joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e9d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x1634]
mov dword [ebp - 0x1680], ecx
cmp dword [ebp - 0x1680], 0
jne 0x406e77
push ebx
push edx
add esp, 4
or ebx, 0x3364
add byte [eax], al
pop ebx
push edx
and edx, 0x1104b
xor edx, 0x55cd
and edx, 0x22c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x124fc
add ebx, 0x1613b
pop ebx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x768], edx
jmp 0x406edf
push eax
push edx
add esp, 4
and eax, 0x1088e
or eax, 0x3915
and eax, 0xef7b
pop eax
push edx
call 0x406e9d
add byte [ebp + 0x3a], al
xor cl, byte [edx + edi + 0x42]
xor al, 0x83
les eax, [edx + ebx*2]
push esi
or esi, 0x4d44
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x406ed5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x406ca0
mov dword [ebp - 0x768], 0
push edi
push edx
add esp, 4
add edi, 0x3481
call 0x406ef6
add byte [esi + 0x3a], cl
inc edx
xor eax, 0xc483503f
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x4c], al
dec edx
dec ebx
aaa
aas
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv esp
or al, byte [eax]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff898
add byte [ebp + 0x41], dh
push ecx
push esi
add esp, 4
sub ecx, 0xe702
jmp 0x415627
pop ecx
push eax
add eax, 0xe408
jmp 0x406f33
or eax, 0xbc21
add eax, 0x1165b
pop eax
push edx
push edi
add esp, 4
and edx, 0x14516
pop edx
mov dword [ebp - 0xac0], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
Function at 0x406ef6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x1634]
mov dword [ebp - 0x1680], ecx
cmp dword [ebp - 0x1680], 0
jne 0x406e77
push ebx
push edx
add esp, 4
or ebx, 0x3364
add byte [eax], al
pop ebx
push edx
and edx, 0x1104b
xor edx, 0x55cd
and edx, 0x22c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x124fc
add ebx, 0x1613b
pop ebx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x768], edx
jmp 0x406edf
push eax
push edx
add esp, 4
and eax, 0x1088e
or eax, 0x3915
and eax, 0xef7b
pop eax
push edx
call 0x406e9d
add byte [ebp + 0x3a], al
xor cl, byte [edx + edi + 0x42]
xor al, 0x83
les eax, [edx + ebx*2]
push esi
or esi, 0x4d44
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x406ed5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x406ca0
mov dword [ebp - 0x768], 0
push edi
push edx
add esp, 4
add edi, 0x3481
call 0x406ef6
add byte [esi + 0x3a], cl
inc edx
xor eax, 0xc483503f
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x4c], al
dec edx
dec ebx
aaa
aas
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv esp
or al, byte [eax]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff898
add byte [ebp + 0x41], dh
push ecx
push esi
add esp, 4
sub ecx, 0xe702
jmp 0x415627
pop ecx
push eax
add eax, 0xe408
jmp 0x406f33
or eax, 0xbc21
add eax, 0x1165b
pop eax
push edx
push edi
add esp, 4
and edx, 0x14516
pop edx
mov dword [ebp - 0xac0], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
Function at 0x406f07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x1634]
mov dword [ebp - 0x1680], ecx
cmp dword [ebp - 0x1680], 0
jne 0x406e77
push ebx
push edx
add esp, 4
or ebx, 0x3364
add byte [eax], al
pop ebx
push edx
and edx, 0x1104b
xor edx, 0x55cd
and edx, 0x22c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x124fc
add ebx, 0x1613b
pop ebx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x768], edx
jmp 0x406edf
push eax
push edx
add esp, 4
and eax, 0x1088e
or eax, 0x3915
and eax, 0xef7b
pop eax
push edx
call 0x406e9d
add byte [ebp + 0x3a], al
xor cl, byte [edx + edi + 0x42]
xor al, 0x83
les eax, [edx + ebx*2]
push esi
or esi, 0x4d44
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x406ed5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x406ca0
mov dword [ebp - 0x768], 0
push edi
push edx
add esp, 4
add edi, 0x3481
call 0x406ef6
add byte [esi + 0x3a], cl
inc edx
xor eax, 0xc483503f
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x4c], al
dec edx
dec ebx
aaa
aas
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv esp
or al, byte [eax]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff898
add byte [ebp + 0x41], dh
push ecx
push esi
add esp, 4
sub ecx, 0xe702
jmp 0x415627
pop ecx
push eax
add eax, 0xe408
jmp 0x406f33
or eax, 0xbc21
add eax, 0x1165b
pop eax
push edx
push edi
add esp, 4
and edx, 0x14516
pop edx
mov dword [ebp - 0xac0], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al

Function at 0x407080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
push ecx
sbb al, 0x89
xchg ebp, eax
adc dh, ah
invalid
Function at 0x4072e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fiadd word [eax]
add byte [ecx + 0x134e9ef], al
add byte [ecx + 0xd71cc7], al
add byte [edi + 0x57], bl

Function at 0x4073c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0x4535434f
dec edx
pop eax
push esi
push eax
add esp, 4
xor esi, 0x13c61
pop esi
cmp dword [ebp - 0x2d0], 0
jne 0x407398
mov eax, 0x6b
mov word [ebp - 0x17dc], ax
mov ecx, 0x65
mov word [ebp - 0x17da], cx
mov edx, 0x72
mov word [ebp - 0x17d8], dx
mov eax, 0x6e
mov word [ebp - 0x17d6], ax
push eax
or eax, 0xd502
add eax, 0x12412
pop eax
push edx
push esi
add esp, 4
sub edx, 0x910
xor edx, 0x1807b
pop edx
push edx
push ecx
add esp, 4
or edx, 0xe8ce
call 0xf2c173c5
and byte [ebx], bh
add byte [eax], al
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a00], ecx
mov edx, dword [ebp - 0x1a00]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1a04], eax
mov ecx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1694], ecx
call dword [eax + 0x50]
add esp, 4
and eax, 0xf608
call 0x40740c
add byte [edi + 0x47], al
cmp dl, byte [eax + 0x40]
dec ebx
dec ebp
cmp al, 0x32
add esp, 4
or eax, 0x31ff
pop eax
push edi
and edi, 0xe8b7
xor edi, 0xe1cc
loope 0x407422
add byte [edi - 0x7d], bl
mov ebp, 0xffffe96c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2d0], 0
jmp 0x4076e3
invalid
xchg ebp, eax
insb byte es:[edi], dx
invalid

Function at 0x40740c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0x4535434f
dec edx
pop eax
push esi
push eax
add esp, 4
xor esi, 0x13c61
pop esi
cmp dword [ebp - 0x2d0], 0
jne 0x407398
mov eax, 0x6b
mov word [ebp - 0x17dc], ax
mov ecx, 0x65
mov word [ebp - 0x17da], cx
mov edx, 0x72
mov word [ebp - 0x17d8], dx
mov eax, 0x6e
mov word [ebp - 0x17d6], ax
push eax
or eax, 0xd502
add eax, 0x12412
pop eax
push edx
push esi
add esp, 4
sub edx, 0x910
xor edx, 0x1807b
pop edx
push edx
push ecx
add esp, 4
or edx, 0xe8ce
call 0xf2c173c5
and byte [ebx], bh
add byte [eax], al
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a00], ecx
mov edx, dword [ebp - 0x1a00]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1a04], eax
mov ecx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1694], ecx
call dword [eax + 0x50]
add esp, 4
and eax, 0xf608
call 0x40740c
add byte [edi + 0x47], al
cmp dl, byte [eax + 0x40]
dec ebx
dec ebp
cmp al, 0x32
add esp, 4
or eax, 0x31ff
pop eax
push edi
and edi, 0xe8b7
xor edi, 0xe1cc
loope 0x407422
add byte [edi - 0x7d], bl
mov ebp, 0xffffe96c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2d0], 0
jmp 0x4076e3
invalid
xchg ebp, eax
insb byte es:[edi], dx
invalid
Function at 0x407420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0x4535434f
dec edx
pop eax
push esi
push eax
add esp, 4
xor esi, 0x13c61
pop esi
cmp dword [ebp - 0x2d0], 0
jne 0x407398
mov eax, 0x6b
mov word [ebp - 0x17dc], ax
mov ecx, 0x65
mov word [ebp - 0x17da], cx
mov edx, 0x72
mov word [ebp - 0x17d8], dx
mov eax, 0x6e
mov word [ebp - 0x17d6], ax
push eax
or eax, 0xd502
add eax, 0x12412
pop eax
push edx
push esi
add esp, 4
sub edx, 0x910
xor edx, 0x1807b
pop edx
push edx
push ecx
add esp, 4
or edx, 0xe8ce
call 0xf2c173c5
and byte [ebx], bh
add byte [eax], al
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a00], ecx
mov edx, dword [ebp - 0x1a00]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1a04], eax
mov ecx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1694], ecx
call dword [eax + 0x50]
add esp, 4
and eax, 0xf608
call 0x40740c
add byte [edi + 0x47], al
cmp dl, byte [eax + 0x40]
dec ebx
dec ebp
cmp al, 0x32
add esp, 4
or eax, 0x31ff
pop eax
push edi
and edi, 0xe8b7
xor edi, 0xe1cc
loope 0x407422
add byte [edi - 0x7d], bl
mov ebp, 0xffffe96c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2d0], 0
jmp 0x4076e3
invalid
xchg ebp, eax
insb byte es:[edi], dx
invalid
Function at 0x410ad0
Capabilities:
Execute syscall

Disassembly:
add al, 0xb
add eax, 0xe5865505
mov ss, word [eax + 5]
add eax, 0x88565b5d
leave
or dword [esi + 0x657c1eb], eax
add eax, 0x176ed386
add eax, 0x565c6305
mov cl, cl
or ebp, ebp
syscall
add eax, 0x38440505
dec eax
inc edi
inc ebx
inc edi
inc eax
dec eax
cmp cl, byte [eax + 0x696409c9]
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x8e050505
mov dh, byte [ecx - 0x17]
add al, 4
nop
xchg edx, eax
jno 0x410aff
add al, 4
nop
push esi
xor eax, 0xe96d9a8e
add al, 4
nop
mov ch, byte [ebp - 0x17]
add al, 4
mov cs, word [edx + 0x404f245]
pop eax
pop ebx
mov cl, cl
or dword [esi + 0x57d5ad0], eax
add eax, 0xe5865560
jne 0x410b6c
add eax, 0x5b555d05
mov cl, cl
or dword [esi + 0x5e94ef5], eax
add eax, 0x12b1cd86
push es
add eax, 0x885c555d
leave
or dword [esi + 0x638adc5], eax
add eax, 0x45c2885d
add al, 4
add eax, 0x8acc147a
xor dword [edx], eax
add al, 4
add eax, 0xee050505
rol dword [edi], 5
add eax, 0xf2459290
add al, 4
nop
push esi
adc dword [eax - 0x7571eeb9], edx
stc
test byte [esp + eax], 0x5b
pop ebx
mov cl, cl
or ebp, ebp
syscall
add eax, 0x493e0505
push edx
push edx
push ebp
cmp dword [esp + edx*2], edi
push edx
mov cl, cl
or dword [esi + 0x66db1f3], eax
add eax, 0xb0bcb86
push es
add eax, 0xcd865563
mov ch, 0x6b
push es
add eax, 0x5221c586
push es
add eax, 0xf9c2885d
test byte [esp + eax], 5
jp 0x410bd8
int3
add al, 0x8e
xchg edx, eax
loope 0x410bdd
add al, 4
pop esp
pop eax
mov cl, cl
or dword [esi + 0x63533f4], eax
add eax, 0x6249fc86
add eax, 0x5b5c6405
mov cl, cl
or ebp, ebp
syscall
add eax, 0x3d4b0505
cmp eax, dword [esi + 0x3b]
cmp edx, dword [ecx + 0x46]
dec ecx
mov cl, cl
or dword [esp + ebx*2 - 0x7a], esp
aam 0
pop ebx
add eax, 0x9a926405
dec ebp
add al, 4
mov ds, word [edx + 0x404f6fd]
nop
mov ah, cl
add byte [esp + eax], al
nop
dec ebp
xor eax, 0xf601928e
add al, 4
cmp bh, dl
imul ecx, dword [esi + 0x402799a], 4
cmp ch, al
imul ecx, dword [esi + 0x403fd8a], 4
push esi
push ebp
mov cl, cl
or eax, esi
or dword [ebp + 0x48], ecx
cmp eax, 0x58565e55
mov cl, cl
or dword [esi + 0x5ed80c6], eax
add eax, 0xd3865b5e
ret 0x538
Function at 0x427c80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5af674
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x615370]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
xor ebx, ebx
mov dword [edi], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea esi, [edi + 0x10]
push esi
mov byte [esp + 0x30], 3
call fcn.00428c80
mov byte [esp + 0x2c], 4
mov eax, dword [edi]
cmp eax, ebx
je 0x427cdf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi], ebx
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x427cf1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], eax
cmp dword [esi + 0xc], eax
jbe 0x427d02
call fcn.00588c45
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0x427d11
call fcn.00588c45
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
push ecx
push ebp
push ebx
push eax
lea ebx, [esp + 0x28]
call fcn.00429300
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x42bbf0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7f4
mov eax, dword [0x615370]
xor eax, esp
mov dword [esp + 0x7f0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp dword [esi - 0xcc], 0
push edi
mov dword [esp + 0x10], eax
je 0x42bcdc
mov edi, dword [sym.imp.USER32.dll_GetCapture]
call edi
xor ecx, ecx
push 0x7ce
push ecx
lea edx, [esp + 0x32]
push edx
mov ebx, eax
mov word [esp + 0x34], cx
call fcn.0058e300
add esp, 0xc
push 0x3e7
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
call edi
cmp dword [esi - 0xcc], eax
je 0x42bcf5
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x42bc7d
call edi
xor ecx, ecx
cmp dword [ebx + 0x58], eax
setne cl
mov eax, ecx
test eax, eax
je 0x42bcf5
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x42bcd1
call edi
cmp dword [ebx + 0x58], eax
je 0x42bcd1
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi - 0xcc]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x42bcdc
mov edx, dword [esi + 0x1c]
mov eax, dword [edx + 0x18c]
test eax, eax
je 0x42bcd1
mov dword [esi + 0x68], eax
lea eax, [esi - 0x124]
call fcn.0042be70
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7f0]
xor ecx, esp
call fcn.005886fc
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x74], 0
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
je 0x42bd15
mov eax, dword [esi - 0xcc]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
test eax, eax
je 0x42bcd1
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, 0x201
je 0x42bd54
cmp eax, 0xa1
je 0x42bd54
cmp eax, 0x204
je 0x42bd54
cmp eax, 0xa4
je 0x42bd54
cmp eax, 0x20a
je 0x42bd9f
cmp eax, 0x100
jne 0x42bdaa
mov ecx, dword [esi - 0xcc]
cmp dword [edi + 8], 0x1b
mov dword [edi], ecx
jmp 0x42bd9d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x42bd76
mov edx, dword [eax + 0x58]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42bd76
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x58]
push eax
call ebx
test eax, eax
jne 0x42bdaa
mov edx, dword [esi - 0xcc]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x42bdaa
lea eax, [esi - 0x124]
call fcn.0042be70
mov ecx, dword [esp + 0x7fc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.005886fc
mov esp, ebp
pop ebp
ret 4
Function at 0x42c2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5af590
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x615370]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov eax, dword [0x621148]
mov edx, dword [eax + 0xc]
mov ecx, 0x621148
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x54]
mov byte [esp + 0x44], al
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x58]
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ecx
call fcn.00406500
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x24], edx
cmp ebp, esi
je 0x42c362
cmp esi, ebx
je 0x42c34f
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
cmp ebp, ebx
je 0x42c35c
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push ebp
call eax
mov ebp, esi
mov dword [esp + 0x28], ebp
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
cmp esi, edi
je 0x42c3a4
cmp edi, ebx
je 0x42c392
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push edi
call edx
cmp esi, ebx
je 0x42c39e
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov esi, edi
mov dword [esp + 0x38], esi
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x18]
push edx
add edi, 0x164
call fcn.0042ccd0
mov byte [esp + 0x44], bl
cmp esi, ebx
je 0x42c3c8
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
cmp ebp, ebx
je 0x42c3d5
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push ebp
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c3f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c41d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x24
Function at 0x431050
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5ac8b9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x615370]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
xor esi, esi
push esi
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
shl ebp, 0x10
cmp dword [esp + 0x30], esi
je 0x4310a0
or ebp, 0x1000000
mov edx, dword [0x621148]
mov eax, dword [edx + 0xc]
mov ecx, 0x621148
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 1
mov esi, 0x40
mov eax, dword [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
add esi, esi
sub eax, esi
or eax, ecx
jge 0x4310e7
mov ecx, esi
mov eax, edi
call fcn.00406a80
mov eax, dword [edi]
test esi, esi
jl 0x431150
cmp esi, dword [eax - 8]
jg 0x431150
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + esi*2], dx
lea ecx, [esi + 1]
push ecx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov ebx, eax
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x431122
push ecx
push eax
call fcn.0058a3a5
add esp, 8
test eax, eax
jl 0x431150
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x431150
mov dword [ecx - 0xc], eax
mov edx, dword [edi]
xor ecx, ecx
mov word [edx + eax*2], cx
cmp ebx, esi
je 0x4310c6
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
push 0x80070057
call fcn.00406af0
int3
Function at 0x432c20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x38
push ebx
push ebp
mov ebp, dword [esp + 0x44]
mov eax, dword [ebp + 0x58]
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x432c48
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
xor ebx, ebx
cmp dword [ebp + 0x178], ebx
je 0x432c39
mov esi, dword [ebp + 0x174]
mov ecx, dword [ebp + 0x178]
add ecx, esi
cmp esi, ecx
jbe 0x432c69
call fcn.00588c45
mov edx, dword [ebp + 0x15c]
mov dword [esp + 0x18], esi
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.0051f920
mov esi, eax
mov eax, dword [ebp + 0x178]
mov ecx, 7
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
cmp eax, ebx
je 0x432cc2
inc dword [ebp + 0x174]
mov ecx, dword [ebp + 0x174]
cmp dword [ebp + 0x170], ecx
ja 0x432cb1
mov dword [ebp + 0x174], ebx
dec eax
mov dword [ebp + 0x178], eax
cmp eax, ebx
jne 0x432cc2
mov dword [ebp + 0x174], ebx
mov al, byte [esp + 0x44]
push ebx
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 1
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
sub edx, dword [esp + 0x38]
sub ecx, dword [esp + 0x34]
mov esi, eax
call fcn.0053b4f0
mov ebx, eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp + 0x198]
sub edx, dword [ebp + 0x190]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x194]
sub eax, dword [ebp + 0x18c]
mov byte [esp + 0x4c], 0
mov byte [esp + 0x4d], 0
mov byte [esp + 0x4e], 0xff
mov byte [esp + 0x4f], 1
mov ecx, dword [esp + 0x4c]
push ecx
mov ecx, dword [ebp + 0x184]
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x44]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x4c]
sub edx, eax
push edx
mov edx, dword [esp + 0x58]
sub edx, ecx
push edx
push eax
push ecx
push esi
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x38]
push 2
mov dword [esp + 0x28], ecx
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x34], edx
lea edx, [esp + 0x28]
push edx
mov edx, dword [ebp + 0x58]
push esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
push edx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esp + 0x44], 0
jne 0x432df0
mov ecx, dword [ebp + 0x58]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
mov edx, dword [ebp + 0x58]
push 4
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x38
ret 4
Function at 0x432e10
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
sub esp, 0x1c
mov edi, esp
sub esp, 0x1c
mov ecx, 7
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov edi, esp
mov ecx, 7
lea esi, [esp + 0x48]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00433100
push ebx
call fcn.00432c20
test eax, eax
jl 0x432e5e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xf
call esi
push ebx
call fcn.00432c20
test eax, eax
jge 0x432e50
mov al, byte [ebx + 0x158]
test al, al
je 0x432e97
mov ecx, dword [ebx + 0x17c]
test ecx, ecx
je 0x432e97
cmp dword [ecx + 0x58], 0
je 0x432e97
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x34]
call eax
mov eax, dword [ebx + 0x17c]
call fcn.00410ad0
mov ecx, dword [ebx + 0x58]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x38

Function at 0x434110
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x15c], 0
je 0x434125
mov eax, 0x80004005
pop ebx
ret 4
mov eax, dword [esp + 8]
mov dword [ebx + 0x15c], 1
mov dword [ebx + 0x144], eax
call fcn.004341d0
mov edx, dword [ebx]
mov eax, dword [edx + 0xa8]
push 1
mov ecx, ebx
call eax
cmp dword [ebx + 0x160], 0
jne 0x43416f
push 0
push 0
push ebx
push 0x4340c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x160], eax
xor eax, eax
pop ebx
ret 4
Function at 0x43ed80
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x154]
test eax, eax
je 0x43edc6
cmp dword [esp + 8], 0
jne 0x43eda6
mov eax, dword [eax + 0x58]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0xac]
call eax
test eax, eax
je 0x43edc6
mov ecx, dword [esi + 0x154]
mov edx, dword [ecx + 0x58]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 4