joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407aa7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x485008]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
push edi
lea eax, [esp + 0x18]
mov edi, 0x202
push eax
push edi
mov esi, edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x407b04
push 0
push 0x4700b8
push str.error_WSAStartup
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x1ac]
pop edi
pop esi
xor ecx, esp
call fcn.00445b7e
mov esp, ebp
pop ebp
ret
cmp word [esp + 0x18], di
je 0x407b1f
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
push 0x4700d4
push str.error_WSAStartup_version
jmp 0x407ae6
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x407aee
mov eax, dword [eax + 0xc]
push 2
pop edi
push 0xb972
mov esi, dword [eax]
mov esi, dword [esi]
mov word [esp + 0xc], di
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0xe], ax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 6
push 1
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407b7e
push 0
push str.error
push str.INVALID_SOCKET
jmp 0x407ae6
push 0x10
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x407aee
mov eax, esi
jmp 0x407af0

Function at 0x407b9c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
push ebx
push dword [ebp + 8]
mov esi, 0x200
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.0040143a
lea ecx, [ebp - 0x204]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407bd9
sub ecx, edx
test ecx, ecx
jle 0x407c09
dec ecx
jmp 0x407bff
test ecx, ecx
js 0x407c09
mov eax, ecx
dec ecx
cmp eax, esi
jae 0x407cbd
mov byte [ebp + eax - 0x204], bl
cmp byte [ebp + ecx - 0x204], 0x20
je 0x407be9
lea eax, [ebp - 0x204]
push eax
push str._n__s
call fcn.004013df
mov al, byte [ebp - 0x204]
pop ecx
pop ecx
test al, al
je 0x407caf
cmp al, 0x2f
jne 0x407c69
push 0x44
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00447370
lea eax, [ebp - 0x204]
mov word [ebp - 0x248], 0xd44
push eax
push 0x40
pop edx
lea ecx, [ebp - 0x244]
call fcn.004014cb
add esp, 0x10
lea eax, [ebp - 0x248]
push ebx
push 0x44
jmp 0x407ca2
push 0x62
lea eax, [ebp - 0x266]
push ebx
push eax
call fcn.00447370
lea eax, [ebp - 0x204]
mov word [ebp - 0x268], 0x2764
push eax
push 0x60
pop edx
lea ecx, [ebp - 0x264]
call fcn.004014cb
add esp, 0x10
lea eax, [ebp - 0x268]
push ebx
push 0x64
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
call fcn.00445cb0
int3
Function at 0x407cc3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x200
lea eax, [ebp - 0x204]
push esi
xor edi, edi
push edi
push eax
call fcn.00447370
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.0040143a
push 0x82
lea eax, [ebp - 0x286]
push edi
push eax
call fcn.00447370
movzx ecx, byte [ebp - 0x285]
mov esi, 0x80
movzx eax, byte [ebp + 8]
mov edx, esi
cmp byte [0x7e6be0], 0
push str.3Lazy__8
cmovne ecx, eax
mov word [ebp - 0x288], 0x2884
mov byte [ebp - 0x285], cl
lea ecx, [ebp - 0x284]
call fcn.004014cb
lea ecx, [ebp - 0x284]
add esp, 0x30
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407d5b
sub ecx, edx
lea eax, [ebp - 0x204]
push eax
sub esi, ecx
lea eax, [ebp - 0x284]
add ecx, eax
mov edx, esi
call fcn.004014cb
pop ecx
push edi
push 0x84
lea eax, [ebp - 0x288]
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00445b7e
leave
ret
Function at 0x40807f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x104], eax
cmp eax, 0xef
jg 0x40823a
test eax, eax
js 0x40823a
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x1c]
test esi, esi
jne 0x4080c7
test ebx, ebx
jne 0x408238
jmp 0x4080cf
test ebx, ebx
je 0x408238
push edi
imul edi, eax, 0x12c
push ecx
push 0x20
pop edx
lea ecx, [edi + 0x7efca4]
mov dword [edi + 0x7efba0], 1
call fcn.004014cb
push 0xfc
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.00447370
add esp, 0x10
lea eax, [ebp + 0x28]
push eax
push ecx
push dword [ebp + 0x24]
lea ecx, [ebp - 0xf4]
call fcn.0040140b
lea eax, [ebp - 0xf4]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408124
sub eax, edx
mov word [ebp - 0xff], 0x12d
cdq
push 4
pop ecx
idiv ecx
test edx, edx
mov edx, 0x80
setne cl
add al, 3
add cl, al
mov eax, dword [ebp - 0x104]
shl cl, 2
mov byte [ebp - 0x100], cl
mov ecx, dword [ebp + 0x10]
test ecx, 0x200
mov byte [ebp - 0xfc], al
movzx eax, byte [ebp - 0xfb]
cmovne eax, edx
mov byte [ebp - 0xfa], cl
mov byte [ebp - 0xfb], al
test ecx, 0x800
jne 0x4081c7
test cl, 8
jne 0x408193
test ecx, 0x100
je 0x4081c7
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
call fcn.0040879f
pop ecx
pop ecx
test eax, eax
je 0x4081c7
mov al, byte [ebp - 0xfa]
mov cl, al
and cl, 0x10
je 0x4081bb
test al, 0x20
je 0x4081bb
xor al, 0x20
jmp 0x4081c1
test cl, cl
je 0x4081c7
xor al, 0x30
mov byte [ebp - 0xfa], al
mov eax, dword [ebp + 0x14]
lea edi, [edi + 0x7efba8]
mov byte [ebp - 0xf8], al
lea edx, [ebp - 0x100]
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov byte [ebp - 0xf7], al
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 0xf6], al
mov byte [ebp - 0xf5], bl
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4]
jne 0x408206
inc ecx
cmp ecx, 0x3f
jne 0x4081f6
jmp 0x408237
cmp dword [0x7ef514], 0
jne 0x40822c
movzx eax, byte [ebp - 0x100]
push 0
push eax
lea eax, [ebp - 0x100]
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
push 0x3f
pop ecx
lea esi, [ebp - 0x100]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445b7e
leave
ret
Function at 0x408246
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x1f4], eax
test edi, edi
jne 0x40827f
test ebx, ebx
jne 0x408449
jmp 0x408287
test ebx, ebx
je 0x408449
imul eax, eax, 0x12c
push ecx
push 0x20
pop edx
mov dword [ebp - 0x1f8], eax
lea ecx, [eax + 0x7efca4]
mov dword [eax + 0x7efba0], 1
call fcn.004014cb
push 0xfc
lea eax, [ebp - 0x1f0]
push 0
push eax
call fcn.00447370
push esi
mov edx, 0xef
lea ecx, [ebp - 0x1e3]
call fcn.004014cb
lea eax, [ebp + 0x30]
push eax
push 0
push dword [ebp + 0x2c]
lea eax, [ebp - 0xf4]
push 0xf0
push eax
call fcn.0040143a
add esp, 0x28
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4082f0
sub esi, ecx
lea eax, [ebp - 0xf4]
mov edx, 0xee
lea ecx, [ebp - 0x1e2]
push eax
sub edx, esi
add ecx, esi
call fcn.004014cb
pop ecx
lea ecx, [ebp - 0xf4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40831e
sub ecx, edx
mov word [ebp - 0x1ef], 0x12d
push 4
lea eax, [ecx + 2]
add eax, esi
cdq
pop ecx
idiv ecx
test edx, edx
mov edx, 0x80
setne cl
add al, 3
add cl, al
mov eax, dword [ebp - 0x1f4]
shl cl, 2
mov byte [ebp - 0x1f0], cl
mov ecx, dword [ebp + 0x10]
shr ecx, 7
not cl
mov byte [ebp - 0x1ec], al
mov al, byte [ebp + 0x24]
and cl, 8
or cl, byte [ebp + 0x10]
test dword [ebp + 0x10], 0x200
mov byte [ebp - 0x1e9], al
movzx eax, byte [ebp - 0x1eb]
cmovne eax, edx
mov byte [ebp - 0x1ea], cl
mov byte [ebp - 0x1eb], al
test cl, 8
je 0x4083d3
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push ebx
push edi
call fcn.0040879f
pop ecx
pop ecx
test eax, eax
je 0x4083d3
mov al, byte [ebp - 0x1ea]
mov cl, al
and cl, 0x10
je 0x4083bf
test al, 0x20
je 0x4083bf
xor al, 0x20
jmp 0x4083cd
test cl, cl
jne 0x4083cb
test al, 0x20
jne 0x4083cb
xor al, 0x10
jmp 0x4083cd
xor al, 0x30
mov byte [ebp - 0x1ea], al
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x1f0]
mov byte [ebp - 0x1e8], al
xor ecx, ecx
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x1e7], al
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 0x1e6], al
mov eax, dword [ebp - 0x1f8]
mov byte [ebp - 0x1e5], bl
lea edi, [eax + 0x7efba8]
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4]
jne 0x408418
inc ecx
cmp ecx, 0x3f
jne 0x408408
jmp 0x408449
cmp dword [0x7ef514], 0
jne 0x40843e
movzx eax, byte [ebp - 0x1f0]
push 0
push eax
lea eax, [ebp - 0x1f0]
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
push 0x3f
pop ecx
lea esi, [ebp - 0x1f0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445b7e
leave
ret
Function at 0x408458
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x7ef514], 0
push esi
je 0x4084b7
xorps xmm0, xmm0
xor eax, eax
movlpd qword [ebp - 0xc], xmm0
mov esi, 0x7efba0
mov word [ebp - 0xc], 0x2a08
mov byte [ebp - 9], 0
mov dword [ebp - 4], eax
cmp dword [esi], 0
je 0x4084a3
push 0
mov byte [ebp - 7], al
lea eax, [ebp - 0xc]
push 8
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
inc eax
add esi, 0x12c
mov dword [ebp - 4], eax
cmp esi, 0x8014e0
jl 0x408484
jmp 0x4084e3
mov esi, 0x7efba8
cmp dword [esi - 8], 0
je 0x4084d5
movzx eax, byte [esi]
push 0
push eax
push esi
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
add esi, 0x12c
cmp esi, 0x8014e8
jl 0x4084bc
pop esi
leave
ret

Function at 0x4084e6
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, ecx, 0x12c
push ebx
push esi
xor ebx, ebx
lea esi, [eax + 0x7efba0]
cmp dword [esi], ebx
je 0x40853d
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
mov word [ebp - 8], 0x2a08
mov byte [ebp - 5], bl
mov byte [ebp - 3], cl
cmp dword [0x7ef514], ebx
jne 0x40852e
push ebx
push 8
lea eax, [ebp - 8]
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
push 0x12c
push ebx
push esi
call fcn.00447370
add esp, 0xc
pop esi
pop ebx
leave
ret

Function at 0x408541
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov dword [ebp - 4], edx
mov ebx, ecx
mov edx, 0x470160
mov ecx, 0x48bfcc
call fcn.00405997
mov ecx, eax
mov eax, dword [ebp - 4]
cmp ebx, eax
jg 0x40860e
push esi
push edi
test ecx, ecx
je 0x4085dd
cmp dword [0x7ef514], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0xc], 0x2a08
mov byte [ebp - 9], 0
mov byte [ebp - 7], bl
mov byte [ebp - 6], al
jne 0x4085a7
push 0
push 8
lea eax, [ebp - 0xc]
push eax
push dword [0x49123c]
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp - 4]
imul esi, ebx, 0x12c
mov edi, 0x12c
add esi, 0x7efba0
cmp esi, 0x8014e0
jge 0x40860c
cmp dword [esi], 0
je 0x4085d4
push edi
push 0
push esi
call fcn.00447370
mov eax, dword [ebp - 4]
add esp, 0xc
inc ebx
add esi, edi
cmp ebx, eax
jle 0x4085b8
jmp 0x40860c
imul esi, ebx, 0x12c
mov edi, 0x12c
add esi, 0x7efba0
cmp esi, 0x8014e0
jge 0x40860c
cmp dword [esi], 0
je 0x408605
mov ecx, ebx
call fcn.004084e6
mov eax, dword [ebp - 4]
inc ebx
add esi, edi
cmp ebx, eax
jle 0x4085ee
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409fda
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x47038c
call esi
test eax, eax
jne 0x40a016
push eax
push 0x47039c
push str.d3dx9_43.dll_was_not_found_on_your_computer._nTry_reinstalling_DirectX9_runtime._Cannot_start_Overlay.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40a0e0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 0x801dc0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40a03e
push eax
push 0x470438
push str.LFSLazyOverlay.dll_not_found
jmp 0x40a0ce
push ebx
call esi
mov esi, eax
test esi, esi
jne 0x40a071
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.Cannot_load_library._Error_code__x
push eax
call fcn.00401468
add esp, 0xc
lea eax, [ebp - 0x84]
push esi
push 0x470468
push eax
jmp 0x40a0ce
push 0x470478
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x40a090
push eax
push 0x470488
push str.Procudure_not_found_in_library
jmp 0x40a0ce
cmp dword [0x6b82d4], 0
je 0x40a0d8
call fcn.00403778
test eax, eax
jne 0x40a0af
push eax
push 0x4704b8
push str.Could_not_get_thread_ID
jmp 0x40a0ce
push eax
push esi
push ebx
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x49140c], eax
test eax, eax
jne 0x40a0d8
push eax
push str.LFSLazy_Overlay
push str.Cannot_hook_dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40a0df
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00445b7e
leave
ret

Function at 0x40a0ed
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x485008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11
push 2
pop esi
push esi
push esi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x801ec4], eax
mov eax, dword [0x7e6bf0]
mov word [ebp - 0x98], si
xor esi, esi
inc eax
mov dword [ebp - 0x94], esi
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x96], ax
lea eax, [ebp - 0x98]
push 0x10
push eax
push dword [0x801ec4]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x40a192
mov eax, dword [0x7e6bf0]
inc eax
push eax
lea eax, [ebp - 0x88]
push str.Cannot_bind__d_UDP_port__nUsed_UDP_port_is_always_InSim_port__1
push eax
call fcn.00401468
add esp, 0xc
lea eax, [ebp - 0x88]
push esi
push 0x46e060
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.00433737
xor ecx, ecx
inc ecx
call fcn.00417e3a
call fcn.004024bf
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00445b7e
leave
ret
Function at 0x40bfd6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a16e8]
sub esp, 0x1c
sub eax, dword [0x4a16e0]
je 0x40c1e3
mov ecx, dword [0x4a16e4]
sub ecx, dword [0x4a16dc]
je 0x40c1e3
movss xmm2, dword [0x7e69b4]
mulss xmm2, dword [0x47d2d0]
push ebx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
push esi
push edi
mulss xmm2, dword [0x47d2e0]
movaps xmm1, xmm2
divss xmm1, xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov cl, byte [0x6b80b0]
cvttss2si esi, xmm1
movaps xmm1, xmm2
divss xmm1, xmm0
cvttss2si edi, xmm1
test cl, cl
je 0x40c081
mov eax, dword [0x4a16d8]
movaps xmm1, xmm2
sub eax, dword [0x4a16d0]
movd xmm0, eax
mov eax, dword [0x4a16d4]
sub eax, dword [0x4a16cc]
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvttss2si esi, xmm1
divss xmm2, xmm0
cvttss2si edi, xmm2
jmp 0x40c0be
mov eax, esi
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sar ecx, 1
sub eax, edx
movzx edx, byte [0x7e6499]
mov ebx, eax
mov dword [ebp - 4], ecx
sub edx, ecx
movzx ecx, byte [0x7e68ad]
sar ebx, 1
push esi
push edi
sub ecx, ebx
mov dword [ebp - 8], ebx
call fcn.0040879f
pop ecx
pop ecx
test eax, eax
jne 0x40c102
mov cl, byte [0x6b80b0]
cmp cl, 1
jne 0x40c1e0
mov eax, esi
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sar ecx, 1
sub eax, edx
movzx edx, byte [0x7e6499]
mov ebx, eax
mov dword [ebp - 4], ecx
sub edx, ecx
movzx ecx, byte [0x7e68ad]
sar ebx, 1
push esi
push edi
sub ecx, ebx
mov dword [ebp - 8], ebx
call fcn.00408e56
pop ecx
pop ecx
test eax, eax
je 0x40c1e0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test al, al
jns 0x40c1e0
xor ecx, ecx
inc ecx
call fcn.0040cb9e
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x1c], esi
call fcn.0040cb9e
mov dword [ebp - 0x14], eax
movzx eax, byte [0x7e68ad]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x7e6499]
mov dword [ebp - 0x10], eax
jmp 0x40c1d3
push 1
call edi
test al, al
jns 0x40c1e0
xor ecx, ecx
inc ecx
call fcn.0040cb9e
mov ecx, dword [ebp - 0xc]
sub ecx, esi
lea esi, [eax + ecx]
xor ecx, ecx
call fcn.0040cb9e
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, esi
sub eax, ebx
mov eax, ecx
cmovns ebx, esi
sub eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmovns eax, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov al, 0xc8
sub al, cl
push 5
lea edx, [ebx + ecx]
movzx ecx, al
cmp edx, 0xc8
movzx eax, bl
mov ebx, dword [ebp - 0x18]
cmovle ecx, eax
mov al, 0xc8
mov byte [0x7e68ad], cl
mov ecx, dword [ebp - 4]
sub al, cl
lea edx, [ebx + ecx]
movzx ecx, al
cmp edx, 0xc8
movzx eax, bl
cmovle ecx, eax
mov byte [0x7e6499], cl
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x1c]
cmp byte [0x6b807a], 0
jne 0x40c144
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c1e5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x29
pop ecx
call fcn.00408757
test eax, eax
je 0x40c2c2
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c2c2
xor ecx, ecx
push ebx
push esi
inc ecx
call fcn.0040cb9e
xor ecx, ecx
mov ebx, eax
call fcn.0040cb9e
movzx esi, byte [0x7e6be6]
mov dword [ebp - 8], eax
movzx eax, byte [0x7e69b0]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
jmp 0x40c2b3
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c2c0
xor ecx, ecx
inc ecx
call fcn.0040cb9e
sub esi, ebx
xor ecx, ecx
add esi, eax
call fcn.0040cb9e
mov ecx, dword [ebp - 4]
xor edx, edx
sub ecx, dword [ebp - 8]
add eax, ecx
test esi, esi
cmovns edx, esi
movzx esi, byte [0x7f2bbe]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
lea eax, [edx + esi]
cmp eax, 0xc8
jle 0x40c284
mov edx, 0xc8
sub edx, esi
movzx esi, byte [0x7f2bbf]
lea eax, [ecx + esi]
cmp eax, 0xc8
jle 0x40c29c
mov ecx, 0xc8
sub ecx, esi
push 5
mov byte [0x7e6be6], dl
mov byte [0x7e69b0], cl
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xc]
cmp byte [0x6b807a], 0
jne 0x40c237
pop esi
pop ebx
leave
ret

Function at 0x40c2c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x32
pop ecx
call fcn.00408757
test eax, eax
je 0x40c3a1
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c3a1
xor ecx, ecx
push ebx
push esi
inc ecx
call fcn.0040cb9e
xor ecx, ecx
mov ebx, eax
call fcn.0040cb9e
movzx esi, byte [0x7e6491]
mov dword [ebp - 8], eax
movzx eax, byte [0x7e68a7]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
jmp 0x40c392
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c39f
xor ecx, ecx
inc ecx
call fcn.0040cb9e
sub esi, ebx
xor ecx, ecx
add esi, eax
call fcn.0040cb9e
mov ecx, dword [ebp - 4]
xor edx, edx
sub ecx, dword [ebp - 8]
add eax, ecx
test esi, esi
cmovns edx, esi
movzx esi, byte [0x7f364a]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
lea eax, [edx + esi]
cmp eax, 0xc8
jle 0x40c363
mov edx, 0xc8
sub edx, esi
movzx esi, byte [0x7f364b]
lea eax, [ecx + esi]
cmp eax, 0xc8
jle 0x40c37b
mov ecx, 0xc8
sub ecx, esi
push 5
mov byte [0x7e6491], dl
mov byte [0x7e68a7], cl
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xc]
cmp byte [0x6b807a], 0
jne 0x40c316
pop esi
pop ebx
leave
ret
Function at 0x40c3a3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
inc ebx
cmp byte [0x6b80b0], 0
jne 0x40c3e4
mov ecx, ebx
call fcn.00408757
test eax, eax
jne 0x40c40a
xor ecx, ecx
call fcn.00408757
test eax, eax
jne 0x40c40a
push 2
pop ecx
call fcn.00408757
test eax, eax
jne 0x40c40a
cmp byte [0x6b80b0], al
je 0x40c4b7
mov ecx, ebx
call fcn.00408f0a
test eax, eax
jne 0x40c40a
xor ecx, ecx
call fcn.00408f0a
test eax, eax
jne 0x40c40a
push 2
pop ecx
call fcn.00408f0a
test eax, eax
je 0x40c4b7
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c4b7
push esi
mov ecx, ebx
call fcn.0040cb9e
xor ecx, ecx
mov ebx, eax
call fcn.0040cb9e
movzx esi, byte [0x7e68a4]
mov dword [ebp - 8], eax
movzx eax, byte [0x7e69b1]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
jmp 0x40c4ad
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40c4b6
xor ecx, ecx
inc ecx
call fcn.0040cb9e
sub esi, ebx
xor ecx, ecx
add esi, eax
call fcn.0040cb9e
mov ecx, dword [ebp - 4]
xor edx, edx
sub ecx, dword [ebp - 8]
add eax, ecx
test esi, esi
push 5
cmovns edx, esi
xor ecx, ecx
test eax, eax
mov esi, 0xaa
cmovns ecx, eax
lea eax, [edx + 0x1e]
cmp eax, 0xc8
cmovg edx, esi
lea eax, [ecx + 0x14]
add esi, 0xa
mov byte [0x7e68a4], dl
cmp eax, 0xc8
cmovg ecx, esi
mov byte [0x7e69b1], cl
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xc]
cmp byte [0x6b807a], 0
jne 0x40c443
pop esi
pop ebx
leave
ret

Function at 0x40cb9e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x6b807a], 0
push esi
mov esi, ecx
je 0x40cc06
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x40cc06
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x6b80b0], 0
mov eax, 0x4a16dc
mov edx, 0x4a16cc
cmove edx, eax
test esi, esi
je 0x40cbf2
mov eax, dword [ebp - 8]
sub eax, dword [edx]
mov ecx, dword [edx + 8]
imul eax, eax, 0xc8
sub ecx, dword [edx]
cdq
idiv ecx
jmp 0x40cc08
mov eax, dword [ebp - 4]
sub eax, dword [edx + 4]
mov ecx, dword [edx + 0xc]
imul eax, eax, 0xc8
sub ecx, dword [edx + 4]
jmp 0x40cbed
xor eax, eax
pop esi
leave
ret
Function at 0x40eabd
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push 1
push 0
push 0
push dword [0x801940]
mov edi, ecx
mov dword [0x801934], edi
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
test edi, edi
sete al
push eax
push dword [0x801948]
call dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
mov esi, 0x3d61
cmp edi, 1
sete bl
push ebx
push esi
push dword [0x801940]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc esi
cmp esi, 0x3d71
jl 0x40eafb
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp edi, 2
sete al
push eax
push dword [0x80193c]
call ebx
xor eax, eax
cmp edi, 3
sete al
push eax
push dword [0x801938]
call ebx
xor eax, eax
cmp edi, 4
sete al
push eax
push dword [0x801930]
call ebx
xor eax, eax
cmp edi, 5
sete al
push eax
push dword [0x80194c]
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
test edi, edi
setne al
push eax
push 0x3d54
push dword [0x801940]
call ebx
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
xor eax, eax
cmp edi, 1
setne al
push eax
push 0x3d57
push dword [0x801940]
call ebx
push eax
call esi
xor eax, eax
cmp edi, 2
setne al
push eax
push 0x3d58
push dword [0x801940]
call ebx
push eax
call esi
xor eax, eax
cmp edi, 3
setne al
push eax
push 0x3d5a
push dword [0x801940]
call ebx
push eax
call esi
xor eax, eax
cmp edi, 4
setne al
push eax
push 0x3d5c
push dword [0x801940]
call ebx
push eax
call esi
xor eax, eax
cmp edi, 5
setne al
push eax
push 0x3d5e
push dword [0x801940]
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
ret