joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012fdc
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb0
mov eax, dword [0x10171b0]
and word [ebp - 0x34], 0
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0x40], 0
push 0x27
pop ecx
mov dword [ebp + 0x6c], eax
xor eax, eax
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
push 0x50
pop ebx
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x23
mov edi, 0x400
push edi
call esi
test eax, eax
je 0x10130b0
xor eax, eax
cmp word [ebp - 0x34], 0x30
sete al
test eax, eax
mov dword [ebp - 0x38], eax
je 0x1013056
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x1005
push edi
call esi
test eax, eax
je 0x10130b0
xor eax, eax
cmp word [ebp - 0x34], 0x31
sete al
mov dword [ebp - 0x40], eax
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x25
push edi
call esi
test eax, eax
je 0x10130b0
xor eax, eax
cmp word [ebp - 0x34], 0x31
push ebx
sete al
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push 0x1e
push edi
call esi
xor esi, esi
cmp eax, esi
je 0x10130b0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [ebp + 0x7c]
xor ecx, ecx
cmp dword [ebp - 0x3c], esi
setne cl
add eax, ecx
mov ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
and ecx, 3
lea eax, [eax + ecx + 4]
cmp eax, ebx
jbe 0x10130ac
xor eax, eax
cmp eax, esi
jne 0x10130c3
push dword [ebp + 0x7c]
push 0x100221c
push dword [ebp + 0x78]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x1013131
cmp dword [ebp - 0x38], esi
mov edi, dword [ebp + 0x78]
mov word [edi], si
je 0x10130e8
cmp dword [ebp - 0x40], esi
je 0x10130e0
push ebx
push 0x1002214
push edi
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push ebx
mov ebx, 0x1002210
jmp 0x10130ee
push ebx
mov ebx, 0x100220c
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
push ebx
push edi
call esi
cmp dword [ebp - 0x3c], 0
je 0x1013105
push dword [ebp + 0x7c]
push ebx
push edi
call esi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x34]
push eax
push edi
call esi
push dword [ebp + 0x7c]
push 0x1002204
push edi
call esi
cmp dword [ebp - 0x38], 0
je 0x1013131
cmp dword [ebp - 0x40], 0
jne 0x1013131
push dword [ebp + 0x7c]
push 0x10021fc
push edi
call esi
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
call fcn.0101209b
add ebp, 0x70
leave
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x93f3008], 0x8088405
inc edx
mov dword [ebx + 0x93f3008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5c4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
add edx, edx
inc edx
test edx, edx
js 0x41e5e0
mov ecx, dword [eax + edx*4]
dec edx
push ecx
jns 0x41e5d9
mov dword [ebp + 0x10], esp
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
lea ebx, [ecx + 1]
mov eax, ebx
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ebx, ebx
jle 0x41e61a
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp ebx, 1
jle 0x41e641
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp ebx, 2
jle 0x41e668
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
cmp ebx, 3
jle 0x41e68f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x24], eax
sub dword [ebp - 0x30], 1
sbb dword [ebp - 0x2c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea eax, [esi + 0x20]
xor edx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
xor eax, eax
mov dword [ebp - 8], eax
mov word [ebp - 2], 0
mov word [ebp - 2], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 8], esp
and esp, 0xfffffff0
push 0x33
call fcn.0041e6cf

Function at 0x41e764
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 8], 0
je 0x41e7d5
cmp dword [ebp + 0x10], 0
jne 0x41e77a
cmp dword [ebp + 0xc], 0
je 0x41e7d5
cmp dword [ebp + 0x14], 0
je 0x41e7d5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041e795
pop ecx
pop ecx
pop ebp
ret

Function at 0x41e7dc
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
cmp dword [ebp + 8], 0
je 0x41e860
cmp dword [ebp + 0x10], 0
jne 0x41e7f4
cmp dword [ebp + 0xc], 0
je 0x41e860
cmp dword [ebp + 0x14], 0
je 0x41e860
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x33
call fcn.0041e813
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x41e868
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.0041e883
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x93d753a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93d7541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x93d889f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x93f5348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x93f5348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x93f4178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93d88a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x4b3483c
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x568f692d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push edi
lea eax, [ebp - 0x21c]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push dword [ebp + 8]
call fcn.004013f9
call fcn.00443802
test eax, eax
je 0x4010d6
push 0x10
push 0x469f96
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012b0
cmp dword [0x489880], 0
push ebx
push esi
mov ebx, 0x489894
jne 0x401106
push 0xffffffffffffffff
push dword [0x489888]
mov esi, 0x48b930
push 1
call fcn.00405f68
mov al, byte [0x47765c]
mov byte [0x48b932], al
jmp 0x401154
lea eax, [ebp - 2]
push eax
push 0x489880
mov esi, ebx
mov eax, 0x48b930
call fcn.004065c2
test al, al
jne 0x40112e
mov dword [0x477674], 1
jmp 0x4012a1
mov al, byte [0x48b930]
mov byte [0x489884], al
mov al, byte [0x48b931]
push 0x48987c
mov byte [ebp - 1], al
lea eax, [ebp - 0x428]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
push dword [0x489880]
push ebx
call fcn.00418bae
test eax, eax
je 0x40118a
mov edi, 0x48b930
call fcn.00406134
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x477674], 1
jmp 0x4012ae
cmp byte [ebp - 1], 1
jne 0x40123c
cmp byte [0x489855], 1
jne 0x40123c
call fcn.0040d365
test al, al
jne 0x40123c
push edi
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
cmp byte [ebp - 2], 0
je 0x401215
mov edi, 0x46a000
push edi
lea esi, [ebp - 0x10]
call fcn.0040dcac
push ebx
mov eax, esi
call fcn.0040dea7
push edi
mov eax, esi
call fcn.0040dea7
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x428]
push eax
push 0x46a004
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x10]
call fcn.0044d460
pop ecx
jmp 0x401297
push 1
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x428]
push eax
push 0x46a004
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401297
call fcn.004012b5
call fcn.00401388
cmp byte [0x489884], 0
jne 0x401259
mov edi, 0x48a2d8
call fcn.0040990c
push 1
mov eax, 0x489aa0
call fcn.00418d10
cmp byte [0x489884], 0
jne 0x401297
mov edi, 0x48b0fc
mov esi, dword [edi]
test esi, esi
je 0x40128c
push dword [esi + 8]
call fcn.0044d460
push esi
call fcn.0044d460
and dword [edi], 0
pop ecx
pop ecx
add edi, 4
cmp edi, 0x48b918
jl 0x401273
mov edi, 0x48b930
call fcn.00406134
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x401e83
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esi]
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x401e93
xor al, al
jmp 0x401f1d
push ebx
push edi
push 1
push eax
call fcn.004031a8
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401edf
push 0x25
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401f01
push 0x27
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push dword [esi]
call fcn.004031a8
pop edi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x4023b2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
mov eax, dword [ebx]
test eax, eax
jne 0x4023c5
xor al, al
jmp 0x4023fd
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xb0
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4023e8
xor al, al
jmp 0x4023fc
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x402402
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 0x101]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044d3f6
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x40245f
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x40243e
mov ecx, dword [ebp - 4]
and word [ecx + eax*2], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
push eax
mov eax, dword [ebp + 8]
call fcn.0040de0f
mov bl, 1
push dword [ebp - 4]
call fcn.0044d460
pop ecx
mov al, bl
jmp 0x4023fb
xor bl, bl
jmp 0x402452
Function at 0x402e9b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x402ed3
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x402ecc
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x402fe4
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
push ebx
mov ebx, 0x100
je 0x402f12
push ebx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044d935
test eax, eax
pop ecx
pop ecx
jne 0x402f0f
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x402f7d
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d9c3
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
call fcn.0044d98e
add esp, 0x10
test eax, eax
jne 0x402f78
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x80c]
push eax
push str._s_u
push eax
call fcn.0044d9d9
push dword [esi + 0x18]
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d935
add esp, 0x18
test eax, eax
je 0x402fd9
inc dword [ebp - 4]
jmp 0x402f80
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x402fb2
push 0x400
lea eax, [ebp - 0x80c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0044d935
test eax, eax
pop ecx
pop ecx
je 0x402fd9
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x402fd1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x402fce
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x402fce
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jne 0x402fe0
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x402fe3
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x4031a8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x4031d3
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x4031ee
push 1
jmp 0x4031d5
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x40328b
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [esp + 8]
push 0x46a170
call fcn.0040de0f
mov eax, dword [ebx]
test eax, eax
jne 0x4032a8
xor al, al
pop ebx
ret 4
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
push 0
push 0xe
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x4032c5
mov esi, 0x7fff
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044d3f6
pop ecx
mov edi, eax
push edi
lea eax, [esi + 1]
push eax
push 0xd
push dword [ebx]
call ebp
and word [edi + esi*2], 0
test eax, eax
jle 0x40330d
mov eax, dword [esp + 0x14]
push edi
call fcn.0040de0f
mov bl, 1
push edi
call fcn.0044d460
pop ecx
pop edi
pop esi
mov al, bl
pop ebp
jmp 0x4032a4
xor bl, bl
jmp 0x4032ff