joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abc3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp ebx, 0x11
je 0x40abe4
push 0x11
call edi
shr eax, 0xf
test al, 1
je 0x40abe7
push 2
pop esi
cmp ebx, 0x10
je 0x40abf7
push 0x10
call edi
shr eax, 0xf
test al, 1
je 0x40abfa
or esi, 4
cmp ebx, 0x12
je 0x40ac0a
push 0x12
call edi
shr eax, 0xf
test al, 1
je 0x40ac0d
or esi, 1
cmp ebx, 0x5b
je 0x40ac2d
cmp ebx, 0x5c
je 0x40ac2d
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x40ac2d
push 0x5c
call edi
shr eax, 0xf
test al, 1
je 0x40ac30
or esi, 8
cmp ebx, 0x11
je 0x40ac49
cmp ebx, 0x10
je 0x40ac49
cmp ebx, 0x12
je 0x40ac49
cmp ebx, 0x5b
je 0x40ac49
cmp ebx, 0x5c
jne 0x40ac4b
xor ebx, ebx
movzx eax, bl
shl esi, 8
or si, ax
mov eax, dword [ebp + 8]
pop edi
mov word [eax], si
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40ccb5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
xor esi, esi
mov dword [ebp - 0x18], eax
push 0x438
lea ebx, [eax + 4]
mov dword [ebp - 0x14], esi
push dword [ebx]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00402de9
mov eax, dword [ebp - 8]
mov ecx, dword [0x5491e8]
mov dword [ebp - 0x10], eax
add eax, 2
push esi
mov dword [ebp - 8], eax
call fcn.0044c51c
push ecx
push ecx
mov ecx, esp
mov esi, eax
sub esp, 0x10
lea eax, [ebp - 0x14]
and dword [ecx], 0
mov ecx, esp
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
push dword [ebx]
add ecx, 0x68
call fcn.0041ad0a
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp - 0x18]
mov ecx, dword [esi + 0x10]
push 5
mov dword [edx + 0x94], ecx
mov dword [edx + 0x98], eax
push dword [edx + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x499
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret

Function at 0x40e542
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, ecx
push 0x493
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4aa
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
neg esi
sbb esi, esi
and esi, 5
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
ret
Function at 0x40efd1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.004f4d40
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x101c]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], edi
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x40f15e
push ebx
mov ebx, dword [ebp - 0x101c]
push esi
shr ebx, 2
xor esi, esi
mov dword [ebp - 0x1018], esi
test ebx, ebx
je 0x40f15c
call fcn.00402cbd
push eax
lea ecx, [ebp - 0x1010]
call fcn.00402161
mov ecx, dword [ebp + esi*4 - 0x1004]
lea edx, [ebp - 0x1010]
call fcn.004035ca
mov esi, dword [ebp - 0x1010]
test al, al
je 0x40f12e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x1020]
call fcn.00401f21
xor eax, eax
cmp dword [edi + 4], eax
mov edi, dword [ebp - 0x1020]
mov dword [ebp - 0x100c], eax
jbe 0x40f0c2
mov ecx, dword [ebp - 0x1008]
push eax
call fcn.00402478
push edi
mov ecx, eax
call fcn.00401fc2
test eax, eax
je 0x40f152
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 0x1008]
inc eax
mov dword [ebp - 0x100c], eax
cmp eax, dword [ecx + 4]
jb 0x40f08e
push 0
push esi
push dword [0x547d9c]
call dword [sym.imp.SHELL32.dll_ExtractIconW]
mov dword [ebp - 0x1024], eax
test eax, eax
je 0x40f152
mov ecx, dword [ebp - 0x1014]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x100c], eax
cmp eax, dword [ecx + 8]
jb 0x40f100
inc eax
push eax
call fcn.00420591
test al, al
je 0x40f16d
mov ecx, dword [ebp - 0x1014]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x100c]
mov esi, dword [ebp - 0x1024]
push edi
mov dword [eax + edx*4], esi
inc dword [ecx + 4]
mov ecx, dword [ebp - 0x1008]
call fcn.0041e3a3
lea ecx, [edi - 0x10]
call fcn.004033d1
mov esi, dword [ebp - 0x1010]
lea ecx, [esi - 0x10]
call fcn.004033d1
mov esi, dword [ebp - 0x1018]
inc esi
mov dword [ebp - 0x1018], esi
cmp esi, ebx
jae 0x40f15c
mov edi, dword [ebp - 0x1008]
jmp 0x40f037
lea ecx, [edi - 0x10]
call fcn.004033d1
jmp 0x40f12e
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004b3dd4
leave
ret 8
push 0x8007000e
call fcn.0040345b
int3
Function at 0x4107e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, ecx
xor eax, eax
push 0x4a5
mov dword [ebp - 0x14], eax
push dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 4]
call fcn.00402de9
mov eax, dword [ebp - 8]
mov ecx, dword [0x5491e8]
mov dword [ebp - 0x10], eax
add eax, 2
push 0
mov dword [ebp - 8], eax
call fcn.0044c51c
push ecx
push ecx
mov ecx, esp
mov esi, eax
sub esp, 0x10
lea eax, [ebp - 0x14]
and dword [ecx], 0
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebx + 0x28]
push dword [ebx + 4]
call fcn.0041ad0a
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esi + 0x10]
push 5
mov dword [ebx + 0x54], ecx
mov dword [ebx + 0x58], eax
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4a6
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call esi
push 0x4a7
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret

Function at 0x41194b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov edi, ecx
jne 0x411a22
mov eax, dword [ebp + 0xc]
cmp eax, 0x14
jne 0x41197a
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
xor eax, eax
inc eax
jmp 0x411a24
cmp eax, 0xf
jne 0x41198e
sub esp, 0x10
call fcn.00411a32
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x411972
cmp eax, 0x113
jne 0x4119a4
push 1
call fcn.004014af
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x411972
cmp eax, 0x201
jne 0x4119da
lea esi, [edi + 0x30]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push dword [edi + 4]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov byte [edi + 0x40], 1
call dword [sym.imp.USER32.dll_SetCapture]
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41199c
cmp eax, 0x200
jne 0x411a0e
cmp byte [edi + 0x40], 0
je 0x41199c
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, dword [edi + 0x34]
add dword [edi + 0x2c], eax
mov eax, dword [esp + 8]
mov dword [edi + 0x34], ecx
mov ecx, edi
mov dword [edi + 0x30], eax
push 0
jmp 0x411997
cmp eax, 0x202
jne 0x411a22
sub esp, 0x10
call fcn.00411d24
jmp 0x411987
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x41223c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412255
lea ecx, [esi + 0x34]
pop esi
jmp fcn.0040785c
pop esi
ret
Function at 0x4140c1
Capabilities:
Get keyboard layout
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
mov edi, ecx
jne 0x4141f5
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x38]
cmp eax, 0x258
ja 0x414206
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x2c
mov ebx, eax
mov dword [ebp - 0x34], 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.004b6620
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp ebx, dword [edi + 0x28]
mov ecx, dword [ebp - 0x28]
setne al
cmp ecx, dword [edi + 0x24]
jne 0x41415b
test al, al
je 0x414206
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ebx
test al, al
jne 0x41416f
test byte [ebp - 0x30], 1
je 0x4141fb
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
call fcn.004142fa
test byte [ebp - 0x30], 1
je 0x41419b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x4141a5
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 2
pop ecx
call fcn.0044a46f
mov ecx, dword [ebp - 0x40]
add eax, eax
push 0x50
push dword [ebp - 0x40]
neg ecx
push dword [ebp - 0x44]
sub ecx, eax
mov eax, dword [ebp - 0x38]
add eax, ecx
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor ebx, ebx
push ebx
push 0x3e8
push 2
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x414206
cmp dword [ebp + 0xc], 2
jne 0x414206
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret 0x10

Function at 0x4143da
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
call fcn.00402cbd
mov ecx, dword [ebp + 8]
push eax
call fcn.00402161
movzx ebx, word [ebp + 0xc]
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jle 0x414424
mov ecx, dword [ebp + 8]
push edi
push edi
call fcn.0040335d
push eax
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [edi - 1]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004033a6
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41442d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00402cbd
push eax
lea ecx, [ebp - 4]
call fcn.00402161
push 9
push 9
lea ecx, [ebp - 4]
call fcn.0040335d
push eax
movzx eax, word [ebp + 0xc]
push 0x59
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00422564
mov eax, dword [ebp - 4]
lea ecx, [ebp - 4]
mov esi, dword [eax - 0xc]
push esi
call fcn.0040335d
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004d5669
pop ecx
pop ecx
push esi
lea ecx, [ebp - 4]
call fcn.004033a6
mov edi, dword [ebp - 4]
lea ecx, [edi - 0x10]
call fcn.004021de
mov esi, dword [ebp + 8]
lea ecx, [edi - 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.004033d1
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x418f81
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0
mov esi, 0x5492b0
mov edi, ecx
push esi
call fcn.0045cc98
xor ebx, ebx
inc ebx
push ebx
push 0x5492c0
call fcn.0045cc98
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.0045aa11
push ebx
lea ecx, [esp + 0x14]
call fcn.0045aa11
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push dword [0x5493e8]
call fcn.0045a867
mov edx, dword [0x5493e8]
test al, al
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push dword [0x5493ec]
cmovne edx, ebx
mov dword [0x5493e8], edx
call fcn.0045a867
mov ecx, dword [0x5493ec]
test al, al
cmovne ecx, ebx
cmp byte [0x5494d0], 0
mov dword [0x5493ec], ecx
lea ecx, [edi + 0x17e8]
je 0x41901f
call fcn.0043c22d
jmp 0x419027
push dword [edi + 4]
call fcn.0043c1cf
movzx eax, byte [0x5493fc]
mov ecx, edi
push eax
call fcn.00418e1a
call fcn.00402cbd
push eax
lea ecx, [esp + 0x14]
call fcn.00402161
push 0
mov edx, str.Options.json
lea ecx, [esp + 0x14]
call fcn.0045b3d7
mov esi, dword [esp + 0x14]
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x419080
mov eax, edi
lea ecx, [edi + 0x24]
push dword [eax + 4]
call fcn.00419da6
lea ecx, [edi + 0x24]
call fcn.0042f2cc
jmp 0x419101
push str.startup_show
lea ecx, [esp + 0x18]
call fcn.00401f21
mov ecx, dword [0x549184]
lea eax, [esp + 0x14]
push eax
call fcn.0043ca85
mov ecx, dword [esp + 0x14]
mov bl, al
add ecx, 0xfffffff0
call fcn.004033d1
test bl, bl
jne 0x4190f6
push str.startup_minimized
lea ecx, [esp + 0x18]
call fcn.00401f21
mov ecx, dword [0x549184]
lea eax, [esp + 0x14]
push eax
call fcn.0043ca85
mov ecx, dword [esp + 0x14]
mov bl, al
add ecx, 0xfffffff0
call fcn.004033d1
test bl, bl
jne 0x419101
mov eax, dword [0x5493dc]
cmp eax, 1
je 0x4190f6
test eax, eax
jne 0x419101
cmp byte [0x5493d8], al
je 0x419101
push dword [edi + 4]
lea ecx, [edi + 0x24]
call fcn.00419da6
push dword [0x5494dc]
push ecx
lea ecx, [edi + 0x1248]
call fcn.00414000
lea ecx, [esi - 0x10]
call fcn.004033d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42274a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x10], ecx
call fcn.00402cbd
push eax
lea ecx, [ebp - 0xc]
call fcn.00402161
xor ebx, ebx
lea ecx, [ebp - 0xc]
push ebx
mov edx, str.DictionaryHistory.json
call fcn.0045b3d7
mov esi, dword [ebp - 0xc]
pop ecx
test al, al
je 0x422847
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x422792
mov bl, 1
jmp 0x422847
push edi
call fcn.00402cbd
push eax
lea ecx, [ebp - 0x14]
call fcn.00402161
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.0043df32
test al, al
je 0x42283b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
call fcn.0043f71a
mov edi, eax
test edi, edi
je 0x42283b
mov edx, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
call dword [edx + 0x18]
mov ecx, dword [ebp - 0x10]
call fcn.00422b1b
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], ebx
jbe 0x422829
mov esi, dword [ebp - 0x10]
call fcn.00402cbd
push eax
lea ecx, [ebp - 4]
call fcn.00402161
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0043f30f
test al, al
je 0x422812
push dword [ebp - 4]
mov ecx, esi
call fcn.00422af4
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov eax, dword [ebp - 8]
inc ebx
cmp ebx, dword [eax + 0xc]
jb 0x4227e9
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.00422990
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov bl, 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004033d1
pop edi
lea ecx, [esi - 0x10]
call fcn.004033d1
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x428096
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4280b2
xor al, al
jmp 0x4280eb
call fcn.00402cbd
push eax
lea ecx, [ebp - 4]
call fcn.00402161
mov ecx, dword [esi]
lea edx, [ebp - 4]
call fcn.0043df32
mov esi, dword [ebp - 4]
test al, al
jne 0x4280d5
xor bl, bl
jmp 0x4280e1
push 0
push esi
mov ecx, edi
call fcn.0043b777
mov bl, al
lea ecx, [esi - 0x10]
call fcn.004033d1
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429a21
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xfffffe62
je 0x429b39
cmp eax, 0xfffffe64
je 0x429b0e
cmp eax, 0xfffffffd
je 0x429ab4
cmp eax, 0xfffffffe
jne 0x429be9
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
lea eax, [ebp + 0x10]
push dword [ebp - 8]
lea ecx, [edi + 0x54]
push eax
call fcn.00428c96
test byte [ebp + 0x10], 2
je 0x429be9
push eax
lea eax, [ebp + 0x13]
mov ecx, edi
push eax
call fcn.00429c15
cmp byte [ebp + 0x13], 0
je 0x429be9
test eax, eax
je 0x429be9
push eax
push 0
call fcn.00463f66
jmp 0x429be9
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
lea ebx, [edi + 0x54]
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
lea eax, [ebp + 0x10]
mov ecx, ebx
push dword [ebp - 8]
push eax
call fcn.00428c96
mov esi, eax
test esi, esi
je 0x429b03
test byte [ebp + 0x10], 4
je 0x429b03
push esi
mov ecx, ebx
call fcn.00428a95
test eax, eax
jne 0x429b03
push esi
mov ecx, edi
call fcn.00429e6f
jmp 0x429be9
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x429be9
cmp word [esi + 0xc], 0x2e
jne 0x429be9
push 0
lea eax, [ebp + 0x13]
push eax
call fcn.00429c15
cmp byte [ebp + 0x13], 0
je 0x429be9
push eax
call fcn.004636a0
jmp 0x429be9
push dword [esi + 0x14]
lea eax, [ebp + 0x13]
push eax
call fcn.00429c15
cmp byte [ebp + 0x13], 0
mov edi, eax
je 0x429b72
push 0x3ff
lea eax, [ebp + 0x10]
mov ecx, edi
push eax
call fcn.0041b79c
push dword [eax]
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.004d3032
mov ecx, dword [ebp + 0x10]
add esp, 0xc
jmp 0x429be1
mov edx, edi
lea ecx, [ebp + 0x14]
call fcn.00428d02
lea eax, [edi + 0xc]
push eax
push 0x522adc
lea edx, [ebp + 0x14]
lea ecx, [ebp - 4]
call fcn.00401e53
pop ecx
mov edx, eax
lea ecx, [ebp + 0x10]
call fcn.0041b766
pop ecx
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004033d1
push 0x3ff
lea eax, [ebp - 4]
push eax
lea ecx, [ebp + 0x10]
call fcn.0041b79c
push dword [eax]
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.004d3032
mov ecx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004033d1
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x42aba2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
xor ecx, ecx
movzx eax, si
test ebx, ebx
cmovne eax, ecx
mov dword [edi], 1
mov word [edi + 4], ax
movzx eax, si
jne 0x42abd3
push ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
mov word [edi + 6], ax
mov eax, ebx
neg eax
sbb eax, eax
and dword [edi + 0xc], 0
and dword [edi + 0x10], 0
and eax, 4
cmp dword [ebp + 8], 0
mov dword [edi + 8], eax
je 0x42abf7
or eax, 2
mov dword [edi + 8], eax
test ebx, ebx
jne 0x42ac11
and esi, 0xff00
mov ecx, 0xe000
cmp si, cx
jne 0x42ac11
or eax, 1
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42e991
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x42e9ae
cmp byte [esi + 5], 0
je 0x42e9ae
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 5], 0
pop esi
ret

Function at 0x42f2cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00402cbd
push eax
lea ecx, [ebp - 4]
call fcn.00402161
push 0xb3
lea eax, [ebp - 8]
push eax
call fcn.00451d23
push str.6.10.0
push dword [eax]
lea eax, [ebp - 4]
push 0x522768
push str._s__s__s_n_n
push eax
call fcn.004023f1
mov ecx, dword [ebp - 8]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [0x549210]
lea ecx, [ecx - 0x10]
call fcn.004021de
lea ecx, [ebp - 8]
lea esi, [eax + 0x10]
mov dword [ebp - 8], esi
call fcn.0045ca50
lea ecx, [esi - 0x10]
mov dword [ebp - 0x14], eax
call fcn.004033d1
call fcn.00402cbd
push eax
lea ecx, [ebp - 8]
call fcn.00402161
push str.help.txt
mov edx, 0x549208
lea ecx, [ebp - 0xc]
call fcn.00401e53
mov esi, dword [ebp - 0xc]
lea edx, [ebp - 8]
pop ecx
mov ecx, esi
call fcn.0045b716
mov edi, dword [ebp - 8]
test al, al
jne 0x42f37c
xor bl, bl
jmp 0x42f389
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [esi - 0x10]
call fcn.004033d1
test bl, bl
je 0x42f3c5
call fcn.00402cbd
push eax
lea ecx, [ebp - 8]
call fcn.00402161
lea edx, [ebp - 8]
mov ecx, edi
call fcn.0043df32
mov esi, dword [ebp - 8]
test al, al
je 0x42f3c0
push dword [esi - 0xc]
lea ecx, [ebp - 4]
push esi
call fcn.00402366
lea ecx, [esi - 0x10]
jmp 0x42f401
lea eax, [ebp - 8]
push eax
push 0xc7
lea eax, [ebp - 0x10]
push eax
call fcn.00451d23
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0041b766
pop ecx
lea ecx, [ebp - 4]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00402366
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004033d1
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 4]
push eax
add ecx, 0x98
call fcn.00408924
lea ecx, [edi - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004033d1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430844
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
lea ecx, [ebx + 0x30]
mov dword [ebp - 0x28], edi
call fcn.00433141
xor eax, eax
lea ecx, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00433141
mov edi, dword [ebx + 0x620]
xor eax, eax
mov esi, dword [ebp - 0x18]
add edi, edi
sub edi, dword [ebp - 0x10]
add edi, dword [ebp - 8]
sub esi, dword [ebp - 0x20]
push 5
pop ecx
cmp esi, edi
cmovge eax, ecx
push eax
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp + 0x10], 0
jne 0x4308fa
cmp esi, edi
jl 0x4308fa
cmp byte [ebp + 0x14], 0
je 0x4308fa
mov edx, dword [ebp - 0x10]
sub edx, dword [ebx + 0x620]
mov ecx, dword [ebp - 8]
sub edx, ecx
add edx, dword [ebp - 0x18]
mov eax, edx
sub eax, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
mov dword [ebp - 8], ecx
push eax
push dword [ebp - 0x28]
call fcn.0041e124
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret 0x10

Function at 0x430b03
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, ecx
push edi
push 5
xor edi, edi
cmp byte [0x549409], 0
pop eax
cmovne edi, eax
push edi
push dword [ebx + 0x4b4]
call esi
push edi
push dword [ebx + 0x2f4]
call esi
cmp byte [0x549409], 0
je 0x430b77
push dword [0x54940c]
lea ecx, [ebx + 0x4b0]
call fcn.00412dbe
mov eax, dword [0x54942c]
cmp dword [eax - 0xc], 0
je 0x430b82
push 1
mov esi, 0x54942c
lea ecx, [ebx + 0x2f0]
push esi
call fcn.00408924
mov ecx, esi
call fcn.004033fc
jmp 0x430b82
lea ecx, [ebx + 0x2f0]
call fcn.00408b83
mov ecx, ebx
call fcn.0042fe89
lea ecx, [ebx + 0x30]
call fcn.0041d4cb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret