joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad1d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
or ebp, 0xffffffff
jmp 0x4ad1f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ad1f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ad1e8
mov eax, 1
add ebx, ebx
jne 0x4ad20b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ad21c
jne 0x4ad23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ad23b
dec eax
add ebx, ebx
jne 0x4ad228
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ad200
add ebx, ebx
jne 0x4ad237
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ad28d
xor ecx, ecx
sub eax, 3
jb 0x4ad253
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ad2c2
sar eax, 1
mov ebp, eax
jmp 0x4ad25e
add ebx, ebx
jne 0x4ad25e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ad22c
inc ecx
add ebx, ebx
jne 0x4ad26c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ad22c
add ebx, ebx
jne 0x4ad279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ad26e
jne 0x4ad28a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ad26e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ad2ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ad29e
jmp 0x4ad1ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ad2ac
add edi, ecx
jmp 0x4ad1ee
pop esi
mov edi, esi
mov ecx, 0x3493
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ad2ca
cmp byte [edi], 0x4c
jne 0x4ad2ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ad2cf
lea edi, [esi + 0xa9000]
mov eax, dword [edi]
or eax, eax
je 0x4ad347
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb2970]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb2ac4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ad2fc
mov ecx, edi
jns 0x4ad32b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb2ac8]
or eax, eax
je 0x4ad341
mov dword [ebx], eax
add ebx, 4
jmp 0x4ad319
call dword [esi + 0xb2ad8]
mov ebp, dword [esi + 0xb2acc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ad37b
sub esp, 0xffffff80
jmp 0x417770
Function at 0x65c2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x65c2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x65c2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x65c2d9
mov dword [ebp + 0x45a159], 1
cmp dword [ebp + 0x45a159], 0
jne 0x65c2e4
jmp 0x65c2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c389
pop ebp
jmp 0x65c30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.0065c616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
add eax, 0xfea12ab2
loopne 0x65c30e
pop ds
push 0x4360a8c8
add edi, dword [esi*4 - 0x3c676660]
sub edi, esi
lcall 0xfd41, 0x6c6783a4
xchg edi, eax
shr dword [eax], 0x7b
invalid
Function at 0x401a10
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x401a89
mov al, byte [esp]
test al, al
je 0x401a89
push ebx
push esi
push edi
mov edi, str.Config.ini
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
and ecx, 3
push 1
push str.Tutorial
rep movsb byte es:[edi], byte [esi]
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
cmp eax, 1
pop ebx
jne 0x401a89
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret

Function at 0x401aa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x401b27
mov al, byte [esp]
test al, al
je 0x401b27
push ebx
push esi
push edi
mov edi, str.Config.ini
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x110]
and ecx, 3
push 0xa
push eax
push 0
rep movsb byte es:[edi], byte [esi]
call fcn.0046855f
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push edx
push str.Tutorial
push str.Options
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x403640
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x104
mov al, byte [esi + 0xd38]
test al, al
jne 0x4036bd
mov ecx, dword [0x8aa48c]
lea eax, [esi + 0xe3d]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x8aa48c]
lea edx, [esi + 0xd39]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esi + 0xf48]
mov edx, dword [esi + 0xf50]
mov ecx, dword [esi + 0xf44]
sub edx, eax
push 1
push edx
mov edx, dword [esi + 0xf4c]
sub edx, ecx
push edx
mov edx, dword [0x8ab7f4]
add eax, edx
push eax
mov eax, dword [0x8ab7f0]
add ecx, eax
push ecx
mov ecx, dword [0x8aa48c]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0
jmp 0x403726
mov ecx, dword [0x8aa48c]
lea eax, [esi + 0xd39]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x8aa48c]
lea edx, [esi + 0xe3d]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esi + 0xf58]
mov edx, dword [esi + 0xf60]
mov ecx, dword [esi + 0xf54]
sub edx, eax
push 1
push edx
mov edx, dword [esi + 0xf5c]
sub edx, ecx
push edx
mov edx, dword [0x8ab7f4]
add eax, edx
push eax
mov eax, dword [0x8ab7f0]
add ecx, eax
push ecx
mov ecx, dword [0x8aa48c]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0x2a
mov edx, dword [0x8aa48c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xcc
push edx
call esi
mov eax, dword [0x8ab7e8]
test eax, eax
je 0x403770
mov eax, dword [0x8aa48c]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call esi
mov ecx, dword [0x8aa48c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [0x8aa48c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x414dc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
sub eax, 0x31
mov esi, ecx
je 0x414e79
dec eax
je 0x414ed0
sub eax, 0x8d
jne 0x414f40
mov eax, dword [0x8aa48c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x8aa48c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [esi + 0x850]
lea ebx, [esi + 0x850]
test al, al
jne 0x414e37
mov edi, 0x47ad94
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x8aa48c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ecx
mov ecx, dword [0x8aa48c]
push 0xb1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x8aa488
call fcn.00450c70
pop ebx
pop edi
mov eax, 1
pop esi
ret 8
push 0x10
call edi
xor edx, edx
mov dl, ah
test dl, dl
je 0x414ed0
mov eax, dword [0x8aa48c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x8aa48c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x8aa48c]
push 0x47ad84
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, 0x47ad84
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x8aa48c]
not ecx
dec ecx
push ecx
push ecx
push 0xb1
push eax
jmp 0x414f26
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x414f40
mov edx, dword [0x8aa48c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x8aa48c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x8aa48c]
push 0x47ad90
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, 0x47ad90
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x8aa48c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ecx
push 0xb1
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x8aa488
call fcn.00450c70
pop edi
mov eax, 1
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x418470
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4185f3
mov eax, dword [esp + 8]
cmp eax, 9
je 0x4184a2
cmp eax, 0xd
je 0x418520
cmp eax, 0x20
je 0x418520
mov eax, 1
pop esi
ret 8
xor ecx, ecx
mov dl, byte [esi + 0x462]
inc dl
mov al, dl
mov byte [esi + 0x462], dl
cmp al, 3
jb 0x4184bf
mov byte [esi + 0x462], 0
xor eax, eax
mov al, byte [esi + 0x462]
lea edx, [eax + eax*2]
shl edx, 3
sub edx, eax
mov eax, dword [esi + edx*8 + 0x234]
test eax, eax
jne 0x4185ea
inc ecx
cmp ecx, 3
jl 0x4184a4
xor eax, eax
mov al, byte [esi + 0x462]
lea ecx, [eax + eax*2]
shl ecx, 3
sub ecx, eax
mov eax, dword [esi + ecx*8 + 0x234]
test eax, eax
jne 0x418520
xor eax, eax
lea ecx, [esi + 0x234]
cmp dword [ecx], 0
jne 0x41851a
inc eax
add ecx, 0xb8
cmp eax, 3
jl 0x418507
jmp 0x418520
mov byte [esi + 0x462], al
xor eax, eax
mov al, byte [esi + 0x462]
lea edx, [eax + eax*2]
shl edx, 3
sub edx, eax
mov ecx, dword [esi + edx*8 + 0x234]
test ecx, ecx
je 0x4185ea
xor ecx, ecx
xor edx, edx
mov ch, byte [esi]
mov dx, word [esi + 0x460]
and ecx, 0xffff
push ebp
or ecx, eax
mov eax, dword [0x8ab7f4]
shl ecx, 0x10
or ecx, edx
mov edx, dword [0x8aa48c]
push edi
mov ebp, ecx
mov ecx, dword [0x8ab7f0]
push 1
push 0x10
add eax, 0x23a
push 0x162
add ecx, 0xdf
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x8aa48c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x8aa48c]
lea edi, [esi + 0x130]
push 0x104
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x8aa48c]
push 0x8b187c
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x8ab7b0]
push edi
push ebp
push 0x7ee
push eax
mov dword [0x8aa498], 1
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.00417fb0
pop edi
pop ebp
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8
Function at 0x418600
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41870f
push ebx
push ebp
push edi
lea edi, [esi + 0x238]
xor ebx, ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi - 4]
test eax, eax
je 0x4186ee
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x4186ee
xor eax, eax
xor ecx, ecx
mov ah, byte [esi]
mov cx, word [esi + 0x460]
mov al, bl
mov byte [esi + 0x462], bl
mov edx, dword [0x8ab7f4]
push 1
shl eax, 0x10
or eax, ecx
mov ecx, dword [0x8aa48c]
mov ebp, eax
mov eax, dword [0x8ab7f0]
push 0x10
add edx, 0x23a
push 0x162
add eax, 0xdf
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [0x8aa48c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8aa48c]
lea edi, [esi + 0x130]
push 0x104
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x8aa48c]
push 0x8b187c
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x8ab7b0]
push edi
push ebp
push 0x7ee
push edx
mov dword [0x8aa498], 1
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.00417fb0
mov edi, dword [esp + 0x10]
inc ebx
add edi, 0xb8
cmp ebx, 3
mov dword [esp + 0x10], edi
jl 0x41861e
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8

Function at 0x418601
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41870f
push ebx
push ebp
push edi
lea edi, [esi + 0x238]
xor ebx, ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi - 4]
test eax, eax
je 0x4186ee
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x4186ee
xor eax, eax
xor ecx, ecx
mov ah, byte [esi]
mov cx, word [esi + 0x460]
mov al, bl
mov byte [esi + 0x462], bl
mov edx, dword [0x8ab7f4]
push 1
shl eax, 0x10
or eax, ecx
mov ecx, dword [0x8aa48c]
mov ebp, eax
mov eax, dword [0x8ab7f0]
push 0x10
add edx, 0x23a
push 0x162
add eax, 0xdf
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [0x8aa48c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x8aa48c]
lea edi, [esi + 0x130]
push 0x104
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x8aa48c]
push 0x8b187c
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x8ab7b0]
push edi
push ebp
push 0x7ee
push edx
mov dword [0x8aa498], 1
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.00417fb0
mov edi, dword [esp + 0x10]
inc ebx
add edi, 0xb8
cmp ebx, 3
mov dword [esp + 0x10], edi
jl 0x41861e
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x41d9a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov ecx, eax
shr eax, 0x10
and ecx, 0xffff
mov dword [esi + 0x35b2ac], eax
mov edx, eax
mov eax, ecx
mov dword [esi + 0x35b2a8], ecx
push edx
push eax
lea ecx, [esi + 0x3615b0]
call fcn.00418460
test eax, eax
jne 0x41db78
mov eax, dword [esi + 0x35b2b8]
test eax, eax
je 0x41db78
mov ecx, dword [esi + 0x35b2a8]
mov eax, 0x2aaaaaab
add ecx, 0xc8
mov edi, dword [esi + 0xf532c]
imul ecx
mov eax, dword [esi + 0x35b2ac]
sar edx, 3
mov ecx, edx
add eax, 0x9d
shr ecx, 0x1f
add edx, ecx
add edx, edi
mov dword [esi + 0x35b2b0], edx
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [esi + 0xf5330]
sar eax, 5
add eax, edx
mov dword [esi + 0x35b2b4], eax
mov eax, dword [esi + 0x364450]
test eax, eax
je 0x41da6f
mov cl, byte [eax + 0x88]
cmp cl, 3
je 0x41da65
test cl, cl
je 0x41da51
cmp cl, 1
jne 0x41da6f
mov eax, dword [eax + 0x61c70]
cmp eax, 0xff
je 0x41da65
cmp eax, 0x6bef
jne 0x41da6f
mov dword [esi + 0x364450], 0
mov edx, dword [esi + 0x35b2ac]
mov eax, dword [esi + 0x35b2a8]
push edx
push eax
lea ecx, [esi + 0x2a548c]
call fcn.0042b9c0
test eax, eax
jne 0x41db78
mov ecx, dword [esi + 0x35b2ac]
mov edx, dword [esi + 0x35b2a8]
push ecx
lea eax, [esi + 0x2a60e4]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x41db78
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
je 0x41db0f
mov eax, dword [esi + 0x364444]
test eax, eax
je 0x41db0f
mov edx, dword [eax + 4]
mov ecx, dword [esi + 0x2f8784]
cmp edx, ecx
je 0x41db0f
mov cl, byte [eax + 0x88]
test cl, cl
je 0x41dae5
cmp cl, 1
jne 0x41db0f
mov ecx, dword [eax + 0x61c74]
test ecx, ecx
jne 0x41db0f
mov ecx, dword [eax + 0xd0]
mov eax, dword [eax + 0xcc]
push ecx
push eax
push edx
mov ecx, 0x8ab828
call fcn.004523b0
pop edi
xor eax, eax
pop esi
ret 8
push ebx
mov edi, str.gold
lea eax, [esi + 0x2a54c8]
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x41db43
test cl, cl
je 0x41db3f
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x41db43
add eax, 2
add edi, 2
test cl, cl
jne 0x41db1b
xor eax, eax
jmp 0x41db48
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x41db5f
mov ecx, 0x30e
lea edi, [esi + 0x2a54ac]
rep stosd dword es:[edi], eax
pop edi
pop esi
ret 8
mov eax, dword [esi + 0x35b2ac]
mov ecx, dword [esi + 0x35b2a8]
push eax
push ecx
lea ecx, [esi + 0x2f8780]
call fcn.004129c0
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x41dd33
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x362370]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
mov dword [esp + 0x10], ebx
jne case.0x41de55.17
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea ecx, [esi + 0x3615b0]
call fcn.00418470
test eax, eax
jne case.0x41de55.17
mov eax, dword [esi + 0x35b2b8]
test eax, eax
je case.0x41de55.17
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esi + 0x2a548c]
call fcn.0042cbd0
test eax, eax
jne case.0x41de55.17
mov eax, dword [esi + 0x364444]
test eax, eax
je 0x41ddb8
mov edi, dword [eax + 4]
mov ebp, dword [eax + 0xcc]
mov ebx, dword [eax + 0xd0]
mov eax, dword [eax + 0x88]
jmp 0x41ddbc
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x35b2ac]
mov edx, dword [esi + 0x35b2a8]
push eax
mov eax, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
push ebx
push ebp
push ecx
push edx
push eax
push edi
lea ecx, [esi + 0x2f8780]
call fcn.00413a30
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x4d
call ebx
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x41de41
mov al, byte [esi + 0x2f8840]
test al, al
je 0x41de03
cmp al, 0x1d
jne 0x41de41
mov al, byte [esi + 0x35b148]
test al, al
jne 0x41de14
push str._ride
jmp 0x41de19
push str._unride
mov ecx, 0x8ab828
call fcn.004520f0
mov dword [esi + 0x4279a4], 0x3e8
mov dword [esi + 0x4279a8], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
lea eax, [edi - 0xd]
cmp eax, 0x5b
ja case.0x41de55.17
xor edx, edx
mov dl, byte [eax + 0x41df7c]
jmp dword [edx*4 + 0x41df68]
push 0x11
call ebx
xor ecx, ecx
mov cl, ah
test cl, cl
je case.0x41de55.17
push str._attackmode
mov ecx, 0x8ab828
call fcn.004520f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
push 0x11
call ebx
xor edx, edx
mov dl, ah
test dl, dl
je case.0x41de55.17
push str._rest
mov ecx, 0x8ab828
call fcn.004520f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov ecx, 0x8aa488
call fcn.00450c70
mov eax, dword [0x8aa48c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x8aa48c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov ecx, esi
call fcn.0041dfe0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x38]
test eax, eax
je case.0x41de55.17
mov dl, byte [esi + 0x35b2bd]
xor ecx, ecx
inc dl
mov al, dl
mov byte [esi + 0x35b2bd], dl
cmp al, 2
jbe 0x41df0b
mov byte [esi + 0x35b2bd], cl
xor eax, eax
mov al, byte [esi + 0x35b2bd]
sub eax, 0
je 0x41df40
dec eax
je 0x41df2f
dec eax
jne 0x41df4f
mov dword [esi + 0x4279ac], 0x42aa0000
mov ecx, 0x555555
jmp 0x41df4f
mov dword [esi + 0x4279ac], 0x41700000
mov ecx, 0xf0f0f
jmp 0x41df4f
mov dword [esi + 0x4279ac], 0x437f0000
mov ecx, 0xffffff
push ecx
lea ecx, [esi + 0x35b2c0]
call fcn.00434610
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x4280f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xd38], ebx
je 0x428352
mov eax, dword [esi + 0xd28]
mov dword [esi + 0xd34], ebx
mov dword [esi + 0xd2c], eax
mov eax, dword [esi + 0xd38]
push ebp
cmp eax, ebx
mov ebp, 1
mov dword [esp + 0xc], 0xdf
mov dword [esp + 0x10], 0x23a
mov dword [esp + 0x14], 0x241
mov dword [esp + 0x18], 0x24a
jle 0x4282df
push edi
mov edi, dword [esi + 0xd2c]
xor eax, eax
mov ecx, dword [edi]
cmp ecx, 0xf
ja case.0x42815f.5
jmp dword [ecx*4 + 0x428358]
lea ecx, [esi + 0x6554]
call fcn.0042eb80
lea eax, [esi + 0x656c]
jmp case.0x42815f.5
lea ecx, [esi + 0x29ce4]
call fcn.0044b2d0
lea eax, [esi + 0x29cfc]
jmp case.0x42815f.5
lea ecx, [esi + 0x33188]
call fcn.0044e260
lea eax, [esi + 0x331a0]
jmp case.0x42815f.5
lea ecx, [esi + 0x3399c]
call fcn.00415b10
lea eax, [esi + 0x339b4]
jmp case.0x42815f.5
lea ecx, [esi + 0x4707c]
call fcn.00425040
lea eax, [esi + 0x47094]
jmp case.0x42815f.5
lea ecx, [esi + 0x47834]
call fcn.004243d0
lea eax, [esi + 0x4784c]
jmp case.0x42815f.5
lea ecx, [esi + 0x47c28]
call fcn.00450530
lea eax, [esi + 0x47c40]
jmp case.0x42815f.5
lea ecx, [esi + 0x507ec]
call fcn.00414700
lea eax, [esi + 0x50804]
jmp case.0x42815f.5
lea ecx, [esi + 0x51150]
call fcn.0043f460
lea eax, [esi + 0x51168]
jmp case.0x42815f.5
lea ecx, [esi + 0x516e8]
call fcn.00447470
lea eax, [esi + 0x51700]
jmp case.0x42815f.5
lea ecx, [esi + 0x518e0]
call fcn.00441380
lea eax, [esi + 0x518f8]
jmp case.0x42815f.5
lea ecx, [esi + 0x52118]
call fcn.004269c0
lea eax, [esi + 0x52130]
jmp case.0x42815f.5
lea ecx, [esi + 0x524f0]
call fcn.00439500
lea eax, [esi + 0x52508]
jmp case.0x42815f.5
lea ecx, [esi + 0x52e5c]
call fcn.0043e3c0
lea eax, [esi + 0x52e74]
cmp dword [edi], 8
je 0x42829f
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x42829f
xor ebp, ebp
mov eax, dword [esi + 0xd2c]
test eax, eax
je 0x4282cf
mov eax, dword [eax + 4]
test eax, eax
je 0x4282cf
mov ecx, dword [esi + 0xd38]
mov dword [esi + 0xd2c], eax
mov eax, dword [esi + 0xd34]
cmp eax, ecx
jge 0x4282c9
lea ecx, [eax + 1]
mov dword [esi + 0xd34], ecx
mov eax, dword [esi + 0xd38]
inc ebx
cmp ebx, eax
jl 0x42814c
pop edi
mov eax, dword [0x7da1c4]
mov ecx, dword [0x7da1c0]
push eax
push ecx
mov ecx, esi
call fcn.0042aab0
cmp eax, 7
ja case.0x4282f8.4
jmp dword [eax*4 + 0x428398]
lea ecx, [esi + 0x6554]
call fcn.0042fab0
jmp case.0x4282f8.4
lea ecx, [esi + 0x29ce4]
call fcn.0044b6b0
jmp case.0x4282f8.4
lea ecx, [esi + 0x3399c]
call fcn.00416790
jmp case.0x4282f8.4
lea ecx, [esi + 0x47c28]
call fcn.00450ac0
jmp case.0x4282f8.4
lea ecx, [esi + 0x33188]
call fcn.0044e650
test ebp, ebp
pop ebp
jne 0x428352
mov edx, dword [0x8aa48c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
add esp, 0x20
ret