joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409043
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x479958
call fcn.0045c5c4
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [edi + 0x2c]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0046c6d1
push eax
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0046c488
mov eax, dword [edi]
push 1
push ebx
push ebx
mov dword [esi + 8], eax
push dword [edi + 0x1c]
call fcn.0045c9e0
mov ecx, dword [edi + 0x20]
add eax, ecx
lea ecx, [ebp + 8]
adc edx, ebx
and dword [esi + 0x30], ebx
and dword [esi + 0x2c], ebx
mov dword [esi + 0x10], eax
or ebx, 0xffffffff
lea eax, [edi + 4]
push ebx
push eax
mov dword [esi + 0x14], edx
call fcn.00469567
mov eax, dword [ebp + 8]
push ebx
mov dword [esi + 0x18], eax
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp + 8]
call fcn.00469567
mov eax, dword [ebp + 8]
add edi, 0x14
push ebx
push edi
lea ecx, [ebp + 8]
mov dword [esi + 0x1c], eax
call fcn.00469567
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov dword [ebp - 4], ebx
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x42c84b
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4490fe
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x483574
call fcn.0045c665
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [0x4a94a4]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 8], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xc], eax
mov eax, dword [0x4a94a4]
lea ebx, [esi + 0x10]
mov dword [ebx], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x14], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x18], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x2c], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x30], eax
mov eax, dword [0x4a94a4]
lea ecx, [esi + 0x3c]
mov dword [ecx], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x44], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x54], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x58], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x5c], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x60], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x64], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x68], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x70], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x74], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x7c], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x80], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x84], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0x88], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xa0], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xa4], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xa8], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xac], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xb4], eax
mov eax, dword [0x4a94a4]
mov dword [esi + 0xbc], eax
push 0x4a1800
invalid

Function at 0x453421
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4af588]
push ebx
push esi
push edi
push eax
call dword [0x486264]
mov ebx, eax
test ebx, ebx
jne 0x45343d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
lea ecx, [ebx + 0xc88]
push ebp
push ecx
call fcn.004597f1
mov ebp, dword [esp + 0x18]
add esp, 4
xor edi, edi
call fcn.00459741
xor edx, edx
mov esi, eax
mov dl, byte [edi + ebp]
xor esi, edx
push esi
call fcn.00459771
add esp, 4
inc edi
cmp edi, 0xc
jl 0x453453
mov al, byte [ebx + 0xafc]
pop ebp
test al, 8
je 0x453489
xor eax, eax
mov ax, word [ebx + 0xb00]
shr eax, 8
jmp 0x45349e
mov eax, dword [ebx + 0xc4a]
xor ecx, ecx
shr eax, 0x10
mov cl, ah
and ecx, 0xff
mov eax, ecx
and esi, 0xffff
cmp esi, eax
je 0x4534af
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [ebx + 0x8cea]
mov ecx, dword [ebx + 0xab2]
cmp eax, ecx
jbe 0x4534c1
mov eax, ecx
mov esi, dword [ebx + 0x8ce6]
mov edx, eax
dec eax
test edx, edx
je 0x4534ed
lea edi, [eax + 1]
call fcn.00459741
mov ebx, eax
xor eax, eax
mov al, byte [esi]
xor ebx, eax
push ebx
call fcn.00459771
add esp, 4
mov byte [esi], bl
inc esi
dec edi
jne 0x4534d1
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x459771
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x4af588]
push eax
call dword [0x486264]
test eax, eax
je 0x4597e9
mov edx, dword [eax + 0xcca]
push esi
mov esi, dword [esp + 8]
mov ecx, edx
xor ecx, esi
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a73d4]
xor ecx, edx
mov edx, dword [eax + 0xcce]
mov dword [eax + 0xcca], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [eax + 0xcd2]
imul ecx, ecx, 0x8088405
inc ecx
mov esi, edx
mov dword [eax + 0xcce], ecx
and esi, 0xff
shr ecx, 0x18
xor ecx, esi
pop esi
shr edx, 8
mov ecx, dword [ecx*4 + 0x4a73d4]
xor ecx, edx
mov dword [eax + 0xcd2], ecx
ret
Function at 0x4055f0
Capabilities:
Create directory

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.00436600
push dword [esp + 0x18]
call fcn.00419280
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00419000
push dword [esp]
push 0
call sub.SHELL32.DLL_SHCreateDirectory
mov dword [esp + 4], eax
push dword [esp + 4]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40563c
mov edx, 0x492218
lea ecx, [esp + 0xc]
call fcn.00419008
jmp 0x40566e
mov ebx, 0x50
cmp ebx, dword [esp]
jne 0x405656
mov edx, 0x492218
lea ecx, [esp + 0xc]
call fcn.00419008
jmp 0x40566e
mov ebx, 0xb7
cmp ebx, dword [esp]
jne 0x40566e
mov edx, 0x492218
lea ecx, [esp + 0xc]
call fcn.00419008
pop eax
mov edx, dword [esp + 8]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x405697
push dword [esp]
call fcn.00436660
push dword [esp + 8]
call fcn.00436660
add esp, 0xc
pop ebx
ret 4
Function at 0x419953
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x4199eb
push edi
push 0xdf096c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0xdef924]
test edi, edi
je 0x4199bf
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4199b8
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0xdef924
call fcn.00436396
pop ecx
pop ecx
jmp 0x4199ba
mov edi, dword [edi]
test edi, edi
jne 0x41998f
pop ebx
mov eax, dword [0xded230]
mov esi, eax
inc eax
push 0x10
push 0xdef924
mov dword [0xded230], eax
call fcn.004363d6
pop ecx
pop ecx
push 0xdf096c
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x419b26
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x419b7b
push dword [esp + 0x10]
push 0x419aa5
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0xdef92c]
test esi, esi
je 0x419bd4
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x419b73
cmp byte [esi + 0x10], 0
je 0x419b73
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x419b4f
jmp 0x419bd4
mov esi, dword [0xdef92c]
test esi, esi
je 0x419bd4
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x419bcd
cmp byte [esi + 0x11], 0
je 0x419ba9
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x419bc0
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0xdef92c
call fcn.00436396
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x419b88
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x419c77
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0xdf0994]
call fcn.00435a69
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x419d77
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x419ccd
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x419cc5
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x419d0d
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x419d4f
push 0x22
pop edx
cmp cx, dx
je 0x419cff
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x419cef
xor ecx, ecx
cmp word [eax], cx
je 0x419d4f
mov ecx, eax
add eax, 2
jmp 0x419d51
test dx, dx
je 0x419d57
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x419cff
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x419d45
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x419d4f
cmp cx, dx
je 0x419d42
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x419d32
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x419d17
jmp 0x419cff
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x419d59
xor edx, edx
cmp dword [ebp], ebx
jne 0x419d62
test edi, edi
jne 0x419d7f
test edx, edx
je 0x419d67
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x419cbb
test edi, edi
jne 0x419d90
mov eax, ebx
jmp 0x419d94
test esi, esi
je 0x419d90
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x419d94
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x41a5a0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xdef944], 0
jne 0x41a5ae
call fcn.0041a520
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xdef948]
call esi
test eax, eax
jne 0x41a5d1
call fcn.0041a520
push dword [0xdef948]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x41a5e0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x41a640
mov ebx, 0x10
test edi, edi
jns 0x41a649
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x41a612
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41a660
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xdef944], 0
jne 0x41a66e
call fcn.0041a520
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xdef948]
call esi
mov edx, eax
test edx, edx
jne 0x41a695
call fcn.0041a520
push dword [0xdef948]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x41a6c8
mov ebx, 0x10
test esi, esi
jns 0x41a6d1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x41a6e0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41b4a7
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
cmp dword [0xdefcd0], 0
push ebx
push ebp
push esi
je 0x41b4c6
call fcn.0041b290
call dword [0xdf0c78]
jmp 0x41b687
push 0xffffffffffffffff
call fcn.0041b705
xor ebp, ebp
cmp dword [0xdf0bec], ebp
jne 0x41b505
mov esi, dword [sym.imp.USER32.DLL_PeekMessageW]
jmp 0x41b4f5
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.DLL_DispatchMessageW]
push 1
push ebp
push ebp
push ebp
lea eax, [esp + 0x40]
push eax
call esi
test eax, eax
jne 0x41b4df
cmp dword [0xdefcc0], ebp
je 0x41b687
mov eax, dword [0xdf0bf8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
cmp esi, 0x88760827
jne 0x41b533
mov dword [0xdefcc0], ebp
xor eax, eax
jmp 0x41b6a1
cmp esi, 0x88760868
jne 0x41b581
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0xdf0bf8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
cmp esi, 0x88760827
je 0x41b526
cmp esi, 0x88760869
je 0x41b579
test esi, esi
je 0x41b579
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x20
jb 0x41b543
cmp esi, 0x88760868
je 0x41b526
cmp esi, 0x88760869
jne 0x41b624
push dword [0xdefc7c]
call fcn.00435de4
jmp 0x41b5a1
push dword [eax]
call fcn.0041ba45
lea eax, [esp + 0xc]
push eax
push dword [0xdefc7c]
call fcn.00435d84
test eax, eax
jne 0x41b59a
mov eax, dword [0xdf0bf8]
push 0xdf0c0c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
test eax, eax
jne 0x41b526
push dword [0xdefc7c]
call fcn.00435de4
jmp 0x41b5e1
push dword [eax]
call fcn.0041ba4b
lea eax, [esp + 0xc]
push eax
push dword [0xdefc7c]
call fcn.00435d84
test eax, eax
jne 0x41b5da
mov eax, dword [0xdf0bf8]
push 0xdf0bfc
push ebp
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x48]
or dword [0xdf0c54], 0xffffffff
or dword [0xdf0c58], 0xffffffff
or dword [0xdf0c5c], 0xffffffff
or dword [0xdf0c60], 0xffffffff
call fcn.0041b290
cmp dword [0xdf0bec], ebp
je 0x41b66a
lea eax, [esp + 0x20]
push eax
push dword [0xdefcb8]
call dword [sym.imp.USER32.DLL_GetClientRect]
mov eax, dword [0xdefc30]
lea edx, [esp + 0x20]
push ebp
push ebp
push edx
mov dword [esp + 0x24], eax
lea edx, [esp + 0x1c]
mov eax, dword [0xdefc34]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
push edx
jmp 0x41b66e
push ebp
push ebp
push ebp
push ebp
mov eax, dword [0xdf0bf8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov dword [0xdefcc0], eax
mov ecx, dword [0xdefc3c]
test ecx, ecx
je 0x41b69e
cmp ecx, dword [0xdf0c08]
je 0x41b69e
call fcn.0041b7c9
xor eax, eax
inc eax
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x41e132
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41e1da
push ebx
push esi
push 0x48
push 8
push dword [0xdef744]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov esi, eax
xor ebx, ebx
inc ebx
or dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x34], eax
test bl, cl
je 0x41e1cf
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x41e1e1
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41e1bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41e1c2
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x41e1d6
push esi
call fcn.0041dd95
pop ecx
jmp 0x41e1d8
push esi
call fcn.0041ddec
pop ecx
mov edi, esi
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret 0x18

Function at 0x41e508
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.DLL_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x41e522
inc esi
push 2
call edi
test bx, ax
je 0x41e52e
or esi, 2
push 4
call edi
test bx, ax
je 0x41e53a
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41eb0a
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.DLL_GetClientRect]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x41eb42
push dword [edi]
call dword [sym.imp.USER32.DLL_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
test byte [edi + 0x14], 8
je 0x41ec27
call dword [sym.imp.USER32.DLL_GetFocus]
cmp dword [edi], eax
jne 0x41ec27
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
sub ebp, dword [esp + 0x18]
mov dword [esp + 0x28], eax
test eax, eax
jle 0x41ec55
test ebp, ebp
jle 0x41ec55
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x41ec55
push ebp
push dword [esp + 0x2c]
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x41ec1e
push eax
push ebx
call dword [sym.imp.GDI32.DLL_SelectObject]
cmp dword [edi + 0x10], 0
je 0x41ebc8
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.DLL_DrawStateW]
jmp 0x41ebdd
push 0
call dword [sym.imp.GDI32.DLL_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.DLL_FillRect]
push 2
pop eax
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
sub dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.DLL_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x3c]
push eax
push eax
push esi
call dword [sym.imp.GDI32.DLL_BitBlt]
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push ebx
call dword [sym.imp.GDI32.DLL_DeleteDC]
jmp 0x41ec55
cmp dword [edi + 0x10], ebx
je 0x41ec41
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.DLL_DrawStateW]
jmp 0x41ec55
push ebx
call dword [sym.imp.GDI32.DLL_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.DLL_FillRect]
cmp dword [esp + 0x10], 0
je 0x41ec65
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x41ec6d
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.DLL_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00421173
push eax
call fcn.00421869
push dword [0xdefd44]
mov dword [esp + 0x24], eax
call fcn.00435e11
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.DLL_ScreenToClient]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x41ece1
inc ebx
push 0x12
call esi
test di, ax
je 0x41eced
or ebx, 2
push 0x11
call esi
test di, ax
je 0x41ecf9
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.0041e508
push 0x41ed4e
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00424742
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x41f92c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0xdf0cb8]
call fcn.00435bda
mov ebx, eax
test ebx, ebx
je 0x41f990
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x41f955
push dword [esp + 0xc]
push ebx
call eax
jmp 0x41f990
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004367c0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004368a0
pop edi
pop esi
pop ebx
ret 8
Function at 0x42282f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x4228a9
push 9
call esi
test al, al
jns 0x4228a9
push 0x11
call esi
test al, al
js 0x4228a9
push 0x10
call esi
test al, al
js 0x4228a9
push 0x12
call esi
test al, al
js 0x4228a9
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4228a9
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x4228a9
xor eax, eax
jmp 0x42292a
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4228d1
push 0x11
call esi
test al, al
js 0x4228c9
push 0x10
call esi
test al, al
js 0x4228c9
push 0x12
call esi
test al, al
jns 0x4228d1
push 1
push edi
call fcn.00422932
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x4228e7
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x422927
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x422927
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x422927
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x422927
lea eax, [esi - 1]
push eax
push dword [0xdf0cc8]
call fcn.00435bda
test eax, eax
je 0x422927
mov eax, dword [eax + 8]
jmp 0x422929
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4