joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4015dc
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401611
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40160d
cmp edi, eax
jae 0x401611
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4015ff
cmp edi, eax
jb 0x401615
xor eax, eax
jmp 0x40161f
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401a9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x9c
lea ebp, [esp - 4]
mov eax, dword [0x4ab1a4]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0xc
mov eax, 0x488b25
call fcn.0045cbb7
xor edi, edi
mov ebx, ecx
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], edi
mov word [ebp + 4], di
mov eax, 0x494fdc
lea esi, [ebp]
mov dword [ebp - 4], edi
call fcn.004087dc
push str.BF56FF80_3803_422B_80A0_9844629C810C
mov eax, esi
push eax
call fcn.004087be
push str.Implemented_Categories_
mov eax, esi
push eax
call fcn.004087be
push str.C376DC05_16CC_4498_8BF3_1F0D8FF4013A
mov eax, esi
push eax
call fcn.004087be
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], edi
jae 0x401b1b
lea eax, [ebp + 4]
lea ecx, [ebp - 0x10]
push ecx
push 0x201
push edi
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401b67
xor ebx, ebx
push edi
push 1
lea esi, [ebp]
call fcn.0040884a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0045447b
add ebp, 0xa0
leave
ret
push 0x7e
lea eax, [ebp + 0x1e]
push edi
push eax
xor esi, esi
mov word [ebp + 0x1c], di
call fcn.00455160
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push str.uuid
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x80
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401bb2
lea eax, [ebp + 0x1c]
mov esi, ebx
call fcn.004087dc
xor esi, esi
inc esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, esi
jmp 0x401b37
Function at 0x4030f6
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4ab1a4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea esi, [eax + 8]
mov ebx, dword [esi + 8]
cmp dword [esi + 4], ebx
push edi
jbe 0x40311f
call fcn.0045446b
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x40312c
call fcn.0045446b
cmp edi, ebx
je 0x40315f
mov eax, dword [esi + 8]
sub eax, ebx
sar eax, 2
mov ecx, eax
shl ecx, 2
test eax, eax
lea edx, [ecx + edi]
mov dword [ebp - 0x240], edx
jle 0x403156
push ecx
push ebx
push ecx
push edi
call fcn.004542e6
add esp, 0x10
mov eax, dword [ebp - 0x240]
mov dword [esi + 8], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403176
xor eax, eax
jmp 0x403248
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40319e
test ebx, ebx
je 0x40316f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40316f
lea eax, [ebp - 0x218]
push 0x4951dc
push eax
call fcn.004546f2
test eax, eax
pop ecx
pop ecx
jne 0x40320e
mov edx, dword [esi + 4]
test edx, edx
jne 0x4031c0
xor ecx, ecx
jmp 0x4031c8
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x4031eb
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x4031eb
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x234]
mov dword [eax], ecx
add eax, 4
mov dword [esi + 8], eax
jmp 0x40320e
mov edi, dword [esi + 8]
cmp edx, edi
jbe 0x4031f7
call fcn.0045446b
push edi
push esi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x244]
push eax
mov eax, esi
call fcn.0041abca
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40319e
test ebx, ebx
je 0x40322e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
test eax, eax
jne 0x403239
xor esi, esi
jmp 0x403241
mov esi, dword [esi + 8]
sub esi, eax
sar esi, 2
xor eax, eax
test esi, esi
setne al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045447b
leave
ret 4

Function at 0x4032b9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov byte [ebp - 1], bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x403301
push edi
call fcn.00453739
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x403310
push edi
push ebx
push eax
call fcn.00455160
add esp, 0xc
push dword [esi]
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x403301
mov byte [ebp - 1], 1
jmp 0x403310
mov eax, dword [esi]
cmp eax, ebx
je 0x403310
push eax
call fcn.004572a5
pop ecx
mov dword [esi], ebx
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 4
Function at 0x40344a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48aae8
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4ab1a4]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
push edi
mov eax, dword [0x4ab1a4]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor edi, edi
push 0x208
lea eax, [esp + 0x1a]
push edi
xor esi, esi
push eax
inc esi
mov word [esp + 0x20], di
call fcn.00455160
add esp, 0xc
push 0x104
lea eax, [esp + 0x18]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], edi
call fcn.00403614
test eax, eax
je 0x4034e2
xor eax, eax
cmp dword [esp + 0x10], edi
setne al
add eax, 3
mov esi, eax
jmp 0x403560
lea eax, [esp + 0x14]
push eax
call fcn.00403d46
test eax, eax
je 0x4034f4
push 2
jmp 0x40355f
lea eax, [esp + 0x14]
push eax
call fcn.00403974
test eax, eax
lea eax, [esp + 0x14]
push eax
je 0x403554
lea eax, [esp + 0x10]
push eax
call fcn.00401860
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x23c], edi
call fcn.00441b1c
lea eax, [esp + 0x10]
mov dword [esp], str.LsfSdk.dll
push eax
call fcn.0043105b
push dword [esp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
add eax, 0xfffffff0
add esi, 0xb
call fcn.0040154a
jmp 0x403560
call fcn.00403b5d
test eax, eax
je 0x403560
push 0xd
pop esi
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0045447b
mov esp, ebp
pop ebp
ret
Function at 0x4062e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
mov edi, 0x4afd74
mov ecx, edi
lea esi, [esp + 0x14]
call fcn.0040183b
mov ecx, edi
lea esi, [esp + 0x18]
call fcn.0040183b
mov ecx, edi
lea esi, [esp + 0x1c]
call fcn.0040183b
mov ecx, edi
lea esi, [esp + 0x20]
call fcn.0040183b
mov ecx, edi
lea esi, [esp + 0x24]
call fcn.0040183b
mov edx, dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.0040596f
mov eax, esi
call fcn.0040643a
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004064a3
pop ecx
push dword [esp + 0xc]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4b0ce4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4063d7
call fcn.0044863d
push ebx
mov byte [eax], bl
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00430735
test eax, eax
jl 0x4063c2
lea ecx, [esp + 0x10]
call fcn.00405d43
call fcn.004305c4
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0044863d
call fcn.00448679
mov eax, dword [0x4b0ce4]
cmp eax, ebx
je 0x4063e7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.0040154a
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.0040154a
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.0040154a
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.0040154a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.0040154a
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.0040154a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40694b
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b0e88]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x406968
mov edi, dword [eax + 4]
jmp 0x40696a
xor edi, edi
cmp edi, esi
jne 0x40697a
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x40699f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x40699f
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40699f
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.004088bc
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x4069c5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x406ad2
mov edx, eax
call fcn.00414984
mov dword [esp + 0x20], eax
mov eax, edi
call fcn.00408bcf
cmp dword [ebx + 0x428], esi
je 0x406a75
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x406a1e
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x406a56
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x406a75
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x406aba
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x406aba
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x406aba
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00414984
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x406d98
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b0e88]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x406db5
mov edi, dword [eax + 4]
jmp 0x406db7
xor edi, edi
cmp edi, esi
jne 0x406dc7
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x406dec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x406dec
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x406dec
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.00408a60
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x406e12
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x406f1f
mov edx, eax
call fcn.00414984
mov dword [esp + 0x20], eax
mov eax, edi
call fcn.00408bcf
cmp dword [ebx + 0x428], esi
je 0x406ec2
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x406e6b
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x406ea3
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x406ec2
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x406f07
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x406f07
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x406f07
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00414984
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x407346
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b0e88]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x407363
mov edi, dword [eax + 4]
jmp 0x407365
xor edi, edi
cmp edi, esi
jne 0x407375
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x40739a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x40739a
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40739a
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.0040957b
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x4073c0
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x4074cd
mov edx, eax
call fcn.00414984
mov dword [esp + 0x20], eax
mov eax, edi
call fcn.00408bcf
cmp dword [ebx + 0x428], esi
je 0x407470
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x407419
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x407451
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x407470
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x4074b5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x4074b5
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x4074b5
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00414984
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4077d1
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b0e88]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x4077ee
mov edi, dword [eax + 4]
jmp 0x4077f0
xor edi, edi
cmp edi, esi
jne 0x407800
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x407825
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x407825
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x407825
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.004096ea
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x40784b
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x407958
mov edx, eax
call fcn.00414984
mov dword [esp + 0x20], eax
mov eax, edi
call fcn.00408bcf
cmp dword [ebx + 0x428], esi
je 0x4078fb
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x4078a4
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x4078dc
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x4078fb
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x407940
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x407940
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x407940
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00414984
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x407ce9
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b0e88]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x407d06
mov edi, dword [eax + 4]
jmp 0x407d08
xor edi, edi
cmp edi, esi
jne 0x407d18
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x407d3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x407d3d
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x407d3d
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.0040993b
cmp eax, esi
mov dword [esp + 0x18], eax
jne 0x407d63
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x407e70
mov edx, eax
call fcn.00414984
mov dword [esp + 0x20], eax
mov eax, edi
call fcn.00408bcf
cmp dword [ebx + 0x428], esi
je 0x407e13
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x407dbc
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x407df4
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x407e13
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x407e58
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x407e58
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x407e58
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.00414984
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret