joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e02
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x48]
mov dword [esp + 4], 0x40c032
lea eax, [ebp - 0x38]
mov dword [esp], eax
call fcn.00401330
cmp word [ebx], 0
je 0x401e8c
cld
mov dword [ebp - 0x44], ebx
movzx eax, word [ebx]
add ebx, 2
test ax, ax
jne 0x401e4c
mov esi, dword [ebp - 0x44]
lea edi, [ebp - 0x38]
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
seta dl
setb al
cmp dl, al
jne 0x401e86
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x401ec0
cmp word [ebx], 0
jne 0x401e49
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x18]
cmp eax, dword [edx + 8]
jne 0x401eac
mov eax, dword [ecx + 0x28]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x401ec0
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
jne 0x401e8c
mov eax, 0
add esp, 0x44
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402594
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, esi
add eax, dword [esi + 0x3c]
mov edi, esi
add edi, dword [eax + 0x78]
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004024de
test eax, eax
jne 0x402603
mov ebx, 0
cmp ebx, dword [edi + 0x18]
jae 0x402620
lea eax, [ebx*4]
add eax, dword [edi + 0x20]
mov edx, dword [eax + esi]
lea eax, [esi + edx]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004024de
test eax, eax
je 0x40261a
lea eax, [ebx + ebx]
add eax, dword [edi + 0x24]
movzx eax, word [eax + esi]
shl eax, 2
add eax, dword [edi + 0x1c]
add esi, dword [eax + esi]
mov eax, esi
jmp 0x402625
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x4025e0
mov eax, 0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4027dc
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov edx, ebx
and edx, 0x2cc2e3a3
mov eax, dword [0x409028]
xor eax, dword [ebp + 0x1c]
or edx, eax
mov dword [esp + 0xc], 0x446c31e8
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.00405e0a
mov eax, dword [0x40900c]
mov dword [esp], eax
call sub.USER32.dll_OpenClipboard
sub esp, 4
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00406409
call fcn.00403fc3
mov dword [esp], 0x75dcdff
call fcn.004021e0
call fcn.00403fc3
mov dword [esp + 4], eax
mov dword [esp], 0x4cb38da0
call fcn.004057f6
mov edx, eax
mov eax, esi
and eax, 0x6d551006
xor eax, edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40286e
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
mov eax, 0x4e293b9c
mov edi, eax
sub edi, ebx
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.USER32.dll_SetCursorPos
sub esp, 8
mov dword [esp], ebx
call fcn.00404974
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0xbfb00e3
mov eax, dword [0x409008]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00406571
mov esi, eax
mov dword [esp], ebx
call sub.USER32.dll_OpenClipboard
sub esp, 4
mov dword [esp], 0x11c47fe9
call fcn.0040595e
mov dword [esp], eax
call sub.USER32.dll_GetDC
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [0x409024]
mov dword [esp], eax
call fcn.00404679
mov eax, dword [0x409024]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x38ef8fca
mov dword [esp], 0x34023203
call fcn.00401925
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x402ead
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
inc ecx
mov dl, al
inc dl
mov al, dl
xor al, byte [ecx]
inc ecx
mov byte [ebx], al
inc ebx
test al, al
jne 0x402ebd
pop ebx
pop ebp
ret
Function at 0x402f3e
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0x10]
mov ebx, esi
imul ebx, dword [0x409020]
add ebx, dword [ebp + 0xc]
mov eax, dword [0x40901c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040209a
mov edi, eax
mov dword [esp + 0x10], 0x1a84fdab
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov eax, dword [0x40901c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.USER32.dll_CheckMenuRadioItem
sub esp, 0x14
mov dword [esp], 0x3e9b5cbd
call fcn.00402314
mov eax, dword [0x409024]
mov dword [esp], eax
call sub.USER32.dll_GetClipboardData
sub esp, 4
mov eax, dword [0x409018]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040302b
mov edi, dword [ebp + 0xc]
imul edi, dword [0x40900c]
or edi, dword [0x409008]
mov dword [esp], edi
call sub.USER32.dll_IsWindow
sub esp, 4
call fcn.00405b0c
call sub.USER32.dll_GetActiveWindow
mov eax, dword [ebp + 8]
or eax, 0x636e2968
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x403181
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov ecx, dword [0x409020]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
sub edx, dword [edx + 0x1c]
mov dword [ebp - 0x1c], edx
mov ebx, dword [ebp - 0x10]
add ebx, dword [ebx + 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
add ecx, ebx
mov dword [ebp - 0x20], ecx
mov esi, ebx
cmp ebx, ecx
je 0x4031cf
imul eax, eax, 0x19660d
add eax, 0x3c6ef35f
xor byte [esi], al
inc esi
cmp esi, dword [ebp - 0x20]
jne 0x4031bc
cmp ebx, dword [ebp - 0x20]
jae 0x403245
mov edi, dword [ebx]
cmp dword [0x409020], 0x17a90948
jne 0x403208
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov eax, dword [0x40901c]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401966
add ebx, 4
mov eax, dword [ebx]
sub eax, 8
add ebx, 4
lea edx, [ebx + eax]
cmp ebx, edx
jae 0x403240
movzx eax, word [ebx]
shr eax, 0xc
je 0x403239
cmp eax, 3
je 0x403228
int3
movzx eax, word [ebx]
and eax, 0xfff
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add dword [eax + edi], ecx
add ebx, 2
cmp ebx, edx
jb 0x40321a
cmp ebx, dword [ebp - 0x20]
jb 0x4031d4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403814
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [esi]
cmp ebx, esi
je 0x403873
test edi, edi
jne 0x403854
mov dword [esp], ebx
call fcn.0040324d
test eax, eax
je 0x403854
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x403873
cmp edi, 1
jne 0x40386d
mov dword [esp], ebx
call fcn.0040369e
test eax, eax
je 0x40386d
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x10], ebx
jmp 0x403873
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x40383c
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404629
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp + 0x14], 0x51bba816
mov dword [esp + 0x10], 0x51bba816
mov dword [esp + 0xc], 0xa34489e6
mov dword [esp + 8], 0x475d675f
mov dword [esp + 4], 0x68e2c1f2
mov eax, dword [0x409010]
mov dword [esp], eax
call fcn.004045b8
mov ebx, eax
mov dword [esp], eax
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4047eb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x7591b48b
call sub.USER32.dll_VkKeyScanW
sub esp, 4
mov edx, eax
mov eax, dword [0x409004]
mov dword [esp + 0x10], eax
mov eax, dword [0x409020]
mov dword [esp + 0xc], eax
mov eax, dword [0x409018]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0xa8447bd
call fcn.00405186
call fcn.004048b9
mov dword [esp], 0x6a4ec9ae
call sub.USER32.dll_DestroyIcon
sub esp, 4
call sub.USER32.dll_GetFocus
call fcn.00404f4f
mov dword [esp + 4], 0x37978590
mov dword [esp], eax
call sub.USER32.dll_GetSubMenu
sub esp, 8
add eax, dword [0x409020]
leave
ret

Function at 0x404974
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov esi, eax
and esi, dword [section..data]
xor esi, eax
mov dword [esp], eax
call sub.USER32.dll_OpenClipboard
sub esp, 4
mov eax, dword [0x409014]
mov dword [esp + 4], eax
mov dword [esp], 0xf34407
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 4], 0x2cdb485c
mov eax, dword [0x409010]
mov dword [esp], eax
call sub.USER32.dll_WindowFromPoint
sub esp, 8
mov dword [esp], esi
call sub.USER32.dll_DestroyWindow
sub esp, 4
mov esi, eax
mov dword [esp + 4], eax
mov eax, dword [0x409010]
mov dword [esp], eax
call fcn.0040426e
mov dword [esp + 0xc], 0x6a38293d
mov eax, dword [0x409010]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5b6eb79f
mov dword [esp], esi
call sub.USER32.dll_GetMessageW
sub esp, 0x10
mov ebx, eax
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 0xc], eax
mov eax, dword [0x40901c]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 0x516948da
call sub.USER32.dll_DrawFrameControl
sub esp, 0x10
or ebx, dword [0x409010]
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x404c23
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov dword [esp + 4], 0x7b9f3458
mov dword [esp], 0x4922d1a1
call sub.USER32.dll_GetWindowRect
sub esp, 8
mov eax, dword [0x409028]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [0x409024]
mov dword [esp + 4], eax
mov eax, dword [0x40900c]
mov dword [esp], eax
call fcn.00404b82
mov edi, eax
call fcn.00406014
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_SetMenu
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00405744
mov esi, eax
mov dword [esp + 8], 0x21848b9b
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_SetWindowLongW
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
mov dword [esp + 0x10], 0x576f2bb
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x70c5c691
mov dword [esp + 4], esi
mov dword [esp], 0x711aefb
call fcn.00404cfc
imul eax, eax, 0x5c9ea5c
add eax, esi
add eax, dword [section..data]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404f4f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x82bd4460
mov dword [esp + 0xc], 0x82bd4460
mov dword [esp + 8], 0x82bd4460
mov dword [esp + 4], 0x82bd4460
mov dword [esp], 0x82bd4460
call sub.USER32.dll_InsertMenuW
sub esp, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [0x409010]
mov dword [esp + 4], eax
mov eax, dword [0x40900c]
mov dword [esp], eax
call sub.USER32.dll_RegisterHotKey
sub esp, 0x10
mov edx, eax
mov eax, dword [0x40900c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004040e3
mov edx, eax
sub eax, dword [0x409018]
add edx, eax
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], edx
call sub.USER32.dll_GetClipboardFormatNameW
sub esp, 0xc
mov dword [esp + 0x10], 0x253c35ce
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00406199
mov edx, eax
imul edx, eax
mov dword [esp], edx
call fcn.00404974
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0x553b4d77
call sub.USER32.dll_RemoveMenu
sub esp, 0xc
mov dword [esp], 0x2f0a465b
call sub.USER32.dll_VkKeyScanW
sub esp, 4
mov eax, 0x47462d82
leave
ret
Function at 0x40520c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov eax, dword [0x409020]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x3c29a286
mov dword [esp], ebx
call fcn.004040e3
mov edi, ebx
or edi, 0x58a822a6
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x194bda24
mov dword [esp], ebx
call fcn.00405a69
mov eax, dword [0x409024]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040209a
mov dword [esp + 4], 0x4907b88f
mov dword [esp], ebx
call sub.USER32.dll_SetMenu
sub esp, 8
mov edi, eax
and edi, 0x5d02036a
or edi, ebx
or edi, 0x5193c978
call fcn.0040387e
mov dword [esp + 4], edi
mov dword [esp], 0x416b883f
call sub.USER32.dll_EnumWindows
sub esp, 8
mov edi, eax
call fcn.00404f4f
mov dword [esp], esi
call sub.USER32.dll_GetWindowDC
sub esp, 4
mov dword [esp + 4], edi
mov eax, dword [0x40901c]
mov dword [esp], eax
call sub.USER32.dll_LoadCursorW
sub esp, 8
mov eax, dword [0x409020]
sub eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40544d
Capabilities:
Get graphical window text
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0x5d1da22a
mov edi, 0x52d59c60
mov eax, dword [0x409024]
mov dword [esp], eax
call sub.USER32.dll_GetClipboardData
sub esp, 4
call fcn.0040544d
mov dword [esp + 0x10], 0x7482636d
mov dword [esp + 0xc], 0x6e9bffc5
mov eax, dword [0x409004]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x44820447
mov dword [esp], 0x52d59c60
call fcn.00404866
mov esi, eax
mov edx, edi
sub edx, eax
mov eax, ebx
sub eax, dword [0x409024]
mov ebx, edx
xor ebx, eax
mov dword [esp], ebx
call fcn.004056c8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x44820447
mov eax, dword [0x40901c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x3c8955ee
mov dword [esp], eax
call fcn.00404cfc
mov edi, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x3a08fd4d
mov dword [esp + 4], 0x16d90c01
mov dword [esp], ebx
call fcn.00405186
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x44820447
mov dword [esp], esi
call sub.USER32.dll_SendMessageW
sub esp, 0x10
call fcn.00405b0c
mov ebx, eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], edi
call sub.USER32.dll_GetWindowTextW
sub esp, 0xc
and ebx, 0x75b6afcc
or ebx, 0x17954dbc
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405744
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and edi, ebx
or ebx, 0x5dbb1fe0
mov eax, dword [section..data]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov eax, dword [0x409014]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4fb0274f
mov dword [esp + 4], ebx
mov dword [esp], 0x1ddad9e
call fcn.00402ece
mov esi, eax
mov dword [esp], eax
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00404679
mov eax, dword [0x409018]
mov dword [esp + 4], eax
mov dword [esp], 0xc4f85b3
call sub.USER32.dll_GetSubMenu
sub esp, 8
mov ebx, dword [ebp + 0xc]
xor ebx, dword [section..data]
xor ebx, 0x95972af
mov dword [esp], esi
call sub.USER32.dll_UnhookWindowsHookEx
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call fcn.004033d9
and eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x405a69
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
mov dword [esp], ebx
call sub.USER32.dll_VkKeyScanW
sub esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [section..data]
mov dword [esp], eax
call fcn.00401966
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 8], 0x100cd9d6
mov eax, dword [0x409028]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00405c10
mov dword [esp], 0x2382908
call fcn.00402deb
mov eax, dword [ebp + 0x10]
sub eax, edi
and eax, 0x520cd1c4
xor eax, dword [0x409014]
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00404b82
add eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405c10
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [0x409024]
add edx, eax
add edx, 0x181d668d
and edx, eax
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x10]
and edx, eax
mov dword [ebp - 0x14], edx
mov edi, dword [0x409008]
add edi, 0x5a3cb51e
and edi, 0x4ca4f4bb
or edi, 0x22e82c0e
mov ebx, edx
or ebx, eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.USER32.dll_EnumWindows
sub esp, 8
mov esi, eax
mov eax, dword [0x409008]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4d0a5a8d
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00405e0a
mov edi, eax
mov eax, dword [0x409010]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [0x40901c]
mov dword [esp], eax
call fcn.00402f3e
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1283ca48
mov dword [esp + 4], edi
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call sub.USER32.dll_GetMessageW
sub esp, 0x10
call sub.USER32.dll_GetActiveWindow
call sub.USER32.dll_CreateMenu
mov esi, eax
mov eax, dword [0x409010]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.00405744
mov dword [ebp - 0x14], eax
mov eax, dword [0x409020]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.USER32.dll_InsertMenuItemW
sub esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], 0x71078821
call sub.USER32.dll_ScreenToClient
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [0x409014]
mov dword [esp], eax
call fcn.0040302b
mov dword [esp + 0xc], 0x429254dc
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov eax, dword [0x409014]
mov dword [esp], eax
call fcn.004065b0
mov eax, dword [ebp - 0x14]
imul eax, dword [0x409020]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406199
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [esp + 4], esi
mov dword [esp], 0x19e93839
call fcn.00404679
mov eax, dword [0x409028]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6628d1dd
mov dword [esp + 4], ebx
mov dword [esp], ebx
call sub.USER32.dll_RedrawWindow
sub esp, 0x10
mov eax, dword [0x40901c]
mov dword [esp], eax
call sub.USER32.dll_VkKeyScanW
sub esp, 4
mov dword [esp], eax
call sub.USER32.dll_UnhookWindowsHookEx
sub esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x722814e8
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5ccb5653
mov dword [esp], esi
call sub.USER32.dll_TrackPopupMenu
sub esp, 0x1c
mov dword [esp + 0x10], ebx
mov eax, dword [0x409014]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x700b305b
mov eax, dword [0x409020]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00404866
mov dword [esp], edi
call sub.USER32.dll_GetCursorPos
sub esp, 4
mov dword [esp + 8], 0x726f7627
mov dword [esp + 4], 0x4ac26266
mov dword [esp], 0x7e3c4344
call fcn.00405c10
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov ecx, dword [0x40d088]
test ecx, ecx
je 0x407aae
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x58], 0x41414141
mov eax, dword [str._LIBGCCW32_EH_3_MINGW32]
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x41414141
mov dword [ebp - 0x50], 0x41414141
mov dword [ebp - 0x38], eax
mov eax, dword [0x40c258]
mov dword [ebp - 0x4c], 0x41414141
mov dword [ebp - 0x48], 0x41414141
mov dword [ebp - 0x34], eax
mov eax, dword [0x40c25c]
mov dword [ebp - 0x44], 0x41414141
mov dword [ebp - 0x40], 0x41414141
mov dword [ebp - 0x30], eax
mov eax, dword [0x40c260]
mov dword [ebp - 0x3c], 0x41414141
mov dword [ebp - 0x2c], eax
mov eax, dword [0x40c264]
mov dword [ebp - 0x28], eax
mov eax, dword [0x40c268]
mov dword [ebp - 0x24], eax
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
movzx eax, ax
sub esp, 4
test eax, eax
mov dword [ebp - 0x9c], eax
jne 0x407c1d
mov dword [esp], 0x24
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x407c51
cld
mov edi, eax
mov eax, dword [ebp - 0x9c]
mov ecx, 9
rep stosd dword es:[edi], eax
mov dword [ebx], 0x24
mov eax, dword [0x40d048]
mov ecx, 1
mov dword [ebx + 4], sub.msvcrt.dll_abort
mov dword [ebx + 8], 0x4079e0
mov dword [ebx + 0x14], eax
mov edx, dword [0x40d05c]
mov eax, dword [0x40d058]
mov dword [ebx + 0x20], edx
mov edx, 0x1f
mov dword [ebx + 0x1c], eax
lea esi, [esi]
lea edi, [edi]
mov eax, ebx
and eax, ecx
cmp eax, 1
sbb eax, eax
and al, 0x20
add ecx, ecx
add al, 0x41
mov byte [ebp + edx - 0x98], al
dec edx
jns 0x407ba0
mov eax, dword [str._LIBGCCW32_EH_3_MINGW32]
mov dword [ebp - 0x78], eax
mov eax, dword [0x40c258]
mov dword [ebp - 0x74], eax
mov eax, dword [0x40c25c]
mov dword [ebp - 0x70], eax
mov eax, dword [0x40c260]
mov dword [ebp - 0x6c], eax
mov eax, dword [0x40c264]
mov dword [ebp - 0x68], eax
mov eax, dword [0x40c268]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x98]
mov dword [esp], eax
call sub.KERNEL32.dll_AddAtomA
movzx edi, ax
sub esp, 4
test edi, edi
jne 0x407c42
xor edx, edx
test edx, edx
jne 0x407c24
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
movzx eax, ax
call fcn.004079f0
mov ebx, eax
mov dword [0x40d088], ebx
lea eax, [ebx + 4]
mov dword [0x40d078], eax
lea eax, [ebx + 8]
mov dword [0x40d098], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
call fcn.004079f0
cmp eax, ebx
mov edx, edi
jne 0x407c01
jmp 0x407c03
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4067b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov dword [0x5767d0], 0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret