joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf73a7f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
movzx eax, word [esp + 0xc]
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push esi
push edi
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0xf74e1aa
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0xf73a91a
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0xf73a91a
push esi
push dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x28
jne 0xf73a91a
cmp word [ecx + 0xe], 4
jne 0xf73a91a
cmp dword [ecx + 0x20], 0
jne 0xf73a91a
mov dword [ebp - 8], 0x10
lea edx, [ecx + 0x28]
jmp 0xf73a8b7
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + esi*8 + 4]
movzx ecx, bh
movzx eax, bl
shl ecx, 8
shl eax, 0x10
shr ebx, 0x10
or ecx, eax
movzx eax, bl
or ecx, eax
mov dword [edx], ecx
add edx, 4
dec dword [ebp - 8]
je 0xf73a8e8
xor esi, esi
cmp dword [ebp + 0x14], esi
jle 0xf73a8af
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edi, ch
movzx ebx, cl
shl edi, 8
shl ebx, 0x10
shr ecx, 0x10
or edi, ebx
movzx ebx, cl
or edi, ebx
cmp edi, dword [edx]
je 0xf73a890
add eax, 8
inc esi
cmp esi, dword [ebp + 0x14]
jl 0xf73a8c1
jmp 0xf73a8af
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xf73a911
push 0
mov eax, dword [ebp - 4]
push dword [ebp - 4]
add eax, 0x68
push eax
push 4
push dword [ebp - 4]
push esi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x10], eax
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 4], 0
je 0xf73a929
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0xf73a938
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x10], 0
je 0xf74e1b1
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
jmp 0xf73a945
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadBitmapA]
jmp 0xf73a945

Function at 0xf745509
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0xf745544
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xf74552b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0xf74553c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0xf745546
inc edi
add eax, 0x28
cmp edi, esi
jb 0xf745521
xor eax, eax
pop edi
pop esi
ret
Function at 0xf75670e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
call ebx
mov esi, eax
push 1
push esi
mov eax, dword [0xf7b8990]
push eax
call fcn.0f72c825
push eax
mov edi, eax
push esi
call ebx
sub eax, esi
cmp eax, 0xffffffff
jne 0xf756766
mov al, byte [edi]
mov byte [ebp - 2], al
push edi
call fcn.0f72c7eb
push 0
lea eax, [ebp - 2]
mov byte [ebp - 1], 0
push eax
push dword [ebp + 8]
call fcn.0f7564d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 2], 0x63
jmp 0xf756745

Function at 0xf756812
Capabilities:
Get disk information

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0xf75683d
cmp eax, 2
je 0xf756841
cmp eax, 4
je 0xf756848
cmp eax, 5
je 0xf75684f
cmp eax, 6
je 0xf756856
mov eax, 4
ret 4
xor eax, eax
jmp 0xf75683a
mov eax, 3
jmp 0xf75683a
mov eax, 6
jmp 0xf75683a
mov eax, 5
jmp 0xf75683a
mov eax, 7
jmp 0xf75683a
Function at 0xf757080
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, 1
mov esi, dword [ebp + 8]
mov edi, esi
cmp byte [esi], 0
je 0xf75713b
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x3a
jne 0xf75713b
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x3a
jne 0xf75714c
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
cmp byte [esi], al
jne 0xf75714c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
test ebx, ebx
je 0xf757275
push dword [ebp + 0xc]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x214]
cmp byte [edi], 0x5c
push eax
jne 0xf757150
call fcn.0f757038
mov byte [eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add ebx, eax
cmp ebx, 0x104
jle 0xf757157
mov eax, 0x17c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [esi], 0x5c
jne 0xf7570e1
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x5c
jne 0xf7570e1
xor ebx, ebx
jmp 0xf7570e1
call fcn.0f73c497
jmp 0xf75710d
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x3a
jne 0xf7571f2
mov al, byte [ebp - 0x214]
push 0
push 0
mov byte [ebp - 0x10c], al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
push 1
push edi
mov eax, dword [0xf7b8990]
push eax
call fcn.0f72c825
push eax
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
sub eax, edi
cmp eax, 0xffffffff
je 0xf7571cf
push 0xf7b8490
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
call edi
test eax, eax
jne 0xf7571e9
mov dword [ebp - 4], 0x44
push ebx
call edi
push ebx
call fcn.0f72c7eb
cmp dword [ebp - 4], 0
jne 0xf75726d
push 0x105
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0f735047
add esp, 0xc
test eax, eax
je 0xf757288
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea ecx, [ebp - 0x10c]
lea eax, [ebp + edi - 0x10c]
push eax
push ecx
call dword [sym.imp.USER32.dll_CharPrevA]
cmp edi, 3
jbe 0xf75725f
cmp byte [eax], 0x5c
jne 0xf757248
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
call fcn.0f760ea3
test eax, eax
jne 0xf75725f
mov dword [ebp - 4], 0x4c
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
jmp 0xf757132
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0xf757165
mov dword [ebp - 4], 0x4c
jmp 0xf75726d
Function at 0xf757fa4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov edx, dword [0xf7b85e0]
push esi
push edi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x34]
test byte [ecx + edx], 4
je 0xf757fc9
push esi
call fcn.0f7594eb
pop edi
pop esi
pop ebx
ret 4
mov edi, dword [esi + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0xf757ff8
mov ebx, dword [esi + 0x114]
push edi
call fcn.0f72610b
movzx eax, ax
shl eax, 9
xor eax, ebx
and eax, 0x600
xor eax, ebx
mov dword [esi + 0x114], eax
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0xf757fc3
Function at 0xf75876d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push 0
push 0
push 0x31
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
test eax, eax
je 0xf7588fd
push eax
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x148]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push eax
push dword [ebp - 8]
push edx
push edi
call ebx
cmp dword [ebp - 0x14], 0
jne 0xf7587e9
lea eax, [ebp - 0x10]
push eax
push 1
push 0xf7b84bc
push edi
call ebx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x48]
push eax
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
add dword [ebp - 0x48], 4
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x48]
add eax, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x44]
dec dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
push 0x10
cdq
sub eax, edx
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
sar eax, 1
add dword [ebp - 0x34], eax
call ebx
push 0xf
lea ecx, [ebp - 0x38]
push eax
push eax
push ecx
push edi
call fcn.0f7385b8
push 1
lea ecx, [ebp - 0x38]
push 1
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x14
call ebx
push 0xf
lea ecx, [ebp - 0x38]
push eax
push eax
push ecx
push edi
call fcn.0f7385b8
push 1
lea ecx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x20]
push eax
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.0f722815
push 2
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [ebp - 0x10], eax
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0xf7588b2
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
push ebx
call fcn.0f7227b8
cmp eax, dword [ebp - 0x1c]
jne 0xf7588aa
push reloc.OLEAUT32.dll_SafeArrayGetDim
push ebx
call fcn.0f7227b8
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x20
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x148]
push dword [ebp - 8]
push edx
push edi
call dword [sym.imp.USER32.dll_DrawTextA]
cmp dword [ebp - 4], 0
je 0xf7588d9
push dword [ebp - 4]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x10]
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
lea ecx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
call fcn.0f722815
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
jmp 0xf7587a2
Function at 0xf7594eb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [esi + 0x2c]
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0xf759712
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x1000000
je 0xf759523
mov edi, 1
mov dword [ebp - 4], edi
push 0
mov eax, dword [0xf7ae160]
push 0
push 0x229
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
jne 0xf759573
push 0
push ebx
push 0x224
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebx, eax
jne 0xf759573
test edi, edi
je 0xf759573
push 0
push ebx
push 0x223
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], 0
cmp dword [0xf7b31d4], 0
jne 0xf75959f
push ebx
call fcn.0f72610b
movzx eax, ax
shl eax, 9
xor eax, dword [esi + 0x114]
and eax, 0x600
xor eax, dword [esi + 0x114]
mov dword [esi + 0x114], eax
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [0xf7ae160]
push 0
push 0x229
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
jne 0xf7596b3
lea eax, [ebp - 0x50]
push eax
push str.VBMDITempChildRT
push dword [0xf7ae6d4]
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0xf75962f
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf7594b0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2c], str.VBMDITempChildRT
mov dword [ebp - 0x3c], 0
mov eax, dword [0xf7ae6d4]
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0xf7ae6d4]
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x28], str.VBMDITempChildRT
mov dword [ebp - 0xc], 0x50000000
push eax
push ebx
push 0x220
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0xf7ae158]
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [0xf7ae158]
push 0x221
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [0xf7ae160]
jne 0xf7596a8
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0xf7ae15c]
push eax
call fcn.0f72a817
mov eax, dword [0xf7ae15c]
push 0
push 1
push 0x1056
mov edx, dword [eax + 0x20]
push dword [eax + 0x2c]
push eax
mov ebx, dword [edx]
call dword [ebx + 8]
test edi, edi
je 0xf759712
mov eax, dword [esi + 0x114]
and ah, 0xfd
or ah, 4
cmp dword [ebp - 4], 0
mov dword [esi + 0x114], eax
je 0xf759712
mov ecx, dword [0xf7ae15c]
mov eax, dword [ecx + 0x174]
test ah, 1
je 0xf759712
or al, 0x40
push 1
push 0
mov dword [ecx + 0x174], eax
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xf759785
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0xf759806
mov eax, dword [ebp + 0xc]
test byte [eax + 0xc0], 0x20
je 0xf759806
push eax
call fcn.0f75971b
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x170]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x18], eax
test eax, eax
mov dword [ebp - 4], 0
jle 0xf759806
mov esi, dword [ebp - 4]
push 0x400
push esi
push ebx
call dword [sym.imp.USER32.dll_GetMenuState]
test ah, 8
mov dword [ebp - 0xc], eax
je 0xf75980f
mov eax, dword [ebp + 0xc]
test byte [eax + 0xc0], 8
je 0xf7597fb
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_AppendMenuA]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jl 0xf7597c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
push eax
mov dword [ebp - 0x10], eax
push dword [0xf7ae160]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0xf7597fb
push 0x400
lea eax, [ebp - 0x218]
push 0x100
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringA]
cmp dword [ebp - 4], 0xa
mov edx, dword [0xf7ae270]
jge 0xf7598ba
lea esi, [ebp - 0x118]
mov edi, 3
push 0xfd
push esi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [ebp - 0x1c], 0
cmp byte [ebp - 0x118], 0
mov edx, dword [0xf7ae270]
je 0xf7598b2
mov ecx, 0x26
cmp edi, 0xff
jae 0xf7598b2
mov al, byte [esi]
mov byte [ebp + edi - 0x218], al
inc edi
cmp byte [esi], cl
jne 0xf7598ac
mov byte [ebp + edi - 0x218], cl
inc edi
inc esi
cmp byte [esi], 0
jne 0xf75988e
mov byte [ebp + edi - 0x218], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 8], eax
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0xf7598da
lea eax, [ebp - 8]
lea edx, [ebp - 0x218]
push eax
push edx
call ecx
add esp, 8
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [ebp - 0x218]
mov eax, dword [0xf7ae270]
cmp dword [ebp - 8], ecx
je 0xf7597fb
mov eax, dword [eax + 0x14]
test eax, eax
je 0xf7597fb
push dword [ebp - 8]
call eax
add esp, 4
jmp 0xf7597fb
Function at 0xf75dbb5
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
xor esi, esi
push ebp
push 0x7f02
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp dword [0xf7b8550], esi
mov dword [0xf7b8560], 1
jne 0xf75dbfe
cmp dword [0xf7ae430], 2
jne 0xf75dbfe
mov dword [0xf7ae240], esi
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ebp, 0x200
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0xf75ddc3
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
mov eax, dword [0xf7b8578]
je 0xf75dc97
cmp dword [esp + 0x18], ebp
jae 0xf75dc43
cmp dword [esp + 0x18], 0x209
ja 0xf75dc97
lea eax, [esp + 0x14]
push eax
call ebx
cmp dword [0xf7b8560], 0
jne 0xf75dc09
cmp dword [0xf7ae430], 2
jne 0xf75dc66
mov dword [0xf7ae240], 1
test esi, esi
je 0xf75de18
push 0
push dword [esp + 0x38]
push dword [0xf7b8554]
call dword [0xf7ae190]
test eax, eax
jne 0xf75de11
call fcn.0f75e224
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret 8
cmp dword [esp + 0x18], 0x100
jne 0xf75dcb7
cmp dword [esp + 0x1c], 0x1b
jne 0xf75dcb7
mov dword [0xf7b8560], 0
mov esi, 0x11f
cmp dword [esp + 0x18], ebp
je 0xf75de05
cmp dword [esp + 0x18], 0x202
je 0xf75de05
cmp dword [esp + 0x18], 0x205
je 0xf75de05
cmp dword [esp + 0x18], 0x208
je 0xf75de05
mov ecx, 0xa0
cmp dword [esp + 0x18], ecx
je 0xf75de05
cmp dword [esp + 0x18], 0xa2
je 0xf75de05
cmp dword [esp + 0x18], 0xa5
je 0xf75de05
cmp dword [esp + 0x18], 0xa8
je 0xf75de05
cmp dword [esp + 0x18], ecx
jb 0xf75dd34
cmp dword [esp + 0x18], 0xa9
jbe 0xf75dd58
cmp dword [esp + 0x18], 0x100
jb 0xf75dd48
cmp dword [esp + 0x18], 0x108
jbe 0xf75dd58
cmp dword [esp + 0x18], ebp
jb 0xf75ddb2
cmp dword [esp + 0x18], 0x209
ja 0xf75ddb2
cmp dword [esp + 0x18], 0x104
jne 0xf75dc4a
cmp dword [esp + 0x1c], 0x12
je 0xf75ddf6
cmp dword [esp + 0x1c], 0x11
je 0xf75ddf6
test eax, eax
je 0xf75dc4a
cmp dword [esp + 0x1c], 0x10
je 0xf75dc4a
mov dword [0xf7b8578], 0
cmp dword [esp + 0x1c], 9
je 0xf75dda3
cmp dword [esp + 0x1c], 0x1b
jne 0xf75ddb2
mov dword [0xf7b8560], 0
mov esi, 0x11f
cmp dword [esp + 0x18], 0x104
je 0xf75ddc3
lea eax, [esp + 0x14]
push eax
call ebx
cmp dword [0xf7b8560], 0
je 0xf75dc53
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, dword [esp + 0x38]
jbe 0xf75dc4a
mov dword [0xf7b8560], 0
mov esi, 0x11e
jmp 0xf75dc4a
mov dword [0xf7b8578], 1
jmp 0xf75dc4a
lea eax, [esp + 0x14]
push eax
call ebx
jmp 0xf75dc4a
mov eax, esi
jmp 0xf75dc8d
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0xf7ae19c]
jmp 0xf75dc8d
Function at 0xf75ea8f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 8
cmp dword [0xf7ae1f4], 0
push esi
mov dword [eax], 0
push edi
jne 0xf75eb1f
mov edi, dword [ebp + 0x14]
cmp edi, 0xa1
je 0xf75eacd
cmp edi, 0xa3
je 0xf75eacd
cmp edi, 0x201
je 0xf75eacd
cmp edi, 0x203
jne 0xf75eb15
mov esi, dword [ebp + 0xc]
test byte [esi + 0x1c], 0x20
je 0xf75eb15
mov ecx, dword [ebp + 0x1c]
movsx eax, cx
shr ecx, 0x10
mov dword [ebp - 8], eax
movsx eax, cx
mov dword [ebp - 4], eax
cmp edi, 0x201
je 0xf75eaf8
cmp edi, 0x203
jne 0xf75eb02
lea eax, [ebp - 8]
push eax
push esi
call fcn.0f73b4cd
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.0f75eeaf
mov eax, 1
jmp 0xf75eb17
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.0f75c95a
mov edi, dword [ebp + 0x14]
cmp eax, dword [0xf7b85c8]
je 0xf75eb37
cmp edi, 0x215
jne 0xf75eb55
mov esi, dword [ebp + 0xc]
cmp dword [0xf7b85c8], esi
jne 0xf75eb60
cmp edi, 0x1012
je 0xf75eb4f
cmp edi, 0x1f
jne 0xf75eb60
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
call fcn.0f75f2bb
xor eax, eax
jmp 0xf75eb17
cmp edi, 0x14
ja 0xf75eb78
je 0xf75ebb1
cmp edi, 0xf
je 0xf75ebb1
cmp dword [0xf7b85c8], esi
je 0xf75ebc1
xor eax, eax
jmp 0xf75eb17
cmp edi, 0x85
je 0xf75ebb1
cmp edi, 0x88
je 0xf75ebb1
cmp edi, 0x100
jb 0xf75eb6c
cmp edi, 0x102
jbe case.0xf75ec10.513
cmp edi, 0x104
jb 0xf75eb6c
cmp edi, 0x106
ja 0xf75eb6c
jmp case.0xf75ec10.513
cmp dword [0xf7ae1f8], 0
je 0xf75eb6c
call fcn.0f75ee19
jmp 0xf75eb6c
mov ecx, dword [ebp + 0x1c]
movsx eax, cx
shr ecx, 0x10
mov dword [ebp - 8], eax
movsx eax, cx
mov dword [ebp - 4], eax
cmp edi, 0xa0
ja 0xf75ebe9
je 0xf75ec2b
cmp edi, 0x20
je 0xf75ec17
xor eax, eax
jmp 0xf75eb17
cmp edi, 0x200
ja 0xf75ec05
je 0xf75ec21
sub edi, 0xa1
cmp edi, 8
ja case.default.0xf75ec10
jmp dword [edi*4 + 0xf75eca0]
sub edi, 0x201
cmp edi, 8
ja case.default.0xf75ec10
jmp dword [edi*4 + 0xf75ecc4]
call fcn.0f75ecfc
jmp 0xf75eb17
lea eax, [ebp - 8]
push eax
push esi
call fcn.0f73b4cd
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0f75efff
jmp case.0xf75ec10.513
lea eax, [ebp - 8]
push eax
push esi
call fcn.0f73b4cd
push 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
test ax, ax
jl case.0xf75ec10.513
push 4
call esi
test ax, ax
jl case.0xf75ec10.513
push 2
call esi
test ax, ax
jl case.0xf75ec10.513
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0f75f232
jmp case.0xf75ec10.513
Function at 0xf75f3e1
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
sub esp, 8
cmp dword [eax], 1
push esi
mov si, word [eax + 4]
push edi
jne 0xf75f3fa
mov si, 1
movzx eax, si
test eax, eax
jl 0xf75f40b
cmp eax, 1
jle 0xf75f418
cmp eax, 2
je 0xf75f465
mov eax, 5
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0xf7ae1f4], 0
je 0xf75f428
push 1
call fcn.0f75f2bb
cmp si, 1
jne 0xf75f461
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x2c]
call fcn.0f75c9ce
push edi
push esi
call fcn.0f72b9d4
test eax, eax
je 0xf75f44b
mov eax, 0x16c
jmp 0xf75f410
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.0f75eeaf
xor eax, eax
jmp 0xf75f410
cmp dword [0xf7ae1f4], 0
je 0xf75f461
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0f75f232
jmp 0xf75f461

Function at 0xf75fd1d
Capabilities:
Read .ini file

Disassembly:
push esi
mov eax, dword [0xf7b8990]
push edi
push 0
push 0x100
push eax
call fcn.0f72c825
mov edi, eax
push str.WINHELP.INI
push 0xff
push edi
push 0xf7b9530
push str.VB.HLP
push str.FILES
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0xf75fd96
mov ecx, dword [esp + 0xc]
push 0xf7ae230
call fcn.0f760f03
mov esi, eax
push edi
call fcn.0f72c7eb
test esi, esi
je 0xf75fd88
mov ecx, dword [esp + 0xc]
push str.VB.HLP
call fcn.0f76101c
test eax, eax
mov eax, 1
jne 0xf75fd91
push 7
call fcn.0f782944
xor eax, eax
pop edi
pop esi
ret 4
mov ecx, dword [esp + 0xc]
push edi
call fcn.0f733fd2
jmp 0xf75fd65

Function at 0xf760ea3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0xf760ebb
test al, 0x10
mov eax, 1
jne 0xf760ebd
xor eax, eax
ret 4