0x438]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x458a06
test al, 1
je 0x4589cb
push ebx
push 0
call fcn.004584c2
test byte [ebx + 0x14], 2
je 0x4589d7
push ebx
call fcn.00504d51
test byte [ebx + 0x14], 4
je 0x4589e3
push ebx
call fcn.00504da3
test byte [ebx + 0x14], 8
je 0x458a01
cmp dword [0x56a110], 0
je 0x458a01
cmp dword [0x56a120], 0
je 0x458a01
push ebx
call fcn.005051d0
xor edx, edx
mov dword [ebx + 0x14], edx
cmp dword [ebp + 8], 0
jne 0x458a52
cmp dword [ebx + 0xc], 0
jne 0x458a18
push ebx
call fcn.005051d0
push 0x11
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
jne 0x458a36
push ebx
call fcn.00504d51
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
je 0x458a52
push ebx
call fcn.00504da3
push ebx
push 0
call fcn.00458d93
cmp dword [0x56d694], 0
jne 0x458aa0
push ebx
push 1
call fcn.00458c56
cmp dword [esi + 0x684], 0
je 0x458a81
push dword [0x55f89c]
push dword [ebx]
call fcn.004ee341
push dword [0x55f89c]
push 0
push 0x5dd
call fcn.0042c564
push eax
push dword [ebx]
call fcn.004ef100
jmp 0x458c4f
cmp byte [ebx + 0x990], 0
je 0x458ace
cmp byte [ebx + 0x9f4], 0
je 0x458ace
cmp byte [ebx + 0xa58], 0
je 0x458ace
cmp byte [ebx + 0xb8c], 0
je 0x458ace
cmp word [ebx + 0xd1c], 0
ja 0x458b00
push ebx
push 1
call fcn.00458c56
push 0
call fcn.0042c4bf
mov dword [0x56a218], 1
push 0
push 0x67
push 0x111
push dword [0x56cee8]
call sub.USER32.dll_PostMessageA
jmp 0x458c4f
test edi, edi
je 0x458b54
mov dword [ebx + 0x434], 1
cmp dword [ebx + 0x430], 2
jge 0x458b21
mov dword [ebx + 0x430], 2
movzx edx, word [ebx + 0xd1c]
push edx
lea ecx, [ebx + 0xb8c]
push ecx
mov eax, dword [ebx + 0x430]
dec eax
push eax
push 0
push 0x5e3
call fcn.0042c564
push eax
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x458bc7
mov dword [ebx + 0x430], 1
mov dword [ebx + 0x434], 1
movzx edx, word [ebx + 0xd1c]
push edx
lea ecx, [ebx + 0xb8c]
push ecx
push 0
push 0x5e2
call fcn.0042c564
push eax
push 0x577e2a
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp dword [ebx + 0x988], 0
je 0x458baf
push 0x2e
lea eax, [ebx + 0xb8c]
push eax
call fcn.0054c230
add esp, 8
test eax, eax
jne 0x458bc7
cmp dword [0x56a110], 0
je 0x458bc7
cmp dword [0x56a120], 0
je 0x458bc7
push ebx
call fcn.005051d0
lea edx, [ebx + 0xb8c]
push edx
push 0x64
lea ecx, [ebx + 0xd1e]
push ecx
call fcn.0042e322
cmp dword [esi + 0x684], 0
je 0x458bf2
push dword [0x55f89c]
push dword [ebx]
call fcn.004ee341
xor eax, eax
mov dword [0x56ac00], eax
mov dword [0x56ac10], 1
push dword [0x55f89c]
push 0x577e2a
push dword [ebx]
call fcn.004ee447
push dword [0x55f89c]
push dword [ebx]
call fcn.004ee341
push ebx
call fcn.00496cb4
push 1
call fcn.00412c1c
cmp dword [ebx + 0x510], 0
jne 0x458c49
cmp dword [0x56a0f8], 0
jne 0x458c49
push ebx
call fcn.00525737
jmp 0x458c4f
push ebx
call fcn.00525ac6
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45b454
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
push 0x561070
push dword [ebp + 8]
call fcn.0054fbc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45b47a
xor eax, eax
jmp 0x45b4f1
push dword [ebp - 4]
push pe_nt_image_headers32
push 1
push 0x57d778
call fcn.0054fe88
add esp, 0x10
mov esi, eax
test esi, esi
jbe 0x45b4ce
xor edx, edx
mov eax, 0x57d778
cmp esi, edx
jbe 0x45b4c6
mov ecx, ebx
xor cl, byte [eax]
and ecx, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x560c70]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
inc eax
cmp esi, edx
ja 0x45b4a2
cmp esi, 0x200
jae 0x45b47a
mov eax, dword [ebp - 4]
test byte [eax + 0x12], 0x10
je 0x45b4e4
push dword [ebp - 4]
call fcn.0054f730
pop ecx
xor eax, eax
jmp 0x45b4f1
push dword [ebp - 4]
call fcn.0054f730
pop ecx
not ebx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x45e20e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xfec]
test eax, eax
je 0x45e236
cmp edx, dword [eax + 8]
je 0x45e236
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x45e22a
test eax, eax
jne 0x45e241
xor eax, eax
jmp 0x45e438
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x45e252
mov eax, 1
jmp 0x45e438
push ebx
call sub.USER32.dll_IsWindowEnabled
test eax, eax
jne 0x45e273
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x45e438
push ebx
push esi
call fcn.0045e0b5
test eax, eax
jne 0x45e295
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x45e438
lea edx, [ebp - 0x3f0]
push edx
push 0x3e7
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
cmp byte [ebp - 0x3f0], 0
je 0x45e3c6
push dword [esi + 0xc8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
jne 0x45e2d1
mov eax, 1
jmp 0x45e438
push 0
push 0
push 0x31
push dword [esi + 0xc8]
call sub.USER32.dll_SendMessageA
lea edx, [ebp - 0x42c]
push edx
push 0x3c
push eax
call sub.GDI32.dll_GetObjectA
test eax, eax
jne 0x45e30b
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x45e438
mov byte [ebp - 0x417], 1
lea edx, [ebp - 0x42c]
push edx
call sub.GDI32.dll_CreateFontIndirectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45e33d
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x45e438
push dword [ebp - 8]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
lea edx, [ebp - 0x43c]
push edx
push ebx
call sub.USER32.dll_GetWindowRect
push 2
lea ecx, [ebp - 0x43c]
push ecx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
cmp byte [ebp - 0x3f0], 0
je 0x45e3a7
push esi
push edi
lea esi, [ebp - 0x43c]
lea edi, [ebp - 0x44c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x2c10
lea eax, [ebp - 0x44c]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x3f0]
push edx
push edi
call sub.USER32.dll_DrawTextA
push dword [ebp - 4]
push edi
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteObject
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
jmp 0x45e407
lea ecx, [ebp - 0x44c]
push ecx
push ebx
call sub.USER32.dll_GetWindowRect
push 2
lea eax, [ebp - 0x44c]
push eax
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
mov edx, dword [ebp - 0x44c]
add edx, 0xa
mov dword [ebp - 0x444], edx
mov ecx, dword [ebp - 0x448]
add ecx, 0xa
mov dword [ebp - 0x440], ecx
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
push 1
lea eax, [ebp - 0x44c]
push eax
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45e712
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx edx, ax
mov dword [ebp - 0xc], edx
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 0xfec]
test ebx, ebx
je 0x45e8df
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x20], eax
xor edx, edx
mov dword [ebx + 0x1c], edx
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x45e8d4
push esi
call sub.USER32.dll_IsWindowEnabled
test eax, eax
je 0x45e8d4
push esi
push edi
call fcn.0045e0b5
test eax, eax
je 0x45e8d4
lea eax, [ebp - 0x408]
push eax
push esi
call sub.USER32.dll_GetWindowRect
push 2
lea edx, [ebp - 0x408]
push edx
push dword [edi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x408]
push eax
call sub.USER32.dll_PtInRect
test eax, eax
je 0x45e8d4
push 0
push 0
push 0x31
push dword [edi + 0xc8]
call sub.USER32.dll_SendMessageA
mov esi, eax
test esi, esi
je 0x45e83a
push dword [edi + 0xc8]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45e83a
push esi
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov esi, eax
lea eax, [ebp - 0x3f8]
push eax
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 0x2c10
lea edx, [ebp - 0x408]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x3f8]
push ecx
push dword [ebp - 0x10]
call sub.USER32.dll_DrawTextA
push esi
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
push dword [edi + 0xc8]
call sub.USER32.dll_ReleaseDC
push dword [ebp - 8]
push dword [ebp - 0xc]
lea edx, [ebp - 0x408]
push edx
call sub.USER32.dll_PtInRect
test eax, eax
je 0x45e8d4
cmp dword [0x561354], 0
jne 0x45e86e
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
mov dword [0x561354], eax
cmp dword [0x561354], 0
jne 0x45e889
push 0x32
push dword [0x56cee4]
call sub.USER32.dll_LoadCursorA
mov dword [0x561354], eax
mov eax, dword [0x561354]
test eax, eax
je 0x45e8d4
push eax
call sub.USER32.dll_SetCursor
cmp dword [0x561358], 0
jne 0x45e8a6
mov dword [0x561358], eax
mov dword [ebp - 4], 1
mov dword [ebx + 0x1c], 1
cmp dword [edi + 0xff0], 0
jne 0x45e8d4
push 0
push 0x32
push 0x7d
push dword [edi + 0xc8]
call sub.USER32.dll_SetTimer
mov dword [edi + 0xff0], eax
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45e74a
mov eax, dword [0x561358]
test eax, eax
je 0x45e904
cmp dword [ebp - 4], 0
jne 0x45e904
push eax
call sub.USER32.dll_SetCursor
xor edx, edx
mov dword [0x561358], edx
xor ecx, ecx
mov dword [0x561354], ecx
mov ebx, dword [edi + 0xfec]
test ebx, ebx
je 0x45e91d
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
jne 0x45e91d
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45e90e
test ebx, ebx
je 0x45e92c
push dword [edi + 0xc8]
call fcn.0045e441
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f196
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xfd8]
test ebx, ebx
je 0x45f286
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfe0]
je 0x45f27b
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov edi, eax
push edi
push esi
call fcn.0045ec53
test eax, eax
jne 0x45f1df
push edi
push esi
call fcn.0045e0f3
test eax, eax
je 0x45f221
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowRect
sub dword [ebp - 0x10], 2
sub dword [ebp - 0xc], 2
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 2
lea edx, [ebp - 0x10]
push edx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push 1
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
jmp 0x45f22b
push 0
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x45f27b
push 0x587110
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 0x26
push 0x587110
call fcn.0054c230
add esp, 8
test eax, eax
je 0x45f27b
mov byte [eax], 1
push 0x587110
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45f1b0
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov ebx, dword [esi + 0xfd8]
test ebx, ebx
je 0x45f339
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfe0]
jne 0x45f32e
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov edi, eax
cmp dword [ebx + 0x1c], 0
je 0x45f2de
push edi
push esi
call fcn.0045ec53
test eax, eax
jne 0x45f2de
push edi
push esi
call fcn.0045e0f3
test eax, eax
jne 0x45f2de
push 8
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x45f32e
push 0x587110
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 1
push 0x587110
call fcn.0054c230
add esp, 8
test eax, eax
je 0x45f32e
mov byte [eax], 0x26
push 0x587110
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45f29f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x470359
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
xor edx, edx
mov dword [ebp - 0xc], edx
push 2
push dword [ebp + 0x10]
mov ebx, dword [0x56cee4]
push ebx
call sub.KERNEL32.dll_FindResourceA
push eax
push ebx
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x470520
push eax
call sub.KERNEL32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x470520
push dword [0x56cee8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
je 0x470520
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4703c5
mov esi, eax
jmp 0x4703ec
mov ax, word [ebx + 0xe]
dec eax
sub ax, 2
jb 0x4703dd
dec ax
je 0x4703dd
sub ax, 4
je 0x4703dd
jmp 0x4703ea
mov cx, word [ebx + 0xe]
mov esi, 1
shl esi, cl
jmp 0x4703ec
xor esi, esi
test esi, esi
jle 0x4704ae
cmp esi, 0x100
jg 0x4704ae
lea eax, [esi - 1]
shl eax, 2
add eax, 8
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4704ae
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x47048b
mov ecx, dword [ebp - 8]
mov word [ecx + 2], si
mov eax, dword [ebp - 8]
mov word [eax], 0x300
lea edx, [ebx + 0x28]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
add eax, 4
add edx, 2
mov dword [ebp - 0x14], edx
cmp esi, dword [ebp - 0x10]
jle 0x47047e
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 1]
mov byte [eax + 1], dl
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx - 2]
mov byte [eax + 2], dl
mov byte [eax + 3], 0
inc dword [ebp - 0x10]
add eax, 4
add dword [ebp - 0x14], 4
cmp esi, dword [ebp - 0x10]
jg 0x470452
push dword [ebp - 8]
call sub.GDI32.dll_CreatePalette
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GlobalFree
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4704ae
push 0
push eax
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x4704e0
push 0xf
call sub.GDI32.dll_GetStockObject
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4704e0
push 0
mov edx, dword [ebp + 0xc]
push dword [edx]
push edi
call sub.GDI32.dll_SelectPalette
mov dword [ebp - 0xc], eax
push edi
call sub.GDI32.dll_RealizePalette
movzx ecx, word [ebx]
add ecx, ebx
shl esi, 2
movzx eax, si
add ecx, eax
mov esi, ecx
push 0
push ebx
push esi
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x470514
push 0
push dword [ebp - 0xc]
push edi
call sub.GDI32.dll_SelectPalette
push edi
push dword [0x56cee8]
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x472464
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_GetKeyboardState
mov bl, byte [ebp + esi - 0x100]
mov al, byte [ebp + 0xc]
mov byte [ebp + esi - 0x100], al
lea edx, [ebp - 0x100]
push edx
call sub.USER32.dll_SetKeyboardState
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4724a5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
lea eax, [ebp - 0x100]
push eax
call sub.USER32.dll_GetKeyboardState
test eax, eax
jne 0x4724c2
xor eax, eax
jmp 0x4724f1
push 0
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x100]
push ecx
push 0
push dword [ebp + 8]
call sub.USER32.dll_ToAscii
cmp eax, 1
je 0x4724e6
cmp eax, 2
jne 0x4724ef
movzx eax, word [ebp - 0x114]
jmp 0x4724f1
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x472b5d
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x472d49
cmp dword [ebx + 0x810], 0
je 0x472d49
cmp dword [ebx + 0x6f8], 0
je 0x472d49
cmp dword [ebx + 0x8f8], 0
je 0x472d49
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebx + 0x8f8]
call sub.GDI32.dll_GetObjectA
push 0
lea edx, [ebp - 0x3c]
push edx
push dword [ebx]
call fcn.005201c7
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x34]
jne 0x472bca
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x30]
je 0x472d49
inc dword [ebx + 0x908]
inc dword [ebx + 0x90c]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebx + 0x908]
jge 0x472be7
mov dword [ebx + 0x908], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebx + 0x90c]
jge 0x472bf8
mov dword [ebx + 0x90c], eax
mov eax, dword [ebx + 0x908]
cmp eax, dword [ebp - 0x34]
jle 0x472c06
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x90c]
cmp eax, dword [ebp - 0x30]
jle 0x472c14
mov dword [ebp - 0x30], eax
push dword [ebx + 0x810]
call sub.USER32.dll_GetDC
mov esi, eax
test esi, esi
je 0x472d49
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov edi, eax
test edi, edi
jne 0x472c46
push esi
push dword [ebx + 0x810]
call sub.USER32.dll_ReleaseDC
jmp 0x472d49
push esi
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x472c5d
push edi
call sub.GDI32.dll_DeleteDC
jmp 0x472c35
mov eax, dword [ebx + 0x8f8]
mov dword [ebp - 4], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebx + 0x8f8], eax
cmp dword [ebx + 0x8f8], 0
jne 0x472c94
mov edx, dword [ebp - 4]
mov dword [ebx + 0x8f8], edx
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
jmp 0x472c55
push dword [ebx + 0x8f8]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 8], eax
mov ecx, dword [0x55f890]
push dword [ecx*4 + 0x57d6d8]
call sub.GDI32.dll_CreateSolidBrush
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x3c]
push eax
push edi
call sub.USER32.dll_FillRect
push dword [ebp - 0x14]
call sub.GDI32.dll_DeleteObject
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push edi
call sub.GDI32.dll_BitBlt
push 0xcc0020
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push esi
call sub.GDI32.dll_BitBlt
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
call sub.GDI32.dll_DeleteDC
push dword [ebp - 8]
push edi
call sub.GDI32.dll_SelectObject
push edi
call sub.GDI32.dll_DeleteDC
push esi
push dword [ebx + 0x810]
call sub.USER32.dll_ReleaseDC
push dword [ebp - 4]
call sub.GDI32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4