joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411830
Capabilities:
Log keystrokes

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
jmp 0x411840
cmp byte [eax*8 + 0x4bf234], bl
je 0x411870
inc eax
cmp eax, 0x6d
jl 0x411840
push ebp
movzx ebp, bl
push 2
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [edi], ax
test ax, ax
je 0x41188e
xor edx, edx
pop ebp
mov word [edi + 2], dx
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [eax*8 + 0x4bf230]
dec esi
push esi
push eax
push edi
call fcn.0048ac34
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
mov eax, edi
pop edi
pop esi
ret
cmp byte [esp + 0x10], 0
je 0x4118ad
test bl, bl
je 0x4118ad
push ebp
push str.vk_02X
call fcn.0046f100
add esp, 8
pop ebp
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
mov word [edi], ax
pop ebp
mov eax, edi
pop edi
pop esi
ret

Function at 0x411a20
Capabilities:
Log keystrokes via polling

Disassembly:
cmp ax, 0xa
jne 0x411a29
mov al, 0xd
ret
push ecx
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov edx, eax
shr edx, 8
cmp dl, 0xff
jne 0x411a45
cmp al, 0xff
jne 0x411a45
xor al, al
ret
test dl, 0x38
jne 0x411a42
test esi, esi
je 0x411a90
mov cl, dl
and cl, 6
cmp cl, 6
jne 0x411a5d
or byte [esi], 8
jmp 0x411a7f
test dl, 2
je 0x411a6e
mov cl, byte [esi]
test cl, 3
jne 0x411a6e
or cl, 1
mov byte [esi], cl
test dl, 4
je 0x411a7f
mov cl, byte [esi]
test cl, 0xc
jne 0x411a7f
or cl, 4
mov byte [esi], cl
test dl, 1
je 0x411a90
mov cl, byte [esi]
test cl, 0x30
jne 0x411a90
or cl, 0x10
mov byte [esi], cl
ret

Function at 0x411cc0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov bl, byte [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
xor eax, eax
mov word [esi], ax
test bl, bl
jne 0x411cee
test di, di
jne 0x411ce1
pop edi
pop ebp
mov eax, esi
pop ebx
ret
mov ecx, edi
call fcn.00412040
mov byte [esp + 0x10], al
jmp 0x411d05
test di, di
jne 0x411d0e
mov ecx, dword [esp + 0x10]
push ecx
xor bl, bl
call fcn.00411dc0
add esp, 4
movzx edi, ax
mov bl, byte [esp + 0x10]
test di, di
je 0x411d3b
cmp bl, 0x9c
jb 0x411d18
cmp bl, 0x9f
jbe 0x411d3b
xor eax, eax
lea ebx, [ebx]
cmp word [eax*8 + 0x4bf59c], di
je 0x411d6b
inc eax
cmp eax, 0xd
jl 0x411d20
xor ecx, ecx
mov word [esi], cx
cmp word [esi], 0
jne 0x411cdb
xor eax, eax
lea ecx, [ecx]
cmp byte [eax*8 + 0x4bf234], bl
je 0x411d88
inc eax
cmp eax, 0x6d
jl 0x411d40
movzx ecx, bl
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [esi], ax
test ax, ax
je 0x411da5
xor edx, edx
mov word [esi + 2], dx
jmp 0x411daa
mov edx, dword [eax*8 + 0x4bf598]
lea edi, [ebp - 1]
push edi
push edx
push esi
call fcn.0048ac34
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411d35
mov edx, dword [eax*8 + 0x4bf230]
lea edi, [ebp - 1]
push edi
push edx
push esi
call fcn.0048ac34
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411daa
xor eax, eax
mov word [esi], ax
cmp word [esi], 0
mov eax, esi
jne 0x411db6
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
ret
Function at 0x412040
Capabilities:
Log keystrokes

Disassembly:
movzx eax, cx
cmp eax, 0x11c
jg 0x412098
je 0x412095
sub eax, 0x1d
cmp eax, 0x36
ja case.0x4120a9.286
movzx eax, byte [eax + 0x412114]
jmp dword [eax*4 + 0x4120cc]
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, 0xc
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, 0x23
ret
mov al, 0x21
ret
mov al, 0x22
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x28
ja case.0x4120a9.286
movzx edx, byte [eax + 0x412164]
jmp dword [edx*4 + 0x41214c]
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x90
ret
mov al, 0x6f
ret
movzx eax, cl
push 1
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
ret

Function at 0x412190
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4c0df8], eax
mov edx, 1
mov eax, 0x4c0df8
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4c17b4
jl 0x4121a0
mov dword [0x4be3b4], 1
mov dword [0x4c390c], 1
pop edi
ret

Function at 0x4121e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c390c], 0
push esi
mov esi, 0x4c0df8
jne 0x4121fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00412190
mov dword [0x4be3b4], 0x270
mov dword [0x4c0df4], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x412210
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x412245
mov ecx, dword [esi]
mov eax, dword [0x4c0df8]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x4122b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4be3b4]
jne 0x4122bd
call fcn.004121e0
mov eax, dword [0x4c0df4]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c0df4], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x412300
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4be3b4]
jne 0x41230e
call fcn.004121e0
mov ecx, dword [0x4c0df4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4c0df4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x412355
fadd qword [0x4b8930]
fmul qword [0x4b8978]
pop ecx
ret
Function at 0x4155b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x4be3d0]
add eax, 4
imul eax, eax, 0x108
push ebx
push esi
push edi
push eax
call fcn.00488234
xor ebx, ebx
add esp, 4
mov dword [0x4c09e0], eax
cmp eax, ebx
jne 0x4155e7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [0x4be3fc]
push 0x4032d0
mov edi, eax
push 0x4ef6d80
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4c1ea8]
push 0xe
push ecx
mov dword [0x4be3fc], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [ebp + 8]
cmp dword [esi], ebx
jne 0x415628
mov dword [esp + 0xc], 1
jmp 0x4156d5
mov edx, dword [0x4be3fc]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xe4], bl
call edi
mov ecx, dword [0x4be3fc]
mov dword [ecx + 0xd4], eax
mov dword [ecx + 0xd8], 0x64
cmp byte [0x4c1ffb], bl
jne 0x41567a
mov eax, dword [0x4c1ea8]
push 0x4031d0
push 0x64
push 0xb
push eax
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne cl
mov byte [0x4c1ffb], cl
mov byte [esi + 0xa9d], 1
call edi
mov ecx, dword [esi]
push ebx
mov edi, 1
add dword [0x4c2014], edi
push ebx
push edi
mov dword [esi + 0xabc], eax
mov dword [esi + 0xab8], eax
call fcn.00425ba0
sub dword [0x4c2014], edi
mov dword [esp + 0xc], eax
cmp byte [0x4c1ffb], bl
je 0x4156cf
mov edx, dword [0x4c1ea8]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x4156cf
mov byte [0x4c1ffb], bl
mov byte [esi + 0xa9d], bl
mov eax, dword [0x4be3fc]
cmp dword [eax + 0xf8], ebx
lea ecx, [eax + 0xf8]
je 0x415701
mov eax, dword [eax + 0xfc]
push eax
push ecx
call fcn.0042f200
mov dword [esp + 0x14], eax
mov eax, dword [0x4be3fc]
add esp, 8
push 1
push ebx
mov byte [eax + 0xe4], 1
mov esi, eax
mov dword [eax + 0xb4], ebx
mov dword [eax + 0xb8], ebx
mov dword [eax + 0xbc], ebx
mov dword [eax + 0xc0], ebx
mov dword [eax + 0xc4], ebx
mov byte [eax + 0xef], bl
mov dword [eax + 0x28], ebx
mov dword [eax + 0x4c], ebx
mov byte [eax + 0xe0], bl
mov dword [eax + 0x48], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xf8], ebx
mov byte [eax + 0x100], bl
mov ecx, 0x42
mov edi, 0x4c0af0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4c26a8]
push 0xffffffffffffffff
push 0x49b8c0
mov byte [eax + 0xe4], 1
mov dword [eax + 0xd8], ebx
mov word [eax + 0xe5], 1
mov dword [eax + 0x2c], SysStringLen
call fcn.00471c00
mov ecx, dword [0x4bf608]
cmp word [ecx], bx
jne 0x4157df
cmp dword [0x4c38b0], ebx
jne 0x4157df
cmp dword [0x4c1fd8], ebx
jne 0x4157df
cmp dword [0x4c1fdc], ebx
jne 0x4157df
cmp byte [0x4c1fcb], bl
jne 0x4157df
mov ecx, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
push ebx
and ecx, 7
add ecx, 2
push 0x4c4000
xor eax, eax
call fcn.00415820
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415820
Capabilities:
Set current directory

Disassembly:
sub esp, 0x90c
push ebx
push ebp
mov ebp, dword [esp + 0x918]
xor ebx, ebx
push esi
push edi
mov dword [ebp + 0xa58], ecx
cmp eax, ebx
je 0x415847
mov byte [esp + 0x17], 1
cmp word [eax], bx
je 0x41584b
mov byte [esp + 0x17], bl
cmp eax, ebx
je 0x4158b5
cmp word [eax], bx
je 0x4158b5
push eax
push str.Critical_Error:__s_n_nThe_program_will_exit.
mov esi, 0x400
lea edi, [esp + 0x120]
call fcn.0046f100
mov edx, dword [0x4c4a84]
mov ecx, dword [0x4c1ea8]
add esp, 8
push 0x10000
push edx
mov eax, edi
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [0x4c1ea8]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4158ae
mov eax, dword [0x4c1ea8]
push eax
mov byte [0x4c1ea4], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call fcn.00409890
cmp dword [ebp + 0xa54], ebx
je 0x4159ea
cmp byte [0x4c4e86], bl
jne 0x4159ea
mov esi, dword [0x4c26a8]
cmp byte [esi + 0x17], bl
jne 0x4158db
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x4158e8
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x415901
test byte [esi + 0x15], 4
je 0x4158fc
mov eax, esi
call fcn.0042f5b0
mov eax, dword [esi + 8]
jmp 0x415911
cmp al, 2
jne 0x41590c
call fcn.00401000
jmp 0x415911
mov eax, 0x4c3fa8
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0048ac34
mov eax, dword [0x4be3fc]
inc dword [0x4c2014]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x122], dx
mov ecx, 0x42
mov esi, 0x4c0af0
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x4be3fc], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x4c4000
call fcn.004154b0
mov dword [0x4c4aa8], ebx
mov dword [0x4c4aac], ebx
cmp dword [0x4c2040], ebx
je 0x41597b
push 0x4c26b0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [0x4be3c4]
mov ecx, dword [ebp + 0xa54]
mov dword [0x4be3c4], ebx
mov byte [0x4c4e86], 1
call fcn.00401240
test eax, eax
jne 0x4159ab
mov eax, dword [esp + 0x924]
push eax
push ebp
call fcn.00415a10
mov byte [0x4c4e86], bl
cmp byte [esp + 0x17], bl
je 0x4159c5
mov ecx, dword [esp + 0x924]
push ecx
push ebp
call fcn.00415a10
lea edx, [esp + 0x18]
push edx
call fcn.00403090
add esp, 4
pop edi
mov dword [0x4be3c4], esi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x90c
ret 8
mov ecx, dword [esp + 0x924]
mov eax, dword [0x4be3fc]
push ecx
push ebp
mov dword [0x4be3c4], ebx
mov byte [eax + 0xef], bl
call fcn.00415a10
int3
Function at 0x41bce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov cx, word [0x4be3ec]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
push esi
mov word [esp + 0xc], ax
xor edx, edx
push edi
lea ebx, [esp + 0x10]
mov eax, ebp
mov word [esp + 0x12], cx
mov dword [esp + 0x14], 0x90028
mov dword [esp + 0x18], 0x3e003c
mov dword [esp + 0x1c], 0x3d003a
mov dword [esp + 0x20], 0x2d002b
mov dword [esp + 0x24], 0x2f002a
mov dword [esp + 0x28], 0x7e0021
mov dword [esp + 0x2c], 0x7c0026
mov dword [esp + 0x30], 0x5b005e
mov dword [esp + 0x34], 0x3f002e
mov word [esp + 0x38], dx
call fcn.00408f40
test eax, eax
je 0x41bd68
cmp eax, ebp
jbe 0x41bd83
sub eax, 2
jmp 0x41bd83
mov eax, ebp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bd70
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 2]
mov edi, eax
cmp eax, ebp
jbe 0x41bda4
lea esp, [esp]
movzx eax, word [edi]
cmp eax, 0x20
je 0x41bd9d
cmp eax, 9
jne 0x41bda4
sub edi, 2
cmp edi, ebp
ja 0x41bd90
mov esi, edi
sub esi, ebp
sar esi, 1
inc esi
cmp esi, 0xfd
jbe 0x41bdd5
cmp byte [esp + 0x4c], 0
je 0x41bdc9
mov ecx, dword [esp + 0x40]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0042f010
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ebx, dword [esp + 0x44]
push esi
push ebp
push ebx
call fcn.0048ac34
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x42bfa0
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4c2014]
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x4be3d0]
jl 0x42bfc9
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov esi, dword [0x4c26a8]
cmp byte [esi + 0x17], 0
jne 0x42bfd8
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42bfe5
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42bffe
test byte [esi + 0x15], 4
je 0x42bff9
mov eax, esi
call fcn.0042f5b0
mov eax, dword [esi + 8]
jmp 0x42c00e
cmp al, 2
jne 0x42c009
call fcn.00401000
jmp 0x42c00e
mov eax, 0x4c3fa8
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0048ac34
mov eax, dword [0x4be3fc]
inc dword [0x4c2014]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x122], dx
mov ecx, 0x42
mov esi, 0x4c0af0
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x4be3fc], eax
push edi
mov eax, 0x4c4000
mov dword [esi + 0x2c], edi
call fcn.004154b0
mov dword [0x4c4aa8], edi
mov dword [0x4c4aac], edi
cmp dword [0x4c2040], edi
je 0x42c07c
push 0x4c26b0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or eax, 0xffffffff
cmp byte [esi + 0xe6], 0
jne 0x42c097
mov byte [esi + 0xe6], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
cmp dword [0x4c4ab4], edi
je 0x42c0a7
cmp dword [0x4c4ab0], edi
jne 0x42c0b0
cmp byte [esi + 0xe6], 0
je 0x42c0df
cmp byte [esi + 0xe6], 0
mov byte [esi + 0xe4], 0
jne 0x42c0df
cmp dword [0x4c4ab4], edi
jl 0x42c0d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xd4], eax
mov eax, dword [0x4c4ab4]
mov dword [esi + 0xd8], eax
mov eax, dword [0x4c4a40]
mov ebp, dword [0x4c4a44]
mov ecx, dword [0x4c4a78]
mov edx, dword [0x4c4a7c]
mov edi, eax
mov dword [0x4c4a44], eax
mov eax, dword [esp + 0x124]
mov ebx, ecx
mov dword [esp + 0x14], edx
mov dword [0x4c4a7c], ecx
mov dword [0x4c4a40], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x120]
push 0
push 0xffffffffffffffff
push 0
push ecx
mov dword [0x4c4abc], eax
mov dword [0x4c4ab8], eax
mov dword [0x4c4a78], eax
call fcn.00458020
mov esi, eax
cmp esi, 1
jne 0x42c153
mov edx, dword [esp + 0x120]
push edx
call fcn.0042a5f0
mov esi, eax
mov eax, dword [0x4be3fc]
mov ecx, dword [eax + 0xc0]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov dword [0x4c2030], ecx
mov dword [0x4c4a40], edi
mov dword [0x4c4a78], ebx
mov dword [0x4c4a44], ebp
mov dword [0x4c4a7c], edx
call fcn.00403090
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
Function at 0x42f480
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.004936b0
cmp dword [esp + 0x4008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4018]
mov ebx, ecx
je 0x42f5a3
test ebx, ebx
jne 0x42f4b8
mov eax, dword [esp + 0x400c]
mov ebx, dword [eax + 0x624]
test ebx, ebx
je 0x42f4c2
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42f4cf
mov ecx, dword [eax + 0x260]
movzx eax, word [eax + 0x264]
mov edx, dword [esp + 0x4014]
mov ecx, dword [ecx*4 + 0x4c1e98]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.0046f100
add esp, 0x10
cmp word [ebp], 0
lea edi, [esp + eax*2 + 0x10]
je 0x42f520
lea eax, [esp + 0x10]
mov edx, edi
sub edx, eax
sar edx, 1
push ebp
push str._____Specifically:__s_n
sub esi, edx
call fcn.0046f100
add esp, 8
mov esi, dword [esp + 0x4018]
cmp esi, 3
jne 0x42f54f
call fcn.00488748
add eax, 0x20
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0048a037
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x42f5a1
test ebx, ebx
jne 0x42f574
mov ecx, dword [esp + 0x4014]
mov ebx, dword [ecx + 0x624]
test ebx, ebx
je 0x42f593
mov eax, dword [esp + 0x401c]
push ebp
push 1
push eax
mov ecx, ebx
call fcn.0042ed60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
mov edx, dword [esp + 0x401c]
push ebp
push edx
call fcn.0042f010
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
Function at 0x42f8c0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42f8e7
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42f8f1
xor edx, edx
mov word [esp + 0x120], dx
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00490d90
mov esi, dword [0x4c4a5c]
add esp, 0xc
test esi, esi
je 0x42f93d
cmp byte [esi + 0x11], 0
je 0x42f936
mov edx, dword [esi]
mov eax, dword [edx]
push eax
push 0x4a2fd0
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.0046f140
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42f915
cmp word [esp + 0x20], 0
je 0x42f998
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42f950
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x42f986
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x49e9ec
push edi
call fcn.0048ac34
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x42f998
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x42f998
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x4c09e0]
cmp byte [eax + 0xef], 0
je 0x42f9b7
cmp byte [0x4c4a9d], 0
mov dword [esp + 0x14], 1
je 0x42f9bf
mov dword [esp + 0x14], 0
mov eax, dword [0x4c2014]
mov dword [esp + 0x18], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42fadd
mov dword [esp + 0x18], 0x4a59a4
xor ebp, ebp
cmp dword [0x4c1fdc], 0
mov edi, 0x49d9b0
je 0x42f9f2
mov edi, 0x49d9a8
cmp dword [0x4c1fd8], 0
mov esi, 0x49d9b0
je 0x42fa05
mov esi, 0x49d9a8
push 1
call fcn.00411140
mov bl, al
add esp, 4
lea eax, [esp + 0x1e8]
call fcn.004114d0
mov ecx, dword [0x4c2010]
mov edx, dword [0x4c2014]
push eax
mov eax, dword [0x4c2018]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [0x4c4a64]
push ecx
mov ecx, dword [0x4c4a68]
push ebp
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push edi
mov edi, dword [esp + 0x414]
push esi
lea edx, [esp + 0x14c]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.0046f100
lea esi, [edi + eax*2]
mov eax, esi
mov ebx, edi
sub eax, ebx
sar eax, 1
mov ecx, 0xfffe
add esp, 0x34
sub ecx, eax
push ecx
push esi
call fcn.00408c90
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42fa92
sub eax, edx
sar eax, 1
cmp dword [0x4c28bc], 0
lea edi, [esi + eax*2]
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42fab7
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
mov edx, edi
sub edx, ebx
sar edx, 1
mov esi, 0xfffe
push eax
sub esi, edx
call fcn.0046f100
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
lea ebp, [eax - 1]
jmp 0x42f9df
Function at 0x435460
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
mov ebx, dword [0x4c1e48]
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.00471c00
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
call fcn.00442800
mov esi, eax
test esi, esi
je 0x435545
push 0
push esi
mov byte [esp + 0x17], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x4354dc
cmp edi, dword [0x4c3fc0]
je 0x4354dc
call fcn.00473a10
test al, al
jne 0x4354dc
mov ecx, dword [0x4c3fc0]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0xf]
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [esp + 0xf], 0
mov dword [esp + 0x1c], eax
je 0x435501
mov edx, dword [0x4c3fc0]
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435545
lea ecx, [esp + 0x20]
push 0xfc
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x435545
lea eax, [esp + 0x10]
push eax
push 0x4355e0
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [esp + 0x14], 0
jne 0x43558e
mov ecx, dword [0x4be3fc]
cmp byte [ecx + 0x100], 0
jne 0x435571
mov edx, dword [0x4c26a8]
push edx
or eax, 0xffffffff
mov ecx, 0x49e334
call fcn.00401200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x4a59a4
push 0
push 0x49e334
call fcn.0042ea30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esp + 0x18]
push eax
push 0x49b868
mov eax, 0x101
lea ecx, [esp + 0x28]
call fcn.0046f140
mov ecx, dword [0x4c26a8]
add esp, 8
push 1
push 0
push 0xffffffffffffffff
push 0x49b8c0
call fcn.00471c00
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebx
call fcn.00471c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x435670
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
push esi
push edi
push eax
mov eax, dword [ebp + 0x14]
call fcn.00442800
mov edi, eax
test edi, edi
je 0x4356a2
mov esi, dword [ebp + 0xc]
push edi
call fcn.004734d0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4356eb
mov ecx, dword [0x4be3fc]
cmp byte [ecx + 0x100], 0
jne 0x4356ce
mov edx, dword [0x4c26a8]
push edx
or eax, 0xffffffff
mov ecx, 0x49e334
call fcn.00401200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push 0x4a59a4
push 0
push 0x49e334
call fcn.0042ea30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
mov byte [esp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test ebx, ebx
je 0x435728
cmp ebx, dword [0x4c3fc0]
je 0x435728
mov esi, edi
call fcn.00473a10
test al, al
jne 0x435728
mov eax, dword [0x4c3fc0]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x435766
mov ecx, dword [0x4c26a8]
push 1
push 0
push 0xffffffffffffffff
push 0x49b8c0
call fcn.00471c00
mov edx, dword [0x4be3fc]
mov eax, dword [edx + 0x58]
cmp eax, 0xffffffff
jle 0x435766
push 1
push eax
call fcn.004012b0
add esp, 8
cmp byte [esp + 0x13], 0
je 0x43577c
mov eax, dword [0x4c3fc0]
push 0
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10