joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c8
Capabilities:
Check if file exists
Create directory
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x138
mov eax, 0x44245e
call fcn.0043c542
mov eax, dword [ebp + 8]
mov dword [ebp - 0x144], eax
push 0x44bc3c
xor edi, edi
push 0x67
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, edi
je 0x4014eb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x140], eax
push ebx
cmp eax, edi
jne 0x40141b
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4014eb
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, edi
je 0x4014eb
push esi
call fcn.0040722d
pop ecx
mov dword [0x455008], eax
cmp eax, edi
je 0x401458
push esi
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x455008]
call fcn.0040cbf0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x12c
lea eax, [ebp - 0x13c]
push edi
push eax
call fcn.0040afd0
push 3
push esi
push dword [0x455008]
call fcn.0040674c
mov esi, eax
add esp, 0x18
cmp esi, edi
je 0x4014e4
push 0xffffffffffffffff
lea edx, [ebp - 0x13c]
call fcn.004067a8
pop ecx
cmp eax, edi
jne 0x4014e4
lea ecx, [ebp + 0xc]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4014be
push edi
lea ecx, [ebp + 0xc]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 0x44
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x140], esp
push eax
call fcn.00410735
push dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x144]
push esi
call fcn.004014ff
push esi
call fcn.00406846
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410139
call fcn.0043c58c
ret 0x48
Function at 0x4014ff
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
push 0x178
mov eax, 0x44242e
call fcn.0043c542
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x184], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x54]
cmp eax, ebx
je 0x401535
push ebx
push dword [ebp + 0xc]
push 0x52c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x12c
lea eax, [ebp - 0x180]
push ebx
push eax
call fcn.0040afd0
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0xc], ebx
jle 0x401629
push 0x12c
lea eax, [ebp - 0x180]
push ebx
push eax
call fcn.0040afd0
mov eax, dword [ebp - 0x184]
push edi
lea edx, [ebp - 0x180]
call fcn.004067a8
add esp, 0x10
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x54]
call fcn.00410735
push 0x44bc38
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00410153
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00410153
test byte [ebp - 0x78], 0x10
je 0x4015be
push ebx
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
push ebx
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
push edi
push dword [ebp - 0x184]
call fcn.0040680e
add esp, 0x14
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x4015ff
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esi + 0x54]
cmp eax, ebx
je 0x401614
push ebx
push edi
push 0x52d
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00410139
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x401555
mov esi, dword [esi + 0x54]
cmp esi, ebx
je 0x40163e
push ebx
push ebx
push 0x52e
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00410139
call fcn.0043c58c
ret 0x4c
Function at 0x401b65
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x4c
mov eax, 0x442217
call fcn.0043c542
lea eax, [ebp - 0x58]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401bf6
lea ecx, [ebp - 0x54]
call fcn.00410117
and dword [ebp - 4], 0
mov eax, dword [0x455014]
push dword [eax + 8]
mov ecx, edi
call fcn.004114d9
push eax
lea eax, [ebp - 0x54]
push str._s_s__mini
push eax
call fcn.00410944
add esp, 0x10
lea ecx, [ebp - 0x54]
call fcn.0041014a
push eax
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
push 1
push 0
push str.WujiPlayer
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00410139
call fcn.0043c58c
ret

Function at 0x401bfc
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x4c
mov eax, 0x442217
call fcn.0043c542
lea eax, [ebp - 0x58]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c8d
lea ecx, [ebp - 0x54]
call fcn.00410117
and dword [ebp - 4], 0
mov eax, dword [0x455014]
push dword [eax + 0xc]
mov ecx, edi
call fcn.004114d9
push eax
lea eax, [ebp - 0x54]
push str._s_s__mini
push eax
call fcn.00410944
add esp, 0x10
lea ecx, [ebp - 0x54]
call fcn.0041014a
push eax
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
push 1
push 0
push str.WJNews
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00410139
call fcn.0043c58c
ret
Function at 0x401c93
Capabilities:
Set registry value

