joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a080
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [0x45d800]
test eax, eax
je 0x40a099
mov al, byte [esp + 8]
test al, al
jne 0x40a099
mov al, byte [0x45d6fc]
pop ecx
ret
mov al, byte [0x45f111]
push ebx
xor bl, bl
test al, al
push esi
mov byte [esp + 0xb], bl
jne 0x40a153
mov al, byte [0x45f112]
test al, al
jne 0x40a153
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
test ah, ah
jns 0x40a0d2
mov bl, 0x10
mov byte [esp + 0xb], bl
push 0xa1
call esi
test ah, ah
jns 0x40a0e4
or bl, 0x20
mov byte [esp + 0xb], bl
push 0xa2
call esi
test ah, ah
jns 0x40a0f6
or bl, 1
mov byte [esp + 0xb], bl
push 0xa3
call esi
test ah, ah
jns 0x40a108
or bl, 2
mov byte [esp + 0xb], bl
push 0xa4
call esi
test ah, ah
jns 0x40a11a
or bl, 4
mov byte [esp + 0xb], bl
push 0xa5
call esi
test ah, ah
jns 0x40a12c
or bl, 8
mov byte [esp + 0xb], bl
push 0x5b
call esi
test ah, ah
jns 0x40a13b
or bl, 0x40
mov byte [esp + 0xb], bl
push 0x5c
call esi
test ah, ah
jns 0x40a1e2
or bl, 0x80
mov byte [esp + 0xb], bl
jmp 0x40a1e2
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
js 0x40a173
push 0x10
call edi
test ah, ah
jns 0x40a179
mov bl, 0x10
mov byte [esp + 0xf], bl
push 0x11
call esi
movsx ecx, ax
test ecx, ecx
js 0x40a18c
push 0x11
call edi
test ah, ah
jns 0x40a193
or bl, 1
mov byte [esp + 0xf], bl
push 0x12
call esi
movsx edx, ax
test edx, edx
js 0x40a1a6
push 0x12
call edi
test ah, ah
jns 0x40a1ad
or bl, 4
mov byte [esp + 0xf], bl
push 0x5b
call esi
movsx eax, ax
test eax, eax
js 0x40a1c0
push 0x5b
call edi
test ah, ah
jns 0x40a1c7
or bl, 0x40
mov byte [esp + 0xf], bl
push 0x5c
call esi
movsx ecx, ax
test ecx, ecx
js 0x40a1da
push 0x5c
call edi
test ah, ah
jns 0x40a1e1
or bl, 0x80
mov byte [esp + 0xf], bl
pop edi
mov eax, dword [0x45d800]
test eax, eax
je 0x40a2dc
mov al, byte [0x45d6fc]
mov cl, bl
not cl
and cl, al
je 0x40a2dc
mov bl, byte [0x45d6fd]
mov al, byte [0x45d6fe]
not cl
and bl, cl
mov byte [0x45d6fd], bl
and al, cl
mov dl, byte [0x45d6fc]
mov bl, al
shl bl, 7
mov byte [0x45d7a2], bl
mov bl, al
and bl, 0xfe
shl bl, 6
mov byte [0x45d7a3], bl
mov bl, al
and bl, 0xfc
shl bl, 5
mov byte [0x45d7a4], bl
mov bl, al
and bl, 0xf8
shl bl, 4
mov byte [0x45d7a5], bl
and dl, cl
mov bl, al
and bl, 0xc0
shl bl, 1
mov byte [0x45d6fc], dl
mov cl, al
mov dl, al
mov byte [0x45d75b], bl
mov byte [0x45d6fe], al
mov bl, 0x80
and al, bl
and cl, 0xf0
and dl, 0xe0
shl cl, 3
mov byte [0x45d75c], al
shl dl, 2
xor al, al
cmp cl, al
mov byte [0x45d7a0], cl
mov byte [0x45d7a1], dl
jne 0x40a2a0
cmp dl, al
mov byte [0x45d710], al
je 0x40a2a6
mov byte [0x45d710], bl
cmp byte [0x45d7a2], al
jne 0x40a2bb
cmp byte [0x45d7a3], al
mov byte [0x45d711], al
je 0x40a2c1
mov byte [0x45d711], bl
cmp byte [0x45d7a4], al
jne 0x40a2d6
cmp byte [0x45d7a5], al
mov byte [0x45d712], al
je 0x40a2dc
mov byte [0x45d712], bl
mov al, byte [esp + 0xb]
pop esi
pop ebx
pop ecx
ret
Function at 0x40a600
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x200
mov edi, 0x45e368
rep stosd dword es:[edi], eax
mov dword [0x45e878], 0x1d
mov dword [0x45e880], 0x11d
mov dword [0x45e868], 0x2a
mov dword [0x45e870], 0x136
mov dword [0x45e888], 0x38
mov dword [0x45e890], 0x138
mov dword [0x45e668], 0x52
mov dword [0x45e670], 0x4f
mov dword [0x45e678], 0x50
mov dword [0x45e680], 0x51
mov dword [0x45e688], 0x4b
mov dword [0x45e690], 0x4c
mov dword [0x45e698], 0x4d
mov dword [0x45e6a0], 0x47
mov dword [0x45e6a8], 0x48
mov dword [0x45e6b0], 0x49
mov dword [0x45e6d8], 0x53
mov dword [0x45e7e8], 0x145
mov dword [0x45e6e0], 0x135
mov dword [0x45e6b8], 0x37
mov dword [0x45e6d0], 0x4a
mov dword [0x45e6c0], 0x4e
xor edi, edi
mov esi, 0x45e368
mov ebp, 0xff
cmp dword [esi], 0
jne 0x40a70c
push 0
push edi
call ebx
mov dword [esi], eax
inc edi
add esi, 8
dec ebp
jne 0x40a700
mov ecx, dword [0x45e640]
test ecx, ecx
jne 0x40a722
mov ecx, 0x15b
mov eax, dword [0x45e648]
test eax, eax
jne 0x40a730
mov eax, 0x15c
mov edx, 0x100
or eax, edx
mov dword [0x45e648], eax
mov eax, dword [0x45e890]
or ecx, edx
or eax, edx
mov dword [0x45e640], ecx
mov ecx, dword [0x45e650]
mov dword [0x45e890], eax
mov eax, dword [0x45e6e0]
or ecx, edx
mov edi, dword [0x45e380]
or eax, edx
mov esi, dword [0x45e4c8]
mov dword [0x45e650], ecx
mov ecx, dword [0x45e7e8]
mov dword [0x45e6e0], eax
mov eax, dword [0x45e3d0]
mov ebp, dword [0x45e880]
mov ebx, dword [0x45e870]
or ecx, edx
or eax, edx
mov dword [0x45e7e8], ecx
mov ecx, dword [0x45e4d0]
mov dword [0x45e3d4], eax
mov eax, dword [0x45e4d8]
or ecx, edx
or eax, edx
mov dword [0x45e4d4], ecx
mov ecx, dword [0x45e470]
mov dword [0x45e4dc], eax
mov eax, dword [0x45e478]
or ecx, edx
or eax, edx
mov dword [0x45e474], ecx
mov ecx, dword [0x45e488]
mov dword [0x45e47c], eax
mov eax, dword [0x45e480]
or ecx, edx
or eax, edx
mov dword [0x45e48c], ecx
mov ecx, dword [0x45e498]
mov dword [0x45e484], eax
mov eax, dword [0x45e4a8]
or edi, edx
or ecx, edx
or eax, edx
or esi, edx
mov dword [0x45e380], edi
pop edi
or ebp, edx
mov dword [0x45e49c], ecx
mov ecx, dword [0x45e490]
mov dword [0x45e4ac], eax
mov eax, dword [0x45e4a0]
mov dword [0x45e4c8], esi
pop esi
or ebx, edx
mov dword [0x45e880], ebp
or ecx, edx
or eax, edx
pop ebp
mov dword [0x45e870], ebx
mov dword [0x45e494], ecx
mov dword [0x45e4a4], eax
pop ebx
ret
Function at 0x40aa90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x40ab67
mov bl, byte [edi]
test bl, bl
je 0x40ab67
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40aab0
sub eax, edx
cmp eax, 1
jne 0x40aaff
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ebx, ax
mov ecx, ebx
shr ecx, 8
cmp cl, 0xff
jne 0x40aada
cmp al, 0xff
je 0x40ab67
mov edx, dword [esp + 0x10]
test edx, edx
je 0x40aafa
test cl, 1
je 0x40aaea
or dword [edx], 4
test cl, 2
je 0x40aaf2
or dword [edx], 2
test cl, 4
je 0x40aafa
or dword [edx], 1
pop edi
mov al, bl
pop ebx
ret
mov eax, dword [0x45c598]
push esi
xor esi, esi
test eax, eax
jle 0x40ab2f
jmp 0x40ab10
mov eax, dword [esi*8 + 0x45c1d8]
push edi
push eax
call fcn.0044e5aa
add esp, 8
test eax, eax
je 0x40ab3d
mov eax, dword [0x45c598]
inc esi
cmp esi, eax
jl 0x40ab10
mov al, byte [esp + 0x18]
test al, al
je 0x40ab48
pop esi
pop edi
xor al, al
pop ebx
ret
mov al, byte [esi*8 + 0x45c1dc]
pop esi
pop edi
pop ebx
ret
push edi
call fcn.0040aa00
add esp, 4
test eax, eax
je 0x40ab61
movzx eax, byte [eax*2 + 0x45df68]
pop esi
pop edi
pop ebx
ret
pop esi
pop edi
xor eax, eax
pop ebx
ret
pop edi
xor al, al
pop ebx
ret

Function at 0x40add0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
je 0x40aeab
mov edi, dword [esp + 0x18]
cmp edi, 3
jb 0x40aeab
mov eax, dword [esp + 0x10]
push ebx
mov bl, byte [esp + 0x10]
test bl, bl
mov byte [esi], 0
jne 0x40ae0c
test eax, eax
je 0x40aea5
mov bl, byte [eax*2 + 0x45df68]
jmp 0x40ae1a
test eax, eax
jne 0x40ae1e
movzx eax, bl
mov eax, dword [eax*8 + 0x45e368]
test eax, eax
je 0x40ae2e
push edi
push esi
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x40aea5
mov ecx, dword [0x45c598]
xor eax, eax
test ecx, ecx
jle 0x40ae4e
lea ebx, [ebx]
cmp byte [eax*8 + 0x45c1dc], bl
je 0x40ae6a
inc eax
cmp eax, ecx
jl 0x40ae40
movzx eax, bl
push eax
call fcn.004445ad
add esp, 4
test eax, eax
je 0x40ae8e
mov byte [esi], bl
pop ebx
pop edi
mov byte [esi + 1], 0
mov eax, esi
pop esi
ret
cmp eax, ecx
jge 0x40ae4e
mov edx, dword [eax*8 + 0x45c1d8]
lea ecx, [edi - 1]
push ecx
push edx
push esi
call fcn.00443880
add esp, 0xc
pop ebx
mov byte [esi + edi - 1], 0
pop edi
mov eax, esi
pop esi
ret
lea ecx, [edi - 1]
push ecx
push str.not_found
push esi
call fcn.00443880
add esp, 0xc
mov byte [esi + edi - 1], 0
pop ebx
pop edi
mov eax, esi
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x40b3a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
movzx eax, bl
push esi
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
neg al
sbb eax, eax
add eax, 2
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40b3c9
cmp eax, 2
jne 0x40b415
cmp esi, eax
je 0x40b415
cmp bl, 0x90
jne 0x40b3ff
mov al, byte [0x45f111]
test al, al
je 0x40b3e5
call fcn.0040a050
mov eax, esi
pop esi
pop ebx
ret
push 0xffc3d44d
push 0
push 0
push 0
push 0x90
push 1
call fcn.0040aeb0
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 2
call fcn.0040aeb0
add esp, 0x18
mov eax, esi
pop esi
pop ebx
ret
Function at 0x40b860
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [0x45d800]
test eax, eax
je 0x40b875
mov cl, byte [0x45d6fc]
jmp 0x40bac5
mov al, byte [0x45f111]
push ebx
xor bl, bl
test al, al
push esi
mov byte [esp + 0xb], bl
jne 0x40b92f
mov al, byte [0x45f112]
test al, al
jne 0x40b92f
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
test ah, ah
jns 0x40b8ae
mov bl, 0x10
mov byte [esp + 0xb], bl
push 0xa1
call esi
test ah, ah
jns 0x40b8c0
or bl, 0x20
mov byte [esp + 0xb], bl
push 0xa2
call esi
test ah, ah
jns 0x40b8d2
or bl, 1
mov byte [esp + 0xb], bl
push 0xa3
call esi
test ah, ah
jns 0x40b8e4
or bl, 2
mov byte [esp + 0xb], bl
push 0xa4
call esi
test ah, ah
jns 0x40b8f6
or bl, 4
mov byte [esp + 0xb], bl
push 0xa5
call esi
test ah, ah
jns 0x40b908
or bl, 8
mov byte [esp + 0xb], bl
push 0x5b
call esi
test ah, ah
jns 0x40b917
or bl, 0x40
mov byte [esp + 0xb], bl
push 0x5c
call esi
test ah, ah
jns 0x40b9be
or bl, 0x80
mov byte [esp + 0xb], bl
jmp 0x40b9be
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
js 0x40b94f
push 0x10
call edi
test ah, ah
jns 0x40b955
mov bl, 0x10
mov byte [esp + 0xf], bl
push 0x11
call esi
movsx ecx, ax
test ecx, ecx
js 0x40b968
push 0x11
call edi
test ah, ah
jns 0x40b96f
or bl, 1
mov byte [esp + 0xf], bl
push 0x12
call esi
movsx edx, ax
test edx, edx
js 0x40b982
push 0x12
call edi
test ah, ah
jns 0x40b989
or bl, 4
mov byte [esp + 0xf], bl
push 0x5b
call esi
movsx eax, ax
test eax, eax
js 0x40b99c
push 0x5b
call edi
test ah, ah
jns 0x40b9a3
or bl, 0x40
mov byte [esp + 0xf], bl
push 0x5c
call esi
movsx ecx, ax
test ecx, ecx
js 0x40b9b6
push 0x5c
call edi
test ah, ah
jns 0x40b9bd
or bl, 0x80
mov byte [esp + 0xf], bl
pop edi
mov eax, dword [0x45d800]
test eax, eax
je 0x40babf
mov al, byte [0x45d6fc]
mov cl, bl
not cl
and cl, al
je 0x40babf
mov bl, byte [0x45d6fc]
mov al, byte [0x45d6fe]
not cl
and bl, cl
mov byte [0x45d6fc], bl
and al, cl
mov dl, byte [0x45d6fd]
mov bl, al
shl bl, 7
mov byte [0x45d7a2], bl
mov bl, al
and bl, 0xfe
shl bl, 6
mov byte [0x45d7a3], bl
mov bl, al
and bl, 0xfc
shl bl, 5
mov byte [0x45d7a4], bl
mov bl, al
and bl, 0xf8
shl bl, 4
and dl, cl
mov byte [0x45d7a5], bl
mov bl, al
and bl, 0xc0
mov byte [0x45d6fd], dl
shl bl, 1
mov cl, al
mov dl, al
and cl, 0xf0
and dl, 0xe0
mov byte [0x45d75b], bl
shl cl, 3
mov bl, 0x80
mov byte [0x45d6fe], al
shl dl, 2
and al, bl
test cl, cl
mov byte [0x45d7a0], cl
mov byte [0x45d7a1], dl
mov byte [0x45d75c], al
jne 0x40ba7b
test dl, dl
mov byte [0x45d710], cl
je 0x40ba81
mov byte [0x45d710], bl
mov al, byte [0x45d7a2]
test al, al
jne 0x40ba9a
mov al, byte [0x45d7a3]
test al, al
mov byte [0x45d711], 0
je 0x40baa0
mov byte [0x45d711], bl
mov al, byte [0x45d7a4]
test al, al
jne 0x40bab9
mov al, byte [0x45d7a5]
test al, al
mov byte [0x45d712], 0
je 0x40babf
mov byte [0x45d712], bl
mov cl, byte [esp + 0xb]
pop esi
pop ebx
xor eax, eax
test cl, 0xc0
je 0x40bad1
mov eax, 8
test cl, 0xc
je 0x40bad9
or eax, 1
test cl, 0x30
je 0x40bae1
or eax, 4
test cl, 3
je 0x40bae9
or eax, 2
pop ecx
ret
Function at 0x40baf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x45c598]
mov edx, dword [esp + 4]
xor eax, eax
test ecx, ecx
jle 0x40bb0e
cmp byte [eax*8 + 0x45c1dc], dl
je 0x40bb17
inc eax
cmp eax, ecx
jl 0x40bb00
mov dword [esp + 4], edx
jmp fcn.0040add0
mov edx, dword [eax*8 + 0x45c1d8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
lea ecx, [edi - 1]
push ecx
push edx
push esi
call fcn.00443880
add esp, 0xc
mov byte [esi + edi - 1], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x40dd90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x45fcb8], eax
mov edx, 1
mov eax, 0x45fcb8
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x460674
jl 0x40dda4
mov dword [0x45c640], 1
mov dword [0x460678], 1
pop edi
ret

Function at 0x40dde0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x460678]
test eax, eax
push esi
push edi
mov esi, 0x45fcb8
jne 0x40de00
push 0
call fcn.00444bad
push eax
call fcn.0040dd90
add esp, 8
mov dword [0x45c640], 0x270
mov dword [0x45fcb0], esi
mov ecx, 0xe3
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, edi
and al, 1
shr edx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
mov dword [esi], edx
add esi, 4
dec ecx
jne 0x40de15
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, edi
mov edi, dword [esi - 0x38c]
and al, 1
shr edx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, edi
mov dword [esi], edx
add esi, 4
dec ecx
jne 0x40de48
mov eax, dword [0x45fcb8]
mov ecx, dword [esi]
mov edi, dword [esi]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, edi
and al, 1
shr ecx, 1
neg al
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x40deb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x45c640]
jne 0x40debd
call fcn.0040dde0
mov eax, dword [0x45fcb0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x45fcb0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x40df00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x45c640]
jne 0x40df0d
call fcn.0040dde0
mov eax, dword [0x45fcb0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x45fcb0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x40df50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x45c640]
jne 0x40df5e
call fcn.0040dde0
mov ecx, dword [0x45fcb0]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x45fcb0], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
test edx, edx
mov dword [esp], edx
fild dword [esp]
jge 0x40dfa7
fadd qword [0x451550]
fmul qword [0x451548]
pop ecx
ret
Function at 0x40e480
Capabilities:
Write clipboard data

Disassembly:
mov dl, byte [ecx + 0x14]
mov eax, 1
cmp dl, al
jne 0x40e4a0
mov ecx, dword [0x45ef64]
test ecx, ecx
je 0x40e4a0
mov ecx, 0x45ef58
jmp fcn.00402af0
ret
Function at 0x414ca0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
jne 0x414cb6
mov eax, 0x3f
add esp, 8
ret 4
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov ebp, eax
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
push ebp
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test esi, esi
je 0x414d10
cmp esi, edi
je 0x414d10
push ebp
call fcn.004407a0
add esp, 4
test al, al
jne 0x414d10
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetCursor]
test bl, bl
mov ebp, eax
je 0x414d26
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
jne 0x414d5a
mov esi, dword [esp + 0x1c]
push 0x3f
push str.Unknown
push esi
call fcn.00443880
mov eax, esi
add esp, 0xc
mov byte [esi + 0x3f], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414d47
pop edi
pop esi
pop ebp
sub eax, edx
pop ebx
add esp, 8
ret 4
test byte [0x461174], 1
jne 0x414e4e
mov ebx, dword [0x461174]
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f8a
or ebx, 1
push 0
mov dword [0x461174], ebx
call esi
push 0x7f00
push 0
mov dword [0x461138], eax
call esi
push 0x7f03
push 0
mov dword [0x46113c], eax
call esi
push 0x7f8b
push 0
mov dword [0x461140], eax
call esi
push 0x7f01
push 0
mov dword [0x461144], eax
call esi
push 0x7f81
push 0
mov dword [0x461148], eax
call esi
push 0x7f88
push 0
mov dword [0x46114c], eax
call esi
push 0x7f80
push 0
mov dword [0x461150], eax
call esi
push 0x7f86
push 0
mov dword [0x461154], eax
call esi
push 0x7f83
push 0
mov dword [0x461158], eax
call esi
push 0x7f85
push 0
mov dword [0x46115c], eax
call esi
push 0x7f82
push 0
mov dword [0x461160], eax
call esi
push 0x7f84
push 0
mov dword [0x461164], eax
call esi
push 0x7f04
push 0
mov dword [0x461168], eax
call esi
push 0x7f02
push 0
mov dword [0x46116c], eax
call esi
mov dword [0x461170], eax
mov ecx, dword [0x45c698]
xor eax, eax
test ecx, ecx
jle 0x414e6e
lea ebx, [ebx]
cmp dword [eax*4 + 0x461138], ebp
je 0x414e6e
inc eax
cmp eax, ecx
jl 0x414e60
mov eax, dword [eax*4 + 0x45c658]
mov esi, dword [esp + 0x1c]
push 0x3f
push eax
push esi
call fcn.00443880
mov eax, esi
add esp, 0xc
mov byte [esi + 0x3f], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414e90
pop edi
pop esi
pop ebp
sub eax, edx
pop ebx
add esp, 8
ret 4
Function at 0x414eb0
Capabilities:
Check for time delay via gettickcount
Log keystrokes

Disassembly:
sub esp, 0x18
push edi
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x414ec8
mov eax, 0x14
pop edi
add esp, 0x18
ret 8
test byte [0x46118c], 1
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
jne 0x414ee6
or dword [0x46118c], 1
call esi
mov dword [0x461188], eax
push ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x414f19
call esi
cmp ebp, dword [0x461184]
mov dword [esp + 0x10], eax
jne 0x414f27
sub eax, dword [0x461188]
cmp eax, 5
ja 0x414f27
mov eax, dword [0x461180]
test eax, eax
jne 0x415009
pop ebp
pop esi
mov byte [edi], 0
xor eax, eax
pop edi
add esp, 0x18
ret 8
push ebx
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
push ebp
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test esi, esi
je 0x414f61
cmp esi, edi
je 0x414f61
push ebp
call fcn.004407a0
add esp, 4
test al, al
jne 0x414f61
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
push 0x461178
call dword [sym.imp.USER32.dll_GetCaretPos]
mov dword [0x461180], eax
call dword [sym.imp.USER32.dll_GetFocus]
test bl, bl
mov dword [esp + 0x10], eax
pop ebx
je 0x414f8e
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
mov ecx, dword [0x461180]
test ecx, ecx
jne 0x414faa
mov eax, dword [esp + 0x2c]
pop ebp
pop esi
mov byte [eax], 0
xor eax, eax
pop edi
add esp, 0x18
ret 8
test eax, eax
jne 0x414fb0
mov eax, ebp
push 0x461178
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
test byte [0x45d629], 8
jne 0x414ff5
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [0x461178]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x46117c]
mov eax, dword [esp + 0x18]
sub esi, edx
sub ecx, eax
mov dword [0x461178], esi
mov dword [0x46117c], ecx
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x2c]
mov dword [0x461184], ebp
mov dword [0x461188], ecx
cmp byte [esp + 0x28], 0x29
mov eax, dword [0x461178]
je 0x41501a
mov eax, dword [0x46117c]
push 0xa
push edi
push eax
call fcn.004448ca
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
jmp 0x415030
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415030
pop ebp
pop esi
sub eax, edx
pop edi
add esp, 0x18
ret 8
Function at 0x415050
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x290
push esi
mov esi, dword [esp + 0x29c]
test esi, esi
jne 0x415071
mov eax, 0x1f
pop esi
add esp, 0x290
ret 8
lea eax, [esp + 0x104]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x415096
mov byte [esi], 0
xor eax, eax
pop esi
add esp, 0x290
ret 8
push 0x100
lea ecx, [esp + 8]
push ecx
call sub.WSOCK32.dll_gethostname
lea edx, [esp + 4]
push edx
call sub.WSOCK32.dll_gethostbyname
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x4150cc
mov eax, edx
push edi
lea ecx, [ecx]
mov edi, dword [eax + 4]
add eax, 4
inc ecx
test edi, edi
jne 0x4150c0
pop edi
mov eax, dword [esp + 0x298]
cmp eax, ecx
jl 0x4150e0
push 0x1f
push str.0.0.0.0
jmp 0x4150ee
mov eax, dword [edx + eax*4]
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_ntoa
push 0x1f
push eax
push esi
call fcn.00443880
add esp, 0xc
mov byte [esi + 0x1f], 0
call sub.WSOCK32.dll_WSACleanup
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415105
sub eax, edx
pop esi
add esp, 0x290
ret 8
Function at 0x420020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
mov al, byte [0x45b06c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push edi
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 9
mov byte [esp + 0x1b], 0x3c
mov byte [esp + 0x1c], 0x3e
mov byte [esp + 0x1d], 0x3d
mov byte [esp + 0x1e], 0x2b
mov byte [esp + 0x1f], 0x2d
mov byte [esp + 0x20], 0x2a
mov byte [esp + 0x21], 0x2f
mov byte [esp + 0x22], 0x21
mov byte [esp + 0x23], 0
call fcn.00409fc0
add esp, 8
test eax, eax
je 0x420086
cmp eax, edi
jbe 0x42009d
dec eax
jmp 0x42009d
mov eax, edi
lea edx, [eax + 1]
jmp 0x420090
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420090
sub eax, edx
lea eax, [eax + edi - 1]
cmp eax, edi
mov ebx, eax
jbe 0x4200b2
mov al, byte [ebx]
cmp al, 0x20
je 0x4200ad
cmp al, 9
jne 0x4200b2
dec ebx
cmp ebx, edi
ja 0x4200a3
mov esi, ebx
sub esi, edi
inc esi
cmp esi, 0xfd
jbe 0x4200e0
mov al, byte [esp + 0x28]
test al, al
je 0x4200d4
push edi
push str.The_first_word_in_this_line_is_too_long_to_be_any_valid_command_or_variable_name.
mov ecx, ebp
call fcn.0041e570
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0xc
mov edx, esi
push edx
push edi
mov edi, dword [esp + 0x28]
push edi
call fcn.00443880
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x426f80
Capabilities:
Link many functions at runtime

Disassembly:
mov al, byte [0x45f112]
test al, al
je 0x426f8e
jmp fcn.00440ba0
jmp fcn.00440970