joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435876
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4358ff
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4358b0
push 0x66cf
push 1
call fcn.0043595d
pop ecx
pop ecx
jmp 0x4358fd
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4358ec
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4358ea
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x4358fd
push 0x498
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x435959
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43593f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.0042c1f1
add esp, 0xc
jmp 0x435959
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x3bd7
push dword [ebp - 0x38]
push 1
push 0
call fcn.0042a43d
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x436dd7
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x436dff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 0x5b26
call fcn.00436e5c
add esp, 0xc
jmp 0x436e58
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x436e1f
push 0
call fcn.004346ff
pop ecx
jmp 0x436e58
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x436e39
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x436e58
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x436e58
push 0
push 0x1ad3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esp, ebp
pop ebp
ret
Function at 0x438228
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43827f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00438349
add esp, 0x1c
jmp 0x438345
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x438326
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x438306
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0
jne 0x4382f8
mov dword [ebp - 4], 1
jmp 0x4382fc
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x438324
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x438324
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x438345
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push 0
push dword [ebp - 0x60]
push 1
push 0x5caf
push 0x10cb
call fcn.0042a333
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4396f0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4397b5
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x439788
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x439772
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xfffffffc
jmp 0x439786
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x439786
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x4397b3
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x44e2
push 0xe74
push 0x4bc1
push 1
push 1
push 0x15f9
push 1
call fcn.0042ef67
add esp, 0x20
jmp 0x4397da
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x40]
push 0x6324
call fcn.00434258
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x439d29
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x439df4
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x439dcb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x439d97
mov byte [ebp - 1], 0
push 0xcde
push 1
push 1
push 1
push 0x2730
push 1
lea eax, [ebp - 1]
push eax
call fcn.00430e01
add esp, 0x1c
jmp 0x439dc9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x439dc9
push 0x43d
push 0x7bf
push 0x1d4a
push 0x14ec
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x439df2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x439dea
push 0x1107
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x439df2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x439e08
push 0x5e0a
push 0x45b4
push 1
call fcn.00431d60
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4656ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x47358f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x486484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00463534
mov dword [ebp - 0x14], eax
cmp dword [0xa807d0], esi
jne 0x473682
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47360f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x473762
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x473762
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x473762
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa807d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa807d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa807d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa807e0], eax
test eax, eax
je 0x47367f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa807dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4736a7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47369a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4736bc
push 4
pop eax
jmp 0x473764
cmp dword [ebp - 0x14], esi
je 0x4736bc
push dword [0xa807d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4736a1
mov eax, dword [0xa807dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47371a
cmp dword [0xa807e0], edi
je 0x47371a
push eax
call ebx
push dword [0xa807e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47371a
test eax, eax
je 0x47371a
call ecx
test eax, eax
je 0x47370f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47370f
test byte [ebp - 8], 1
jne 0x47371a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47374a
mov eax, dword [0xa807d4]
cmp eax, edi
je 0x473747
push eax
call ebx
test eax, eax
je 0x473747
call eax
mov esi, eax
test esi, esi
je 0x473747
mov eax, dword [0xa807d8]
cmp eax, edi
je 0x473747
push eax
call ebx
test eax, eax
je 0x473747
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa807d0]
call ebx
test eax, eax
je 0x473762
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x473764
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004629db
mov esp, ebp
pop ebp
ret
Function at 0x406720
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x406752
lea esp, [esp]
test cl, 3
je 0x406752
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x418a70]
add ecx, 1
sub esi, 1
jne 0x406730
cmp esi, 0x20
push ebx
push edi
jb 0x40693c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x418e70]
xor edx, dword [ebx*4 + 0x419270]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x418a70]
add ecx, 4
xor edx, dword [eax*4 + 0x419670]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x418e70]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x419270]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x418a70]
add ecx, 4
xor eax, dword [edx*4 + 0x419670]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x418e70]
xor edx, dword [ebx*4 + 0x419270]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x418a70]
xor edx, dword [eax*4 + 0x419670]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x418e70]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x419270]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x418a70]
xor eax, dword [edx*4 + 0x419670]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x418e70]
xor edx, dword [ebx*4 + 0x419270]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x418a70]
xor edx, dword [eax*4 + 0x419670]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x418e70]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x419270]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x418a70]
and edx, 0xff
xor eax, dword [edx*4 + 0x419670]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x418e70]
xor edx, dword [ebx*4 + 0x419270]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x418a70]
add ecx, 4
xor edx, dword [eax*4 + 0x419670]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x418e70]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x419270]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x418a70]
and edx, 0xff
xor eax, dword [edx*4 + 0x419670]
sub edi, 1
jne 0x406762
cmp esi, 4
jb 0x406989
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x418e70]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x419270]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x418a70]
and eax, 0xff
xor edi, dword [eax*4 + 0x419670]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x406946
test esi, esi
pop edi
pop ebx
je 0x4069ad
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x418a70]
add ecx, 1
sub esi, 1
jne 0x406990
not eax
pop esi
ret
Function at 0x407920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ebx + 0x4090], 0
je 0x407982
cmp dword [ebx + 0x6c], 0
jbe 0x407982
push ebp
mov eax, 0xffffff78
push esi
sub eax, ebx
push edi
lea esi, [ebx + 0x4094]
lea ebp, [ebx + 0x88]
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, esi
call fcn.00406f20
mov edi, dword [ebx + 0x40a0]
mov dword [esp + 0xc], eax
movzx eax, byte [ebp]
call fcn.00406f40
mov al, byte [esp + 0xc]
xor byte [ebp], al
mov ecx, dword [esp + 0x10]
add ebp, 1
add ecx, ebp
cmp ecx, dword [ebx + 0x6c]
jb 0x407950
pop edi
pop esi
pop ebp
mov edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x20]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebx + 0x88]
push eax
mov eax, dword [ebx + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [ebx + 0x6c]
mov dword [ebx + 0x6c], 0
je 0x4079b0
or eax, 0xffffffff
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x4079c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4079d6
pop edi
mov eax, 0xffffff9a
pop ebp
ret 0xc
cmp dword [edi + 0x2c], ebp
je 0x4079cc
cmp dword [edi + 0x80], 8
push ebx
push esi
mov dword [edi + 0x34], ebp
jne 0x407a31
cmp dword [edi + 0x84], ebp
jne 0x407a31
lea esi, [edi + 0x30]
cmp dword [edi + 0x40], 0
jne 0x407a11
mov ebx, edi
call fcn.00407920
lea eax, [edi + 0x88]
mov dword [edi + 0x40], 0x4000
mov dword [edi + 0x3c], eax
mov ebx, dword [edi + 0x44]
push 4
push esi
call fcn.004093e0
mov ecx, dword [edi + 0x44]
sub ecx, ebx
add dword [edi + 0x6c], ecx
mov ebp, eax
test ebp, ebp
je 0x4079f4
cmp ebp, 1
jne 0x407a31
xor ebp, ebp
cmp dword [edi + 0x6c], 0
jbe 0x407a49
test ebp, ebp
jne 0x407a49
mov ebx, edi
call fcn.00407920
cmp eax, 0xffffffff
jne 0x407a49
or ebp, eax
cmp dword [edi + 0x80], 8
jne 0x407a6d
cmp dword [edi + 0x84], 0
jne 0x407a87
lea edx, [edi + 0x30]
push edx
call fcn.00409bb0
mov ebp, eax
mov dword [edi + 0x68], 0
cmp dword [edi + 0x84], 0
jne 0x407a87
mov eax, dword [edi + 0x408c]
mov ecx, dword [edi + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov esi, dword [edi + 0x74]
mov ebx, dword [edi + 0x40a4]
mov ecx, dword [esp + 0x1c]
add ebx, dword [edi + 0x44]
add esi, 0x10
mov edx, 4
call fcn.00407240
mov esi, dword [edi + 0x74]
add esi, 0x14
mov edx, 4
mov ecx, ebx
call fcn.00407240
mov ecx, 1
cmp dword [edi + 0x5c], ecx
jne 0x407ace
mov esi, dword [edi + 0x74]
add esi, 0x24
lea edx, [ecx + 1]
call fcn.00407240
mov esi, dword [edi + 0x74]
mov ecx, dword [esp + 0x18]
add esi, 0x18
mov edx, 4
call fcn.00407240
test ebp, ebp
jne 0x407afc
mov edx, dword [edi + 0x78]
mov eax, dword [edi + 0x74]
push edx
push eax
lea ecx, [edi + 0x24]
push ecx
call fcn.00407150
add esp, 0xc
mov ebp, eax
mov edx, dword [edi + 0x74]
push edx
call sub.MSVCRT.dll_free
add esp, 4
test ebp, ebp
jne 0x407ba1
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0xc]
push eax
push ecx
call edx
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x70]
push ebp
add eax, 0xe
push eax
mov eax, dword [edi + 0x10]
push ecx
push edx
call eax
add esp, 0x18
test eax, eax
je 0x407b42
or ebp, 0xffffffff
jmp 0x407b83
mov ecx, dword [edi + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
mov esi, 4
call fcn.004071f0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x407b83
mov edx, dword [edi + 0x20]
push edx
mov ecx, ebx
call fcn.004071f0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x407b83
mov eax, dword [edi + 0x20]
mov ecx, dword [esp + 0x18]
push eax
call fcn.004071f0
add esp, 4
mov ebp, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
push 0
push ecx
mov ecx, dword [edi + 0x10]
push edx
push eax
call ecx
add esp, 0x10
test eax, eax
je 0x407ba1
or ebp, 0xffffffff
add dword [edi + 0x40b0], 1
pop esi
pop ebx
mov dword [edi + 0x2c], 0
pop edi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x40d859
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x40d871
push dword [esp + 4]
push 0x40d7f2
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x40d8ae
push esi
mov esi, dword [0x420f78]
test esi, esi
je 0x40d8ad
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40d8a5
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x420f78
call fcn.004132b6
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x40d87e
pop edi
pop ebx
pop esi
ret 4
Function at 0x40e184
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x64
pop ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x40e25b
mov eax, dword [ebp - 0xc]
dec eax
je 0x40e23e
dec eax
jne 0x40e25b
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x40e1e1
cmp byte [ebp - 0x1e], 1
jne 0x40e1e1
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x40e23a
dec eax
je 0x40e236
dec eax
je 0x40e214
dec eax
jne 0x40e25b
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x40e206
dec eax
jne 0x40e25b
neg esi
sbb esi, esi
and esi, 5
jmp 0x40e20d
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
mov ebx, esi
jmp 0x40e25b
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x40e232
dec eax
je 0x40e22e
dec eax
jne 0x40e25b
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40e210
push 0x3c
jmp 0x40e25a
push 0x32
jmp 0x40e25a
push 0x14
jmp 0x40e25a
push 5
jmp 0x40e25a
cmp dword [ebp - 0x14], 0
je 0x40e258
cmp dword [ebp - 0x14], 0xa
je 0x40e254
cmp dword [ebp - 0x14], 0x5a
jne 0x40e25b
push 0x28
jmp 0x40e25a
push 0x1e
jmp 0x40e25a
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret

Function at 0x40ee43
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x42139c]
call fcn.00412ec1
mov edi, eax
test edi, edi
je 0x40eea5
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x40ee6c
push dword [esp + 0xc]
push edi
call eax
jmp 0x40eea5
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00416eb0
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00416f50
pop esi
pop ebx
pop edi
ret 8
Function at 0x41058e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x410619
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x41060b
push 0x11
call esi
test al, al
js 0x41060b
push 0x10
call esi
test al, al
js 0x41060b
push 0x12
call esi
test al, al
js 0x41060b
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x41060b
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x410639
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x410639
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x410639
dec eax
push eax
push dword [0x4213a4]
call fcn.00412ec1
mov eax, dword [eax + 8]
jmp 0x41063b
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x410fc3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x42131c], eax
je 0x410ff6
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x421320], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x421318], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x411034
cmp dword [ebp - 0xc], 1
je 0x411045
cmp dword [ebp - 0xc], 2
jne 0x411034
cmp dword [ebp - 0x18], 5
jb 0x411045
jne 0x411034
cmp dword [ebp - 0x14], edi
jne 0x411034
mov dword [0x421318], edi
cmp dword [0x421318], edi
je 0x41104b
call fcn.00410f0a
test eax, eax
jne 0x41104b
mov dword [0x421318], edi
pop edi
add ebp, 0x78
leave
ret