joyce8/EMBER2024-capa huggingface dataset:
Function at 0x277fd005
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x277fd0b0
and dword [ebp - 4], eax
and dword [ebp - 8], eax
mov edi, dword [esi + 0x68]
mov ebx, dword [esi + 0x6c]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x6c]
mov dword [ebp + 0xc], eax
push dword [esi + 0x68]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xc
push dword [ebp + 0xc]
push 0x317
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xcc0020
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
push ebx
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, dword [eax]
mov edi, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 0xc]
sub edi, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
sub ebx, edx
jmp 0x277fd033

Function at 0x277fde97
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
xor edi, edi
call esi
test ax, ax
jge 0x277fdead
push 1
pop edi
push 0x11
call esi
test ax, ax
jge 0x277fdeb9
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x277fdec5
or edi, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x2780565d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x2780567e
push eax
push dword [esi]
call edi
and dword [esi + 0x30], 0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x2780568e
push eax
push dword [esi]
call edi
and dword [esi + 0x3c], 0
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x278056cd
mov eax, dword [esi + 0x18]
test eax, eax
je 0x278056cd
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov ecx, 0xfffffdf6
mov dword [ebp - 4], ecx
mov edx, dword [eax + 4]
shr edx, 6
and edx, 1
push edx
lea edx, [ebp - 0xc]
push edx
push ecx
push 0xffffffffffffffff
push dword [eax + 8]
call fcn.27811979
push 3
push dword [esi]
call edi
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x28], 0x3f
and dword [esi + 0x18], 0
pop edi
pop esi
leave
ret 4
Function at 0x27806328
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffffe
mov eax, dword [esi + 0x28]
pop ebx
test al, 1
jne 0x27806457
test al, 0x20
je 0x2780636a
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl 0x2780636a
push 2
call edi
test ax, ax
jl 0x2780636a
push 4
call edi
test ax, ax
jl 0x2780636a
and dword [esi + 0x28], 0xffffffdf
mov ecx, dword [ebp + 0x10]
mov eax, 0x200
cmp ecx, eax
ja 0x27806481
je 0x2780645e
mov eax, ecx
sub eax, 0xa0
je 0x278063b6
dec eax
je 0x2780648d
dec eax
je 0x278063ad
dec eax
dec eax
je 0x2780648d
dec eax
je 0x278063ad
dec eax
dec eax
je 0x2780648d
dec eax
jne 0x27806457
and dword [esi + 0x28], 0xffffffdf
jmp 0x27806457
mov eax, dword [ebp + 0x18]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ecx
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
movzx edi, word [ebp - 4]
movzx eax, word [ebp - 8]
mov ebx, dword [ebp + 0x14]
shl edi, 0x10
or edi, eax
test byte [esi + 0x2c], 1
jne 0x278063f7
push dword [ebp + 0xc]
call fcn.27805630
test eax, eax
je 0x27806457
mov eax, dword [esi + 0x28]
test al, 0x10
je 0x27806457
test al, 0x20
jne 0x27806457
mov eax, edi
push 0
shr eax, 0x10
movsx eax, ax
push ebx
push eax
movsx eax, di
push eax
push dword [ebp + 0xc]
push esi
call fcn.27805daf
mov edi, eax
test edi, edi
je 0x27806479
test byte [esi + 0x28], 0xc0
je 0x27806471
cmp edi, dword [esi + 0x18]
je 0x27806463
push esi
call fcn.2780565d
push esi
mov dword [esi + 0x18], edi
call fcn.27805e5f
push 2
pop edi
cmp dword [esi + 0x3c], 0
je 0x2780644c
push 4
push esi
call fcn.2780575c
test edi, edi
je 0x27806457
push edi
push esi
call fcn.2780575c
pop edi
pop esi
pop ebx
leave
ret 0x14
mov edi, dword [ebp + 0x18]
jmp 0x278063e5
mov edi, dword [esi + 0x30]
dec edi
dec edi
neg edi
sbb edi, edi
and edi, 3
jmp 0x2780643e
push 1
mov dword [esi + 0x18], edi
pop edi
jmp 0x2780644c
push esi
call fcn.2780565d
jmp 0x27806457
mov eax, ecx
sub eax, 0x201
jmp 0x2780638a
or dword [esi + 0x28], 0x20
push esi
call fcn.27805e5f
jmp 0x27806457
Function at 0x2780978f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
push esi
mov esi, dword [eax + 0x30]
cmp esi, dword [ebp + 0x10]
jne 0x278097ab
xor eax, eax
pop esi
leave
ret 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
call edi
mov ecx, eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push 0xa
cdq
pop ebx
idiv ebx
mov ebx, eax
test ebx, ebx
je 0x2780981e
cmp esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
jge 0x27809836
sub eax, ebx
cmp esi, eax
jge 0x2780981e
add ecx, 0x1f4
mov dword [ebp - 8], ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2780962c
call edi
cmp eax, dword [ebp - 8]
ja 0x2780981e
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 8
jl 0x27809810
cmp ebx, 4
jl 0x27809810
lea eax, [ebx + ebx]
push 3
cdq
pop ecx
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, ebx
sub eax, ebx
cmp esi, eax
jl 0x278097df
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2780962c
push 1
pop eax
pop ebx
pop edi
jmp 0x278097a6
sub eax, ebx
cmp esi, eax
jle 0x2780981e
add ecx, 0x1f4
mov dword [ebp - 8], ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2780962c
call edi
cmp eax, dword [ebp - 8]
ja 0x2780981e
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 8
jl 0x27809876
cmp ebx, 0xfffffffc
jg 0x27809876
lea eax, [ebx + ebx]
push 3
cdq
pop ecx
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, ebx
sub eax, ebx
cmp esi, eax
jle 0x2780981e
jmp 0x27809845
Function at 0x278099ad
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push edi
mov dword [ebp - 4], esi
call fcn.27809922
mov eax, dword [0x278290a8]
neg eax
push eax
lea eax, [ebp - 0x14]
push esi
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test byte [edi + 9], 8
jne 0x27809b04
mov eax, dword [0x278290a8]
mov esi, dword [ebp + 0xc]
mov ebx, eax
push esi
push edi
shl ebx, 2
call fcn.27809946
test eax, eax
je 0x27809a05
mov ebx, dword [0x278290a8]
neg ebx
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp dword [ebp + 0x10], eax
jge 0x27809a55
push 8
push 0
push edi
call fcn.278092bb
mov ebx, eax
cmp ebx, esi
jne 0x27809a28
push esi
push edi
call fcn.27809241
mov ebx, eax
mov eax, esi
push 0
sub eax, dword [edi + 0x5c]
push 0x60
pop ecx
cdq
idiv ecx
push eax
push edi
call fcn.278076db
test ebx, ebx
mov dword [ebp - 4], eax
je 0x27809a89
mov eax, dword [ebx]
push 1
pop ecx
test cl, al
jne 0x27809a89
or eax, ecx
mov dword [ebx], eax
mov dword [ebp - 4], ecx
jmp 0x27809a89
mov eax, dword [ebp - 8]
add ebx, eax
cmp dword [ebp + 0x10], ebx
jl 0x27809aa1
mov eax, dword [esi]
push 1
pop ecx
test cl, al
jne 0x27809a6f
or eax, ecx
mov dword [ebp - 4], ecx
mov dword [esi], eax
mov eax, dword [edi + 0x28]
dec eax
push eax
mov eax, esi
sub eax, dword [edi + 0x5c]
push 0x60
pop ecx
cdq
idiv ecx
push eax
push edi
call fcn.278076db
or dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x27809a97
push 0
push edi
call fcn.27807bb4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [esi + 0x30], 0
jne 0x27809aac
test byte [esi], 8
je 0x27809a89
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x27809a89
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x34]
add eax, ecx
cmp dword [ebp + 0x10], eax
jle 0x27809a89
mov ecx, dword [0x278290a8]
add ecx, eax
cmp dword [ebp + 0x10], ecx
jge 0x27809a89
push 0
push esi
push edi
call fcn.278091ae
or dword [esi], 1
mov ecx, dword [edi + 0x5c]
sub eax, ecx
push 0x60
cdq
pop ebx
idiv ebx
push eax
mov eax, esi
sub eax, ecx
push ebx
cdq
pop ecx
idiv ecx
push eax
push edi
call fcn.278076db
mov dword [ebp - 4], 1
jmp 0x27809a89
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x30], esi
jne 0x27809b15
test byte [eax], 8
je 0x27809a89
mov ecx, dword [eax + 0x3c]
add ecx, dword [eax + 0x34]
cmp dword [ebp + 0x10], ecx
jle 0x27809a89
push 1
pop ecx
or dword [eax], ecx
jmp 0x27809a50
Function at 0x2780af43
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
test byte [esi + 9], 8
je 0x2780af6a
mov eax, dword [esi + 0xbc]
lea eax, [eax + eax*4]
lea eax, [esi + eax*4 + 0xe0]
cmp eax, dword [esp + 0x10]
jne 0x2780af6a
push 1
pop edi
test byte [esp + 0x14], 2
jne 0x2780af8a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x2780af8a
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne 0x2780af8a
xor edi, edi
test edi, edi
jne 0x2780afaa
mov eax, dword [esp + 0x10]
push 0x14
sub eax, esi
pop ecx
sub eax, 0xe0
cdq
idiv ecx
cmp dword [esi + 0xc0], eax
jne 0x2780afaa
push 1
pop edi
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x27810417
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x2781044d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x27810448
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x27810432
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x2781043a
cmp edx, ebx
jne 0x27810588
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x27810409
add eax, dword [eax + 4]
jmp 0x278103f6
mov dword [ebp + 0xc], ebx
jmp 0x27810458
Function at 0x278104ba
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x27810470
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x2781048e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x278104ec
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
adc byte [ecx + 0xe2], al
and byte [ecx + 0x1065], al
invalid
invalid
adc byte [ecx + 0xe2], al
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x278104d3
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x278104dc
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x278104e6
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x278104c8
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
dec eax
push es
jbe 0x27810452
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x27810539
dec eax
je 0x27810530
sub eax, 3
je 0x27810527
mov dword [ebp - 4], 0x40
jmp 0x27810556
mov dword [ebp - 4], 4
jmp 0x2781053c
mov dword [ebp - 4], 0x20
jmp 0x2781053c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x27810588
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x27810508
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
sub byte [ebx], al
invalid
call fcn.2780fd99
xchg ebp, eax
push 0x55
lodsd eax, dword [esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x27810594
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x27810cad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.2780fd77
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.2780fda9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2780fd5e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.2780fd99
and al, 0xc9
pop eax
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.2780fd99
adc eax, 0x808afba2
loopne 0x27810db7
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.2780fda9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
adc al, 0xe8
push ecx
out dx, eax
invalid
inc dword [ebx - 0x7a76f33c]
nop
cld
invalid
dec dword [ebp - 0x6537b]
call dword [eax + 0x68]
add al, 1
add byte [eax], al
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x27810e45
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x27810e65
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x27810e82
Function at 0x2781193d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
invalid
invalid
cmp al, dh
test dword [esi - 8], edi
invalid
jmp [0xf87f85c6]
invalid
push dword [ecx - 0x3a]
test dword [eax + 0x3bfffff8], eax
invalid
invalid
cmp eax, esi
test dword [ecx + 0x33fffff8], eax
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.2780fda9
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.2780fd0a
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x27811d11
Function at 0x27812418
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 1
xor ebx, ebx
call esi
mov edi, 0x8000
test di, ax
je 0x27812434
push 1
pop ebx
push 2
call esi
test di, ax
je 0x27812440
or ebx, 2
push 4
call esi
test di, ax
je 0x2781244c
or ebx, 0x10
push 0x10
call esi
test di, ax
je 0x27812458
or ebx, 4
push 0x11
call esi
test di, ax
je 0x27812464
or ebx, 8
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x2781b4e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x160]
push ebx
mov dword [ebp - 0x14], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x104
push eax
push esi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], ebx
call fcn.278000ad
cmp dword [ebp - 0x14], 0
je 0x2781b5bd
cmp dword [esi + 0x54], edi
je 0x2781b53c
push 0
push 1
push 1
push edi
push esi
call fcn.277fdd97
push 0
push edi
push esi
call fcn.277ffb7b
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x2781b54f
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 8]
push dword [esi + 0x28]
and cl, 3
neg cl
sbb ecx, ecx
and ecx, 0xffffffbb
add ecx, 0x448000c5
push ecx
push ebx
push eax
push dword [esi]
call fcn.2781bb30
xor ebx, ebx
mov dword [esi + 0xdc], eax
cmp eax, ebx
je 0x2781b5bd
cmp dword [ebp + 0x10], ebx
je 0x2781b58b
push 1
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
test byte [esi + 9], 0x10
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], ebx
jne 0x2781b5fa
push edi
push dword [esi + 0x18]
call fcn.2781593b
cmp eax, ebx
jne 0x2781b5c4
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0xdc], ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x5c]
lea ebx, [esi + 0xe0]
push eax
push 0xffffffffffffff97
push esi
mov dword [ebx], edi
call fcn.277b9878
test eax, eax
je 0x2781b5ff
push dword [esi + 0xdc]
or dword [ebx], 0xffffffff
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [esi + 0xdc], 0
jmp 0x2781b5bd
mov dword [ebp - 0x30], ebx
jmp 0x2781b5ca
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 5
push 1
push edi
push esi
call fcn.278024ef
jmp 0x2781b5bd
Function at 0x2781b654
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
push esi
call fcn.2781b737
test byte [esi + 9], 2
je 0x2781b733
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi]
jne 0x2781b733
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x2781b733
push dword [ebp + 0x10]
push ebx
push esi
call fcn.2781b4e5
mov eax, dword [esi + 0xdc]
cmp eax, edi
je 0x2781b726
push 0x2781b290
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [esi + 0xe4], eax
cmp dword [0x27829170], edi
je 0x2781b6dd
push edi
push edi
push 0xd5
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xd
jge 0x2781b6dd
or byte [esi + 0x1d], 0x40
push esi
call fcn.2781b417
push dword [esi + 0xdc]
call fcn.2781b628
test byte [esi + 8], 3
jne 0x2781b726
push edi
lea eax, [ebp - 0x10]
push edi
push eax
push edi
push ebx
push esi
call fcn.27802292
push edi
lea eax, [ebp - 0x10]
push edi
push eax
push edi
push ebx
push esi
call fcn.2780380c
lea eax, [ebp - 0x10]
push 1
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0xdc]
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x2781b72c
Function at 0x2781b737
Capabilities:
Get graphical window text
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
mov dword [ebp - 4], 1
mov edi, dword [esi + 0xdc]
mov eax, dword [esi]
test byte [esi + 0xe8], 1
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jne 0x2781b964
test edi, edi
jne 0x2781b782
push 0x2a
push 8
push esi
call fcn.277ff7da
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x2781b794
mov dword [ebp + 0xc], 1
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
sub eax, 0
je 0x2781b8c1
dec eax
je 0x2781b8c8
dec eax
je 0x2781b778
mov eax, dword [esi + 0xe0]
mov edi, 0x1000
test dword [esi + 8], edi
mov dword [ebp - 8], eax
je 0x2781b8d8
test eax, eax
jl 0x2781b88f
cmp eax, dword [esi + 0x15c]
jge 0x2781b88f
and dword [ebp - 0x14], 0
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], eax
je 0x2781b8f5
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
push 0xffffffffffffff96
push esi
call fcn.277b9878
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x2781b964
cmp dword [ebp - 4], 0
je 0x2781b846
cmp dword [ebp + 0xc], 0
jne 0x2781b846
test dword [esi + 8], edi
jne 0x2781b925
cmp dword [ebx], 0xffffffff
je 0x2781b925
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
push esi
call fcn.278003d3
cmp dword [0x27829170], 0
je 0x2781b880
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp ax, 0x411
jne 0x2781b880
push dword [ebp + 8]
call fcn.277e1fe2
mov edi, eax
test edi, edi
je 0x2781b880
push 0
push 1
push 0x15
push edi
call fcn.277e1f98
push edi
push dword [ebp + 8]
call fcn.277e1fcc
push 0
push 5
push 0
push dword [ebp - 8]
push esi
call fcn.278024ef
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0xdc]
jne 0x2781b8a8
or dword [esi + 0xe0], 0xffffffff
and dword [esi + 0xdc], 0
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push 1
push esi
call fcn.277fa461
mov eax, dword [ebp - 4]
jmp 0x2781b77b
mov dword [ebp + 0xc], 1
push 2
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x2781b7ae
push eax
push dword [esi + 0x18]
call fcn.2781593b
mov ebx, eax
test ebx, ebx
je 0x2781b88f
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
jmp 0x2781b7dd
mov edi, 0x104
lea eax, [ebp - 0x144]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
or dword [ebp - 0x34], 1
lea eax, [ebp - 0x144]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], eax
mov edi, 0x1000
jmp 0x2781b7f7
lea eax, [ebp - 0x40]
push eax
push 0xffffff69
push esi
call fcn.277b9878
test dword [esi + 8], edi
mov dword [esi + 0xcc], SysReAllocStringLen
jne 0x2781b846
mov word [ebx + 0x10], 0x7fff
mov word [ebx + 0x12], 0x7fff
mov word [ebx + 0xe], 0x7fff
mov word [ebx + 0x14], 0x7fff
jmp 0x2781b846
xor eax, eax
jmp 0x2781b77b
Function at 0x278219a9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x27827068]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x27821a17
push 0x74
push 1
call fcn.277b28dd
mov esi, eax
add esp, 8
test esi, esi
je 0x27821a0d
mov ecx, dword [0x27827068]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x27821a0d
push esi
call fcn.277b296e
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.278217e0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret