joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x4d6a40], ecx
inc eax
cmp eax, 0x100
jb 0x42e8f5
cmp eax, 0x800
jae 0x42e9c3
nop dword [eax]
mov edx, dword [eax*4 + 0x4d6640]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x4d6a40]
mov dword [eax*4 + 0x4d6a40], edx
inc eax
cmp eax, 0x800
jb 0x42e9a0
lea ecx, [ebp - 0x24]
mov dword [0x4d6a3c], 0x430650
call fcn.00430830
test eax, eax
je 0x42eaaa
mov ecx, dword [ebp - 0x14]
mov edx, ecx
shr edx, 8
mov eax, ecx
mov edi, edx
and eax, 0xf00
and edi, 0xff000
and edx, 0xf00
and ecx, 0xf0
or edi, eax
or edx, ecx
shr edi, 8
shr edx, 4
xor ecx, ecx
mov eax, 0x4c01b4
xor esi, esi
mov ebx, dword [ebp - 0x20]
cmp dword [eax - 8], ebx
jne 0x42ea2a
mov ebx, dword [ebp - 0x1c]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x18]
jne 0x42ea2a
cmp dword [eax], ebx
je 0x42ea47
add esi, 0xc
inc ecx
add eax, 0xc
cmp esi, 0x24
jb 0x42ea13
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret
sub ecx, 0
je 0x42ea80
sub ecx, 1
je 0x42ea64
sub ecx, 1
jne 0x42eaaa
cmp edi, 6
jb 0x42ea75
jne 0x42eaa0
cmp edx, 0xf
jae 0x42eaa0
jmp 0x42ea75
cmp edi, 5
jb 0x42ea75
jne 0x42eaa0
cmp edx, 6
jb 0x42ea75
cmp edx, 0xa
jne 0x42eaa0
mov eax, 1
test eax, eax
jne 0x42eaaa
jmp 0x42eaa0
cmp edi, 6
jb 0x42eaaa
jne 0x42eaa0
cmp edx, 0x1c
je 0x42eaaa
cmp edx, 0x26
je 0x42eaaa
cmp edx, 0x27
je 0x42eaaa
cmp edx, 0x35
je 0x42eaaa
cmp edx, 0x36
je 0x42eaaa
mov dword [0x4d6a3c], 0x4306f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048049b
mov esp, ebp
pop ebp
ret
Function at 0x4337e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x433802
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
push ebx
lea ebx, [edx - 4]
add ebx, ecx
mov dword [ebp - 8], ebx
nop
lea eax, [edi + ecx]
cmp eax, ebx
jae 0x433829
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x433826
inc eax
cmp eax, ebx
jb 0x433817
mov ecx, dword [ebp - 4]
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ecx
sub edi, ecx
cmp eax, ebx
jae 0x43391f
cmp edx, 2
jbe 0x4338d1
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x433908
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
sub ebx, ecx
test esi, esi
je 0x4338a1
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x43389f
mov edx, 0x100
shl edx, cl
mov ecx, dword [ebp + 8]
dec edx
xor ebx, edx
add ecx, edi
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov ecx, dword [ebp - 4]
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 8]
add edi, eax
jmp 0x433810
mov ecx, edx
shr esi, cl
test esi, esi
je 0x433846
cmp esi, 4
ja 0x4338fa
cmp esi, 3
je 0x4338fa
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x433846
mov ecx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x433810
mov ebx, dword [ebp - 8]
or esi, 8
mov ecx, dword [ebp - 4]
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x433810
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebx
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4357c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4357ef
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4357f2
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004357a4
pop esi
leave
ret 8
Function at 0x436030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9016
mov eax, dword fs:[0]
push eax
mov eax, 0x1178
call fcn.00481170
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xfffffffffffffff0
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x1020]
mov ecx, edi
push eax
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x1014]
mov edx, dword [ebp - 0x101c]
sub eax, edx
mov ecx, dword [ebp - 0x1020]
push 0x20
push eax
mov eax, dword [ebp - 0x1018]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, edi
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [edi + 4]
lea ebx, [edi + 0x2c]
mov ecx, ebx
call fcn.0043a510
mov ecx, edi
lea eax, [edi + 0x24]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, ebx
call fcn.00439220
lea ecx, [ebp - 0x1180]
call fcn.0044e580
mov esi, edi
mov dword [ebp - 4], 0
neg esi
lea eax, [edi + 0x28]
lea ecx, [ebp - 0x94]
sbb esi, esi
and esi, eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x24]
push 0
push ebx
push esi
push 0
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
mov esi, esp
call fcn.004058d0
push eax
mov ecx, esi
call fcn.00408e40
lea ecx, [ebp - 0x1180]
call fcn.0044ec30
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00436ae0
test esi, esi
jne 0x436223
push 0x800
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.00482730
add esp, 0xc
lea eax, [ebp - 0x810]
lea ecx, [ebp - 0x1180]
push 0x400
push eax
call fcn.0044ed00
push 0x800
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.00482730
add esp, 0xc
lea eax, [ebp - 0x1010]
lea ecx, [ebp - 0x1180]
push 0x400
push eax
call fcn.0044ed10
push str.load_resource_errr._location:
lea ecx, [ebp - 0x1038]
call fcn.004058e0
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x1038]
call fcn.0040c5e0
push str._msg:
lea ecx, [ebp - 0x1038]
call fcn.0040c5e0
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1038]
call fcn.0040c5e0
push 0x10
push str.Duilib
lea ecx, [ebp - 0x1038]
call fcn.0040d650
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call fcn.00439750
mov edx, edi
lea eax, [edi + 0x20]
neg edx
mov ecx, ebx
sbb edx, edx
and edx, eax
push edx
call fcn.004390d0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x1180]
call fcn.0044d560
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43a190
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a94fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a0], ebx
call fcn.0043a3e0
mov esi, eax
cmp word [edi], bx
je 0x43a1e9
cmp word [edi + 2], 0x3a
jne 0x43a1e9
mov eax, edi
jmp 0x43a220
mov ecx, esi
call fcn.004373d0
test al, al
jne 0x43a2f7
push edi
lea eax, [ebp - 0x19c]
mov ecx, esi
push eax
call fcn.00436c20
mov ebx, 1
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0x1a0], ebx
call fcn.004058d0
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x118]
call fcn.00436a00
mov dword [ebp - 4], 2
test bl, 1
je 0x43a245
lea ecx, [ebp - 0x19c]
call fcn.00436ae0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp - 0x118]
call fcn.004058d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43a2e5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x43a2e5
push esi
mov dword [ebp - 0x1a4], 0
call fcn.00480925
add esp, 4
mov dword [ebp - 0x1a0], eax
lea ecx, [ebp - 0x1a4]
push 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a4], esi
jne 0x43a2d7
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x118]
mov dword [eax], esi
call fcn.00436ae0
mov eax, dword [ebp - 0x1a0]
jmp 0x43a3b4
push dword [ebp - 0x1a0]
call fcn.0048092e
add esp, 4
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.00436ae0
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x94]
call fcn.00436a00
push 0x4c060c
push 0x4c0224
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.00437610
lea eax, [ebp - 0x94]
mov ecx, 0x4d4854
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.00437f40
mov esi, dword [ebp - 0x1ac]
cmp byte [esi + 0xd], 0
jne 0x43a364
lea ecx, [esi + 0x10]
call fcn.004058d0
push eax
lea ecx, [ebp - 0x94]
call fcn.00436cb0
test al, al
jne 0x43a364
mov eax, dword [0x4d4854]
jmp 0x43a36b
mov eax, dword [0x4d4854]
mov esi, eax
cmp esi, eax
je 0x43a39b
mov edi, dword [esi + 0xa4]
push edi
call fcn.00480925
add esi, 0x94
add esp, 4
mov ebx, eax
cmp dword [esi + 0x14], 0xf
jbe 0x43a38e
mov esi, dword [esi]
push edi
push esi
push ebx
call fcn.004821b0
add esp, 0xc
jmp 0x43a39f
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x94]
mov dword [eax], edi
call fcn.00436ae0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret
Function at 0x43a5f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push str.ZIPRES
push dword [ebp + 8]
call fcn.0043a3d0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x43a64a
push edi
push esi
call fcn.0043a3d0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43a649
push esi
call fcn.0043a3d0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x43a649
push 0x43fad0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0042b570
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp + 0xc]
call fcn.0043a660
add esp, 4
pop esi
pop ebp
ret

Function at 0x43ad60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x11
call ebx
movsx esi, ax
sar esi, 0x1f
push 2
and esi, 8
call ebx
mov edi, esi
or edi, 2
test ax, ax
push 1
cmovns edi, esi
call ebx
mov esi, edi
or esi, 1
test ax, ax
push 0x10
cmovns esi, edi
call ebx
mov edi, esi
or edi, 4
test ax, ax
push 0x12
cmovns edi, esi
call ebx
mov ecx, edi
or ecx, 0x20
test ax, ax
cmovns ecx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x43d400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0x354]
call fcn.00437200
mov edi, dword [ebp + 8]
test eax, eax
jle 0x43d45b
nop
push esi
lea ecx, [ebx + 0x354]
mov byte [ebp + 0xb], 0
call fcn.00436c00
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x43d5ac
lea ecx, [ebx + 0x354]
inc esi
call fcn.00437200
cmp esi, eax
jl 0x43d420
sub edi, 0x100
je 0x43d535
sub edi, 4
je 0x43d4d1
sub edi, 2
jne 0x43d52a
cmp dword [ebx + 0xe0], edi
je 0x43d52a
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.00491641
mov ecx, dword [ebx + 0xe0]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x80000012
push edx
push 0x43f8f0
call dword [eax + 0x114]
mov esi, eax
test esi, esi
je 0x43d52a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x108]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebx + 0xe4]
test eax, eax
je 0x43d52a
mov ecx, dword [ebx + 0xf8]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0xf4]
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
call fcn.0043ad60
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43d52a
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x43d593
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x43d593
mov ecx, dword [ebx + 0xe4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x43d593
mov ecx, dword [ebx + 0xe4]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.00481e17
add esp, 8
test eax, eax
je 0x43d593
mov ecx, dword [ebx + 0xe4]
call fcn.00458bb0
test al, al
jne 0x43d52a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
mov ecx, ebx
xor al, 1
movzx eax, al
push eax
call fcn.0043ed30
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43e7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x43e7db
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x43e7db
cmp esi, dword [edi + 0xe4]
je 0x43e7db
cmp byte [edi + 0xdc], 0
jne 0x43e7db
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x43e8d6
test eax, eax
je 0x43e84a
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.0043e320
mov dword [edi + 0xe4], 0
test esi, esi
je 0x43e8d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x43e8d6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x43e8d6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x43e8d6
xorps xmm0, xmm0
mov dword [edi + 0xe4], esi
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.0043e320
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43f6d0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x43f781
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x4d481c
mov dword [ebp - 4], ebx
call fcn.00437200
sub eax, 1
mov dword [ebp + 8], eax
js 0x43f778
push eax
mov ecx, 0x4d481c
call fcn.00436c00
cmp dword [ebp - 4], 0
mov edi, eax
je 0x43f76a
mov ecx, edi
call fcn.0043a170
cmp dword [esi], eax
je 0x43f739
mov ecx, edi
call fcn.0043a170
cmp ebx, eax
jne 0x43f75d
push esi
mov ecx, edi
call fcn.0043f670
test al, al
jne 0x43f805
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.0043d400
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x43f723
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
sub eax, 1
mov dword [ebp + 8], eax
jns 0x43f710
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x4d481c
xor edi, edi
call fcn.00437200
test eax, eax
jle 0x43f778
mov ecx, 0x4d481c
call fcn.00437200
push edi
mov ecx, 0x4d481c
call fcn.00436c00
mov ebx, eax
mov ecx, ebx
call fcn.0043a170
cmp dword [esi], eax
je 0x43f7cb
mov ecx, 0x4d481c
inc edi
call fcn.00437200
cmp edi, eax
jl 0x43f791
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.0043f670
test al, al
jne 0x43f805
mov eax, dword [esi + 8]
cmp eax, 0xe5
jne 0x43f7eb
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xc]
mov ecx, ebx
push eax
push dword [esi + 4]
call fcn.0043d400
test al, al
je 0x43f778
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4401b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4401f5
cmp byte [ebp + 8], 0
je 0x4401e9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x45aa60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x45aacf
cmp dword [ebp + 8], 0x100
jne 0x45aabf
cmp word [ebp + 0xc], 0xd
jne 0x45aabf
cmp byte [esi + 0x7a2], 0
je 0x45aa9e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45aabf
cmp byte [esi + 0x7a3], 0
jne 0x45aabf
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x45aab8
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.0043e320
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x46edf0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x46ee7b
cmp dword [esi + 0x10], 0
je 0x46ee7b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00480c40
mov ebx, esp
test ebx, ebx
je 0x46ee7b
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.00436b90
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043e320
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043a8c0
test al, al
je 0x46ee7b
mov ecx, dword [esi + 0x10]
call fcn.0044a650
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret 0x10

Function at 0x46fa30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4d1480]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.0044ce90
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x46fac5
lea eax, [ebp - 0x14]
push eax
call fcn.0046e160
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, dword [esi + 0x7e8]
test eax, eax
je 0x46fa9f
push 0
mov ecx, esi
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048049b
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, esi
call fcn.00437200
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048049b
mov esp, ebp
pop ebp
ret 0x14