joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b550
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b6fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44b6dc
mov dl, 1
mov eax, dword [0x411940]
call fcn.00403254
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403fbc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44b6cb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043955c
test al, al
je 0x44b6be
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44b70c
lea eax, [ebp - 0x254]
call fcn.00408a8c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44b6be
xor eax, eax
push ebp
push 0x44b6b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44b744
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44b6a0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040422c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44b6a0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040422c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b6be
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44b5c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041541c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b702
lea eax, [ebp - 0x260]
call fcn.00403fbc
ret

Function at 0x44c030
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x452bb0]
cmp byte [eax + 0xa5], 0
jne 0x44c0a1
cmp dword [0x452bc8], 0
jne 0x44c062
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44bfec
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x452bc8], eax
cmp dword [0x452bc4], 0
jne 0x44c07d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x452bc4], eax
cmp dword [0x452bcc], 0
jne 0x44c0a1
push esp
push 0
push 0
push 0x44bf90
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x452bcc], eax
pop edx
ret
Function at 0x44c198
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44c1af
add esp, 0xfffffff0
call fcn.00403590
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041922c
mov eax, dword [0x450f94]
cmp word [eax + 2], 0
jne 0x44c1d7
mov eax, dword [0x450f94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044d870
mov eax, dword [0x45103c]
cmp word [eax + 2], 0
jne 0x44c1f1
mov eax, dword [0x45103c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044da68
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411524]
call fcn.00403254
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411524]
call fcn.00403254
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b408]
call fcn.00421050
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44c378
mov eax, dword [0x450ebc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421420
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44e008
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x450ebc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c0c8
test eax, eax
je 0x44c2e6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408480
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c0f0
test eax, eax
je 0x44c2fa
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040422c
mov eax, dword [0x450dc0]
cmp byte [eax], 0
jne 0x44c32e
mov eax, ebx
call fcn.0044c4a0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044e1e4
mov eax, ebx
call fcn.0044eba8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c36e
call fcn.004035e8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c720
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x452bb0]
cmp dword [eax + 0x30], 0
je 0x44c7ca
cmp dword [ebx + 0x94], 0
jne 0x44c7c4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44c6b0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44c7c4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44c78a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44c7c4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041388c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44c799
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44d32c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44d361
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040ac
jmp 0x44d36e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404010
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44e3c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44e401
mov eax, esi
call fcn.00434cd0
test al, al
je 0x44e401
mov eax, dword [ebx + 0x84]
call fcn.004349cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44e401
push 0
mov eax, dword [ebx + 0x84]
call fcn.004349cc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x402a7e
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [esp + 0x10], esi
jbe 0x402acb
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x58
push 0x41f390
push 0x4766b0
mov byte [edi + esi], al
call fcn.00401374
push eax
call fcn.004019f8
mov al, byte [edi + esi]
add esp, 0xc
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edi + esi], al
inc esi
cmp esi, dword [esp + 0x10]
jb 0x402a8c
pop edi
pop esi
ret

Function at 0x402f68
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x475500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x41f3b0
lea ecx, [ebp - 0x1c]
call fcn.00401af2
push 0xc
call fcn.004065e4
xor esi, esi
pop ecx
test eax, eax
je 0x402fa1
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00401b4b
jmp 0x402fa3
mov eax, esi
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x475038
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push esi
push esi
push esi
push 0x402a6c
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
call fcn.00402a52
mov edx, 0x475038
add edx, 0x188
mov esi, 0x429038
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00402918
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00406622
leave
ret

Function at 0x4071ff
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x40723e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40723e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40723e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40723e
cmp dword [ecx + 0x74], 0xe
jbe 0x40723e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x411ef9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422500
push 0x4224f8
push 0x420d94
push 0x1e
call fcn.00411d66
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411f2d
push dword [ebp + 8]
mov ecx, esi
call dword [0x41f140]
call esi
jmp 0x411f33
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x418094
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418131
push ebx
push esi
call fcn.0041805d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00416ce2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4180de
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418130
push edi
push eax
call fcn.0041224f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4180fe
call fcn.0041189b
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41812f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00416ce2
add esp, 0x20
test eax, eax
jne 0x41811d
push edi
call fcn.0041189b
jmp 0x418125
push ebx
call fcn.0041189b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41dd00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dd2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dd2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401cec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x100]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x401e25
push eax
call fcn.00427432
mov ebx, eax
test ebx, ebx
pop ecx
je 0x401df2
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x401d66
lea eax, [ebx + 0x14]
push eax
call fcn.0041d805
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.00427673
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x100], eax
jne 0x401dbc
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x401dae
cmp word [ecx], ax
je 0x401dae
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401df2
cmp dword [ebx + 0x10], eax
je 0x401df2
mov dword [ebp - 4], 1
jmp 0x401df2
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x401ddb
lea eax, [ebx + 0x14]
push eax
call fcn.0041d805
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.00427673
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0x100], ecx
je 0x401e03
push 0x67
jmp 0x401e1e
cmp dword [ebp - 8], ecx
je 0x401e25
cmp dword [ebp - 0xc], ecx
je 0x401e25
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0xfc]
cmp edx, dword [eax]
jne 0x401e1c
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00401919
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4039db
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4b7ef5
call fcn.004b5be0
sub esp, 0x10
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00427bb4
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.0040bf76
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040d60b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x405150
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00482db0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4051a9
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x405257
mov eax, dword [ebp - 0x94]
dec eax
je 0x405243
dec eax
jne 0x405257
cmp dword [ebp - 0xa0], 6
jne 0x4051f4
inc eax
cmp dword [ebp - 0x9c], eax
jne 0x4051dc
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
add ecx, 8
jmp 0x4051f0
cmp dword [ebp - 0x9c], edi
jne 0x405230
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x405257
cmp dword [ebp - 0xa0], 5
jne 0x405223
cmp dword [ebp - 0x9c], 2
jne 0x40520a
push 5
jmp 0x405240
cmp dword [ebp - 0x9c], 1
jne 0x405217
push 6
jmp 0x405240
cmp dword [ebp - 0x9c], edi
jne 0x405257
push 3
jmp 0x405240
cmp dword [ebp - 0xa0], 4
ja 0x405257
push 4
jmp 0x405240
cmp dword [ebp - 0x9c], 2
jne 0x405257
cmp byte [ebp + 0x76], al
jne 0x405257
push 0xa
pop edi
jmp 0x405257
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x4072bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
inc edi
cmp dword [ebp + 0xc], 0x4e
jne 0x4072f1
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0x3e8
jne 0x4072f1
mov ecx, esi
mov dword [esi + 0x3c8], edi
call fcn.0040722a
mov dword [ebx], eax
cmp dword [esi + 0x3c8], 0
je 0x4072f1
mov eax, edi
jmp 0x407338
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004083e8
test eax, eax
jne 0x4072ed
mov eax, dword [ebp + 0xc]
cmp eax, 0x402
jne 0x40733d
push 5
push dword [esi + 4]
lea eax, [esi + 0x3c8]
mov dword [ebp + 0xc], eax
mov dword [eax], edi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebx], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x4072ed
xor eax, eax
pop edi
pop ebp
ret 0x10
cmp eax, 0x403
jne 0x407377
mov eax, dword [esi + 0x3cc]
mov dword [esi + 0x28], eax
xor eax, eax
push eax
push eax
push eax
mov dword [esi + 0x3c8], edi
mov dword [esi + 0x3b8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
and dword [ebx], 0
cmp dword [esi + 0x3c8], 0
jmp 0x407334
cmp eax, 0x465
jne 0x4073a4
lea ecx, [esi + 0x2c]
mov dword [esi + 0x3c8], edi
call fcn.00407d92
mov dword [esi + 0x43c], eax
mov eax, dword [esi + 0x30]
push 5
lea ecx, [esi + 0x400]
call fcn.0047c1e4
jmp 0x40736b
cmp eax, 0x110
jne 0x407336
lea eax, [esi + 0x3c8]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax], edi
mov dword [ebp + 0xc], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
call fcn.00406c86
mov dword [ebx], eax
jmp 0x40732e
Function at 0x4079f9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [ebp + 0xc], 0x4e
push edi
mov edi, eax
jne 0x407a31
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0x3e8
jne 0x407a31
mov ecx, edi
mov dword [edi + 0x3c4], esi
call fcn.0040796f
mov dword [ebx], eax
cmp dword [edi + 0x3c4], 0
je 0x407a31
mov eax, esi
jmp 0x407a78
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004083e8
test eax, eax
jne 0x407a2d
mov eax, dword [ebp + 0xc]
cmp eax, 0x402
jne 0x407a7e
push 5
push dword [edi + 4]
lea eax, [edi + 0x3c4]
mov dword [ebp + 0xc], eax
mov dword [eax], esi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebx], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x407a2d
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
cmp eax, 0x403
jne 0x407ab8
mov eax, dword [edi + 0x3cc]
mov dword [edi + 0x28], eax
xor eax, eax
push eax
push eax
push eax
mov dword [edi + 0x3c4], esi
mov dword [edi + 0x3b8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
and dword [ebx], 0
cmp dword [edi + 0x3c4], 0
jmp 0x407a74
cmp eax, 0x465
jne 0x407ae5
lea ecx, [edi + 0x2c]
mov dword [edi + 0x3c4], esi
call fcn.00407d92
mov dword [edi + 0x428], eax
mov eax, dword [edi + 0x30]
push 5
lea ecx, [edi + 0x3f8]
call fcn.00437044
jmp 0x407aac
cmp eax, 0x110
jne 0x407a76
lea eax, [edi + 0x3c4]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp + 0xc], eax
mov eax, esp
mov dword [eax], ecx
call fcn.00407675
mov dword [ebx], eax
jmp 0x407a6e
Function at 0x408268
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp ebp, esi
push edi
mov ebx, eax
mov dword [esp + 0x18], esi
jne 0x40829f
mov eax, dword [0x4eb2f8]
cmp eax, esi
je 0x40828d
mov ebp, dword [eax + 4]
jmp 0x40828f
xor ebp, ebp
cmp ebp, esi
jne 0x40829f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x4082c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x4082c4
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4082c4
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], 1
push ecx
mov eax, esp
mov dword [ebx + 0x3b8], esi
push ebp
mov dword [eax], esi
call fcn.00409192
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x14], ecx
jne 0x4082ef
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x4083de
mov eax, dword [0x4eb2f8]
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x408306
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov dword [eax + 4], ecx
mov eax, ebp
call fcn.0042d543
cmp dword [ebx + 0x3ac], esi
je 0x40837d
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp edi, dword [esp + 0x24]
je 0x408361
push 1
push edi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp edi, dword [esp + 0x24]
je 0x40837d
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, ebx
call fcn.0040934e
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x3b8], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x18], esi
je 0x4083c2
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x4083c2
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x4083c2
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4eb2f8]
cmp eax, esi
je 0x4083d2
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4