joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2760d5df
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 0x10
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movsx edi, word [ebp + 0x10]
movsx ebx, ax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.275b9bca
push dword [0x2762e03c]
lea eax, [ebp - 0x14]
push dword [0x2762e038]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push ebx
lea eax, [ebp - 0x14]
push edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x2760d69b
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp + 0x10]
push eax
push dword [esi + 0x18]
call fcn.2762257d
test eax, eax
je 0x2760d67c
or dword [ebp - 0x11c], 0xffffffff
lea eax, [ebp - 0x118]
push 0x104
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x128]
push eax
push 0xfffffcd8
push esi
call fcn.27582d58
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [esi + 8]
and eax, 3
cmp al, 2
jne 0x2760d69b
push esi
call fcn.275ba622
test eax, eax
jne 0x2760d672
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x2760d672
xor eax, eax
jmp 0x2760d675
Function at 0x2760d80a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x14
lea eax, [esi + 0x60]
push eax
push 0x1046
call fcn.275bdc64
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
lea ebx, [esi + 0x74]
push 0x28
push ebx
push 0x1047
call fcn.275bdc64
push eax
call edi
lea eax, [esi + 0x9c]
push 0x14
push eax
push 0x1048
call fcn.275bdc64
push eax
call edi
mov eax, ebx
mov cl, byte [eax]
test cl, cl
je 0x2760d873
cmp cl, 0x79
je 0x2760d873
cmp cl, 0x4d
je 0x2760d873
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x2760d85a
cmp byte [eax], 0x79
jne 0x2760d9f7
and dword [esi + 0xb0], 0
and dword [ebp + 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esi + 0xb4]
mov ebx, 0x400
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x2a
push dword [ebp - 4]
add eax, 0x38
push eax
push ebx
call edi
test eax, eax
je 0x2760da06
inc dword [ebp + 0xc]
add dword [ebp - 4], 0x2a
cmp dword [ebp + 0xc], 0xc
jl 0x2760d89b
and dword [ebp + 0xc], 0
lea eax, [esi + 0x2ac]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0xb
push dword [ebp - 4]
add eax, 0x31
push eax
push ebx
call edi
test eax, eax
je 0x2760da06
inc dword [ebp + 0xc]
add dword [ebp - 4], 0xb
cmp dword [ebp + 0xc], 7
jl 0x2760d8cc
mov eax, dword [ebp + 8]
test byte [eax + 0x695], 2
jne 0x2760d91b
lea eax, [ebp - 0x54]
push 0x40
push eax
push 0x100c
push ebx
call edi
test eax, eax
jle 0x2760d91b
movsx eax, byte [ebp - 0x54]
sub eax, 0x30
mov dword [esi + 0x2fc], eax
lea eax, [ebp - 0x54]
push 0x40
push eax
push 0x100d
push ebx
call edi
test eax, eax
jle 0x2760d93a
movsx eax, byte [ebp - 0x54]
sub eax, 0x30
mov dword [esi + 0x300], eax
push 0xc
lea eax, [esi + 0x304]
lea ecx, [esi + 0xb4]
pop edx
mov dword [eax], ecx
add eax, 4
add ecx, 0x2a
dec edx
jne 0x2760d949
push 7
lea eax, [esi + 0x334]
lea ecx, [esi + 0x2ac]
pop edx
mov dword [eax], ecx
add eax, 4
add ecx, 0xb
dec edx
jne 0x2760d963
push 0x20
push esi
push 0x1043
call fcn.275bdc64
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
add esi, 0x20
push 0x40
push esi
push 0x1044
call fcn.275bdc64
push eax
call edi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x368], 0
je 0x2760d9ed
mov ax, word [esi + 0x464]
mov word [ebp - 0x14], ax
mov ax, word [esi + 0x466]
mov word [ebp - 0x12], ax
mov ax, word [esi + 0x46a]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.2760ff50
push esi
call fcn.27610320
lea eax, [esi + 0x3f4]
push eax
push esi
call fcn.2761046e
push esi
call fcn.276101e7
push esi
call fcn.2760fe17
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [esi + 0xb0], 1
jmp 0x2760d883
xor eax, eax
jmp 0x2760d9f0
Function at 0x27613b14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
mov esi, dword [ebp + 8]
mov eax, 0x400
test word [esi + 0xe0], ax
je 0x27613b59
mov ecx, dword [esi + 8]
test cl, 8
je 0x27613b5e
lea ecx, [ebp - 0x80]
push pe_nt_image_headers32
push ecx
push 0x1003
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x80]
add esi, 0x5c
push eax
push esi
call fcn.27612010
pop esi
leave
ret 4
test cl, 4
lea ecx, [ebp - 0x80]
push pe_nt_image_headers32
push ecx
je 0x27613b70
push 0x20
jmp 0x27613b45
push 0x1f
jmp 0x27613b45
Function at 0x2761460f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
cmp edi, 0x73
pop edx
jne 0x2761463e
test byte [esi + 0xe0], 2
jne 0x2761463e
push 0
push esi
call fcn.27613e30
pop edi
xor eax, eax
pop esi
leave
ret 0xc
test byte [esi + 8], 0x10
je 0x27614651
cmp edi, 0x71
jne 0x27614651
push esi
call fcn.276142ae
jmp 0x27614636
mov cx, word [esi + 0xe0]
test ch, 2
je 0x2761469d
mov eax, edi
sub eax, 0x25
je 0x27614698
dec eax
dec eax
jne 0x27614636
test ch, 1
je 0x27614636
lea eax, [esi + 0x5c]
push edx
push eax
call fcn.276124d5
cmp eax, 0xffffffff
je 0x27614636
and word [esi + 0xe0], 0xfdff
lea eax, [esi + 0xb0]
push 1
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x27614636
or edx, 0xffffffff
jmp 0x27614668
cmp edi, 0x24
jne 0x276146ca
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x276146ca
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x10]
push 1
push eax
push esi
call fcn.27614832
jmp 0x27614636
push dword [ebp + 0x10]
lea eax, [esi + 0x5c]
push edi
push eax
push esi
call fcn.276127d9
test eax, eax
je 0x276146e7
push esi
call fcn.27614786
jmp 0x27614636
test byte [esi + 8], 2
je 0x27614636
cmp dword [esi + 0x7c], 0xffffffff
jne 0x27614636
or byte [esi + 0xe1], 2
jmp 0x27614685

Function at 0x27614951
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
push 0x275e6080
xor edi, edi
mov dword [esi], 0x7ed
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x275e6068
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x27614998
push esi
push edi
push edi
push 0x20000030
push 1
push 0x400
call eax
mov eax, edi
pop edi
pop esi
leave
ret 4
lea eax, [ebp + 8]
push eax
push 1
push edi
push 0x275e6090
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x27614990
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x275e60c8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jne 0x27614990
lea eax, [ebp - 0x14]
push eax
call fcn.2761490e
pop ecx
mov dword [esi], eax
jmp 0x27614990

Function at 0x276149f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0x1009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0xc]
push eax
call fcn.2761490e
mov esi, dword [ebp + 0xc]
pop ecx
cmp si, 0x64
jae 0x27614a4e
lea eax, [ebp + 0xc]
push eax
call fcn.27614951
test eax, eax
mov ecx, 0x7ed
jl 0x27614a3a
mov ecx, dword [ebp + 0xc]
push 0x64
mov eax, ecx
xor edx, edx
pop edi
div edi
sub ecx, edx
cmp si, dx
jbe 0x27614a57
lea esi, [esi + ecx - 0x64]
mov ax, si
pop edi
pop esi
leave
ret 8
add esi, ecx
jmp 0x27614a4e
Function at 0x276150d9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x2761519b
cmp dword [esi + 0x14], edi
je 0x2761519b
push esi
call fcn.27615042
mov ecx, dword [esi + 0x40]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jl 0x27615107
lea edx, [ecx - 1]
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x27615112
lea eax, [ecx - 1]
cmp eax, edi
jge 0x27615118
xor eax, eax
cmp eax, ecx
jl 0x2761511f
lea eax, [ecx - 1]
mov ecx, dword [ebp + 0x14]
cmp edx, edi
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x54], eax
jl 0x27615171
mov dword [esi + 0x48], edx
mov dword [esi + 0x50], edx
cmp edx, eax
je 0x2761518e
cmp ecx, edi
je 0x2761518e
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
test byte [esi + 0xc], 8
jne 0x27615176
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x276150a9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x58], eax
push 1
pop eax
pop edi
pop esi
pop ebp
ret 0x10
mov edx, dword [esi + 0x50]
jmp 0x27615132
push 1
push esi
call fcn.27615017
push edi
push dword [esi + 0x44]
push 0x2a
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x27615165
push 1
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x27615168
xor eax, eax
jmp 0x2761516b

Function at 0x276155ff
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
cmp dword [esp + 0xc], 0
je 0x2761561a
or eax, 0x1000000
push 0x32
push dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
ret 0xc

Function at 0x27615db6
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, dword [esp + 8]
push 2
push esi
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x27615dd5
and byte [esi + 1], al
mov byte [esi], 0x2c
pop esi
ret 4
Function at 0x27615dd9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
lea esi, [ebp - 0x20]
pop ebx
push edi
mov dword [ebp - 0xc], ebx
call fcn.275c3f82
mov eax, dword [edi + 0x18]
test eax, eax
je 0x27615e23
test byte [edi + 8], 2
je 0x27615e23
cmp dword [edi + 0x30], 2
jne 0x27615e37
push 0
push 0
push 0x188
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [edi + 0x2c], eax
push edi
call fcn.275c3fc3
mov dword [ebp - 0xc], eax
movzx ecx, word [ebp - 0xc]
movzx eax, word [edi + 0x2c]
shl ecx, 0x10
pop edi
pop esi
or eax, ecx
pop ebx
leave
ret 4
lea ecx, [ebp - 0x20]
push 0x12
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [edi + 0x20], 0x10
je 0x27615ea4
lea eax, [ebp - 2]
push eax
call fcn.27615db6
cmp byte [ebp - 0x20], 0x2d
jne 0x27615e5f
or ebx, 0xffffffff
lea esi, [ebp - 0x1f]
and dword [ebp - 8], 0
mov al, byte [esi]
test al, al
je 0x27615e98
cmp al, byte [ebp - 2]
mov byte [ebp + 8], al
jne 0x27615e80
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
je 0x27615e95
mov al, byte [ebp + 8]
add al, 0xd0
cmp al, 9
ja 0x27615e23
mov ecx, dword [ebp - 8]
movsx eax, al
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*2]
mov dword [ebp - 8], eax
inc esi
jmp 0x27615e63
imul ebx, dword [ebp - 8]
mov dword [edi + 0x2c], ebx
jmp 0x27615e1a
cmp byte [ebp - 0x20], 0x78
je 0x27615ee2
cmp byte [ebp - 0x20], 0x58
je 0x27615ee2
cmp byte [ebp - 0x20], 0x30
jne 0x27615ec5
cmp byte [ebp - 0x1f], 0x78
je 0x27615ec2
cmp byte [ebp - 0x1f], 0x58
jne 0x27615ec5
lea esi, [ebp - 0x1e]
xor ecx, ecx
mov al, byte [esi]
test al, al
je 0x27615f07
cmp al, 0x41
jl 0x27615ee7
cmp al, 0x46
jg 0x27615ee7
sub al, 0x37
movsx eax, al
shl ecx, 4
add ecx, eax
inc esi
jmp 0x27615ec7
lea esi, [ebp - 0x1f]
jmp 0x27615ec5
cmp al, 0x61
jl 0x27615ef3
cmp al, 0x66
jg 0x27615ef3
sub al, 0x57
jmp 0x27615ed7
cmp al, 0x30
jl 0x27615e23
cmp al, 0x39
jg 0x27615e23
sub al, 0x30
jmp 0x27615ed7
mov dword [edi + 0x2c], ecx
jmp 0x27615e1a
Function at 0x2761684d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
mov dword [ebp - 0x5c], edi
je 0x27616866
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp + 0xc]
push 0x14
pop eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
mov dword [ebp - 0x60], eax
je 0x2761687c
mov ecx, dword [ebx + 0x1c]
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x70]
push eax
push 0xfffffe61
push esi
call fcn.27582d58
push dword [esi]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
test byte [ebp - 8], 1
jne 0x27616949
test edi, edi
je 0x27616949
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x27616949
push 4
call fcn.27597d80
push 4
mov dword [ebp - 4], eax
call fcn.27597d80
test ebx, ebx
mov edi, eax
mov esi, ebx
je 0x276168e7
push esi
push 0
push edi
call fcn.27597c8f
mov esi, dword [esi]
test esi, esi
jne 0x276168d8
mov esi, dword [ebp + 0x10]
push esi
push 0
push dword [ebp - 4]
call fcn.27597c8f
mov esi, dword [esi]
test esi, esi
jne 0x276168ea
mov eax, dword [ebp - 4]
mov esi, dword [eax]
dec esi
js 0x27616938
push esi
xor ebx, ebx
push dword [ebp - 4]
call fcn.27597d8e
cmp esi, dword [edi]
mov dword [ebp + 0x10], eax
jge 0x2761691e
push esi
push edi
call fcn.27597d8e
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
je 0x27616935
push 1
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call fcn.27594de6
dec esi
jns 0x27616903
mov ebx, dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.275972b7
push edi
call fcn.275972b7
mov esi, dword [ebp + 8]
test byte [ebp - 8], 2
jne 0x2761696c
test ebx, ebx
je 0x2761696c
test byte [ebx + 0x10], 0x20
jne 0x2761696c
push 1
push ebx
push 2
push esi
call fcn.27594de6
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x276182bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x276183a4
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x14]
push ebx
push esi
call fcn.2761806e
test byte [ebp + 8], 4
mov edi, eax
je 0x276182fd
cmp dword [ebp + 0xc], 0
je 0x276182fd
push 0
push 0xfffffecf
push edi
push esi
call fcn.275b12b3
mov eax, dword [ebp + 8]
test al, 0xe
je 0x27618331
cmp dword [ebp + 0xc], 0
jne 0x27618331
push dword [esi]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], ebx
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0x64
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test byte [ebp + 8], 0xc
je 0x276183c5
cmp dword [ebp + 0xc], 0
jne 0x276183c5
push edi
push esi
call fcn.275b17f5
push edi
push dword [esi + 0x2c]
call fcn.275abc67
movsx ecx, word [eax]
movsx edx, word [eax + 2]
sub ecx, edx
mov dword [esi + 0x44], ecx
movsx ecx, word [eax]
mov dword [esi + 0x40], ecx
sub ecx, ebx
mov dword [esi + 0x3c], ecx
movsx eax, word [eax + 2]
mov dword [esi + 0x48], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 1
push eax
push 0xfffffece
push edi
push esi
call fcn.275b12b3
test eax, eax
jne 0x276183ab
and dword [esi + 0x38], eax
push esi
call fcn.275a91f5
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebx
leave
ret 0x14
push esi
call fcn.275b0431
test eax, eax
jne 0x276183a4
push ebx
push esi
call fcn.276182a5
push eax
push esi
call fcn.27618259
jmp 0x276183a4
test byte [ebp + 8], 2
je 0x276183a4
test byte [esi + 8], 2
je 0x276183a4
cmp dword [ebp + 0xc], 0
je 0x276183e7
push 0
push 0xfffffed1
push edi
push esi
call fcn.275b12b3
jmp 0x276183a4
or dword [esi + 0x34], 1
push 5
push dword [esi + 0x30]
push esi
call fcn.275b12e1
jmp 0x276183a4
Function at 0x276190ee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x2761922f
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.275a9c95
test eax, eax
je 0x2761922f
call fcn.276190c9
test eax, eax
jne 0x2761922f
xor edi, edi
push edi
push 0xfffffffffffffff3
push esi
call fcn.27582d58
test eax, eax
jne 0x2761922f
test byte [esi + 8], 4
je 0x27619236
mov dword [ebp - 4], edi
mov dword [ebp + 8], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.275aea73
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0xc], ebx
je 0x2761922f
cmp ebx, dword [esi + 0x170]
je 0x2761922f
test byte [esi + 0x20], 0x40
je 0x276191bc
mov eax, dword [esi + 0xe8]
lea edi, [esi + 0xe8]
test al, 8
je 0x276191bc
test al, 4
je 0x276191bc
mov ebx, dword [esi]
push 0x2e
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
and dword [edi], 0xfffffff7
lea eax, [esi + 0xec]
push eax
push 0xffffffffffffff8e
push esi
call fcn.27582d58
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x2761922f
mov ebx, dword [ebp + 0xc]
push 2
push ebx
push esi
mov dword [esi + 0x170], ebx
call fcn.275acf08
test byte [ebp - 0x10], 6
mov dword [ebp + 0xc], eax
je 0x2761922f
xor edi, edi
cmp dword [ebp + 8], edi
je 0x276191de
push 4
pop edi
cmp dword [ebp - 4], 0
je 0x276191e7
or edi, 8
test eax, eax
jne 0x276191f5
push 0x275e61a0
call fcn.27622851
push dword [ebp + 0xc]
push edi
push ebx
push esi
call fcn.2761aca8
xor edi, edi
cmp dword [ebp - 4], edi
je 0x27619219
xor eax, eax
cmp dword [ebp + 8], edi
sete al
push eax
push edi
push eax
push ebx
push esi
call fcn.275b3bfc
cmp dword [ebp + 8], edi
jne 0x27619221
mov dword [esi + 0x58], ebx
push esi
call fcn.275b3499
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov dword [ebp - 4], ecx
call edi
xor ecx, ecx
test ax, ax
setl cl
mov dword [ebp + 8], ecx
jmp 0x27619147
Function at 0x2761988c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x27619937
and dword [ebp - 4], eax
and dword [ebp - 8], eax
mov edi, dword [esi + 0x68]
mov ebx, dword [esi + 0x6c]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x6c]
mov dword [ebp + 0xc], eax
push dword [esi + 0x68]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xc
push dword [ebp + 0xc]
push 0x317
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xcc0020
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push ebx
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [eax]
mov edi, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 0xc]
sub edi, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
sub ebx, edx
jmp 0x276198ba
Function at 0x2761ecaa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
push esi
mov esi, dword [eax + 0x30]
cmp esi, dword [ebp + 0x10]
jne 0x2761ecc6
xor eax, eax
pop esi
leave
ret 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
call edi
mov ecx, eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push 0xa
cdq
pop ebx
idiv ebx
mov ebx, eax
test ebx, ebx
je 0x2761ed39
cmp esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
jge 0x2761ed51
sub eax, ebx
cmp esi, eax
jge 0x2761ed39
add ecx, 0x1f4
mov dword [ebp - 8], ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2761eb47
call edi
cmp eax, dword [ebp - 8]
ja 0x2761ed39
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 8
jl 0x2761ed2b
cmp ebx, 4
jl 0x2761ed2b
lea eax, [ebx + ebx]
push 3
cdq
pop ecx
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, ebx
sub eax, ebx
cmp esi, eax
jl 0x2761ecfa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2761eb47
push 1
pop eax
pop ebx
pop edi
jmp 0x2761ecc1
sub eax, ebx
cmp esi, eax
jle 0x2761ed39
add ecx, 0x1f4
mov dword [ebp - 8], ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2761eb47
call edi
cmp eax, dword [ebp - 8]
ja 0x2761ed39
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 8
jl 0x2761ed91
cmp ebx, 0xfffffffc
jg 0x2761ed91
lea eax, [ebx + ebx]
push 3
cdq
pop ecx
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, ebx
sub eax, ebx
cmp esi, eax
jle 0x2761ed39
jmp 0x2761ed60
Function at 0x2761eec8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push edi
mov dword [ebp - 4], esi
call fcn.2761ee3d
mov eax, dword [0x2762e03c]
neg eax
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test byte [edi + 9], 8
jne 0x2761f01f
mov eax, dword [0x2762e03c]
mov esi, dword [ebp + 0xc]
mov ebx, eax
push esi
push edi
shl ebx, 2
call fcn.2761ee61
test eax, eax
je 0x2761ef20
mov ebx, dword [0x2762e03c]
neg ebx
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp dword [ebp + 0x10], eax
jge 0x2761ef70
push 8
push 0
push edi
call fcn.2761e7d6
mov ebx, eax
cmp ebx, esi
jne 0x2761ef43
push esi
push edi
call fcn.2761e75c
mov ebx, eax
mov eax, esi
push 0
sub eax, dword [edi + 0x5c]
push 0x60
pop ecx
cdq
idiv ecx
push eax
push edi
call fcn.2761cbf6
test ebx, ebx
mov dword [ebp - 4], eax
je 0x2761efa4
mov eax, dword [ebx]
push 1
pop ecx
test cl, al
jne 0x2761efa4
or eax, ecx
mov dword [ebx], eax
mov dword [ebp - 4], ecx
jmp 0x2761efa4
mov eax, dword [ebp - 8]
add ebx, eax
cmp dword [ebp + 0x10], ebx
jl 0x2761efbc
mov eax, dword [esi]
push 1
pop ecx
test cl, al
jne 0x2761ef8a
or eax, ecx
mov dword [ebp - 4], ecx
mov dword [esi], eax
mov eax, dword [edi + 0x28]
dec eax
push eax
mov eax, esi
sub eax, dword [edi + 0x5c]
push 0x60
pop ecx
cdq
idiv ecx
push eax
push edi
call fcn.2761cbf6
or dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x2761efb2
push 0
push edi
call fcn.2761d0cf
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [esi + 0x30], 0
jne 0x2761efc7
test byte [esi], 8
je 0x2761efa4
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x2761efa4
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x34]
add eax, ecx
cmp dword [ebp + 0x10], eax
jle 0x2761efa4
mov ecx, dword [0x2762e03c]
add ecx, eax
cmp dword [ebp + 0x10], ecx
jge 0x2761efa4
push 0
push esi
push edi
call fcn.2761e6c9
or dword [esi], 1
mov ecx, dword [edi + 0x5c]
sub eax, ecx
push 0x60
cdq
pop ebx
idiv ebx
push eax
mov eax, esi
sub eax, ecx
push ebx
cdq
pop ecx
idiv ecx
push eax
push edi
call fcn.2761cbf6
mov dword [ebp - 4], 1
jmp 0x2761efa4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x30], esi
jne 0x2761f030
test byte [eax], 8
je 0x2761efa4
mov ecx, dword [eax + 0x3c]
add ecx, dword [eax + 0x34]
cmp dword [ebp + 0x10], ecx
jle 0x2761efa4
push 1
pop ecx
or dword [eax], ecx
jmp 0x2761ef6b