joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x51b9a4], 0
push esi
mov esi, 0x519e00
jne 0x413d9a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00413d30
mov dword [0x5164e0], 0x270
mov dword [0x519dfc], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x413db0
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x413de5
mov ecx, dword [esi]
mov eax, dword [0x519e00]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x413e50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x5164e0]
jne 0x413e5d
call fcn.00413d80
mov eax, dword [0x519dfc]
mov ecx, dword [eax]
add eax, 4
mov dword [0x519dfc], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x413ea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x5164e0]
jne 0x413eae
call fcn.00413d80
mov ecx, dword [0x519dfc]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x519dfc], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x413ef5
fadd qword [0x50f830]
fmul qword [0x50f888]
pop ecx
ret
Function at 0x41d3e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x516500]
add eax, 4
imul eax, eax, 0x108
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push eax
call fcn.004c9c38
add esp, 4
mov dword [0x5199e0], eax
test eax, eax
jne 0x41d40f
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [0x5165ec]
push 0x403e80
mov edi, eax
push 0x4ef6d80
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x51aed0]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0xe
push ecx
mov dword [0x5165ec], eax
call edi
call fcn.004010e0
cmp dword [ebp], 0
jne 0x41d453
mov ebx, 1
jmp 0x41d502
mov edx, dword [0x5165ec]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xec], 0
call esi
cmp byte [0x51b028], 0
mov ecx, dword [0x5165ec]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], 0x64
jne 0x41d4a3
mov eax, dword [0x51aed0]
push 0x403d80
push 0x64
push 0xb
push eax
call edi
test eax, eax
setne cl
mov byte [0x51b028], cl
mov byte [ebp + 0xadd], 1
call esi
mov ecx, dword [ebp]
push 0
mov esi, 1
add dword [0x51b040], esi
push 0
push esi
mov dword [ebp + 0xaf4], eax
mov dword [ebp + 0xaf0], eax
call fcn.00424e00
sub dword [0x51b040], esi
cmp byte [0x51b028], 0
mov ebx, eax
je 0x41d4fb
mov edx, dword [0x51aed0]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x41d4fb
mov byte [0x51b028], 0
mov byte [ebp + 0xadd], 0
mov ebp, dword [0x5165ec]
cmp dword [ebp + 0x104], 0
je 0x41d55c
mov eax, dword [ebp + 0x104]
cmp dword [eax + 8], 6
jne 0x41d527
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0x104]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41d53d
push eax
call fcn.004ca991
add esp, 4
mov ecx, dword [ebp + 0x104]
push ecx
call fcn.004cb3e6
mov dword [ebp + 0x104], 0
mov ebp, dword [0x5165ec]
add esp, 4
mov eax, ebp
call fcn.00401450
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
mov byte [ebp + 0xec], 1
push 0x4e6a28
mov ecx, 0x42
mov esi, ebp
mov edi, 0x519af0
rep movsd dword es:[edi], dword [esi]
push edx
mov byte [ebp + 0xec], 1
mov dword [ebp + 0xe0], 0
mov word [ebp + 0xed], 1
mov dword [ebp + 0x2c], SysReAllocString
call fcn.004aefb0
mov eax, dword [0x516610]
cmp word [eax], 0
jne 0x41d5f6
cmp dword [0x51b940], 0
jne 0x41d5f6
cmp dword [0x51b000], 0
jne 0x41d5f6
cmp dword [0x51b004], 0
jne 0x41d5f6
cmp byte [0x51b024], 0
jne 0x41d5f6
neg ebx
sbb ebx, ebx
and ebx, 7
push 0
add ebx, 2
push ebx
push 0x51c0f8
call fcn.0041d650
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x41d650
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esp, 0x124
push ebx
xor ebx, ebx
push esi
push edi
mov dword [eax + 0xa98], ecx
cmp byte [0x51e763], bl
jne 0x41d7da
cmp byte [eax + 0xadc], bl
je 0x41d7da
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x51b6d0]
push ebx
push 1
mov dword [0x51f7a4], eax
call fcn.004016f0
push 0x7f
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004cb3f1
mov eax, dword [0x5165ec]
inc dword [0x51b040]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x13a], dx
mov ecx, 0x42
mov esi, 0x519af0
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x5165ec], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x51c0f8
call fcn.0041d2e0
mov dword [0x51cbd8], ebx
mov dword [0x51cbdc], ebx
cmp dword [0x51b06c], ebx
je 0x41d705
push 0x51b6d8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0xa8c]
mov edi, dword [0x5164f4]
mov dword [0x5164f4], ebx
mov byte [0x51e763], 1
mov byte [esp + 0xf], 1
mov byte [0x518343], bl
cmp ecx, ebx
je 0x41d745
call fcn.00401760
test eax, eax
je 0x41d745
cmp byte [0x518343], bl
jne 0x41d745
mov byte [esp + 0xf], bl
mov byte [0x518343], 1
cmp byte [esp + 0xf], bl
je 0x41d79d
call fcn.00443590
mov dword [esp + 0x10], eax
mov eax, dword [0x51f7a4]
cdq
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esi + 0xa8c], ebx
lea ecx, [esp + 0x10]
sete al
mov dword [esp + 0x24], edx
lea edx, [esi + 0xa58]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], 1
push eax
push 2
push ecx
push edx
call fcn.004a1c30
cmp eax, 3
jne 0x41d79d
mov byte [esp + 0xf], bl
mov byte [0x51e763], bl
cmp byte [esp + 0xf], bl
jne 0x41d7d0
cmp dword [ebp + 0xc], 3
je 0x41d7d0
lea eax, [esp + 0x30]
push eax
call fcn.00403bf0
add esp, 4
mov dword [0x5164f4], edi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push esi
call fcn.0041d820
cmp byte [0x518343], bl
jne 0x41d80f
cmp ecx, 9
jne 0x41d80f
mov edx, dword [0x51ae58]
cmp word [edx], bx
je 0x41d7fa
mov eax, dword [ebp + 0x10]
mov dword [0x51f7a4], eax
pop edi
pop esi
mov byte [0x518343], 1
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call fcn.0041d820
int3
Function at 0x42b590
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x51b040]
sub esp, 0x124
push ebx
push esi
push edi
cmp eax, dword [0x516500]
jl 0x42b5ba
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [0x51b6d0]
cmp byte [esi + 0x17], 0
jne 0x42b5c9
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42b5d6
mov eax, esi
call fcn.00401610
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42b5ef
test byte [esi + 0x15], 4
je 0x42b5ea
mov eax, esi
call fcn.0042e530
mov eax, dword [esi + 8]
jmp 0x42b5ff
cmp al, 2
jne 0x42b5fa
call fcn.004014b0
jmp 0x42b5ff
mov eax, 0x51c06c
push 0x7f
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004cb3f1
mov eax, dword [0x5165ec]
inc dword [0x51b040]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x13a], dx
mov ecx, 0x42
mov esi, 0x519af0
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x5165ec], eax
push edi
mov eax, 0x51c0f8
mov dword [esi + 0x2c], edi
call fcn.0041d2e0
mov dword [0x51cbd8], edi
mov dword [0x51cbdc], edi
cmp dword [0x51b06c], edi
je 0x42b66d
push 0x51b6d8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or eax, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x42b688
mov byte [esi + 0xee], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x51cbe4], edi
je 0x42b69e
cmp dword [0x51cbe0], edi
jne 0x42b6a7
cmp byte [esi + 0xee], 0
je 0x42b6d2
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x42b6d2
cmp dword [0x51cbe4], edi
jl 0x42b6cc
call ebx
mov dword [esi + 0xdc], eax
mov eax, dword [0x51cbe4]
mov dword [esi + 0xe0], eax
mov ecx, dword [0x51cb4c]
mov eax, dword [0x51cb48]
mov edx, dword [0x51cbb4]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x51cbb0]
mov edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [0x51cb4c], eax
mov dword [0x51cbb4], ecx
mov dword [0x51cb48], esi
call ebx
mov dword [0x51cbec], eax
mov dword [0x51cbe8], eax
mov dword [0x51cbb0], eax
mov eax, dword [ebp + 8]
cmp byte [eax], 5
jne 0x42b730
mov esi, dword [eax + 0xc]
call fcn.0042b520
mov esi, eax
jmp 0x42b77a
mov ebx, dword [eax + 0xc]
push 0x4e7d8c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], esi
call fcn.004a4b10
add esp, 4
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x28]
push ecx
push 0x4e6a10
xor eax, eax
mov ecx, ebx
call fcn.0049ec30
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b77a
mov esi, dword [esp + 0xc]
neg esi
sbb esi, esi
add esi, 4
mov edx, dword [0x5165ec]
mov eax, dword [edx + 0xc4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov dword [0x51cbb0], ecx
mov dword [0x51b054], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x30]
push ecx
mov dword [0x51cb48], edi
mov dword [0x51cb4c], edx
mov dword [0x51cbb4], eax
call fcn.00403bf0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42d970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], eax
xor eax, eax
push edi
mov edi, 8
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], str.What
mov dword [esp + 0x48], eax
cmp esi, eax
jne 0x42d9fd
movzx esi, word [ecx]
imul esi, esi, 0x15
mov esi, dword [esi + 0x5168a0]
mov dword [esp + 0x40], esi
movzx esi, word [ecx + 4]
mov ecx, dword [ecx + 8]
mov esi, dword [esi*4 + 0x51a7c0]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], 0x4f0fe8
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x70], str.Line
mov dword [esp + 0x88], 1
mov dword [esp + 0x84], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x90], str.Message
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa0], ecx
cmp edx, eax
je 0x42da9d
cmp word [edx], ax
je 0x42da9d
mov edi, 0xa
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb0], str.Extra
mov dword [esp + 0xc8], eax
mov dword [esp + 0xc0], edx
lea edx, [esp + 8]
push edi
push edx
call fcn.0049ed70
add esp, 8
pop edi
pop esi
add esp, 0xc8
ret 4
Function at 0x42e3f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.004d5830
cmp dword [esp + 0x4008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4018]
mov ebx, ecx
je 0x42e525
test ebx, ebx
jne 0x42e428
mov eax, dword [esp + 0x400c]
mov ebx, dword [eax + 0x630]
test ebx, ebx
je 0x42e432
movzx ecx, word [ebx + 4]
movzx eax, word [ebx + 8]
jmp 0x42e43f
mov ecx, dword [eax + 0x26c]
movzx eax, word [eax + 0x270]
mov edx, dword [esp + 0x4014]
mov ecx, dword [ecx*4 + 0x51a7c0]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str.u_qom1deyqsrf
call fcn.004a4b10
add esp, 4
push eax
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.004ac070
add esp, 0x10
cmp word [ebp], 0
lea edi, [esp + eax*2 + 0x10]
je 0x42e4a2
push ebp
push str.phqgh
call fcn.004a4b10
add esp, 4
push eax
lea eax, [esp + 0x18]
mov edx, edi
sub edx, eax
sar edx, 1
sub esi, edx
call fcn.004ac070
add esp, 8
mov esi, dword [esp + 0x4018]
cmp esi, 3
jne 0x42e4d1
call fcn.004ca161
add eax, 0x20
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004cbab6
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x42e523
test ebx, ebx
jne 0x42e4f6
mov ecx, dword [esp + 0x4014]
mov ebx, dword [ecx + 0x630]
test ebx, ebx
je 0x42e515
mov eax, dword [esp + 0x401c]
push ebp
push 1
push eax
mov ecx, ebx
call fcn.0042dd40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
mov edx, dword [esp + 0x401c]
push ebp
push edx
call fcn.00477180
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
Function at 0x42e9f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42ea17
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42ea21
xor edx, edx
mov word [esp + 0x120], dx
mov esi, dword [0x51cb94]
xor eax, eax
mov word [esp + 0x20], ax
test esi, esi
je 0x42ead8
cmp byte [esi + 0x11], 0
je 0x42ea79
mov ecx, dword [esi]
push ecx
call fcn.004a1b30
add esp, 4
sub eax, 0
je 0x42ea5d
dec eax
je 0x42ea56
mov eax, str.Object
jmp 0x42ea62
mov edx, dword [esi]
mov eax, dword [edx + 4]
jmp 0x42ea62
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4f18f8
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.004ac0b0
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42ea36
cmp word [esp + 0x20], si
je 0x42ead8
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ea90
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x42eac6
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x4ec7dc
push edi
call fcn.004cb3f1
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x42ead8
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x42ead8
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x5199e0]
cmp byte [eax + 0xf8], 0
je 0x42eaf7
cmp byte [0x51cbd5], 0
mov dword [esp + 0x14], 1
je 0x42eaff
mov dword [esp + 0x14], 0
mov eax, dword [0x51b040]
cmp eax, 1
jle 0x42eb21
push str.p__5_0_55__tl2__i_:_c___2_0m2___n8._x___137p_95_4_e0__._o
call fcn.004a4b10
mov dword [esp + 0x1c], eax
mov eax, dword [0x51b040]
add esp, 4
jmp 0x42eb29
mov dword [esp + 0x18], 0x4f5ac4
cmp eax, 1
jle 0x42eb33
lea ebp, [eax - 1]
jmp 0x42eb35
xor ebp, ebp
cmp dword [0x51b004], 0
mov edi, 0x4eaf68
je 0x42eb48
mov edi, 0x4eaf60
cmp dword [0x51b000], 0
mov esi, 0x4eaf68
je 0x42eb5b
mov esi, 0x4eaf60
lea ecx, [esp + 0x1e8]
push ecx
push 1
call fcn.004127e0
add esp, 4
mov bl, al
call fcn.00412ba0
mov edx, dword [0x51b03c]
mov ecx, dword [0x51b044]
sub ecx, dword [esp + 0x18]
add esp, 4
push eax
mov eax, dword [0x51b040]
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
mov ecx, dword [0x51cb9c]
push edx
mov edx, dword [0x51cba0]
push ebp
lea eax, [esp + 0x38]
push eax
push ecx
push edx
push edi
push esi
lea eax, [esp + 0x14c]
push eax
push str._a___wedAD_a:_i:_98ypm_JB
call fcn.004a4b10
mov edi, dword [esp + 0x420]
add esp, 4
push eax
mov esi, 0xfffe
call fcn.004ac070
lea esi, [edi + eax*2]
mov ecx, esi
mov ebx, edi
sub ecx, ebx
sar ecx, 1
mov edx, 0xfffe
add esp, 0x34
sub edx, ecx
push edx
push esi
call fcn.004099d0
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ebf6
sub eax, edx
sar eax, 1
cmp dword [0x51b8e4], 0
lea edi, [esi + eax*2]
je 0x42ec18
push 0x4f0f58
jmp 0x42ec1d
push str._BK_1u
call fcn.004a4b10
add esp, 4
push eax
mov eax, edi
sub eax, ebx
sar eax, 1
mov esi, 0xfffe
sub esi, eax
call fcn.004ac070
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
Function at 0x435f00
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.00442310
mov edi, eax
test edi, edi
je 0x435f2e
mov esi, dword [esp + 0x1c]
push edi
call fcn.004b0980
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x435f79
mov ecx, dword [0x5165ec]
test byte [ecx + 0x100], 1
jne 0x435f5c
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push edx
call fcn.004aefb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x4f5ac4
push 0
push 0x4eb75c
call fcn.0042dac0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x435fb1
cmp ebp, dword [0x51c084]
je 0x435fb1
mov esi, edi
call fcn.004b0ee0
test al, al
jne 0x435fb1
mov eax, dword [0x51c084]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x435fef
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push edx
call fcn.004aefb0
mov eax, dword [0x5165ec]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x435fef
push 1
push eax
call fcn.00401930
add esp, 8
test bl, bl
je 0x436003
mov ecx, dword [0x51c084]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x436cf0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00430080
mov ebx, eax
test ebx, ebx
jne 0x436d2c
push esi
push eax
push 0x4ec0ec
call fcn.004a4b10
mov ecx, dword [ebp + 8]
add esp, 4
push eax
call fcn.0042dd40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x436d38
jmp dword [eax*4 + 0x436f38]
mov eax, dword [ebp + 0xc]
cmp word [eax], 0
je 0x436d53
push eax
call fcn.00453860
add esp, 4
jmp 0x436d59
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x51b6d0]
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453860
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x436dd1
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x436dd1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x51b6d0]
push 0x18
push 0
push esi
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push ecx
call fcn.004aefb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [edi]
push edx
call fcn.004cbc63
movzx eax, ax
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x436e0f.67
movzx eax, byte [eax + 0x436f68]
jmp dword [eax*4 + 0x436f4c]
mov esi, 0x40
jmp 0x436e3e
mov esi, 0x4000
jmp 0x436e3e
mov esi, 0x20
jmp 0x436e3e
mov esi, 0x8000
jmp 0x436e3e
mov esi, 0x80
jmp 0x436e3e
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp word [eax], 0
je 0x436e52
push eax
call fcn.00453860
add esp, 4
jmp 0x436e58
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x436dd1
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x436dd1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x436da5
mov edx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push edx
call fcn.004aefb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp word [edi], 0
je 0x436ed2
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.0041ac70
fmul qword [0x50f870]
call fcn.004d8ac0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x436ee0
mov byte [esp + 0x13], 1
xor edi, edi
lea esp, [esp]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453860
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x436efd
test esi, esi
jne 0x436db4
jmp 0x436f01
test esi, esi
je case.0x436e0f.67
cmp byte [esp + 0x13], 0
jne 0x436f1f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x436db4
push 1
push 0x64
call fcn.00401930
add esp, 8
jmp 0x436ee0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4377b0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [0x51ae08]
push edi
push eax
mov eax, dword [esp + 0x18]
call fcn.00442310
mov edi, eax
test edi, edi
je 0x4377d6
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [eax + 1]
jmp 0x4377db
mov ebp, 1
push 1
push 0
lea ecx, [ebp - 1]
push ecx
push 0
push esi
call fcn.004aefb0
cmp eax, 1
je 0x4377f9
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov ecx, esi
test edi, edi
je 0x43788b
push ebp
push 0
push 1
call fcn.004016f0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [esi + 0x17], 0
mov ebp, eax
jne 0x437822
mov edi, dword [esi + 0xc]
jmp 0x437824
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43783c
test byte [edi + 0x15], 8
je 0x437837
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x437841
mov eax, 0x51e75c
lea edx, [ebp + ebp]
mov dword [eax], edx
cmp byte [esi + 0x17], 0
jne 0x437852
mov edi, dword [esi + 0xc]
jmp 0x437854
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43786c
test byte [edi + 0x15], 8
je 0x437867
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x437871
mov eax, 0x51e75c
test dword [eax], 0xfffffffe
jne 0x4378c8
push 0
push 1
mov ecx, esi
call fcn.004016f0
xor ecx, ecx
mov word [eax], cx
jmp 0x4378c8
push 0
push 1
call fcn.004016f0
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], dl
jne 0x4378a3
mov edi, dword [esi + 0xc]
jmp 0x4378a5
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x4378bd
test byte [edi + 0x15], 8
je 0x4378b8
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x4378c2
mov eax, 0x51e75c
mov dword [eax], 0
cmp byte [esi + 0x17], 0
jne 0x4378d1
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x4378f1
cmp dword [0x51c0a8], 0
je 0x4378f1
mov ecx, 0x51c09c
call fcn.004049a0
pop edi
pop esi
pop ebp
pop ecx
ret 4
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4

Function at 0x438750
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004d5830
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
mov esi, dword [0x51ae08]
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0x7fff
jb 0x438804
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push esi
call fcn.004aefb0
test eax, eax
jne 0x4387a2
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
push edi
push 0
push 1
mov ecx, esi
call fcn.004016f0
push eax
push ebx
call ebp
test eax, eax
jne 0x4387c5
push eax
push 1
mov ecx, esi
call fcn.004016f0
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], 0
jne 0x4387ce
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x4387f1
cmp dword [0x51c0a8], 0
je 0x4387f1
mov ecx, 0x51c09c
call fcn.004049a0
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x438811
mov eax, 0x4f5ac4
push 1
push 0
push edi
push eax
push esi
call fcn.004aefb0
pop edi
pop esi
pop ebp
add esp, 0x10000
ret