joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d790
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41d80b
test byte [ebx + 0x20], 0x30
je 0x41d812
mov eax, dword [0x491e50]
test eax, eax
je 0x41d89b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41d802
cmp dword [eax + 0x14], 0
je 0x41d825
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41d7f5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41d86f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41d7ad
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41d83c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41d892
mov eax, dword [0x491e50]
test eax, eax
je 0x41d8c1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41d802
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41d84f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41d84f
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41d7c0
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x491e50], eax
jmp 0x41d858
Function at 0x420140
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040dc80
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42022f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x4202d3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420268
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420260
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x4202d0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x4202ea
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4202a2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4202a2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4202a2
Function at 0x4014a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x49e5d4]
test eax, eax
je 0x4014d4
cmp dword [eax + 0x1fc], 0
jne 0x401671
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push 0
push 0
push 0
push esi
mov dword [0x49e430], 0
call ebx
test eax, eax
je 0x401652
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40160a
mov ecx, dword [0x49e54c]
xor ebx, ebx
test ecx, ecx
je 0x401553
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
test eax, eax
je 0x401553
nop dword [eax + eax]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x401604
cmp dword [ebp - 4], ebx
je 0x401553
mov ecx, dword [0x49e54c]
jmp 0x401530
mov eax, dword [0x49e5d4]
test eax, eax
je 0x4015f6
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x4015f6
push dword [0x49e5a8]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x401591
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x4015a2
cmp eax, 0x104
jne 0x4015f2
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x4015f2
cmp edi, 0x11
je 0x4015f2
mov ecx, dword [0x49e5d4]
test ecx, ecx
je 0x4015f2
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x4015f2
cmp eax, 0x104
je 0x4015d9
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x4015d9
xor edx, edx
jmp 0x4015de
mov edx, 1
push ecx
mov ecx, dword [0x49e5b0]
push edi
call fcn.0045a280
add esp, 8
test eax, eax
jne 0x401604
test ebx, ebx
jne 0x401604
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401638
test al, 1
je 0x40161e
cmp dword [esi + 4], 0x111
je 0x401651
test al, 2
je 0x40162b
cmp dword [esi + 4], 0x201
je 0x401651
test al, 4
je 0x401638
cmp dword [esi + 4], 0x202
je 0x401651
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401500
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x49e438
push 0
push 0xb
push 0
call dword [sym.imp.MMFS2.dll_Ordinal_31]
mov dword [0x49e430], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push 0x104
mov esi, ecx
call fcn.00464c74
mov edi, eax
add esp, 8
test edi, edi
je 0x40a2b6
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
mov esi, eax
call fcn.00464c8a
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x427e50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x49c014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x49e7dc], 0
mov ecx, dword [0x49e5dc]
push edi
mov dword [ebp - 0x48], ecx
mov dword [ecx + 0x2c], 0
lea edi, [ecx + 0x2c]
mov dword [ebp - 0x44], edi
je 0x427fbb
push ebx
push esi
xor esi, esi
xor edx, edx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov ecx, dword [eax + 0x254]
movzx eax, word [edx + ecx]
test eax, eax
je 0x427f9d
cmp eax, 4
jbe 0x427f09
cmp eax, 5
jne 0x427f9d
add esi, 0x16
lea edi, [ebx + 8]
add esi, ecx
nop dword [eax]
movzx eax, word [esi]
add ebx, ebx
cmp dword [0x49e7dc], 0
je 0x427ef9
cmp dword [0x49e430], 0
je 0x427ee7
movzx eax, al
movzx eax, byte [eax + 0x49e438]
shl ax, 8
jmp 0x427eee
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test ax, ax
jns 0x427ef9
or ebx, 1
sub esi, 2
sub edi, 1
jne 0x427ec0
mov edi, dword [ebp - 0x44]
jmp 0x427f95
lea esi, [eax - 1]
mov dword [ebp - 0x38], 0x34
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0x83
push eax
push esi
call dword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x427f95
mov edx, dword [ebp - 0x30]
shl esi, 5
mov eax, dword [esi + 0x49e610]
sub edx, eax
mov ecx, dword [esi + 0x49e614]
sub ecx, eax
mov eax, ecx
shr eax, 2
cmp edx, eax
ja 0x427f4f
mov ebx, 4
jmp 0x427f5f
lea eax, [ecx + ecx*2]
shr eax, 2
cmp edx, eax
mov eax, 8
cmovae ebx, eax
mov eax, dword [esi + 0x49e618]
mov ecx, dword [esi + 0x49e61c]
mov edx, dword [ebp - 0x2c]
sub ecx, eax
sub edx, eax
mov eax, ecx
shr eax, 2
cmp edx, eax
ja 0x427f80
or ebx, 1
jmp 0x427f8d
lea eax, [ecx + ecx*2]
shr eax, 2
cmp edx, eax
jb 0x427f8d
or ebx, 2
mov eax, dword [ebp - 0x18]
shl eax, 4
or ebx, eax
mov esi, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov byte [edi], bl
mov ecx, dword [ebp - 0x48]
add edx, 2
add esi, 0x10
mov dword [ebp - 0x3c], edx
inc edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], edi
cmp edx, 8
jl 0x427e90
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00461195
mov esp, ebp
pop ebp
ret
Function at 0x42f7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, edx
push edi
push 0
mov edi, ecx
movzx eax, word [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
call ebx
test eax, eax
jne 0x42f815
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx eax, word [ebp - 4]
sub eax, 0
je 0x42f85f
sub eax, 2
jne 0x42f80c
mov eax, dword [esi]
sub eax, 0
je 0x42f83b
sub eax, 2
je 0x42f834
xorps xmm0, xmm0
jmp 0x42f844
movsd xmm0, qword [esi + 8]
jmp 0x42f844
movd xmm0, dword [esi + 8]
cvtdq2pd xmm0, xmm0
push 0
lea eax, [ebp - 8]
movsd qword [ebp - 0x18], xmm0
push eax
push 8
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
sub eax, 0
je 0x42f876
sub eax, 2
je 0x42f86f
xor eax, eax
jmp 0x42f879
cvttsd2si eax, qword [esi + 8]
jmp 0x42f879
mov eax, dword [esi + 8]
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4314a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
push 0
push eax
push 2
lea eax, [ebp - 4]
mov edi, ecx
push eax
push edi
mov esi, edx
call ebx
test eax, eax
je 0x43153a
cmp dword [ebp - 8], 2
jb 0x43153a
movsx eax, word [ebp - 4]
mov dword [esi], eax
sub eax, 0
je 0x43150f
sub eax, 1
je 0x43153a
sub eax, 1
jne 0x43153a
push eax
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
test eax, eax
je 0x43153a
cmp dword [ebp - 8], 8
jb 0x43153a
movsd xmm0, qword [ebp - 0x18]
mov eax, 1
movsd qword [esi + 8], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
test eax, eax
je 0x43153a
cmp dword [ebp - 8], 4
jb 0x43153a
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442ee0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [0x49e5dc]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0x440
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x40], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x442ff5
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x442fe3
call fcn.00425dc0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x442f82
push 0
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x442f82
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x442fc0
cmp dword [ebp + 8], 0x103
jne 0x442fc0
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.004014a0
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x442f88
test bx, bx
je 0x442fde
mov edi, dword [ebp - 4]
push 5
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x442fde
push 5
push eax
call esi
call fcn.00425ec0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x104], ecx
sub ecx, dword [esi + 0x58]
add eax, ecx
mov dword [esi + 0x108], edx
sub edx, dword [esi + 0x5c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x64]
add eax, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x124], eax
mov ecx, esi
mov eax, dword [esi + 0xdc]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0xe8]
mov dword [esi + 0x11c], edx
mov edx, 1
mov dword [esi + 0x110], eax
pop esi
pop ebp
jmp fcn.0044b4b0
Function at 0x456dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 1], 0
xor edi, edi
lea ecx, [ebp - 0x10]
push edi
push ecx
push 1
lea ecx, [ebp - 1]
mov eax, edx
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x456e5d
cmp byte [ebp - 1], 0
je 0x456e58
push dword [ebx + 0x2ac]
mov edx, dword [ebx + 0x44]
mov ecx, ebx
push edi
call fcn.00456290
mov ecx, dword [ebx + 0x2a4]
add esp, 8
test ecx, ecx
je 0x456e5d
call fcn.00401410
mov ecx, dword [ebx + 0x2a4]
xor edx, edx
push edi
mov esi, eax
call fcn.00404f20
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
add esp, 4
mov dword [ebp - 8], edi
call fcn.00431550
mov ecx, esi
mov edi, eax
call fcn.00401410
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4583f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x49e5dc]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [ebp - 4], edx
test ebx, ebx
jne 0x458410
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
cmp edx, 0x100
jne 0x45845b
cmp dword [ebp + 8], 9
jne 0x4584b6
cmp dword [ebx + 0x518], ecx
jle 0x4584b6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
test ax, ax
js 0x458446
call fcn.00433ea0
jmp 0x45844b
call fcn.00434060
test eax, eax
je 0x4584b1
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 5
jne 0x4584b6
mov eax, dword [ebx + 0x18]
test byte [eax + 0x14], 0x10
je 0x4584b6
cmp byte [ebx + 0x4c8], cl
je 0x4584b6
mov esi, dword [ebx + 0x1278]
xor edi, edi
cmp dword [ebx + 0x3c], ecx
jle 0x4584b6
nop
mov eax, dword [esi]
test eax, eax
jne 0x458490
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x458486
test byte [eax + 0x7c], 4
jne 0x4584a8
test dword [eax + 0x78], 0x2b0
je 0x4584a8
push eax
mov eax, dword [eax + 0x8c]
call eax
inc edi
add esi, 8
cmp edi, dword [ebx + 0x3c]
jl 0x458480
mov edx, dword [ebp - 4]
xor ecx, ecx
movsx eax, word [ebx + 0x1d8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4584f3
xor esi, esi
test eax, eax
jle 0x4584f3
lea edi, [ebx + 0x1dc]
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push ebx
call eax
movsx ecx, ax
test cl, 0x5c
jne 0x4584f3
mov edx, dword [ebp - 4]
inc esi
add edi, 4
cmp esi, dword [ebp - 0xc]
jl 0x4584d0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 4], eax
test eax, eax
je 0x458527
push 0
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push esi
push edi
push 0x304
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 0
push dword [0x49e5b0]
call ebx
mov esi, eax
test esi, esi
je 0x458577
nop dword [eax + eax]
push pe_nt_image_headers32
push 0
push 0
push esi
call edi
push 2
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x458560
mov eax, dword [0x49e5d4]
cmp dword [eax + 0x1fc], 0
jne 0x4585ce
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x20]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4585ce
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x4585b0
push dword [0x49e5ac]
call dword [sym.imp.MMFS2.dll_Ordinal_35]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x4585f1
push 5
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x459140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x49e5d4]
push edi
mov ax, word [esi + 0x14]
mov word [esi + 0x1f8], ax
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
setne al
mov byte [esi + 0x3d1], al
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4591db
push 1
push dword [0x49e5b0]
call edi
push dword [0x49e5b4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4591b4
push 1
push dword [0x49e5b4]
call edi
mov ax, word [esi + 0x14]
mov ecx, 0x180
and ax, cx
mov ecx, pe_nt_image_headers32
cmp ax, cx
jne 0x4591d6
call fcn.00459f80
mov byte [esi + 0x3d1], 1
call fcn.00458160
mov dword [esi + 0x20c], 0
lea eax, [esi + 0x208]
mov dword [esi + 0x210], 0
mov dword [esi + 0x214], 0
mov dword [esi + 0x218], 0
mov dword [esi + 0x21c], 0
mov dword [esi + 0x220], 0
mov dword [esi + 0x224], 0
mov dword [esi + 0x228], 0
mov dword [esi + 0x22c], 0
mov dword [esi + 0x230], 0
push eax
mov dword [eax], 0x2c
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x459272
push 1
push dword [0x49e5b0]
call edi
mov ax, word [esi + 0x14]
mov ecx, 0xfefe
and ax, cx
mov ecx, 0x82
or ax, cx
test byte [esi + 0x1f8], 0x10
mov word [esi + 0x14], ax
jne 0x45931a
mov ecx, dword [0x49e5d8]
test ecx, ecx
je 0x4592f6
movsx eax, word [esi + 0x1c]
cmp dword [ecx], eax
jl 0x4592f6
movsx eax, word [esi + 0x1e]
cmp dword [ecx + 4], eax
jl 0x4592f6
push 2
push dword [0x49e5b0]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
test eax, eax
je 0x4592f6
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x4592f6
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
movsx eax, word [esi + 0x1c]
cmp eax, ecx
jne 0x4592f6
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
movsx eax, word [esi + 0x1e]
cmp eax, ecx
je 0x45931a
or word [esi + 0x14], 0x14
push dword [0x49e5ac]
call dword [sym.imp.MMFS2.dll_Ordinal_16]
movzx eax, ax
or eax, 2
push eax
push dword [0x49e5ac]
call dword [sym.imp.MMFS2.dll_Ordinal_17]
call fcn.004582a0
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x45934f
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 0xffffffff
je 0x45934f
push 8
push 0x401
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_CheckMenuItem]
call fcn.0045a1c0
call fcn.00458160
call fcn.00457d80
push 3
push dword [0x49e5b0]
call edi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push dword [0x49e5b4]
call esi
push 1
push 0
push dword [0x49e5b0]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x49e5e8], 1
pop esi
call fcn.00461195
mov esp, ebp
pop ebp
ret
Function at 0x45a280
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test esi, esi
je 0x45a358
mov eax, dword [ebp + 8]
nop dword [eax]
cmp ax, word [esi + 2]
jne 0x45a2f2
test byte [esi], 0x10
je 0x45a2b1
test ebx, ebx
jne 0x45a2b5
jmp 0x45a2f2
test ebx, ebx
jne 0x45a2f2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test byte [esi], 8
cwde
je 0x45a2c9
test eax, eax
jns 0x45a2ef
jmp 0x45a2cd
test eax, eax
js 0x45a2ef
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [esi]
cwde
test cl, 4
je 0x45a2e3
test eax, eax
jns 0x45a2eb
jmp 0x45a2e7
test eax, eax
js 0x45a2eb
movzx edi, word [esi + 4]
test edi, edi
jne 0x45a2fc
mov eax, dword [ebp + 8]
cmp byte [esi], 0
jl 0x45a358
add esi, 8
jmp 0x45a2a0
test cl, 0x40
je 0x45a32f
cmp edi, 0x7d0
jl 0x45a337
mov esi, dword [ebp - 4]
push 0
movzx eax, di
or eax, 0x10000
push eax
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x7d0
jl 0x45a309
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
je 0x45a358
push 0
push edi
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 0xffffffff
je 0x45a358
test al, 1
je 0x45a30c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a3c0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x49c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
xor eax, eax
mov word [edi], ax
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x45a40f
push 0x3f
lea edx, [ebp - 0x84]
mov ecx, 0x65
call fcn.00458f30
lea eax, [esi - 0x60]
push eax
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x45a454
lea eax, [esi - 0x70]
cmp eax, 0x17
ja 0x45a42c
lea eax, [esi - 0x6f]
push eax
push 0x48df5c
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x45a454
xor ecx, ecx
nop
cmp dword [ecx*8 + 0x48dac8], esi
je 0x45a441
inc ecx
cmp ecx, 0x14
jl 0x45a430
jmp 0x45a454
mov ecx, dword [ecx*8 + 0x48dacc]
mov edx, edi
push 0x3f
call fcn.00458f30
add esp, 4
cmp word [edi], 0
jne 0x45a46c
push 2
xor eax, eax
push esi
mov word [edi + 2], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [edi], ax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00461195
mov esp, ebp
pop ebp
ret