Disassembly:
push 0xdc
mov eax, 0x4421e7
call fcn.0043c542
mov dword [ebp - 0xe4], ecx
call fcn.0041014a
test eax, eax
jne 0x401cb8
xor al, al
jmp 0x401e78
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xe0]
push eax
push 0x20006
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call edi
cmp eax, ebx
jne 0x401e76
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xe0]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0xe0]
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push esi
call edi
cmp eax, ebx
jne 0x401e76
lea ecx, [ebp - 0x54]
call fcn.00410117
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 4], ebx
mov eax, dword [0x455014]
push dword [eax + 0x10]
call fcn.004114d9
push eax
lea eax, [ebp - 0x54]
push str._s_s
push eax
call fcn.00410944
mov eax, dword [0x455014]
add esp, 0x10
push 0xffffffffffffffff
push dword [eax + 4]
lea ecx, [ebp - 0x98]
call fcn.00410715
push 0xffffffffffffffff
push 0x44bde4
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.00410715
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.0041014a
push eax
lea ecx, [ebp - 0x54]
call fcn.004114d9
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
xor edi, edi
inc edi
push edi
push ebx
push str.DisplayIcon
push dword [ebp - 0xe0]
call esi
lea ecx, [ebp - 0x98]
call fcn.0041014a
push eax
lea ecx, [ebp - 0x98]
call fcn.004114d9
push eax
push edi
push ebx
push str.DisplayName
push dword [ebp - 0xe0]
call esi
lea ecx, [ebp - 0xdc]
call fcn.0041014a
push eax
lea ecx, [ebp - 0xdc]
call fcn.004114d9
push eax
push edi
push ebx
push str.DisplayVersion
push dword [ebp - 0xe0]
call esi
lea ecx, [ebp - 0x98]
call fcn.0041014a
push eax
lea ecx, [ebp - 0x98]
call fcn.004114d9
push eax
push edi
push ebx
push str.Publisher
push dword [ebp - 0xe0]
call esi
lea ecx, [ebp - 0x54]
call fcn.0041014a
push eax
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
push edi
push ebx
push str.UninstallString
push dword [ebp - 0xe0]
call esi
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.00410139
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00410139
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00410139
mov al, 1
call fcn.0043c58c
ret
Function at 0x402104
Capabilities:
Create process on windows

Disassembly:
push 0x90
mov eax, 0x4424a6
call fcn.0043c542
lea esi, [ebp - 0x98]
call fcn.00402266
xor ebx, ebx
push ebx
push str._open_
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041044f
test eax, eax
jle 0x4021d3
cmp dword [edi + 0x18], ebx
je 0x4021ca
sub esp, 0x44
mov ecx, esp
mov dword [ebp - 0x9c], esp
push 0xffffffffffffffff
push str.C:Program_FilesWuji
call fcn.00410715
mov esi, dword [edi + 0x18]
call fcn.00401311
push dword [edi + 0x18]
call fcn.0040138a
mov ecx, dword [edi + 0x18]
push 1
push 1
call fcn.00401a9d
mov ecx, dword [edi + 0x18]
push 1
call fcn.00401652
mov ecx, dword [edi + 0x18]
call fcn.00401c93
mov ecx, dword [edi + 0x18]
call fcn.00401e7e
lea ecx, [ebp - 0x54]
call fcn.00410117
mov byte [ebp - 4], 1
push dword [edi + 8]
lea eax, [ebp - 0x54]
push str.C:Program_FilesWuji_s__qipao
push eax
call fcn.00410944
add esp, 0xc
push 5
lea ecx, [ebp - 0x54]
call fcn.004114d9
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.00410139
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x402251
push 0x284
call fcn.00407238
mov esi, eax
pop ecx
mov dword [ebp - 0x9c], esi
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x4021f5
call fcn.00402578
jmp 0x4021f7
xor eax, eax
mov byte [ebp - 4], bl
mov dword [edi], eax
cmp eax, ebx
je 0x402251
push ebx
push 0x258
push 0x190
push ebx
push ebx
push 0x60000
push 0x96c80000
push 0x44bf14
push ebx
mov ecx, eax
call fcn.004110f0
mov ecx, dword [edi]
call fcn.00410c6b
mov ecx, dword [edi]
push 5
call fcn.004100e8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0x43
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call fcn.004100e8
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00410139
call fcn.0043c58c
ret

Function at 0x4022bf
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.00402405
mov eax, dword [0x455014]
push dword [eax + 0xc]
call fcn.0040232a
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
xor ebx, ebx
push ebx
push 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, ebx
je 0x4022f0
push ebx
push eax
call edi
mov eax, dword [0x455014]
push dword [eax + 8]
call fcn.0040232a
push eax
push ebx
push 1
call esi
cmp eax, ebx
je 0x40230b
push ebx
push eax
call edi
mov eax, dword [0x455014]
push dword [eax + 0x14]
call fcn.0040232a
push eax
push ebx
push 1
call esi
cmp eax, ebx
je 0x402326
push ebx
push eax
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x40232a
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2114
call fcn.0040dcd0
mov eax, dword [0x452024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x1110], eax
lea eax, [ebp - 0x110c]
push eax
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1108]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x4023ed
mov eax, dword [ebp - 0x110c]
push ebx
push edi
shr eax, 2
xor edi, edi
test eax, eax
jle 0x4023e9
push dword [ebp + edi*4 - 0x1108]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x1114]
push eax
push esi
lea eax, [ebp - 0x2114]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x2114]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push dword [ebp - 0x1110]
lea eax, [ebp - 0x108]
push eax
call fcn.004072c0
pop ecx
pop ecx
test eax, eax
jne 0x4023fc
mov eax, dword [ebp - 0x110c]
inc edi
shr eax, 2
cmp edi, eax
jl 0x40237e
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004068c3
leave
ret 4
mov eax, dword [ebp + edi*4 - 0x1108]
jmp 0x4023eb

Function at 0x402405
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x452024]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402430
xor eax, eax
jmp 0x402486
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x402450
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40242c
mov eax, dword [ebp - 0x20]
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402445
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004068c3
leave
ret
Function at 0x40494a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x404955
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x404a09
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x44b828]
add ecx, 8
sub edi, 8
dec esi
jne 0x40496c
pop ebx
test edi, edi
je 0x404a22
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x44b828]
inc ecx
dec edi
jne 0x404a0d
pop esi
not eax
pop edi
ret

Function at 0x40518f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4051bf
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4051ba
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4051e7
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4051d0
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0040cbf0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x4068c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x452024]
jne 0x4068cd
repz ret
jmp fcn.00407bc2

Function at 0x40ba4f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x452024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407cc8
and dword [ebp - 0x14], 0
cmp dword [0x454b48], 0
mov dword [ebp - 0x18], eax
jne 0x40bb02
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40bbaa
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40bbaa
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x454b48], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x454b4c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x454b50], eax
call edi
push eax
call esi
mov dword [0x454b58], eax
test eax, eax
je 0x40bb02
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x454b54], eax
mov eax, dword [0x454b54]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40bb5b
cmp dword [0x454b58], ecx
je 0x40bb5b
push eax
call esi
push dword [0x454b58]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40bb5b
test ebx, ebx
je 0x40bb5b
call edi
test eax, eax
je 0x40bb52
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40bb52
test byte [ebp - 8], 1
jne 0x40bb5b
or dword [ebp + 0x10], 0x200000
jmp 0x40bb8e
mov eax, dword [0x454b4c]
cmp eax, dword [ebp - 0x18]
je 0x40bb8e
push eax
call esi
test eax, eax
je 0x40bb8e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40bb8e
mov eax, dword [0x454b50]
cmp eax, dword [ebp - 0x18]
je 0x40bb8e
push eax
call esi
test eax, eax
je 0x40bb8e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x454b48]
call esi
test eax, eax
je 0x40bbaa
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40bbac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004068c3
leave
ret

Function at 0x41118a
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x4111a0
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x4111ac
or edi, 1
push 1
call esi
test ax, ax
jns 0x4111b8
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x4111c4
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x4111d0
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x412d34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x412d59
cmp ebx, dword [esi + 0x54]
je 0x412d59
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x412e1b
push edi
test eax, eax
je 0x412dac
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.00412874
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x412e1a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x412e1a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x412e1a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x412e1a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.00412874
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41301c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0xd0]
xor ebx, ebx
call fcn.004100e8
test eax, eax
jle 0x413071
push ebx
lea ecx, [esi + 0xd0]
mov byte [ebp - 1], 0
call fcn.00410108
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x4130cf
lea ecx, [esi + 0xd0]
inc ebx
call fcn.004100e8
cmp ebx, eax
jl 0x413038
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x413126
sub eax, 4
je 0x4130d3
dec eax
dec eax
jne 0x41311d
push dword [ebp + 0xc]
mov byte [ebp + 8], al
lea edi, [ebp + 9]
stosb byte es:[edi], al
call fcn.0043c772
pop ecx
mov ecx, dword [esi + 0x50]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov byte [ebp + 8], al
mov eax, dword [ecx]
push 0x412318
call dword [eax + 0xf4]
mov esi, eax
test esi, esi
je 0x41311d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x41311f
cmp dword [esi + 0x54], 0
je 0x41311d
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x10], al
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0041118a
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41311d
cmp dword [esi + 0x54], 0
je 0x413175
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc0]
test al, al
je 0x413175
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xcc]
test al, al
je 0x413175
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.RichEditUI
push eax
call fcn.00407743
pop ecx
pop ecx
test eax, eax
je 0x413175
mov ecx, dword [esi + 0x54]
call fcn.0041d927
test al, al
jne 0x41311d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.00412ecc
jmp 0x4130cf
Function at 0x41db2f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x2fc], ebx
je 0x41db96
cmp dword [ebp + 8], 0x100
jne 0x41db85
cmp byte [ebp + 0xc], 0xd
jne 0x41db85
cmp byte [esi + 0x302], bl
je 0x41db6c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41db85
cmp byte [esi + 0x303], bl
jne 0x41db85
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x41db81
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.00412874
xor eax, eax
jmp 0x41db99
mov eax, dword [esi + 0x2fc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10