joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0xdf00e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdf00ee
pushal
call 0xdf00f4
pop ebp
sub ebp, 0x10
sub ebp, 0x9f00e4
jmp 0xdf010a
mov eax, 0x9f00e4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x802af449
xor byte [eax], dl
inc eax
dec ecx
jne 0xdf0121
jmp 0xdf0134
ret 0xc284
Function at 0x402bb4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 4]
push ecx
push 0x20008
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x402cb8
mov eax, dword [0x452331]
mov dword [ebp - 0x10], eax
mov ax, word [0x452335]
mov word [ebp - 0xc], ax
xor edx, edx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
test eax, eax
je 0x402cab
xor edx, edx
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x18]
push 0
push 2
push dword [ebp - 4]
call sub.ADVAPI32.DLL_GetTokenInformation
push dword [ebp - 0x18]
call fcn.00445e1c
pop ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push 2
push dword [ebp - 4]
call sub.ADVAPI32.DLL_GetTokenInformation
test eax, eax
je 0x402c98
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
jmp 0x402c8e
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
push dword [edx + eax*8 + 4]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x402c8b
mov dword [ebp - 8], 1
jmp 0x402c98
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp ecx, dword [eax]
jb 0x402c6c
push dword [ebp - 0x20]
call fcn.00445c58
pop ecx
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_FreeSid
jmp 0x402cc3
push str._Install__Unable_to_create_administrator_SID__n
call fcn.00448250
pop ecx
jmp 0x402cc3
push str._Install__Unable_to_open_process_token__n
call fcn.00448250
pop ecx
cmp dword [ebp - 4], 0
je 0x402cd1
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402fe8
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x453040
call fcn.0044691c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004509d8
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 8]
call fcn.0043c5b0
test al, al
je 0x40306c
call fcn.00402730
test al, al
je 0x40304b
mov eax, 1
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00450a88
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40308a
push 0x80
lea eax, [ebp + 8]
call fcn.00401bc8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [ebp + 8]
call fcn.00401bc8
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00450a88
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x403090
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push 0x94
push 0
lea eax, [ebp - 0x98]
push eax
call fcn.00446600
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea edx, [ebp - 0x98]
push edx
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
jne 0x4030cd
xor eax, eax
jmp 0x4030dc
cmp dword [ebp - 0x94], 5
jbe 0x4030da
mov al, 1
jmp 0x4030dc
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4030e0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, 0x453064
call fcn.0044691c
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004509d8
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
push 2
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x403142
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00450a88
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4031e4
push 0xf01ff
push str.asComSvc
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x403185
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00450a88
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4031e4
push str.ASUS_Com_Service
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp + 8]
call fcn.00401bc8
push eax
push 1
push 2
push 0x10
push dword [ebp - 0x28]
call sub.ADVAPI32.DLL_ChangeServiceConfigA
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 0x28]
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp - 0x30], 0
setne al
and eax, 1
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00450a88
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x4068cc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00406530
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00444454
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x40692a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x457050]
mov dl, 1
mov eax, dword [0x406428]
call fcn.0043f1e0
call fcn.00443cd8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406934
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00444454
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x40698c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x457054]
mov dl, 1
mov eax, dword [0x406428]
call fcn.0043f1e0
call fcn.00443cd8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406560
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x407974
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00444010
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4079c3
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00444240
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e594
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x40e59a
ret

Function at 0x4108f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x410949
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x410930
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x410920
jmp 0x410949
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x410931
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4179a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45741c
cmp dword [edi], 0
jne 0x417a20
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x457418]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45360c
mov ecx, 2
call fcn.0044307c
mov edx, 0x41797c
lea eax, [esi + 5]
call fcn.0041799c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041799c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4179f5
mov dword [0x457418], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x417b3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x417b8c]
test si, 4
je 0x417b50
or bl, 1
test si, 8
je 0x417b5a
or bl, 4
test si, 1
je 0x417b64
or bl, 8
test si, 2
je 0x417b6e
or bl, 0x10
test si, 0x10
je 0x417b78
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x417b87
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x417b90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x417bc8]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x417ba9
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x417bb8
or bl, 4
test esi, 0x20000000
je 0x417bc3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x41e118
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x41e12a
add esp, 0xfffffff0
call fcn.004438a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00437368
mov eax, ebx
call fcn.0041e464
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x70], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x41ac08
push eax
push 0
push 0
mov eax, dword [0x4570e8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x40dd18]
call fcn.0040eff4
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40dd18]
call fcn.0040eff4
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x40dd18]
call fcn.0040eff4
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0041e844
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x41e760
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x41e760
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x41e760
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41e239
call fcn.004438f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e544
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41e6ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x41e6d0
mov dl, 1
mov eax, dword [0x431274]
call fcn.00443588
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00444010
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x41e6bf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043027c
test al, al
je 0x41e6b2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x41e700
lea eax, [ebp - 0x254]
call fcn.0043ce84
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x41e6b2
xor eax, eax
push ebp
push 0x41e6ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x41e738
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x41e694
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00444240
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x41e694
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00444240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e6b2
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x41e5b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.004343fc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e6f6
lea eax, [ebp - 0x260]
call fcn.00444010
ret

Function at 0x41ef3c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45740c]
cmp byte [eax + 0x95], 0
jne 0x41efad
cmp dword [0x457428], 0
jne 0x41ef6e
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x41eef8
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x457428], eax
cmp dword [0x457424], 0
jne 0x41ef89
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x457424], eax
cmp dword [0x45742c], 0
jne 0x41efad
push esp
push 0
push 0
push 0x41ee9c
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x45742c], eax
pop edx
ret
Function at 0x41f0a4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x41f0bb
add esp, 0xfffffff0
call fcn.004438a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00437368
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x430f38]
call fcn.00443588
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x40e44c]
call fcn.00413e74
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x41f230
mov eax, dword [0x457294]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00414244
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x420a68
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x457294]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0043fce8
test eax, eax
je 0x41f1ae
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0043c838
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0043fd10
test eax, eax
je 0x41f1c2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00444240
mov eax, dword [0x457298]
cmp byte [eax], 0
jne 0x41f1f3
mov eax, ebx
call fcn.0041f31c
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41f225
call fcn.004438f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f58c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45740c]
cmp dword [eax + 0x24], 0
je 0x41f62f
cmp dword [ebx + 0x84], 0
jne 0x41f629
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x41f51c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x41f629
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x41f5f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x41f629
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004325ec
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x41f601
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x42003c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x420071
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004440f8
jmp 0x42007b
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00444064
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x420ddc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x420e14
mov eax, esi
call fcn.0042c17c
test al, al
je 0x420e14
mov eax, dword [ebx + 0x74]
call fcn.0042be80
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x420e14
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042be80
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x423c54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x457468], 0
sete dl
or al, dl
jne 0x423d94
mov eax, dword [0x45746c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x457468]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x423d63
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x457468]
call fcn.004325ec
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x423d5b
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x423d5b
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x423d5b
mov eax, dword [ebp - 0x14]
call fcn.0042be80
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x423d5b
push ebp
call fcn.00423c10
pop ecx
test al, al
jne 0x423d5b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x423d17
mov eax, dword [ebp - 0x14]
call fcn.0042a80c
dec eax
jle 0x423d5b
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00443794
cmp byte [ebp - 1], 0
je 0x423d5b
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x423d5b
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45746c]
call fcn.0042345c
inc edi
dec esi
jne 0x423caa
mov eax, dword [0x45746c]
cmp dword [eax + 8], 0
jle 0x423d7b
mov eax, dword [0x45746c]
call fcn.004234ec
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x423d94
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00423a78
pop ecx
test al, al
jne 0x423d94
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429818
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x429849
je 0x4298a3
sub eax, 7
je 0x42986a
dec eax
je 0x429894
sub eax, 0x17
je 0x429948
jmp 0x429986
add eax, 0xffffff00
sub eax, 9
jb 0x429934
add eax, 0xffffff09
sub eax, 0xb
jb 0x4298fc
jmp 0x429986
mov eax, ebx
call fcn.00417c88
mov edi, eax
test edi, edi
je 0x4299e6
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x4299ef
jmp 0x4299e6
test byte [ebx + 0x44], 0x20
jne 0x4299ef
jmp 0x4299e6
mov edx, esi
mov eax, ebx
call fcn.00426ee4
cmp dword [esi + 0xc], 0xffffffff
jne 0x4299ef
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00438f80
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00425a30
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004296f0
test eax, eax
je 0x4299ef
mov dword [esi + 0xc], 1
jmp 0x4299ef
mov edx, esi
mov eax, ebx
call fcn.00429784
test al, al
je 0x4299e6
cmp dword [esi + 0xc], 0
jne 0x4299ef
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0042be80
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x4299ef
mov eax, ebx
call fcn.00426580
test al, al
jne 0x4299ef
jmp 0x4299e6
mov eax, ebx
call fcn.0042be80
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x4299e6
cmp dword [0x4537ec], 0
je 0x4299e6
mov eax, dword [0x4537ec]
cmp ebx, dword [eax + 0x24]
jne 0x4299e6
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4537ec]
call fcn.00426e18
jmp 0x4299e6
mov eax, dword [0x457430]
cmp byte [eax + 0x20], 0
je 0x4299e6
mov eax, dword [0x457430]
cmp dword [eax + 0x1c], 0
je 0x4299e6
mov eax, dword [esi]
mov edx, dword [0x457430]
cmp eax, dword [edx + 0x1c]
jne 0x4299e6
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00417bcc
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00443794
jmp 0x4299ef
mov edx, esi
mov eax, ebx
call fcn.00426ee4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret