joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401af4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401baa
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x47d5cc
call sub.KERNEL32.DLL_VirtualQuery
cmp byte [0x47d04d], 0
je 0x401b22
push 0x47d5cc
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, 0x47d5ec
call fcn.004014b8
mov eax, 0x47d5fc
call fcn.004014b8
mov eax, 0x47d628
call fcn.004014b8
push 0xff8
push 0
call sub.KERNEL32.DLL_SetThreadLocale
mov dword [0x47d624], eax
cmp dword [0x47d624], 0
je 0x401b89
mov eax, 3
mov edx, dword [0x47d624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401b5f
mov eax, 0x47d60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x47d618], eax
mov byte [0x47d5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401bb1
cmp byte [0x47d04d], 0
je 0x401ba9
push 0x47d5cc
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x401bb8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x47d5c4], 0
je 0x401c95
xor edx, edx
push ebp
push 0x401c8e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x47d04d], 0
je 0x401bea
push 0x47d5cc
call sub.KERNEL32.DLL_WaitForSingleObject
mov byte [0x47d5c4], 0
mov eax, dword [0x47d624]
push eax
call sub.KERNEL32.DLL_SizeofResource
xor eax, eax
mov dword [0x47d624], eax
mov ebx, dword [0x47d5ec]
jmp 0x401c1d
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, dword [ebx]
cmp ebx, 0x47d5ec
jne 0x401c0b
mov eax, 0x47d5ec
call fcn.004014b8
mov eax, 0x47d5fc
call fcn.004014b8
mov eax, 0x47d628
call fcn.004014b8
mov eax, dword [0x47d5e4]
test eax, eax
je 0x401c63
mov edx, dword [eax]
mov dword [0x47d5e4], edx
push eax
call sub.KERNEL32.DLL_SizeofResource
mov eax, dword [0x47d5e4]
test eax, eax
jne 0x401c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c95
cmp byte [0x47d04d], 0
je 0x401c83
push 0x47d5cc
call sub.KERNEL32.DLL_WriteFile
push 0x47d5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret
Function at 0x4021e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x47d5c4], 0
jne 0x4021fd
call fcn.00401af4
test al, al
je 0x402205
cmp ebx, 0x7ffffff8
jle 0x40220f
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402363
xor ecx, ecx
push ebp
push 0x40235c
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47d04d], 0
je 0x402230
push 0x47d5cc
call sub.KERNEL32.DLL_WaitForSingleObject
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x402240
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x4022df
mov eax, ebx
test eax, eax
jns 0x402255
add eax, 3
sar eax, 2
mov edx, dword [0x47d624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x4022df
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402290
mov eax, ebx
test eax, eax
jns 0x40227f
add eax, 3
sar eax, 2
mov ecx, dword [0x47d624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x4022b6
mov ecx, ebx
test ecx, ecx
jns 0x402299
add ecx, 3
sar ecx, 2
mov edi, dword [0x47d624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47d5b4]
sub ebx, 4
add dword [0x47d5b8], ebx
call fcn.004043f8
jmp 0x402363
cmp ebx, dword [0x47d61c]
jg 0x402331
sub dword [0x47d61c], ebx
cmp dword [0x47d61c], 0xc
jge 0x402303
add ebx, dword [0x47d61c]
xor eax, eax
mov dword [0x47d61c], eax
mov eax, dword [0x47d620]
add dword [0x47d620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x47d5b4]
sub ebx, 4
add dword [0x47d5b8], ebx
call fcn.004043f8
jmp 0x402363
mov eax, ebx
call fcn.004020ec
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402363
cmp byte [0x47d04d], 0
je 0x40235b
push 0x47d5cc
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x47d5c8], eax
cmp byte [0x47d5c4], 0
jne 0x4023a8
call fcn.00401af4
test al, al
jne 0x4023a8
mov dword [0x47d5c8], 8
mov dword [ebp - 4], 8
jmp 0x402509
xor ecx, ecx
push ebp
push 0x402502
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47d04d], 0
je 0x4023c9
push 0x47d5cc
call sub.KERNEL32.DLL_WaitForSingleObject
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4023e4
mov dword [0x47d5c8], 9
jmp 0x4024d9
dec dword [0x47d5b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x47d5b8], eax
test bl, 1
je 0x402444
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402414
test edx, 0x80000003
je 0x402423
mov dword [0x47d5c8], 0xa
jmp 0x4024d9
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40243b
mov dword [0x47d5c8], 0xa
jmp 0x4024d9
add ebx, edx
mov esi, eax
call fcn.00401c98
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x47d620]
jne 0x402484
sub dword [0x47d620], ebx
add dword [0x47d61c], ebx
cmp dword [0x47d61c], 0x3c00
jle 0x402475
call fcn.00401f88
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004043f8
jmp 0x402509
mov edx, dword [eax]
test dl, 2
je 0x4024a7
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4024a2
mov dword [0x47d5c8], 0xb
jmp 0x4024d9
or dword [eax], 1
jmp 0x4024d0
mov eax, edi
cmp dword [eax + 4], 0
je 0x4024ba
cmp dword [eax], 0
je 0x4024ba
cmp dword [eax + 8], 0xc
jge 0x4024c6
mov dword [0x47d5c8], 0xb
jmp 0x4024d9
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c98
mov edx, ebx
mov eax, esi
call fcn.00401f00
mov eax, dword [0x47d5c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402509
cmp byte [0x47d04d], 0
je 0x402501
push 0x47d5cc
call sub.KERNEL32.DLL_WriteFile
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x403280
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x47a008], 0x8088405
inc edx
mov dword [ebx + 0x47a008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x403494
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x4034c0
cmp edx, 3
ja 0x403556
call dword [ebx + 0x24]
test eax, eax
je 0x4034c0
call fcn.0040293c
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x40346c
mov dword [ebx + 0x1c], 0x402c5c
cmp byte [ebx + 0x48], 0
je 0x40353d
mov eax, 0xc0000000
mov dl, byte [0x47a00c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x47a06c]
mov ecx, 2
sub edi, 3
je 0x40351f
mov ecx, 3
inc edi
je 0x40351f
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x40351f
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetProcAddress
cmp eax, 0xffffffff
je 0x40355d
mov dword [ebx], eax
jmp 0x40356d
mov dword [ebx + 0x24], 0x402c5c
cmp edi, 3
je 0x40354d
push 0xfffffffffffffff6
jmp 0x40354f
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x403534
mov eax, 0x66
jmp 0x403568
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_GlobalLock
call fcn.0040293c
pop edi
pop esi
pop ebx
ret

Function at 0x404794
Capabilities:
Get common file path

Disassembly:
push ecx
cmp byte [0x47d04c], 0
je 0x4047f5
cmp word [0x47d220], 0xd7b2
jne 0x4047bd
cmp dword [0x47d228], 0
jbe 0x4047bd
mov eax, 0x47d21c
call dword [0x47d238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47a094
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetSystemDirectoryA
push eax
call sub.KERNEL32.DLL_GetUserDefaultLCID
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40481c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetSystemDirectoryA
push eax
call sub.KERNEL32.DLL_GetUserDefaultLCID
pop edx
ret
cmp byte [0x47a034], 0
jne 0x404811
push 0
push 0x47a08c
push 0x47a094
push 0
call sub.user32.dll_WinHelpA
pop edx
ret

Function at 0x40504c
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x405060
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x405044
ret

Function at 0x405f08
Capabilities:
Read file on windows

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [esp + 0x10], 0x1000
jne 0x405f28
mov eax, dword [esp + 4]
jmp 0x405f2a
xor eax, eax
add esp, 0x1c
ret
Function at 0x405fbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x406150
call sub.KERNEL32.DLL_GlobalSize
mov esi, eax
test esi, esi
je 0x406024
push 0x406160
push esi
call sub.KERNEL32.DLL_GlobalUnlock
mov ebx, eax
test ebx, ebx
je 0x406024
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x406024
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadResource
jmp 0x406146
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x406064
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x406146
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00405fa8
mov esi, eax
cmp byte [esi], 0
je 0x406146
lea eax, [esi + 1]
call fcn.00405fa8
mov esi, eax
cmp byte [esi], 0
je 0x406146
jmp 0x40606a
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LoadResource
jmp 0x406129
lea eax, [esi + 1]
call fcn.00405fa8
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x406146
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_LoadResource
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GlobalDeleteAtom
mov esi, eax
cmp esi, 0xffffffff
je 0x406146
push esi
call sub.KERNEL32.DLL_GlobalAlloc
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_LockResource
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x406146
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_LoadResource
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_LockResource
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x406088
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406174
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GlobalReAlloc
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063a4
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4061f7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063a4
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4061f7
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4063c0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x406280
xor eax, eax
push ebp
push 0x406279
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405fbc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40625e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4063e0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40625e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406280
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadResource
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_LeaveCriticalSection
push eax
call sub.KERNEL32.DLL_GlobalHandle
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40639a
cmp byte [ebp - 0xd], 0
jne 0x4062c7
cmp byte [ebp - 0x12], 0
je 0x40639a
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4062e0
dec ebx
cmp byte [ebx], 0x2e
je 0x4062ef
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4062df
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40639a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40632c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_LoadResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x40639a
cmp byte [ebp - 0xd], 0
je 0x40639a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LoadResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x40639a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LoadResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4092fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
or eax, 0xffffffff
mov esi, ebx
and esi, 3
cmp esi, 2
ja 0x40934f
mov edx, ebx
and edx, 0xf0
cmp edx, 0x40
ja 0x40934f
push 0
push 0x80
push 3
push 0
mov eax, ebx
and eax, 0xf0
shr eax, 4
mov eax, dword [eax*4 + 0x47a170]
push eax
mov eax, dword [esi*4 + 0x47a164]
push eax
mov eax, edi
call fcn.00404e54
push eax
call sub.user32.dll_GetKeyState
pop edi
pop esi
pop ebx
ret

Function at 0x409354
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, ebx
call fcn.00404e54
push eax
call sub.user32.dll_GetKeyState
pop ebx
ret

Function at 0x409490
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x4094b0
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_GetMenuStringA
test eax, eax
jne 0x4094b0
call sub.user32.dll_GetWindowTextA
jmp 0x4094ef
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x409498
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_GetMenuItemID
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetMenuItemCount
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.00404c04
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x409544
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_GetMenuStringA
test eax, eax
je 0x409561
mov eax, ebx
call fcn.00409490
pop ebx
ret
call sub.user32.dll_GetWindowTextA
pop ebx
ret
Function at 0x40d040
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d116
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a2c
lea eax, [ebp - 8]
call fcn.00404ea4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e54
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d100
mov eax, ebx
call fcn.004027b4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d0f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e54
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d0e3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d128
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d0e3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d100
mov eax, dword [ebp - 0x10]
call fcn.004027d4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d11d
lea eax, [ebp - 8]
call fcn.00404994
ret

Function at 0x40dda8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40de38
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetWindowTextA
mov ebx, eax
test ebx, ebx
je 0x40de04
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0040bf94
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x47be98]
mov dl, 1
mov eax, dword [0x4087c8]
call fcn.0040c8a0
mov edx, eax
jmp 0x40de18
mov ecx, dword [0x47bfd4]
mov dl, 1
mov eax, dword [0x4087c8]
call fcn.0040c864
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.0040434c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de3f
lea eax, [ebp - 0x14]
call fcn.00404994
ret

Function at 0x40e044
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
test dl, dl
je 0x40e052
add esp, 0xfffffff0
call fcn.00403ee4
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403b90
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyNameTextA
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.user32.dll_GetKeyNameTextA
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x4088d4]
call fcn.00403b90
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40e0b1
call fcn.00403f3c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41d178
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x41d19b
add esp, 0xfffffff0
call fcn.00403ee4
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x41d2a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x41d223
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.00409378
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d070
cmp dword [ebx + 4], 0
jge 0x41d286
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0040969c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x1c]
call fcn.0040bf94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x47c060]
mov dl, 1
mov eax, dword [0x417954]
call fcn.0040c8a0
call fcn.0040434c
jmp 0x41d286
movzx edx, di
mov eax, esi
call fcn.004092fc
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d070
cmp dword [ebx + 4], 0
jge 0x41d286
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040969c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x24]
call fcn.0040bf94
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x47b9f8]
mov dl, 1
mov eax, dword [0x4179b0]
call fcn.0040c8a0
call fcn.0040434c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d2a8
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004049b8
ret

Function at 0x420bdc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x420bf5
add esp, 0xfffffff0
call fcn.00403ee4
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x420c86
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403b90
call fcn.0042097c
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], bl
push esi
push 4
lea eax, [esi + 8]
push eax
mov ecx, 0x420b34
xor edx, edx
xor eax, eax
call fcn.00404948
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x420c70
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x10]
call fcn.0040bf94
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47bfac]
mov dl, 1
mov eax, dword [0x418bd0]
call fcn.0040c8a0
call fcn.0040434c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420c8d
lea eax, [ebp - 0x10]
call fcn.00404994
ret
Function at 0x420ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
call sub.user32.dll_GetSystemMetrics
mov edx, dword [0x47c064]
cmp eax, dword [edx]
jne 0x420e03
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x420f16
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyNameTextA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x420efe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x47d86c
call sub.user32.dll_GetLastActivePopup
xor eax, eax
push ebp
push 0x420ee0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47a540], 0
jne 0x420e53
mov dl, 1
mov eax, dword [0x417df0]
call fcn.00403b90
mov dword [0x47a540], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x47a540]
call fcn.0041a380
call fcn.00420970
cmp word [0x47a52e], 0
je 0x420e86
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [0x47a530]
call dword [0x47a52c]
push 0x47d86c
call sub.user32.dll_PostQuitMessage
xor eax, eax
push ebp
push 0x420ec1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420ec8
push 0x47d86c
call sub.user32.dll_GetLastActivePopup
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424bd8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424bde
ret

Function at 0x426918
Capabilities:
Read clipboard data

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.004260f4
push eax
call sub.user32.dll_GetClipboardData
mov eax, dword [ebx + 0x14]
call fcn.004260f4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_DrawTextA
mov eax, dword [ebx + 0x14]
call fcn.004261d4
test al, al
jne 0x42696b
mov eax, dword [ebx + 0x14]
call fcn.004260b8
call fcn.00425434
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnableScrollBar
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnableWindow
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.004260b8
call fcn.00425434
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnableScrollBar
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnableWindow
pop ebx
ret