joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009baf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1009ba40
add esp, 0x18
test eax, eax
je 0x1009bb19
inc eax
cmp byte [eax], 0xcc
je 0x1009bb13
pop ebp
ret

Function at 0x1009bd20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1009bc60
add esp, 0x18
test eax, eax
je 0x1009bd49
inc eax
cmp byte [eax], 0xcc
je 0x1009bd43
pop ebp
ret

Function at 0x100b5f08
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100eb452
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100eb112
Function at 0x401530
Capabilities:
Encrypt data using rc4 prga
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x458d24], 0
je 0x40159d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [0x457004]
add ecx, dword [ebp + 0xc]
cmp ecx, dword [0x457008]
jl 0x401565
mov edx, dword [0x457008]
sub edx, dword [0x457004]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jle 0x401595
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [section..data]
add ecx, dword [0x457004]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042e9d0
add esp, 0xc
mov eax, dword [0x457004]
add eax, dword [ebp - 8]
mov dword [0x457004], eax
mov eax, dword [ebp - 8]
jmp 0x40165f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0042dfca
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [0x458fc4], 0
je 0x40165c
cmp dword [ebp - 8], 0
jle 0x40165c
mov ecx, dword [0x458fd8]
add ecx, dword [0x458fc8]
and ecx, 0xff
mov dword [ebp - 0x14], ecx
mov edx, dword [0x458fdc]
add edx, dword [0x458fcc]
and edx, 0xff
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x40160f
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jge 0x40165c
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
xor edx, dword [ebp - 0x14]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 0x18]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
movzx edx, byte [0x458fe0]
add edx, ecx
mov byte [0x458fe0], dl
mov eax, dword [ebp - 0xc]
mov cl, byte [0x458fe0]
mov byte [eax], cl
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x401606
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x401690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401d90
add esp, 4
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x4016bc
mov dword [ebp - 8], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
cmp dword [0x458d24], 0
je 0x401702
mov eax, dword [ebp + 8]
push eax
call fcn.00401490
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [0x457004], ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0xc], eax
call fcn.00401670
mov eax, dword [ebp - 0xc]
jmp 0x401829
cmp dword [0x458d20], 0
je 0x4017b1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b90
add esp, 4
test eax, eax
jne 0x4017b1
mov edx, dword [0x458fbc]
mov dword [ebp - 0x10], edx
mov eax, dword [0x458fe4]
push eax
call fcn.0042dc95
add esp, 4
push 0x447450
push 0x458db0
call fcn.0042e81b
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40175d
or eax, 0xffffffff
jmp 0x401829
push 0
mov ecx, dword [0x458fb8]
add ecx, dword [0x458fc0]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042e105
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jge 0x401789
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00401530
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call fcn.0042dc95
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x401829
push 0x447458
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
call fcn.0042e81b
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
push edx
call fcn.0042c380
add esp, 4
cmp dword [ebp - 4], 0
jne 0x4017e9
or eax, 0xffffffff
jmp 0x401829
cmp dword [ebp + 0x14], 0
jl 0x401801
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042e105
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042dfca
add esp, 0x10
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call fcn.0042dc95
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0x8000
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401d90
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401830
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40197f
mov eax, 1
jmp 0x401a6f
push 0x44747c
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042c300
add esp, 8
push eax
call fcn.0042e81b
add esp, 8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0042c380
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x4019bc
mov eax, 1
jmp 0x401a6f
mov edx, dword [ebp + 8]
push edx
call fcn.00401490
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042e932
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, 1
test ecx, ecx
je 0x401a43
cmp dword [ebp - 4], 0
jne 0x4019eb
jmp 0x401a43
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jge 0x4019fb
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x401a01
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00401530
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0042e6dd
add esp, 0x10
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jge 0x401a38
jmp 0x401a43
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4019da
call fcn.00401670
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0042dc95
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.0042e8fa
add esp, 4
cmp dword [ebp - 4], 0
je 0x401a6d
mov eax, 1
jmp 0x401a6f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4195c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xa
mov eax, dword [ebp + 0x10]
and eax, 2
je 0x4195ea
mov dword [ebp - 8], 2
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x4196a7
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.0042f4a0
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0xc
mov ecx, dword [0x45a040]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042c300
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c300
add esp, 8
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x41968a
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.0042c380
add esp, 4
mov dword [ebp - 0x14], 0xe
push 0x45478c
lea ecx, [ebp - 0x14]
push ecx
call fcn.0042f6e4
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.0042c380
add esp, 4
jmp 0x419775
mov ecx, dword [ebp + 0x10]
and ecx, 0x10
je 0x4196e9
mov edx, dword [ebp - 8]
push edx
push 0x4476f8
push 0x4476fc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
jmp 0x41975a
mov eax, dword [ebp + 0x10]
and eax, 0x20
je 0x41972e
mov ecx, dword [ebp - 8]
push ecx
push 0x447700
push 0x447704
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c300
add esp, 8
push eax
push str.print
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 4]
push ecx
call fcn.0042c380
add esp, 4
jmp 0x41975a
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042c300
add esp, 8
push eax
call fcn.00419a50
add esp, 8
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
call fcn.0042c380
add esp, 4
cmp dword [ebp - 0x10], 0x20
jge 0x419775
mov dword [ebp - 0x18], 0xe
push 0x45478c
lea eax, [ebp - 0x18]
push eax
call fcn.0042f6e4
mov esp, ebp
pop ebp
ret

Function at 0x4199e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [0x45a038]
call fcn.00425390
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4199fc
jmp 0x419a44
mov dword [ebp - 8], 1
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x419a1a
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [0x45a038]
call fcn.0041d8a0
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x128], 0
je 0x419a44
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00420450
mov esp, ebp
pop ebp
ret
Function at 0x419a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
mov ax, word [ebp + 0xc]
mov word [ebp - 0x24], ax
xor ecx, ecx
mov word [ebp - 0x22], cx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, 0x20
mov esp, ebp
pop ebp
ret

Function at 0x419b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x45a044]
mov ecx, dword [eax + 0x338]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 5
ja case.default.0x419b4a
mov eax, dword [ebp - 8]
jmp dword [eax*4 + 0x419cbc]
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.00432ae5
add esp, 8
jmp 0x419c5e
push 0x104
lea edx, [ebp - 0x42c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x20
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0042ca40
add esp, 0xc
jmp 0x419c5e
push 0x104
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x419c5e
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x419c5e
mov ecx, dword [0x45a044]
mov edx, dword [ecx + 0x368]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x45a044]
add ecx, 0x338
push ecx
call fcn.0040eeb0
add esp, 8
mov edx, dword [0x45a044]
mov eax, dword [edx + 0x338]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x419cb6
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov byte [eax + edx], 0
mov eax, dword [ebp - 4]
jmp 0x419cb6
mov ecx, dword [ebp + 8]
and ecx, 0x10000
je 0x419c49
push 0
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x419c5e
mov dword [ebp - 0x14], 3
push 0x45478c
lea ecx, [ebp - 0x14]
push ecx
call fcn.0042f6e4
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
call fcn.0042c3a0
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [0x45a044]
add edx, 0x338
push edx
call fcn.0040eeb0
add esp, 8
lea eax, [ebp - 0xc]
push eax
call fcn.0042c420
add esp, 4
mov ecx, dword [0x45a044]
mov edx, dword [ecx + 0x338]
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.0042d320
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41d010
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 8], 4
jl 0x41d036
cmp dword [ebp + 8], 0xb
jg 0x41d036
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [0x45a040]
mov edx, dword [ecx + 0x34]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
ja case.default.0x41d049
mov ecx, dword [ebp - 8]
jmp dword [ecx*4 + 0x41d258]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x1c]
jmp 0x41d254
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x18]
jmp 0x41d254
mov ecx, dword [0x45a038]
call fcn.00425390
jmp 0x41d254
mov eax, dword [0x45a050]
jmp 0x41d254
mov eax, dword [ebp - 0x2c]
jmp 0x41d254
mov eax, dword [ebp - 0x28]
jmp 0x41d254
mov eax, dword [ebp - 0x24]
jmp 0x41d254
mov eax, dword [ebp - 0x20]
jmp 0x41d254
mov ecx, dword [0x45a040]
mov eax, dword [ecx + 0x5c]
jmp 0x41d254
mov edx, dword [0x45a040]
mov eax, dword [edx + 0x60]
jmp 0x41d254
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
jmp 0x41d254
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
jmp 0x41d254
mov eax, dword [0x45a040]
cmp dword [eax + 0x44], 1
je case.0x41d049.26
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
mov ecx, dword [0x45a040]
call fcn.00422de0
mov eax, dword [ebp - 4]
jmp 0x41d254
mov eax, dword [0x45a040]
mov eax, dword [eax + 4]
jmp 0x41d254
mov ecx, dword [0x45a040]
cmp dword [ecx + 0x44], 1
je case.0x41d049.27
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x45a040]
call fcn.00422de0
mov eax, dword [ebp - 0xc]
jmp 0x41d254
mov ecx, dword [0x45a040]
mov eax, dword [ecx + 8]
jmp 0x41d254
mov edx, dword [0x45a040]
mov eax, dword [edx + 0x130]
jmp 0x41d254
mov eax, dword [0x45a040]
mov eax, dword [eax + 0x134]
jmp 0x41d254
mov ecx, dword [0x45a040]
mov edx, dword [ecx + 0xa0]
and edx, 0xff
movzx eax, dl
jmp 0x41d254
mov eax, dword [0x45a040]
movzx ecx, word [eax + 0xa0]
sar ecx, 8
and ecx, 0xff
movzx eax, cl
jmp 0x41d254
mov edx, dword [0x45a040]
mov eax, dword [edx + 0xa0]
shr eax, 0x10
and eax, 0xff
movzx eax, al
jmp 0x41d254
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
push 0x26
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
and eax, 0x100
je 0x41d1e8
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 4]
jmp 0x41d254
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x41d254
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x41d254
mov eax, dword [0x45a040]
mov eax, dword [eax + 0x6c]
jmp 0x41d254
mov ecx, dword [0x45a040]
mov eax, dword [ecx + 0x70]
jmp 0x41d254
mov edx, dword [0x45a044]
mov eax, dword [edx + 0x324]
jmp 0x41d254
mov ecx, dword [0x45a038]
call fcn.00425470
jmp 0x41d254
mov dword [ebp - 0x14], 0x15
push 0x45478c
lea eax, [ebp - 0x14]
push eax
call fcn.0042f6e4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41df50
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov edx, dword [0x45a0ac]
mov eax, dword [edx + 0x30c]
and eax, 2
je 0x41e020
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x200
jne 0x41dff6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 8], ecx
cmp dword [0x45a0c0], 0
jne 0x41dfe5
mov edx, dword [0x45a0c4]
cmp edx, dword [ebp - 4]
jne 0x41dfce
mov eax, dword [0x45a0c8]
cmp eax, dword [ebp - 8]
je 0x41dfe3
mov dword [ebp - 0xc], 0
push 0x45478c
lea ecx, [ebp - 0xc]
push ecx
call fcn.0042f6e4
jmp 0x41dff6
mov edx, dword [ebp - 4]
mov dword [0x45a0c4], edx
mov eax, dword [ebp - 8]
mov dword [0x45a0c8], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0x100
jne 0x41e020
cmp dword [0x45a0c0], 0
jne 0x41e020
mov dword [ebp - 0x10], 0
push 0x45478c
lea edx, [ebp - 0x10]
push edx
call fcn.0042f6e4
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x41e070
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 9
jne 0x41e03a
call fcn.004199e0
push 2
call fcn.00404d40
add esp, 4
test eax, eax
je 0x41e070
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push 2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 2
call fcn.00404db0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x421060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jge 0x421092
jmp 0x42113a
mov ecx, dword [ebp + 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x150]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.00424eb0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
je 0x4210cd
cmp dword [ebp - 0x10], 2
je 0x4210e3
jmp 0x4210f9
mov ecx, dword [ebp - 4]
movsx edx, word [ecx + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 0xa]
mov dword [ebp - 0xc], ecx
jmp 0x42110c
mov edx, dword [ebp - 4]
movsx eax, word [edx + 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
movsx edx, word [ecx + 6]
mov dword [ebp - 0xc], edx
jmp 0x42110c
mov eax, dword [ebp - 4]
movsx ecx, word [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
movsx eax, word [edx + 2]
mov dword [ebp - 0xc], eax
push 0xcc0020
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 2]
and edx, 0x200
je 0x421176
push 0xfffffffffffffffd
push 0xfffffffffffffffd
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x138]
push eax
push 0xff
push 0xd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x25
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.0042c300
add esp, 8
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
lea ecx, [ebp - 0x14]
push ecx
call fcn.0042c380
add esp, 4
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x10], ecx
push 0x4478b4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042c300
add esp, 8
push eax
call fcn.0042e81b
add esp, 8
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0042c380
add esp, 4
cmp dword [ebp - 8], 0
jne 0x422d44
or eax, 0xffffffff
jmp 0x422dcc
mov edx, 0x4d42
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x10]
lea eax, [ecx + edx + 0xe]
mov dword [ebp - 0x1e], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c]
add edx, 0xe
mov dword [ebp - 0x16], edx
xor eax, eax
mov word [ebp - 0x1a], ax
xor ecx, ecx
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
push edx
push 0xe
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.0042e6dd
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call fcn.0042e6dd
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
call fcn.0042e6dd
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
call fcn.0042dc95
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4