joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2758ddae
Capabilities:
Check os version

Disassembly:
cmp dword [0x27631c54], 0
push esi
push 1
pop esi
je 0x2758ddfe
mov eax, dword [esp + 8]
sub eax, 0
je 0x275e13ec
dec eax
je 0x2758de31
dec eax
je 0x275e13e4
dec eax
je 0x275e13cb
dec eax
je 0x2758de1b
dec eax
je 0x275e139f
dec eax
jne 0x2758de2d
cmp dword [0x27631bd0], 2
jne 0x2758de2d
cmp dword [0x27631bc4], 3
jb 0x2758de2d
mov eax, esi
pop esi
ret 4
push 0x27631bc0
mov dword [0x27631c54], esi
mov dword [0x27631bc0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x2758ddbb
cmp dword [0x27631bd0], 2
jne 0x2758de2d
cmp dword [0x27631bc4], 5
jae 0x2758ddf8
xor eax, eax
jmp 0x2758ddfa
xor eax, eax
cmp dword [0x27631bd0], 2
sete al
jmp 0x2758ddfa
cmp dword [0x27631bd0], esi
jne 0x2758de2d
mov eax, dword [0x27631bc4]
cmp eax, 4
ja 0x2758ddf8
jne 0x2758de2d
cmp dword [0x27631bc8], 0xa
jmp 0x2758ddf6
cmp dword [0x27631bd0], 2
jne 0x2758de2d
cmp dword [0x27631bc4], 4
jmp 0x2758de2b
cmp dword [0x27631bd0], esi
jmp 0x275e13d2
xor eax, eax
cmp dword [0x27631bd0], esi
jmp 0x2758de3a

Function at 0x2758e05f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push esi
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 9
mov dword [ebp - 4], eax
jl 0x275e4599
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.2758e0cb
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2758e0c6
push dword [ebp + 0x10]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
pop esi
leave
ret
xor eax, eax
jmp 0x2758e0c8

Function at 0x2758e0cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ecx], bl
push edi
mov dword [ebp - 4], ebx
mov edx, ecx
je 0x2758e0e5
inc edx
cmp byte [edx], bl
jne 0x2758e0e0
mov esi, dword [ebp + 0x10]
dec edx
mov edi, esi
cmp edx, ecx
jb 0x2758e0f7
mov al, byte [edx]
dec edx
mov byte [edi], al
inc edi
jmp 0x2758e0eb
mov byte [edi], bl
cmp byte [esi], bl
mov edx, esi
je 0x2758e104
inc edx
cmp byte [edx], bl
jne 0x2758e0ff
dec edx
cmp byte [ecx], bl
mov dword [ebp + 8], edx
mov edi, ecx
je 0x2758e113
inc edi
cmp byte [edi], bl
jne 0x2758e10e
dec edi
cmp ecx, edi
jae 0x2758e132
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
xor byte [ecx + edx], al
movsx eax, byte [ecx + edx]
add dword [ebp - 4], eax
inc ecx
cmp ecx, edi
jb 0x2758e11c
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp esi, edx
mov ecx, esi
jae 0x2758e13e
inc ecx
dec edx
cmp ecx, edx
jb 0x2758e138
mov eax, dword [ebp - 4]
push 0xa
lea edi, [ecx - 1]
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp + 0xc]
add dl, 0x61
cmp esi, edi
ja 0x2758e16c
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
jmp 0x2758e151
pop edi
mov byte [eax], bl
pop esi
pop ebx
leave
ret
Function at 0x275935dc
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
test byte [esi + 0x18], 0x80
pop edi
mov dword [ebp - 4], edi
jne 0x275d890f
mov ebx, dword [esi + 0xcc]
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x275d8916
push esi
call fcn.2759361b
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x27593614
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x275d8925
mov dword [ebp + 0xc], edi
push ebx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 0
je 0x275d89d9
dec eax
je 0x275d89dc
dec eax
je 0x27593612
mov edi, dword [esi + 0x28]
xor eax, eax
cmp edi, eax
je 0x275d89b7
mov ecx, dword [edi + 0x1c]
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], eax
je 0x275d89ec
mov dword [ebp - 0x1c], eax
push 5
push edi
push esi
call fcn.2758c756
or byte [esi + 0x18], 0x80
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x18], 0x7f
lea eax, [ebp - 0x38]
push eax
push 0xfffffe65
push esi
call fcn.27582d58
test eax, eax
mov dword [ebp - 4], eax
je 0x275d89b7
cmp dword [ebp + 0xc], 0
jne 0x275d89b7
cmp dword [ebp - 0x28], 0
je 0x275d89b7
cmp dword [edi + 0xc], 0xffffffff
je 0x275d8a1a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
push esi
call fcn.2758c5df
cmp ebx, dword [esi + 0xcc]
jne 0x275d89ca
and dword [esi + 0x28], 0
and dword [esi + 0xcc], 0
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
jmp 0x27593614
mov dword [ebp + 0xc], edi
push 2
push 0xfffffffffffffff4
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x275d8943
mov ebx, 0x104
lea eax, [ebp - 0x13c]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
or dword [ebp - 0x2c], 1
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jmp 0x275d8964
lea eax, [ebp - 0x38]
push eax
push 0xfffffe6c
push esi
call fcn.27582d58
jmp 0x275d89b7

Function at 0x27595ee9
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp dword [esi + 0x30], edi
jne 0x275d7f7a
xor eax, eax
pop edi
pop esi
ret 8
push 0
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x41d
mov dword [esi + 0x30], edi
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
pop eax
jmp 0x27595efe
Function at 0x27596749
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.275967c2
mov eax, dword [0x2762e024]
mov ebp, dword [esp + 0x10]
cmp eax, 1
je 0x275d47cf
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x2762e1e0], 1
mov byte [0x2762e020], bl
jne 0x2759679f
mov ecx, dword [0x2762e028]
test ecx, ecx
jne 0x275d47e2
push 0x2762e014
push 0x2762e00c
call fcn.27593e2d
add esp, 8
push 0x2762e01c
push 0x2762e018
call fcn.27593e2d
add esp, 8
test ebx, ebx
je 0x275d480e
call fcn.2759698d
pop esi
pop ebp
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x27596763
mov esi, dword [0x2763436c]
sub esi, 4
cmp esi, ecx
jb 0x2759678d
mov eax, dword [esi]
test eax, eax
je 0x275d4801
call eax
mov ecx, dword [0x2762e028]
sub esi, 4
cmp esi, ecx
jb 0x2759678d
jmp 0x275d47f3
push ebp
mov dword [0x2762e024], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x2759aab2
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov al, byte [edi + 2]
mov edx, dword [esi + 0x64]
and eax, 3
shl eax, 3
and edx, 0xffffffe7
mov ecx, dword [esi + 0x50]
or eax, edx
mov dword [esi + 0x64], eax
mov dl, byte [edi + 8]
and edx, 3
and ah, 0xfc
shl edx, 8
or edx, eax
mov dword [esi + 0x64], edx
mov al, byte [edi]
and eax, 7
and edx, 0xfffffff8
or eax, edx
mov dword [esi + 0x64], eax
mov ax, word [edi]
cmp ax, 5
je 0x275d06b7
cmp ax, 6
je 0x275d06b7
mov al, byte [edi + 4]
mov ecx, dword [esi + 0x64]
and eax, 3
and ecx, 0xffffff9f
shl eax, 5
or eax, ecx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi + 0x64], eax
mov cl, byte [edi + 6]
and ecx, 1
and al, 0x7f
shl ecx, 7
or ecx, eax
mov dword [esi + 0x64], ecx
mov al, byte [edi + 0xa]
and eax, 1
and ch, 0xfb
shl eax, 0xa
or eax, ecx
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x70]
test eax, eax
jne 0x275d06c2
mov eax, dword [esi + 0x74]
test eax, eax
jne 0x275d06ca
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x275d06d2
mov eax, dword [edi + 0x18]
mov ecx, esi
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x7c], eax
push dword [edi + 0x20]
call fcn.27585be7
push dword [edi + 0x20]
call ebx
push dword [edi + 0x24]
mov ecx, esi
call fcn.27587168
push dword [edi + 0x24]
call ebx
mov eax, dword [edi + 0x14]
pop edi
mov dword [esi + 0x80], eax
pop esi
xor eax, eax
pop ebx
ret 4
push eax
call fcn.275b7c33
jmp 0x2759ab07
push eax
call ebx
jmp 0x2759ab59
push eax
call ebx
jmp 0x2759ab64
push eax
call ebx
jmp 0x2759ab6f
Function at 0x2759b713
Capabilities:
Log keystrokes
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [ecx + 0x204]
test esi, esi
je 0x2759b739
push edi
push ebx
mov edi, section..data
mov eax, dword [esi + 0x64]
and eax, 7
cmp eax, 1
jae 0x2759b73b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x2759b725
pop ebx
pop edi
pop esi
ret
mov bx, word [eax*2 + 0x2759b9f6]
test bx, bx
je 0x2759b730
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x2762dea4], 0
je 0x2759b77c
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsx eax, bx
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x64]
and eax, 1
shl eax, 7
and cl, 0x7f
or eax, ecx
mov dword [esi + 0x64], eax
jmp 0x2759b730
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x275b7e83
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x2762dea4], eax
jmp 0x2759b758
Function at 0x275a32d1
Capabilities:
Get graphical window text
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
mov dword [ebp - 4], 1
mov edi, dword [esi + 0xdc]
mov eax, dword [esi]
test byte [esi + 0xe8], 1
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jne 0x275e2e82
test edi, edi
jne 0x275e2c9c
push 0x2a
push 8
push esi
call fcn.275a3320
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x275e2cae
mov dword [ebp + 0xc], 1
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 0
je 0x275e2ddf
dec eax
je 0x275e2de6
dec eax
je 0x275a3316
mov eax, dword [esi + 0xe0]
mov edi, 0x1000
test dword [esi + 8], edi
mov dword [ebp - 8], eax
je 0x275e2df6
test eax, eax
jl 0x275e2dad
cmp eax, dword [esi + 0x15c]
jge 0x275e2dad
and dword [ebp - 0x14], 0
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], eax
je 0x275e2e13
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
push 0xffffffffffffff96
push esi
call fcn.27582d58
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x275e2e82
cmp dword [ebp - 4], 0
je 0x275e2d64
cmp dword [ebp + 0xc], 0
jne 0x275e2d64
test dword [esi + 8], edi
jne 0x275e2e43
cmp dword [ebx], 0xffffffff
je 0x275e2e43
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
push esi
call fcn.275acb3f
cmp dword [0x2762e048], 0
je 0x275e2d9e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp ax, 0x411
jne 0x275e2d9e
push dword [ebp + 8]
call fcn.2760997e
mov edi, eax
test edi, edi
je 0x275e2d9e
push 0
push 1
push 0x15
push edi
call fcn.27609934
push edi
push dword [ebp + 8]
call fcn.27609968
push 0
push 5
push 0
push dword [ebp - 8]
push esi
call fcn.275ad22c
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0xdc]
jne 0x275e2dc6
or dword [esi + 0xe0], 0xffffffff
and dword [esi + 0xdc], 0
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push 1
push esi
call fcn.275a24a2
mov eax, dword [ebp - 4]
jmp 0x275a3319
mov dword [ebp + 0xc], 1
push 2
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x275e2ccc
push eax
push dword [esi + 0x18]
call fcn.27597d8e
mov ebx, eax
test ebx, ebx
je 0x275e2dad
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
jmp 0x275e2cfb
mov edi, 0x104
lea eax, [ebp - 0x144]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
or dword [ebp - 0x34], 1
lea eax, [ebp - 0x144]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], eax
mov edi, 0x1000
jmp 0x275e2d15
lea eax, [ebp - 0x40]
push eax
push 0xffffff69
push esi
call fcn.27582d58
test dword [esi + 8], edi
mov dword [esi + 0xcc], SysReAllocStringLen
jne 0x275e2d64
mov word [ebx + 0x10], 0x7fff
mov word [ebx + 0x12], 0x7fff
mov word [ebx + 0xe], 0x7fff
mov word [ebx + 0x14], 0x7fff
jmp 0x275e2d64
xor eax, eax
jmp 0x275a3319
Function at 0x275a4d02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 1
lea eax, [ebp - 4]
pop esi
xor edi, edi
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x275da628
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
leave
ret 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.UseDoubleClickTimer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x275da654
mov esi, dword [ebp - 0xc]
push 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x275a4d31

Function at 0x275a7ac8
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
test byte [esi + 9], 8
jne 0x275df295
test byte [esp + 0x14], 2
jne 0x275a7af2
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x275df2b7
test edi, edi
jne 0x275a7b13
mov eax, dword [esp + 0x10]
push 0x14
sub eax, esi
pop ecx
sub eax, 0xec
cdq
idiv ecx
cmp dword [esi + 0xc8], eax
je 0x275df2cc
mov eax, edi
pop edi
pop esi
ret 0xc
mov eax, dword [esi + 0xc4]
lea eax, [eax + eax*4]
lea eax, [esi + eax*4 + 0xec]
cmp eax, dword [esp + 0x10]
jne 0x275a7ada
push 1
pop edi
jmp 0x275a7ada
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne 0x275a7af2
xor edi, edi
jmp 0x275a7af2
push 1
pop edi
jmp 0x275a7b13
Function at 0x275a9a0e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffffe
mov eax, dword [esi + 0x28]
pop ebx
test al, 1
jne 0x275a9a93
test al, 0x20
jne 0x275a9a9a
mov ecx, dword [ebp + 0x10]
mov eax, 0x200
cmp ecx, eax
ja 0x275a9aff
jne 0x275ded83
mov edi, dword [ebp + 0x18]
test byte [esi + 0x2c], 1
jne 0x275a9a52
push dword [ebp + 0xc]
call fcn.275a9c95
test eax, eax
je 0x275a9a93
mov eax, dword [esi + 0x28]
test al, 0x10
je 0x275a9a93
test al, 0x20
jne 0x275a9a93
mov eax, edi
push 0
shr eax, 0x10
movsx eax, ax
push ebx
push eax
movsx eax, di
push eax
push dword [ebp + 0xc]
push esi
call fcn.275a9bd7
mov edi, eax
test edi, edi
je 0x275a9af7
test byte [esi + 0x28], 0xc0
jne 0x275a9ad0
push 1
mov dword [esi + 0x18], edi
pop edi
test edi, edi
je 0x275a9a93
push edi
push esi
call fcn.275a9cc2
pop edi
pop esi
pop ebx
leave
ret 0x14
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl 0x275a9a27
push 2
call edi
test ax, ax
jl 0x275a9a27
push 4
call edi
test ax, ax
jl 0x275a9a27
and dword [esi + 0x28], 0xffffffdf
jmp 0x275a9a27
cmp edi, dword [esi + 0x18]
je 0x275dedc6
push esi
call fcn.275a9b33
push esi
mov dword [esi + 0x18], edi
call fcn.275a9b8f
push 2
pop edi
cmp dword [esi + 0x3c], 0
jne 0x275dedd7
jmp 0x275a9a88
push esi
call fcn.275a9b33
jmp 0x275a9a93
mov eax, ecx
sub eax, 0x201
je 0x275a9b24
dec eax
jne 0x275a9b11
and dword [esi + 0x28], 0xffffffdf
jmp 0x275a9a93
dec eax
dec eax
je 0x275a9b24
dec eax
je 0x275a9b0b
dec eax
dec eax
je 0x275a9b24
dec eax
je 0x275a9b0b
jmp 0x275a9a93
or dword [esi + 0x28], 0x20
push esi
call fcn.275a9b8f
jmp 0x275a9a93
mov eax, ecx
sub eax, 0xa0
je 0x275ded92
dec eax
jmp 0x275a9b06
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ecx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx edi, word [ebp - 4]
movzx eax, word [ebp - 8]
mov ebx, dword [ebp + 0x14]
shl edi, 0x10
or edi, eax
jmp 0x275a9a40
mov edi, dword [esi + 0x30]
dec edi
dec edi
neg edi
sbb edi, edi
and edi, 3
jmp 0x275a9aeb
push 4
push esi
call fcn.275a9cc2
jmp 0x275a9a88
Function at 0x275a9b33
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x275a9b84
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x275deae1
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x275deaef
push 3
push dword [esi]
call edi
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x28], 0x3f
and dword [esi + 0x18], 0
pop edi
pop esi
leave
ret 4
push eax
push dword [esi]
call edi
and dword [esi + 0x30], 0
jmp 0x275a9b4b
push eax
push dword [esi]
call edi
and dword [esi + 0x3c], 0
jmp 0x275a9b56
mov eax, dword [esi + 0x18]
test eax, eax
je 0x275a9b66
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov ecx, 0xfffffdf6
mov dword [ebp - 4], ecx
mov edx, dword [eax + 4]
shr edx, 6
and edx, 1
push edx
lea edx, [ebp - 0xc]
push edx
push ecx
push 0xffffffffffffffff
push dword [eax + 8]
call fcn.275a8c04
jmp 0x275a9b66
Function at 0x275b38da
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
xor edi, edi
call esi
test ax, ax
jl 0x275dc06e
push 0x11
call esi
test ax, ax
jl 0x275dc076
push 0x10
call esi
test ax, ax
jl 0x275dc07e
mov eax, edi
pop edi
pop esi
ret
push 1
pop edi
jmp 0x275b38f1
or edi, 2
jmp 0x275b38fe
or edi, 4
jmp 0x275b390b

Function at 0x275b3b18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test byte [esi + 9], 0x10
jne 0x275dc28f
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov ebx, eax
test ebx, ebx
je 0x275b3bf5
cmp dword [esi + 0x54], 0xffffffff
je 0x275b3bf5
cmp dword [ebp + 0xc], 0x20
jb 0x275dc2c5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x275dc2c5
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.27597367
test eax, eax
je 0x275dc29d
mov edi, dword [esi + 0x54]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], 0x26
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
cmp ebx, 1
jne 0x275b3ba3
mov eax, dword [ebp - 4]
cmp byte [eax], 0x20
je 0x275dc2ae
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
call fcn.275aecc4
mov edi, eax
cmp edi, dword [ebp + 8]
jge 0x275dc2d3
cmp edi, 0xffffffff
je 0x275dc32e
cmp ebx, 1
jg 0x275dc2db
push 0
push 1
push 1
push edi
push esi
call fcn.275b3bfc
push 0x2b
push 0x200
push esi
mov dword [esi + 0x58], edi
call fcn.275a3320
test eax, eax
je 0x275b3bf5
push 0
push edi
push esi
call fcn.275ae881
pop edi
pop esi
pop ebx
leave
ret 0xc
mov ebx, dword [esi + 0x15c]
mov dword [ebp + 8], ebx
jmp 0x275b3b38
mov eax, dword [esi + 0x54]
lea eax, [ebx + eax - 1]
cdq
idiv ebx
mov edi, edx
jmp 0x275b3b7c
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x275b3bf5
push 2
push 2
push eax
push esi
call fcn.275ad12b
push 0
push 0
call fcn.27597367
jmp 0x275b3bf5
or edi, 0xffffffff
jmp 0x275b3bb9
mov eax, dword [ebp - 4]
mov cl, byte [eax]
push ecx
push eax
call fcn.2761a416
test eax, eax
je 0x275b3bcb
mov eax, dword [ebp - 4]
lea eax, [ebx + eax - 1]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x54]
push esi
call fcn.275aecc4
mov ecx, dword [esi + 0x54]
cmp edi, ecx
jge 0x275dc310
add edi, dword [ebp + 8]
cmp eax, ecx
jge 0x275dc317
add eax, dword [ebp + 8]
cmp eax, edi
jge 0x275dc321
cmp eax, ecx
jle 0x275dc321
mov edi, eax
mov eax, edi
cdq
idiv dword [ebp + 8]
mov edi, edx
jmp 0x275b3bcb
cmp ebx, 1
jle 0x275dc35d
mov eax, dword [ebp - 4]
mov cl, byte [eax]
push ecx
push eax
call fcn.2761a416
test eax, eax
je 0x275dc35d
push 0
push 0
call fcn.27597367
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.275b3b18
jmp 0x275b3bf5
cmp dword [0x27631ec8], 0
jne 0x275dc36e
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
inc dword [0x27631ec8]
jmp 0x275b3bf5
Function at 0x275b9e57
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 0xc]
push ebx
movzx ecx, ax
shr eax, 0x10
push esi
mov esi, dword [ebp + 8]
cmp eax, 0x100
push edi
mov dword [ebp + 0xc], ecx
je 0x275b9f77
cmp eax, 0x200
je 0x275b9f52
cmp eax, 0x300
jne 0x275b9f40
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x147
push dword [esi + 0x18]
call ebx
cmp eax, 0xffffffff
jne 0x275b9eb6
test byte [esi + 0x4c], 1
jne 0x275d5c1b
mov edi, 0x104
lea eax, [ebp - 0x104]
push edi
push eax
push esi
call fcn.275b9faf
lea eax, [ebp - 0x208]
push edi
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.275ba001
xor ecx, ecx
test eax, eax
mov eax, dword [esi + 0x4c]
setne cl
and ecx, 1
and al, 0xfd
shl ecx, 1
or ecx, eax
test cl, 2
mov dword [esi + 0x4c], ecx
je 0x275b9f2a
lea eax, [ebp - 0x208]
push eax
push 0xffffffffffffffff
push esi
call fcn.275ba021
cmp eax, 0xffffffff
jne 0x275b9f2a
push 0
push eax
push 0x14e
push dword [esi + 0x18]
call ebx
movzx eax, word [ebp + 0xc]
push dword [esi]
or eax, 0x50000
push eax
push 0x111
push dword [esi + 4]
call ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
sete al
leave
ret 0xc
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, dword [esi + 0x18]
je 0x275b9f40
push 1
push esi
call fcn.275ba756
push 0
push edi
push 8
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x275b9f40
test byte [esi + 0x4c], 0x10
jne 0x275b9f40
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ebx, 0xb1
push 0
push ebx
push dword [esi + 0x1c]
call edi
push 0xffffffffffffffff
push 0
push ebx
push dword [esi + 0x1c]
call edi
push 0
push 0xfffffcdc
push esi
call fcn.27582d58
and dword [esi + 0x4c], 0xfffffffd
jmp 0x275b9f40
mov eax, dword [esi + 0x34]
test eax, eax
je 0x275b9eb6
mov edi, 0x104
lea ecx, [ebp - 0x104]
push edi
push ecx
push eax
call fcn.275abb3a
jmp 0x275b9ec9