joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f70
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x411470], 0
je 0x405fdf
mov dword [0x411470], 0
call fcn.00405ee7
test eax, eax
je 0x405fd0
push 0
mov eax, dword [0x41d78c]
push eax
push 0x405d40
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x41d0cc], eax
push 0
mov ecx, dword [0x41d78c]
push ecx
push 0x405ea8
push 0xe
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x41d0d0], eax
mov dword [0x41d0d4], 0
jmp 0x405fdf
mov edx, dword [0x41df6c]
push edx
call fcn.00406050
add esp, 4
pop ebp
ret

Function at 0x406050
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
call fcn.0040bde7
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41d0f0], eax
cmp dword [0x41d0f0], 0
je 0x40614a
movsx eax, byte [0x411a3b]
and eax, 1
test eax, eax
jne 0x406098
push str.KeyboardFunc
mov ecx, dword [0x41d0f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d0d8], eax
jmp 0x4060e5
cmp dword [0x411474], 0
je 0x4060db
cmp dword [0x42d000], 0
je 0x4060c3
push str.KeyboardFuncIntF
mov edx, dword [0x41d0f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d0d8], eax
jmp 0x4060d9
push str.KeyboardFuncInt
mov eax, dword [0x41d0f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d0d8], eax
jmp 0x4060e5
mov dword [0x41d0d8], 0
cmp dword [0x41d0d8], 0
je 0x40610c
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x41d0f0]
push edx
mov eax, dword [0x41d0d8]
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x41d0e4], eax
push str.MouseFunc
mov ecx, dword [0x41d0f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d0dc], eax
cmp dword [0x41d0dc], 0
je 0x40614a
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x41d0f0]
push eax
mov ecx, dword [0x41d0dc]
push ecx
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x41d0e8], eax
pop ebp
ret
Function at 0x4061c0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x41d0f4]
add eax, 1
mov dword [0x41d0f4], eax
cmp dword [0x41d0f4], 5
jne 0x406333
mov dword [0x41d0f4], 0
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x406211
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x40
jge 0x406333
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x406317
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x406317
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x406317
push 0xffffffffffffffec
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 8
test eax, eax
je 0x406317
push 0x80
lea ecx, [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.32768
lea eax, [ebp - 0x8c]
push eax
call fcn.0040ca80
add esp, 8
test eax, eax
jne 0x4062d2
push 0x80
lea ecx, [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx eax, byte [ebp - 0x8c]
test eax, eax
jne 0x4062d0
push 0
push 0x1b
push 0x100
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406317
push str.BaseBar
lea edx, [ebp - 0x8c]
push edx
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x406317
push 0x80
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx edx, byte [ebp - 0x8c]
test edx, edx
jne 0x406317
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40632e
jmp 0x406333
jmp 0x406208
mov esp, ebp
pop ebp
ret
Function at 0x406340
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x48], 0
cmp dword [0x41d7bc], 0
jne 0x406479
push 0x4114c8
push 0x40
lea eax, [ebp - 0x40]
push eax
push 0x4114d8
push 0x4114dc
push 0x4114e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x40]
push ecx
call fcn.0040cb8f
add esp, 4
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x406406
push 0x4114f0
push 0x40
lea edx, [ebp - 0x40]
push edx
push 0x411500
push 0x411504
push 0x411508
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x40]
push eax
call fcn.0040cb8f
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x406406
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x44]
jne 0x406406
cmp dword [ebp - 0x48], 0
je 0x406406
mov ecx, dword [ebp - 0x48]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x406406
push 0
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp + 8]
push eax
push 0x411514
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x411518
lea edx, [ebp - 0x40]
push edx
push 0x411528
push 0x411530
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp - 0x48]
push edx
push 0x41153c
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x411540
lea ecx, [ebp - 0x40]
push ecx
push 0x411550
push 0x411554
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esp, ebp
pop ebp
ret
Function at 0x4064c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov dword [ebp - 0x18c], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x80000000
call fcn.00406716
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406670
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x188]
push edx
call fcn.0040c0a0
add esp, 8
push str._shellOpenCommand
lea eax, [ebp - 0x188]
push eax
call fcn.0040c0b0
add esp, 8
push 0
lea ecx, [ebp - 0x188]
push ecx
push 0x80000000
call fcn.00406716
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [0x41d1f8], 0
je 0x406575
xor edx, edx
cmp dword [ebp - 8], 0
setne dl
mov dword [ebp - 0x18c], edx
cmp dword [0x41d1fc], 0
je 0x406570
cmp dword [ebp - 0x18c], 0
je 0x406570
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x41d1fc]
push ecx
call fcn.0040c0a0
add esp, 8
jmp 0x406670
cmp dword [ebp - 8], 0
je 0x406670
push 0x4115b8
mov edx, dword [ebp - 8]
push edx
call fcn.0040cba0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4065a1
mov eax, dword [ebp - 4]
mov word [eax], 0x2020
push 0x4115bc
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040cba0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406618
mov edx, dword [ebp - 4]
mov byte [edx + 1], 0x73
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4065fe
mov edx, dword [ebp - 4]
movsx eax, byte [edx - 1]
cmp eax, 0x22
jne 0x4065e1
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx - 1]
cmp eax, 0x20
jne 0x4065f8
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4065e1
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x188]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x406652
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.0040c0a0
add esp, 8
push 0x4115c0
lea edx, [ebp - 0x188]
push edx
call fcn.0040c0b0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
call fcn.0040c0b0
add esp, 8
push 1
lea edx, [ebp - 0x188]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x406670
mov dword [ebp - 0x18c], 1
mov eax, dword [ebp - 0x18c]
mov esp, ebp
pop ebp
ret
Function at 0x406716
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], 0
cmp dword [ebp - 8], 0
je 0x4067ba
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
push 0x41d0f8
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x4067ba
cmp dword [ebp - 4], 2
jne 0x4067b3
push 0x100
lea edx, [ebp - 0x110]
push edx
push 0x41d0f8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x110]
push eax
push 0x41d0f8
call fcn.0040c0a0
add esp, 8
mov dword [ebp + 0xc], 0x41d0f8
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x40770e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 0x10c]
push eax
push 3
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40773c
xor eax, eax
jmp 0x4077f5
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
test eax, eax
jne 0x40778b
mov byte [ebp - 0x108], 0
mov dword [ebp - 4], 0x100
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40778b
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4077f5
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040c190
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4077c6
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4077f5
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
test edx, edx
jne 0x4077f0
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040c0a0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40905f
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x41d6b4], 1
jne 0x40909a
push 0x41d784
push 0x411c64
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40909a
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x40909e
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movsx eax, byte [0x411a3b]
and eax, 2
test eax, eax
jne 0x409178
cmp dword [ebp + 8], 0
jne 0x409151
cmp dword [0x41d710], 0
jne 0x4090e9
mov dword [0x41d710], 1
push 0x41d580
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x41d568
call dword [sym.imp.USER32.dll_GetClipCursor]
mov dword [ebp - 0x10], 0xfffffe70
mov dword [ebp - 0xc], 0xfffffe70
mov dword [ebp - 8], 0x1000
mov dword [ebp - 4], 0x1000
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_ClipCursor]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0x640
push 0x640
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0x41df90
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x409178
cmp dword [0x41d710], 0
je 0x409178
push 0x41d568
call dword [sym.imp.USER32.dll_ClipCursor]
mov edx, dword [0x41d584]
push edx
mov eax, dword [0x41d580]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov esp, ebp
pop ebp
ret
Function at 0x40917c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [0x41df90]
jne 0x4091a2
mov edx, dword [ebp - 8]
cmp edx, dword [0x41df94]
je 0x40921d
mov eax, dword [ebp - 0xc]
sub eax, dword [0x41df90]
push eax
call fcn.0040ccea
add esp, 4
cmp eax, 1
jg 0x4091e3
mov ecx, dword [ebp - 8]
sub ecx, dword [0x41df94]
push ecx
call fcn.0040ccea
add esp, 4
cmp eax, 1
jg 0x4091e3
mov edx, dword [ebp - 0xc]
mov dword [0x41df90], edx
mov eax, dword [ebp - 8]
mov dword [0x41df94], eax
jmp 0x40921b
mov ecx, dword [ebp - 0xc]
mov dword [0x41df90], ecx
mov edx, dword [ebp - 8]
mov dword [0x41df94], edx
cmp dword [0x41d6e4], 0xa
ja 0x409207
cmp dword [0x411be0], 0
jne 0x409211
push 2
call fcn.004092e6
add esp, 4
mov dword [0x411be0], 0
jmp 0x409254
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test eax, eax
jne 0x40924a
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
jne 0x40924a
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
je 0x409254
push 2
call fcn.004092e6
add esp, 4
cmp dword [0x41d0d4], 0
je 0x409273
mov dword [0x41d0d4], 0
push 1
call fcn.004092e6
add esp, 4
jmp 0x4092e2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x411b3c]
test ecx, ecx
je 0x4092e2
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 0x411b3c]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
je 0x4092c5
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 0x411b3c]
xor ecx, ecx
mov cl, byte [eax + 0x41de60]
test ecx, ecx
jne 0x4092c3
push 1
call fcn.004092e6
add esp, 4
jmp 0x4092e2
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 0x411b3c]
mov byte [eax + 0x41de60], 0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x40927a
mov esp, ebp
pop ebp
ret
Function at 0x4098e9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x41d7bc], 0
je 0x409ab5
cmp dword [0x41d6ec], 0
jne 0x409ab5
cmp dword [0x41d7a8], 0
je 0x409ab5
movsx eax, byte [0x411a3b]
test eax, eax
jne 0x409ab5
cmp dword [0x411be8], 0xffffffff
jne 0x409956
mov eax, dword [0x41d558]
sub eax, dword [0x41d550]
cdq
sub eax, edx
sar eax, 1
mov dword [0x411be8], eax
mov eax, dword [0x41d55c]
sub eax, dword [0x41d554]
cdq
sub eax, edx
sar eax, 1
mov dword [0x411bec], eax
mov dword [0x41d6dc], 1
mov dword [0x41d6c0], 1
movsx ecx, byte [0x411a3b]
test ecx, ecx
je 0x40999c
push 1
mov edx, dword [0x41d55c]
push edx
mov eax, dword [0x41d558]
push eax
mov ecx, dword [0x41d554]
push ecx
mov edx, dword [0x41d550]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [0x41d6d8], 1
push 0x23
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov ecx, dword [0x41d6bc]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebp + 8]
push edx
call fcn.0040acf4
add esp, 4
test eax, eax
jne 0x409aab
cmp dword [0x41d6ec], 0
jne 0x409a7b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x41d6c0], 0
cmp dword [0x41d6dc], 0
jne 0x409a23
push 0x411be8
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
call fcn.0040909e
add esp, 4
push 0
push 0
mov ecx, dword [0x41d6bc]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
movsx edx, byte [0x411a3b]
test edx, edx
je 0x409a42
push 1
push 0xa
push 0xa
push 0xffffffffffffff9c
push 0xffffffffffffff9c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 4], 0
jmp 0x409a54
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x100
jge 0x409a7b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x41de60], al
jmp 0x409a4b
mov dword [0x41d6c0], 0
cmp dword [0x411688], 0
je 0x409aa7
push 0x23
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [0x41d6bc]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
jmp 0x409aba
mov dword [0x41d6c0], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x409b23
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
cmp dword [0x41d6b4], 0
jne 0x409cb3
cmp dword [0x41d71c], 0
jne 0x409b5f
call fcn.004093e2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409b5f
mov dword [0x41d6b4], 2
jmp 0x409ca1
cmp dword [0x41d718], 0
jne 0x409b85
call fcn.00409429
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409b85
mov dword [0x41d6b4], 1
jmp 0x409ca1
cmp dword [0x41d714], 0
je 0x409ca1
call fcn.004095cb
mov eax, dword [0x41d714]
mov dword [ebp - 4], eax
push 0x40
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4119d0
lea edx, [ebp - 0x84]
push edx
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x409be9
mov dword [0x41d6b4], 1
jmp 0x409ca1
push str.ASIMainWndClass
lea eax, [ebp - 0x84]
push eax
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x409c1a
mov dword [0x41d6b4], 2
mov dword [0x41d6b8], 6
jmp 0x409ca1
push str.ImlWinBackdropClass
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x409c48
mov dword [0x41d6b4], 2
mov dword [0x41d6b8], 7
jmp 0x409ca1
push str.ImlWinBackdropClass
lea edx, [ebp - 0x84]
push edx
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x409c76
mov dword [0x41d6b4], 2
mov dword [0x41d6b8], 8
jmp 0x409ca1
push str.Shockwave_Flash
lea eax, [ebp - 0x44]
push eax
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x409c97
mov dword [0x41d6b4], 1
jmp 0x409ca1
mov dword [0x41d6b4], 1
cmp dword [0x41d6b4], 0
je 0x409cb3
mov ecx, dword [ebp - 4]
mov dword [0x41d6bc], ecx
mov eax, dword [0x41d6bc]
mov esp, ebp
pop ebp
ret

Function at 0x40a23c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x41d77c], 0
jne 0x40a2a9
cmp dword [0x41d6b4], 1
jne 0x40a2a9
cmp dword [0x41d6bc], 0
je 0x40a2a9
cmp dword [ebp + 8], 0
jge 0x40a2a9
mov eax, dword [ebp + 8]
neg eax
cdq
mov ecx, 0x32
idiv ecx
test edx, edx
jne 0x40a2a9
push 0x41d788
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
push 1
push 0
mov edx, dword [0x41d6bc]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [0x41d77c], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40a2b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f340
push 0x40cef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xb4], 0
call fcn.00403b10
test eax, eax
jne 0x40a2fa
or eax, 0xffffffff
jmp 0x40a56a
mov ecx, dword [ebp + 8]
mov dword [0x41d78c], ecx
mov dword [ebp - 0xb0], 0x94
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40a333
cmp dword [ebp - 0xa0], 1
jne 0x40a333
mov dword [ebp - 0xb8], 1
jmp 0x40a33d
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
mov dword [0x41d7bc], eax
cmp dword [0x41d7bc], 0
je 0x40a36f
cmp dword [ebp - 0xac], 4
jb 0x40a36f
cmp dword [ebp - 0xa8], 0xa
jb 0x40a36f
mov dword [ebp - 0xbc], 1
jmp 0x40a379
mov dword [ebp - 0xbc], 0
mov ecx, dword [ebp - 0xbc]
mov dword [0x41d7c0], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x41d7cc], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x75
ja case.0x40a3be.9
mov edx, dword [ebp - 0xc0]
xor ecx, ecx
mov cl, byte [edx + 0x40a5a5]
jmp dword [ecx*4 + 0x40a57d]
mov dword [0x41d7c4], 1
push 0
call fcn.0040a9e6
add esp, 4
mov dword [ebp - 0xc4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc4]
jmp 0x40a56a
mov dword [0x41d7ac], 1
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
cmp edx, 0x20
je case.0x40a3be.6
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040ab96
add esp, 4
mov dword [ebp - 0xc8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc8]
jmp 0x40a56a
cmp dword [0x41d7bc], 0
jne 0x40a458
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xcc]
jmp 0x40a56a
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
cmp eax, 0x20
je 0x40a458
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040ac63
add esp, 4
mov dword [ebp - 0xd0], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xd0]
jmp 0x40a56a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.0040ac24
add esp, 4
mov dword [ebp - 0xd4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xd4]
jmp 0x40a56a
push 1
call fcn.0040bec0
add esp, 4
mov dword [ebp - 0xd8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xd8]
jmp 0x40a56a
push 0
call fcn.0040bec0
add esp, 4
mov dword [ebp - 0xdc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xdc]
jmp 0x40a56a
push 0
call fcn.0040ac24
add esp, 4
mov dword [ebp - 0xe0], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xe0]
jmp 0x40a56a
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x40a543
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xe4]
jmp 0x40a56a
jmp 0x40a397
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10