joyce8/EMBER2024-capa huggingface dataset:
Function at 0x31271ab4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
cmp byte [esi + 0x3c], 0
je 0x31271ad8
mov ecx, dword [0x3143fa5c]
mov dl, 1
mov eax, dword [0x31261a88]
call fcn.31249374
call fcn.31235b94
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call fcn.3123bba4
mov edx, dword [0x3143ffbc]
cmp eax, dword [edx]
jne 0x31271b46
xor ebx, ebx
mov eax, dword [0x31444f64]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x31271b10
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_GetMenuItemID
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call sub.user32.dll_GetKeyboardState
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.31271060
cmp ebx, 1
jne 0x31271b40
xor eax, eax
call fcn.31270b88
test ebx, ebx
jne 0x31271af9
jmp 0x31271b52
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call fcn.3123be08
push esp
mov eax, dword [esp + 8]
push eax
call fcn.3123bbbc
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.31271060
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x31284cf0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x31284cf6
ret
Function at 0x312902cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x31290489
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x31290465
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x31290465
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x31290298]
call fcn.312387c4
add esp, 4
lea eax, [ebp - 4]
call fcn.31239b5c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x3143f79c]
push eax
call fcn.312788d4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.312385fc
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.31234a28
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x31283630]
call fcn.3128cc58
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x31290443
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.3128e8d4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.3128d578
call fcn.31287ce0
push eax
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.3128d8e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x31290465
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31290490
lea eax, [ebp - 8]
mov edx, dword [0x31290298]
call fcn.312387d0
lea eax, [ebp - 4]
call fcn.31239b5c
ret
Function at 0x312ad018
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x44]
mov edx, 1
call fcn.31286858
mov eax, dword [ebp - 8]
dec dword [eax + 0xc]
mov eax, dword [ebp - 8]
dec dword [eax + 8]
test ebx, ebx
jle 0x312ad064
dec ebx
push ebp
call fcn.312acf54
pop ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_EnumWindows
test ebx, ebx
jg 0x312ad04b
mov eax, dword [ebp - 8]
inc dword [eax + 0xc]
mov eax, dword [ebp - 8]
inc dword [eax + 8]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x312c2770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.31236df0
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_GetKeyNameTextW
shl eax, 0x10
test eax, eax
je 0x312c27b7
push 0x100
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_ClientToScreen
mov eax, ebx
mov edx, esp
mov ecx, 0x100
call fcn.31237000
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x312e0640
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x312e0729
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
lea esi, [eax + 0x4c]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
push 0
call sub.user32.dll_GetKeyState
mov eax, dword [ebp - 4]
inc word [eax + 0x1ac]
xor edx, edx
push ebp
push 0x312e0705
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x40]
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov si, 0xffcc
call fcn.31235348
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1eb], 0
je 0x312e06ef
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c8], 0
je 0x312e06ef
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x60]
push edx
mov edx, dword [ebp - 8]
movzx ecx, byte [eax + 0x5c]
mov edx, dword [ebp - 8]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x312e070c
mov eax, dword [ebp - 4]
call fcn.312dd2c4
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x312e1b98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov edx, esp
mov eax, ebx
call fcn.312d85dc
push 1
push 1
lea eax, [esp + 8]
push eax
call sub.user32.dll_EnumWindows
push 0xffffffffffffffff
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x258]
push eax
call sub.user32.dll_FindWindowExW
add esp, 0x10
pop ebx
ret
Function at 0x312ef480
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
call sub.user32.dll_EnableMenuItem
test ah, 2
je 0x312ef5dd
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
call sub.user32.dll_EnableWindow
mov ecx, dword [ebp - 0x24]
neg ecx
mov edx, dword [ebp - 0x28]
neg edx
lea eax, [ebp - 0x28]
call fcn.3123ab24
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
call sub.user32.dll_EmptyClipboard
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x312ef5d6
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
test bl, bl
je 0x312ef574
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
call sub.user32.dll_EnableMenuItem
test eax, 0x100000
je 0x312ef574
test eax, 0x200000
je 0x312ef574
push 2
call sub.user32.dll_DrawTextW
mov edi, eax
push 3
call sub.user32.dll_DrawTextW
mov ebx, eax
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov edx, dword [ebp - 0xc]
sub edx, ebx
mov eax, dword [ebp - 0x10]
sub eax, edi
mov ecx, dword [ebp - 0x10]
call fcn.3123aa38
push esi
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0xf
call sub.user32.dll_DrawIconEx
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.3123c318
mov eax, dword [ebp - 0x1c]
sub eax, 2
push eax
mov eax, dword [ebp - 0x20]
sub eax, 2
push eax
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
mov eax, dword [ebp - 0x28]
add eax, 2
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_ExcludeClipRect
lea ecx, [ebp - 0x34]
mov dl, 2
mov eax, esi
call fcn.312ee4d8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.312ee1d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x312ef5dd
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.312e1c94
push eax
call sub.user32.dll_GetScrollInfo
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x313078a4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x31445300], 0
je 0x313078b9
mov eax, dword [0x31445300]
push eax
call sub.user32.dll_MapVirtualKeyW
xor eax, eax
mov dword [0x31445300], eax
push 0
push 0x31445304
call fcn.3123bb64
mov dword [esp], eax
cmp dword [esp], 0
je 0x3130791b
mov eax, dword [0x314452fc]
push eax
call fcn.3123bd80
call fcn.3123bba4
cmp eax, dword [0x314452f8]
je 0x31307912
jmp 0x313078f9
mov eax, dword [0x314452e8]
call fcn.3130989c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xc]
push eax
push 1
call sub.user32.dll_GetKeyboardState
test eax, eax
jne 0x313078ef
mov eax, dword [esp]
push eax
call fcn.3123baac
pop edx
ret
Function at 0x31309460
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
cmp dword [ebx + 0xb8], 0
je 0x313094a5
mov eax, dword [esi]
push eax
call sub.user32.dll_GetClipboardData
test eax, eax
je 0x31309492
push esi
mov eax, dword [ebx + 0xb8]
push eax
call sub.user32.dll_GetActiveWindow
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x313094a5
push esi
mov eax, dword [ebx + 0xb8]
push eax
call sub.user32.dll_GetCapture
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret

Function at 0x313094f8
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x313095e6
cmp eax, 0x109
ja 0x313095e6
call fcn.3123c340
mov ebp, eax
test ebp, ebp
jne 0x313095a8
mov ebp, dword [esi]
mov eax, dword [edi + 0x44]
test eax, eax
je 0x3130954b
cmp ebp, dword [eax + 0x37c]
jne 0x3130954b
call fcn.312e1c94
mov ebp, eax
jmp 0x31309560
push ebp
call sub.user32.dll_DestroyWindow
mov ebp, eax
mov eax, ebp
call fcn.312d52a8
test al, al
jne 0x3130955a
test ebp, ebp
jne 0x31309543
test ebp, ebp
jne 0x31309560
mov ebp, dword [esi]
push ebp
call sub.user32.dll_GetClipboardData
test eax, eax
je 0x31309589
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetSysColorBrush
test eax, eax
je 0x313095e6
mov bl, 1
jmp 0x313095e6
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetSystemMenu
test eax, eax
je 0x313095e6
mov bl, 1
jmp 0x313095e6
push esp
push ebp
call sub.user32.dll_EnumThreadWindows
lea eax, [esp + 4]
push eax
mov eax, dword [edi + 0x170]
push eax
call sub.user32.dll_EnumThreadWindows
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jne 0x313095e6
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetSysColorBrush
test eax, eax
je 0x313095e6
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x31309744
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, edx
mov edi, eax
mov byte [esp], 0
push 1
push 0x20e
push 0x200
push 0
push esi
call sub.user32.dll_GetMenuItemID
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x31309785
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_GetMenuItemID
test eax, eax
je 0x31309877
mov ebp, dword [esi]
test ebp, ebp
je 0x31309799
push ebp
call sub.user32.dll_GetClipboardData
test eax, eax
jne 0x31309799
xor eax, eax
jmp 0x3130979b
mov al, 1
mov byte [esp + 2], al
test bl, bl
jne 0x313097d4
cmp byte [esp + 2], 0
je 0x313097c0
push 1
push 0
push 0
push 0
push esi
call sub.user32.dll_GetMenuItemID
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x313097d4
push 1
push 0
push 0
push 0
push esi
call sub.user32.dll_GetMenuItemInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x31309877
mov byte [esp], 1
cmp dword [esi + 4], 0x12
je 0x31309870
mov byte [esp + 1], 0
cmp word [edi + 0x10a], 0
je 0x3130980b
lea ecx, [esp + 1]
mov edx, esi
mov eax, dword [edi + 0x10c]
call dword [edi + 0x108]
mov edx, esi
mov eax, edi
call fcn.3130b5e8
test al, al
jne 0x31309877
mov edx, esi
mov eax, edi
call fcn.313095f0
test al, al
jne 0x31309877
cmp byte [esp + 1], 0
jne 0x31309877
mov edx, esi
mov eax, edi
call fcn.313094a8
test al, al
jne 0x31309877
mov edx, esi
mov eax, edi
call fcn.313094f8
test al, al
jne 0x31309877
mov edx, esi
mov eax, edi
call fcn.31309460
test al, al
jne 0x31309877
push esi
call sub.user32.dll_LoadStringW
cmp byte [esp + 2], 0
je 0x31309868
push esi
call fcn.3123c280
jmp 0x31309877
push esi
call fcn.3123c278
jmp 0x31309877
mov byte [edi + 0xa4], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x31309d44
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.3130b3cc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x31309d74
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x170]
jmp 0x31309d77
mov ebx, dword [ebp - 0x10]
push 2
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x3143f9bc]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x14], eax
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
mov eax, dword [0x3143f9bc]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x31309e0f
mov dword [ebp - 0x48], 0x28
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x3143f7e8]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_EnableWindow
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub ecx, edx
sar ecx, 1
jns 0x31309de9
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
sub edx, eax
sar edx, 1
jns 0x31309dfb
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsWindow
mov eax, dword [ebp - 0x10]
call fcn.312fd2a4
mov dword [ebp - 0x20], eax
call fcn.312fd0f8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.313086ac
test al, al
je 0x31309e34
or esi, 0x100000
xor ecx, ecx
push ebp
push 0x31309ebb
push dword fs:[ecx]
mov dword fs:[ecx], esp
push esi
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31309ec2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x31309ea1
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
sub ecx, edx
sar ecx, 1
jns 0x31309e7b
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
sub edx, eax
sar edx, 1
jns 0x31309e8d
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_IsWindow
mov eax, dword [ebp - 0x20]
call fcn.312fd368
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetSystemMetrics
mov eax, dword [ebp - 0x1c]
call fcn.312fd100
ret
Function at 0x3130b654
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, eax
mov byte [ebx + 0x34], 0
mov eax, dword [0x314452ec]
mov eax, dword [eax + 0x68]
mov esi, dword [ebx + 0x44]
cmp eax, esi
je 0x3130b689
test esi, esi
je 0x3130b689
cmp byte [esi + 0x29e], 2
je 0x3130b689
mov eax, esi
call fcn.312e1c94
mov edx, 9
call fcn.3130797c
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetSystemMetrics
mov eax, ebx
call fcn.313083c8
mov dl, 1
mov eax, ebx
call fcn.31308528
mov eax, dword [0x314452ec]
mov esi, dword [eax + 0x60]
test esi, esi
je 0x3130b6be
mov eax, esi
call fcn.312e1c94
push eax
call sub.user32.dll_GetWindowTextW
cmp word [ebx + 0x152], 0
je 0x3130b6d6
mov edx, ebx
mov eax, dword [ebx + 0x154]
call dword [ebx + 0x150]
pop esi
pop ebx
ret

Function at 0x3130f770
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x31445318
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x3130f792
shr eax, 1
xor eax, 0xedb88320
jmp 0x3130f794
shr eax, 1
dec edx
jne 0x3130f780
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x3130f779
mov byte [0x31445718], 1
pop esi
pop ebx
ret

Function at 0x3130f7b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x31445718], 0
jne 0x3130f7c7
call fcn.3130f770
mov eax, edi
dec eax
test eax, eax
jl 0x3130f7ef
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x31445318]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x3130f7d1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x31312598
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x31312632.0
jmp dword [ecx*4 + 0x313125cb]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x313125fd
sub dl, 8
je 0x3131260c
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312240
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312298
jmp case.0x31312632.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x31312632.0
movzx ecx, byte [ecx + 0x31312639]
jmp dword [ecx*4 + 0x3131264a]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312344
jmp case.0x31312632.0
cmp dl, 3
jne 0x31312677
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x3131239c
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312358
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x313123e0
jmp case.0x31312632.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x313126a2
sub dl, 8
je 0x313126ae
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x3131240c
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312478
jmp case.0x31312632.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x313126cd
sub dl, 8
je 0x313126d9
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x31312534
jmp case.0x31312632.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x3131255c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x3131277b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.31311744
test eax, eax
je 0x3131277b
mov eax, ebx
call fcn.31312784
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x31312714
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x31312784
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x313127b5
dec al
je 0x313127f0
dec al
je 0x31312835
dec al
je 0x3131289e
jmp 0x31312928
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x31312928
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x313127c5
jmp 0x31312928
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x31312928
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x31312800
jmp 0x31312928
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x31312928
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x31312864
xor ebp, ebp
jmp 0x31312874
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x3131287d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x31312845
jmp 0x31312928
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x31312928
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x313128f7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.3130f7f8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x313128b2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret