joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3138b7a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x3138b7ce
mov eax, ebx
call fcn.3138c254
cmp dword [ebx + 0x40], 0
je 0x3138b7c7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x3138b83f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x3138b831
cmp dword [ebx + 8], 0
je 0x3138b7f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x3138b802
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x3138b831
cmp dword [ebx + 8], 0
je 0x3138b7e3
cmp eax, 3
je 0x3138b815
dec eax
jne 0x3138b7e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x3138b7e3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x3138b7e3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x3138b85d
cmp dword [ebx + 0x14], 0xcc
je 0x3138b85d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.3138b868
pop ebx
ret

Function at 0x3139f8d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x3139f941
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x3143f208]
push eax
push 0
call sub.shell32.dll_ShellExecuteExW
cmp dword [ebp - 4], 0
je 0x3139f92b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.3139f8b8
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x3139f070]
call fcn.313a0314
mov dword [0x3143f26c], eax
mov eax, dword [ebp - 4]
call fcn.3139f864
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3139f948
lea eax, [ebp - 8]
call fcn.31239b5c
ret

Function at 0x3139f94c
Capabilities:
Create process on windows

Disassembly:
push ecx
push esp
mov eax, dword [0x3143f208]
push eax
push 0
call sub.shell32.dll_ShellExecuteExW
call fcn.3139e2ec
mov eax, dword [esp]
pop edx
ret
Function at 0x313a0cfc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov edi, eax
mov esi, dword [ebp + 0x18]
xor eax, eax
push ebp
push 0x313a0e93
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebp - 9]
sub al, 1
jb 0x313a0d37
je 0x313a0d3e
dec al
je 0x313a0d45
dec al
je 0x313a0d4c
jmp 0x313a0d53
mov ebx, 0x30
jmp 0x313a0d55
mov ebx, 0x10
jmp 0x313a0d55
mov ebx, pe_nt_image_headers32
jmp 0x313a0d55
mov ebx, 0x20
jmp 0x313a0d55
xor ebx, ebx
or ebx, 0x40000
or ebx, 0x10000
test edi, edi
jne 0x313a0d7a
lea eax, [ebp - 4]
movzx edx, byte [ebp - 9]
mov edx, dword [edx*4 + str.l_f:1]
call fcn.31236e44
jmp 0x313a0d84
lea eax, [ebp - 4]
mov edx, edi
call fcn.31236e44
test si, 4
je 0x313a0d9c
test si, 8
je 0x313a0d97
or ebx, 1
jmp 0x313a0dd8
or ebx, 0
jmp 0x313a0dd8
test si, 0x10
jne 0x313a0daa
test si, 0x40
je 0x313a0daf
or ebx, 2
jmp 0x313a0dd8
test si, 1
jne 0x313a0dbd
test si, 2
je 0x313a0dce
test si, 8
je 0x313a0dc9
or ebx, 3
jmp 0x313a0dd8
or ebx, 4
jmp 0x313a0dd8
test si, 0x20
je 0x313a0dd8
or ebx, 5
test si, 0x400
je 0x313a0de5
or ebx, 0x4000
mov eax, dword [0x3143f460]
mov edx, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [0x3143f54c]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [0x3143fbf8]
mov eax, dword [eax]
call fcn.31308310
call fcn.3123c338
test eax, eax
jne 0x313a0e38
push ebx
mov eax, dword [ebp - 4]
call fcn.31236e7c
push eax
mov eax, dword [ebp - 8]
call fcn.31236e7c
push eax
mov eax, dword [0x3143fbf8]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
jmp 0x313a0e5b
push ebx
mov eax, dword [ebp - 4]
call fcn.31236e7c
push eax
mov eax, dword [ebp - 8]
call fcn.31236e7c
mov edx, eax
mov eax, dword [0x3143fbf8]
mov eax, dword [eax]
pop ecx
call fcn.31309d44
mov ebx, eax
mov eax, dword [0x3143fbf8]
mov eax, dword [eax]
call fcn.3130833c
mov eax, dword [0x3143f460]
mov dword [eax], 0xffffffff
mov eax, dword [0x3143f54c]
mov dword [eax], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x313a0e9a
lea eax, [ebp - 4]
call fcn.31236de0
ret
Function at 0x313aa26c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
mov eax, dword [esi + 4]
mov edx, eax
sub edx, 3
je 0x313aa2a7
add edx, 0xfffffffb
sub edx, 2
jb 0x313aa299
add edx, 0xfffffff6
sub edx, 2
jb 0x313aa299
add edx, 0xffffffb1
sub edx, 3
jae 0x313aa2f0
mov edx, eax
mov eax, ebx
call fcn.313aa398
jmp 0x313aa390
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.313a9a80
mov cl, 1
mov edx, dword [ebx + 0xac]
mov eax, dword [ebx + 0x4c]
call fcn.313fd4c8
add eax, dword [ebx + 0x168]
push eax
mov eax, ebx
call fcn.313a903c
mov esi, eax
add esi, dword [ebx + 0x16c]
push 0x32
call sub.user32.dll_DrawTextW
add esi, eax
mov ecx, esi
mov eax, ebx
pop edx
call fcn.313aa474
jmp 0x313aa390
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetClassInfoW
test eax, eax
je 0x313aa314
push 0
push 0xf012
push 0x112
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetSysColorBrush
jmp 0x313aa390
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.313a9a80
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetCursorPos
test eax, eax
je 0x313aa35f
push esp
movsx ecx, word [esi + 0xa]
xor edx, edx
mov eax, ebx
call fcn.313a9b48
mov edi, dword [esp + 4]
mov cl, 1
mov edx, dword [ebx + 0xac]
mov eax, dword [ebx + 0x4c]
call fcn.313fd51c
mov ebp, eax
mov dl, 1
mov eax, ebx
call fcn.313a6b64
add ebp, eax
cmp edi, ebp
jle 0x313aa37c
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
call fcn.3123c1b0
mov dword [esi + 0xc], eax
jmp 0x313aa390
mov eax, ebx
call fcn.313a6ef8
test al, al
jne 0x313aa390
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetWindowTextW
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x313b6d70
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 8]
mov eax, esi
call fcn.312858e8
push eax
push 1
push 0
call sub.gdi32.dll_CreatePen
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
call sub.gdi32.dll_CreatePen
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.gdi32.dll_SelectObject
mov esi, eax
push 5
call sub.gdi32.dll_GetStockObject
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.gdi32.dll_SelectObject
mov edi, eax
mov eax, dword [ebp - 0x20]
dec dword [eax + 0xc]
mov eax, dword [ebp - 0x20]
dec dword [eax + 8]
jmp 0x313b6dee
dec dword [ebx]
push ebp
call fcn.313b6cb0
pop ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_EnumWindows
cmp dword [ebx], 0
jg 0x313b6dd8
mov eax, dword [ebp - 0x20]
inc dword [eax + 0xc]
mov eax, dword [ebp - 0x20]
inc dword [eax + 8]
push esi
mov eax, dword [ebp - 0x24]
push eax
call sub.gdi32.dll_SelectObject
push edi
mov eax, dword [ebp - 0x24]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x28]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x2c]
push eax
call sub.gdi32.dll_DeleteObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x313c154c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffa4
mov esi, dword [ebp + 8]
add esi, 0xffffff9c
xor eax, eax
push ebp
push 0x313c16ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.3128d578
mov eax, dword [eax + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x78]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x68]
call fcn.312c6b78
call fcn.313bc660
mov edx, dword [ebp + 8]
mov dword [edx - 0x6c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x6c], 0
je 0x313c15d0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov eax, dword [eax + 0x64]
call fcn.312863cc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.3128d578
mov eax, dword [eax + 0x40]
pop edx
call fcn.312863d4
mov eax, dword [ebp + 8]
mov dword [eax - 0x70], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.31286254
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.31244c8c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
push eax
push 0x5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.3128d578
call fcn.31287ce0
push eax
call sub.gdi32.dll_GetObjectW
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.31286304
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.31286340
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.31286340
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.31286340
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.312863cc
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectW
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.3128d578
mov eax, dword [eax + 0x40]
pop edx
call fcn.312861f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.3128d578
mov eax, dword [eax + 0x40]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x74], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x9c]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.31285f84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x313c1706
lea eax, [ebp - 4]
call fcn.31236de0
ret
Function at 0x313e171c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, ecx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
push edx
call sub.user32.dll_DestroyWindow
mov edi, eax
push edi
call sub.user32.dll_DestroyWindow
test eax, eax
jne 0x313e17b0
lea eax, [esp + 0x10]
push eax
push edi
call sub.user32.dll_ActivateKeyboardLayout
push 2
lea eax, [esp + 0x14]
push eax
push 0
push edi
call sub.user32.dll_GetKeyState
test edi, edi
je 0x313e17ae
cmp byte [esi + 0x7d], 0
jne 0x313e1785
mov eax, dword [esp + 8]
add eax, dword [esi + 0x84]
cmp eax, dword [esp + 0x18]
jne 0x313e1785
mov eax, dword [esp + 0xc]
add eax, dword [esi + 0x8c]
cmp eax, dword [esp + 0x1c]
je 0x313e17ae
cmp byte [esi + 0x7d], 0
je 0x313e17aa
mov eax, dword [esp]
sub eax, dword [esi + 0x80]
cmp eax, dword [esp + 0x10]
jne 0x313e17aa
mov eax, dword [esp + 0xc]
add eax, dword [esi + 0x8c]
cmp eax, dword [esp + 0x1c]
je 0x313e17ae
xor ebx, ebx
jmp 0x313e17b0
mov bl, 1
mov eax, ebx
add esp, 0x20
pop edi
pop esi
pop ebx
ret
Function at 0x313e17bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x313e1c1c
mov esi, dword [ebx + 0x54]
test esi, esi
je 0x313e184c
mov eax, esi
call fcn.31416e64
mov edx, dword [ebx + 0x54]
mov byte [edx + 0x10], al
mov eax, dword [ebx + 0x54]
cmp byte [eax + 0x10], 0
jne 0x313e1c1c
mov eax, dword [ebx + 0x54]
cmp dword [eax + 0x30], 0
je 0x313e1824
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x30]
test byte [eax + 0x54], 0x40
jne 0x313e1c1c
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetCursor
test eax, eax
je 0x313e1c1c
mov eax, dword [ebx + 0x54]
cmp byte [eax + 0x2d], 0
je 0x313e184c
push 0
mov dx, 0x17
xor eax, eax
call fcn.3123c824
push eax
mov eax, dword [0x3143fa64]
mov eax, dword [eax]
push eax
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetSysColorBrush
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.user32.dll_EnableWindow
cmp dword [ebp + 8], 0
jne 0x313e1867
push edi
call sub.user32.dll_EmptyClipboard
mov dword [ebp - 8], eax
jmp 0x313e186d
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x313e1c1c
cmp byte [esi + 6], 0
je 0x313e18d7
lea ecx, [ebp - 0x2c]
mov edx, edi
mov eax, ebx
call fcn.313e15f8
mov ecx, dword [ebp - 0x18]
neg ecx
mov edx, dword [ebp - 0x1c]
neg edx
lea eax, [ebp - 0x2c]
call fcn.3123ab24
cmp dword [0x3143f34c], 0
jne 0x313e18c1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [0x3143f350]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, esi
call fcn.313e259c
jmp 0x313e18d7
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, esi
call fcn.313e259c
mov esi, dword [ebx + 0x78]
test esi, esi
je 0x313e1c1c
cmp byte [esi + 6], 0
je 0x313e1941
lea ecx, [ebp - 0x2c]
mov edx, edi
mov eax, ebx
call fcn.313e168c
mov ecx, dword [ebp - 0x18]
neg ecx
mov edx, dword [ebp - 0x1c]
neg edx
lea eax, [ebp - 0x2c]
call fcn.3123ab24
cmp dword [0x3143f34c], 1
jne 0x313e192b
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [0x3143f350]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, esi
call fcn.313e2e30
jmp 0x313e1941
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, esi
call fcn.313e2e30
mov eax, dword [ebx + 0x74]
cmp byte [eax + 6], 0
je 0x313e1c0c
mov eax, dword [ebx + 0x78]
cmp byte [eax + 6], 0
je 0x313e1c0c
lea eax, [ebp - 0x2c]
push eax
Function at 0x313f4a00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.3123aa38
mov eax, esi
call fcn.313f4804
dec eax
cmp edi, eax
jg 0x313f4b27
test edi, edi
jl 0x313f4b27
mov eax, esi
call fcn.313f4804
dec eax
jl 0x313f4b27
mov ecx, ebx
mov edx, edi
mov eax, esi
call fcn.313f5eb0
mov eax, esi
call fcn.313f611c
test al, al
jne 0x313f4b27
mov eax, dword [ebx]
cmp eax, dword [ebx + 8]
je 0x313f4b27
cmp byte [ebp - 1], 0
je 0x313f4a75
dec dword [ebx + 0xc]
jmp 0x313f4a7c
add dword [ebx + 0xc], 3
dec dword [ebx + 8]
mov eax, esi
call fcn.313f60e0
sub al, 1
jb 0x313f4a96
je 0x313f4aa9
dec al
je 0x313f4acc
dec al
je 0x313f4af6
jmp 0x313f4b27
movzx eax, byte [ebp - 1]
add eax, eax
push eax
push eax
push ebx
call sub.user32.dll_EnumWindows
inc dword [ebx + 0xc]
jmp 0x313f4b27
movzx eax, byte [ebp - 1]
push eax
add eax, eax
push eax
push ebx
call sub.user32.dll_EnumWindows
sub dword [ebx + 4], 2
cmp byte [ebp - 1], 0
je 0x313f4ac6
inc dword [ebx + 0xc]
jmp 0x313f4b27
sub dword [ebx + 0xc], 3
jmp 0x313f4b27
push 1
push 0
push ebx
call sub.user32.dll_EnumWindows
add dword [ebx + 8], 2
cmp byte [ebp - 1], 0
je 0x313f4aec
push 1
push 1
push ebx
call sub.user32.dll_EnumWindows
jmp 0x313f4b27
sub dword [ebx + 0xc], 4
add dword [ebx + 8], 2
jmp 0x313f4b27
push 0
push 1
push ebx
call sub.user32.dll_EnumWindows
mov eax, ebx
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.3123ab24
cmp byte [ebp - 1], 0
je 0x313f4b23
push 1
push 1
push ebx
call sub.user32.dll_EnumWindows
add dword [ebx + 0xc], 3
jmp 0x313f4b27
sub dword [ebx + 0xc], 2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x313f7e6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
cmp ebx, 0xffffffff
jle 0x313f7fc7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, ebx
call fcn.312b60d0
cmp byte [eax + 0x59], 0
je 0x313f7fc7
movzx eax, byte [0x313f7fd0]
mov byte [ebp - 5], al
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.312e1c94
push eax
call sub.user32.dll_EmptyClipboard
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x313f7fc0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.312e1c94
push eax
call sub.user32.dll_ActivateKeyboardLayout
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.312e1c94
push eax
call sub.user32.dll_EnableWindow
push 2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.312e1c94
push eax
push 0
call sub.user32.dll_GetKeyState
mov ecx, dword [ebp - 0x2c]
neg ecx
mov edx, dword [ebp - 0x30]
neg edx
lea eax, [ebp - 0x20]
call fcn.3123ab24
mov ecx, dword [ebp - 0x2c]
neg ecx
mov edx, dword [ebp - 0x30]
neg edx
mov eax, dword [ebp - 0xc]
call fcn.312d7124
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x290]
mov edx, dword [ebp - 0xc]
call fcn.31287d68
movzx eax, word [0x313f7fd4]
push eax
push 0
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 6]
push eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x70]
mov eax, esi
mov edx, ebx
call fcn.312b60d0
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.313f79ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x313f7fc7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x290]
xor edx, edx
call fcn.31287d68
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_RestoreDC
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
call fcn.312e1c94
push eax
call sub.user32.dll_GetScrollInfo
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x313f83cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, ecx
mov esi, edx
mov ebx, eax
push esi
mov esi, edi
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esp + 8]
push eax
call sub.user32.dll_EnumWindows
push esp
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.313f8408
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x313fe0e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, edx
mov edi, eax
cmp byte [edi + 0x80], 0
je 0x313fe334
cmp byte [edi + 0x1df], 0
jne 0x313fe334
mov eax, edi
call fcn.313fe5ac
test al, al
jne 0x313fe141
mov eax, dword [edi + 0x204]
call fcn.312e1c94
push eax
call sub.user32.dll_GetClassInfoW
test eax, eax
jne 0x313fe141
mov eax, dword [edi + 0x204]
call fcn.312e1c94
call fcn.313fe0cc
test al, al
je 0x313fe334
cmp byte [edi + 0x5d], 0
jne 0x313fe16f
push 0
push 0x41a2
push 0xbc4d
mov eax, dword [edi + 0x204]
call fcn.312e1c94
push eax
call sub.user32.dll_GetSysColorBrush
cmp eax, 0x41a2
je 0x313fe334
mov esi, dword [edi + 0x204]
cmp dword [esi + 0x34], 0
je 0x313fe188
cmp byte [esi + 0x8b], 1
je 0x313fe323
mov byte [edi + 0x1ec], 1
cmp dword [edi + 0x220], 0
je 0x313fe24c
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd4c8
mov esi, eax
cmp byte [edi + 0x1d0], 0
je 0x313fe1eb
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd4c8
mov ebp, eax
xor edx, edx
mov eax, edi
call fcn.313fee9c
sub eax, 4
add ebp, eax
mov eax, ebp
jmp 0x313fe22c
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd51c
mov ebp, eax
xor edx, edx
mov eax, edi
call fcn.313fee9c
add ebp, eax
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd4c8
add ebp, eax
mov eax, ebp
mov edx, dword [edi + 0x204]
mov ecx, dword [edx + 0x4c]
sub ecx, esi
push ecx
mov edx, dword [edx + 0x48]
sub edx, esi
push edx
push eax
push esi
call sub.gdi32.dll_CreateRectRgn
mov esi, eax
jmp 0x313fe2fd
mov esi, dword [edi + 0x204]
cmp byte [esi + 0x29a], 2
jne 0x313fe2f0
mov eax, dword [esi + 0x70]
cmp dword [eax + 0xc], 0
jne 0x313fe2f0
mov eax, dword [esi + 0x70]
cmp dword [eax + 8], 0
jne 0x313fe2f0
cmp byte [esi + 0x29e], 1
je 0x313fe2f0
mov eax, dword [esi + 0x4c]
push eax
lea eax, [esp + 4]
push eax
mov ecx, dword [esi + 0x48]
xor edx, edx
xor eax, eax
call fcn.3123aa38
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd51c
neg eax
push eax
mov eax, dword [edi + 0x204]
call fcn.312e1c94
xor ecx, ecx
mov edx, dword [edi + 0x220]
call fcn.313fd4c8
neg eax
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.gdi32.dll_CreateRectRgn
mov esi, eax
jmp 0x313fe2fd
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.313fe33c
mov esi, eax
mov byte [edi + 0x38], 1
cmp bl, 1
cmc
sbb eax, eax
push eax
push esi
mov eax, dword [edi + 0x204]
call fcn.312e1c94
push eax
call sub.user32.dll_IsWindowVisible
mov byte [edi + 0x1ec], 0
jmp 0x313fe334
push 0
push 0
mov eax, esi
call fcn.312e1c94
push eax
call sub.user32.dll_IsWindowVisible
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret