joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e368
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4506f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x419a6e
cmp byte [edi + 0x49], bl
je 0x419a6e
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x419a62
push 8
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0042a540
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], 8
jae 0x4199c2
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x4199da
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x419a03
dec eax
je 0x419a07
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x419a5d
jmp 0x419a69
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x419a17
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x419a40
cmp ebx, 0x10
jae 0x419a26
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0042de27
add esp, 0x10
cmp esi, eax
jne 0x419a5a
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x419a66
test esi, esi
jne 0x4199ce
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040bc90
jmp 0x4199c8
lea ecx, [ebp - 0x2c]
call fcn.00405d60
xor al, al
jmp 0x419a70
lea ecx, [ebp - 0x2c]
call fcn.00405d60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a5ba
mov esp, ebp
pop ebp
ret
Function at 0x426a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x426a6e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x426b4d
mov esi, edx
shr esi, 3
push edi
jmp 0x426a90
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x448208]
add ecx, 8
sub edx, 8
dec esi
jne 0x426a90
pop edi
test edx, edx
je 0x426b6a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x448208]
inc ecx
dec edx
jne 0x426b51
not eax
pop esi
pop ebp
ret

Function at 0x426b70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x448208]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x448208]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x427100
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x4271eb
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x427137
cmp dword [esi + 0x40], edi
jae 0x427137
push eax
call fcn.0042a4d9
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x42714f
lea eax, [edi + edi]
push eax
call fcn.0042b111
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0042a730
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x4271e8
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x448208]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x448208]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x427167
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x42722a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x42720f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0042a730
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x42724c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [0x462f38]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4287e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4289f5
cmp dword [esi + 0x6af90], 3
jb 0x428857
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x428897
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x428897
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x42887f
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00425f60
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x428897
mov edi, eax
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x428974
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00425a30
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x42893e
cmp eax, 3
jb 0x42893e
mov eax, 1
sub edi, eax
lea ecx, [ecx]
add dword [esi + 0x6af84], eax
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub edi, eax
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x4288e0
add dword [esi + 0x6af84], eax
jmp 0x428997
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
xor edi, edi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
jmp 0x428997
movzx edx, byte [ecx + esi + 0x1af70]
push edx
push 0
push esi
call fcn.00425a30
dec dword [esi + 0x6af90]
add esp, 0xc
inc dword [esi + 0x6af84]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x4289d3
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x4289b0
lea ecx, [eax + esi + 0x1af70]
jmp 0x4289b2
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00428650
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4289e8
push esi
call fcn.004260c0
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x428803
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x428a08
lea ecx, [eax + esi + 0x1af70]
jmp 0x428a0a
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.00428650
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423843
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x423852
pop dword [ebp - 0x30]
mov eax, 0x54451286
sub eax, 0x5402da34
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x4e525
push 0
mov eax, 0x1a45529
add eax, 0xfe9f4cdb
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x752730a4
sub ecx, 0x7526ddcf
mov edx, eax
mov edi, 0xfdfbf3a4
add edi, 0x24a305c
add edi, dword [ebp - 0x30]
mov esi, 0xb91ff139
add esi, 0x5a358127
xor dword [ebp - 4], 0xd2c5286c
mov ebx, dword [edi]
add ebx, esi
mov dword [ebp - 8], 0xb4b19a15
mov dword [edx], ebx
xor dword [ebp - 0x28], 0x15afd34d
add edx, 0x58c18dd8
sub edx, 0x58c18dd4
add edi, 4
loop 0x4238b1
add eax, 0x689d454b
sub eax, 0x689c0724
xor ebx, ebx
add ebx, eax
add eax, 0xc29176e1
sub eax, 0xc29176dc
mov ecx, 0xe81fca77
sub ecx, 0xe7dfca77
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x427eaa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4540d0]
jne 0x427eb4
repz ret
jmp fcn.00429e94
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x243b17c1
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x40109d
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0x220]
push eax
push 0x104
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push ebx
call fcn.004013e2
lea edi, [ebx + 0x10]
cmp dword [edi], 0
jne 0x4010e6
push 0xffffffffffffffff
push dword [ebx + 0x18]
mov esi, 0x47bd40
push 1
call fcn.0040fb68
jmp 0x401137
lea eax, [ebp - 2]
push eax
mov al, byte [0x4679c4]
lea esi, [ebx + 0x24]
push edi
mov ecx, 0x47bd40
call fcn.0040fff3
test al, al
jne 0x401110
mov dword [0x4679dc], 1
jmp 0x40126b
mov al, byte [0x47bd40]
mov byte [ebx + 0x14], al
mov al, byte [0x47bd41]
mov byte [ebp - 1], al
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov esi, 0x47bd40
call fcn.0040ffc1
push dword [edi]
lea eax, [ebx + 0x24]
mov dword [ebp - 8], eax
push eax
mov esi, 0x479e08
mov eax, esi
call fcn.004201a0
test eax, eax
je 0x401180
mov edi, 0x47bd40
call fcn.0040fd10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x4679dc], 1
jmp 0x401278
cmp byte [ebp - 1], 1
jne 0x40123e
cmp byte [0x479bbd], 1
jne 0x40123e
call fcn.00416422
test al, al
jne 0x40123e
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
cmp byte [ebp - 2], 0
je 0x401214
mov edi, 0x45bec4
push edi
lea esi, [ebp - 0x14]
call fcn.00416d81
push dword [ebp - 8]
or eax, 0xffffffff
mov ecx, esi
call fcn.00417064
push edi
or eax, 0xffffffff
mov ecx, esi
call fcn.00417064
push 1
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x42c]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x14]
call fcn.0044951c
pop ecx
jmp 0x401261
push 1
lea eax, [ebp - 0x220]
push eax
push dword [0x47bd08]
lea eax, [ebp - 0x42c]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401261
call fcn.0040127d
call fcn.00401371
cmp byte [ebx + 0x14], 0
jne 0x401258
mov ebx, 0x47a6b8
call fcn.00412a78
push 1
mov ecx, esi
call fcn.004203f1
mov edi, 0x47bd40
call fcn.0040fd10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d62
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esi]
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x401d72
xor al, al
jmp 0x401dfe
push ebx
push edi
push 1
push eax
push esi
call fcn.00403196
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401dbf
push 0x25
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401de1
push 0x27
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push dword [esi]
push esi
call fcn.00403196
pop edi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x402347
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebx]
test eax, eax
jne 0x40235a
xor al, al
jmp 0x4023e4
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xb0
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x40237d
xor al, al
jmp 0x4023e3
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
je 0x4023e0
lea eax, [edi + edi + 0x202]
push eax
call fcn.00449614
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x4023d7
mov eax, dword [ebp - 8]
cmp eax, edi
mov esi, dword [ebp - 4]
je 0x4023bd
and word [esi + eax*2], 0
mov eax, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
push dword [ebp + 8]
call fcn.00416e83
push esi
call fcn.0044951c
pop ecx
mov al, 1
jmp 0x4023e2
push dword [ebp - 4]
call fcn.0044951c
pop ecx
xor al, al
pop edi
pop esi
leave
ret 4
Function at 0x402e82
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x402eba
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x402eb3
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x402fcb
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
push ebx
mov ebx, 0x100
je 0x402ef9
push ebx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.00449703
test eax, eax
pop ecx
pop ecx
jne 0x402ef6
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x402f6b
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044985c
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
call fcn.00449827
add esp, 0x10
test eax, eax
jne 0x402f66
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x80c]
push eax
push str._s_u
push eax
call fcn.00449872
push dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.00449703
add esp, 0x18
test eax, eax
jne 0x402f66
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x402fca
inc dword [ebp - 4]
jmp 0x402f6e
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x402fa0
push 0x400
lea eax, [ebp - 0x80c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.00449703
test eax, eax
pop ecx
pop ecx
je 0x402f5f
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x402fbf
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x402fbc
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x402fbc
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
je 0x402f5f
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x4030b4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x4030df
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4030fa
push 1
jmp 0x4030e1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8

Function at 0x403196
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 0xc], 1
jne 0x4031ae
push dword [esp + 8]
call fcn.00403c8c
test al, al
jne 0x4031ca
push 1
jmp 0x4031b0
push 0
push 0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
ret 0xc
Function at 0x403261
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x45bfe0
push dword [ebp + 8]
call fcn.00416e83
mov eax, dword [ebx]
test eax, eax
jne 0x40327c
xor al, al
jmp 0x4032d0
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0
push 0xe
push eax
call esi
mov edi, eax
test edi, edi
je 0x4032cc
lea eax, [edi + edi + 2]
push eax
call fcn.00449614
pop ecx
push eax
inc edi
push edi
push 0xd
push dword [ebx]
mov dword [ebp - 4], eax
call esi
test eax, eax
push dword [ebp - 4]
jg 0x4032bb
call fcn.0044951c
pop ecx
xor al, al
jmp 0x4032ce
push dword [ebp + 8]
call fcn.00416e83
push dword [ebp - 4]
call fcn.0044951c
pop ecx
mov al, 1
pop edi
pop esi
leave
ret 4
Function at 0x403a18
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp byte [edi + 0xb], 0
je 0x403a38
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp byte [edi + 9], 0
push esi
mov esi, 0x400
je 0x403a71
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [edi + 0x48]
lea ecx, [ebp - 0x818]
push ecx
push eax
call fcn.00449703
test eax, eax
pop ecx
pop ecx
jne 0x403a6e
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [edi + 6], 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
je 0x403b07
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call ebx
cmp byte [edi + 0xc], 0
jne 0x403ab0
lea eax, [ebp - 0x818]
push eax
call fcn.0044985c
pop ecx
push eax
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [edi + 0x10]
dec eax
je 0x403ae6
dec eax
je 0x403acf
dec eax
jne 0x403b04
push dword [edi + 0x14]
lea eax, [ebp - 0x818]
push eax
call fcn.00449703
pop ecx
pop ecx
jmp 0x403afd
push dword [edi + 0x14]
lea eax, [ebp - 0x818]
push eax
call fcn.004499ac
test eax, eax
pop ecx
pop ecx
je 0x403b04
jmp 0x403b01
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push eax
lea eax, [ebp - 0x818]
push eax
push ecx
call fcn.00449827
add esp, 0xc
test eax, eax
jne 0x403b04
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [edi + 7], 0
je 0x403b49
push esi
lea eax, [ebp - 0x818]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x818]
push eax
lea esi, [ebp - 0x14]
call fcn.00416d81
lea esi, [edi + 0x2c]
lea eax, [ebp - 0x14]
call fcn.0040f336
push dword [ebp - 0x14]
mov bl, al
call fcn.0044951c
test bl, bl
pop ecx
je 0x403b46
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [edi + 8], 0
pop ebx
je 0x403b6c
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x403b69
push dword [ebp + 8]
mov esi, edi
call fcn.00403bb4
test al, al
je 0x403b69
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [edi + 0xa], 0
je 0x403b8b
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x403b88
inc dword [edi + 0x58]
mov eax, dword [edi + 0x58]
cmp eax, dword [edi + 0x54]
jne 0x403b88
inc dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x403bac
lea eax, [ebp + 8]
push eax
lea esi, [edi + 0x68]
call fcn.00403ccb
inc dword [edi + 0x5c]
xor eax, eax
cmp byte [edi + 4], al
sete al
jmp 0x403baf
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x403bff
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10000
call fcn.0044c510
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x403c1f
cmp byte [esi + 5], 1
jne 0x403c85
and word [ebp - 0x10000], 0
lea eax, [ebp - 0x10000]
push eax
push 0x7fff
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
and word [ebp - 2], 0
test eax, eax
jle 0x403c85
cmp byte [esi + 0xc], 0
jne 0x403c68
lea eax, [ebp - 0x10000]
push eax
call fcn.0044985c
pop ecx
push eax
lea eax, [ebp - 0x10000]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push dword [esi + 0x20]
lea eax, [ebp - 0x10000]
push eax
call fcn.004499ac
test eax, eax
pop ecx
pop ecx
je 0x403c85
mov byte [esi + 0x60], 1
xor eax, eax
jmp 0x403c88
xor eax, eax
inc eax
leave
ret 4