joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027c9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
sub esp, 0xc
call fcn.0041c611
imul eax, eax, 3
mov dword [ebp - 0xc], eax
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x1c]
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x14], eax
push 0
push eax
add ecx, 8
call fcn.0041921f
mov ecx, dword [ebp - 0x14]
sub dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 1
jne 0x40287e
push dword [ebp - 0x10]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.004025fd
test eax, eax
je 0x40287e
mov dword [ebp - 0x14], eax
jmp 0x40282c
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x1d]
mov edx, dword [ebp - 8]
cmp edx, ecx
jae 0x40284b
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x402829
mov byte [ebp - 8], 0
jmp 0x402854
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x1e]
mov edx, dword [ebp - 8]
cmp edx, ecx
jae 0x402877
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4 + 0xa0], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x402851
mov eax, 1
jmp 0x402880
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402a25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 1
mov ecx, dword [ebp - 8]
call fcn.0040257a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.004192c5
push 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00418f5c
test eax, eax
je 0x402a9e
push 1
mov ecx, dword [ebp - 8]
call fcn.0040369f
lea edx, [ebp - 4]
push edx
push 0
push dword [ebp - 8]
push 0x402541
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
test eax, eax
je 0x402a97
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
jmp 0x402aa0
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484f4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
add ecx, 8
call fcn.004032b0
inc dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.0043a93e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0x1010ffff
xor ecx, ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], 0xfffffc18
mov dword [eax + 0x60], 0xfffffc18
dec dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4069b2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push str.AutoDll.ini
push 1
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00418f5c
test eax, eax
je 0x406a21
push dword [ebp - 8]
call fcn.00418ed4
add esp, 4
push eax
push eax
push 0
push 0x500dea
push 0x500de2
call dword [0x4be042]
mov byte [0x500df9], al
push dword [ebp - 0xc]
push 0xa
push 0x500e03
push 0x500dfa
call dword [0x4be042]
cmp ax, 0xa
jae 0x406a10
mov ax, 0xa
mov word [0x500e0d], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406a2f
mov byte [0x500df9], al
mov word [0x500e0d], 0xa
mov esp, ebp
pop ebp
ret

Function at 0x406a33
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor byte [0x500e02], 1
mov eax, dword [0x4cea0c]
test eax, eax
je 0x406a7b
mov byte [0x500e0c], 1
push 0
push 0
push 0
push 0x406a7f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x406a6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.0040a986
mov byte [0x500e0c], 0
mov esp, ebp
pop ebp
ret

Function at 0x40a318
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00409c64
push 2
movzx eax, word [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a367
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
call fcn.00409dcb
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
lea eax, [ecx + eax*4 + 0x28]
mov dword [edx + 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40b1cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
sub esp, 0xd4
lea ecx, [ebp - 0xdc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d4a80
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x492e28
push 0x3f9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp - 8]
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 8]
call fcn.004375e9
push 0x5ab
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040c45a
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b271
cmp byte [ebp + 0x10], 0xff
je 0x40b271
push 5
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0x10]
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x40b28f
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x492e2c
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x10], 0
jne 0x40b2c3
push 0x565
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ad
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
call fcn.0040b3d6
push dword [eax*4 + 0x48bc04]
push 0x3ff
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x12], 0xff
jne 0x40b2fe
push 0x48b284
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x40b317
mov ecx, dword [ebp - 8]
call fcn.0040e070
push 0
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.00461fc8
lea edx, [ebp - 0x70]
push edx
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.0044282d
lea edx, [ebp - 0x70]
push edx
push 0x5af
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
call fcn.0041ddf0
mov dword [ebp - 0xc], eax
jmp 0x40b36b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0x50
jae 0x40b3d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je 0x40b3ce
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + 0x11]
cmp al, 0x1a
jae 0x40b39f
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b781
call fcn.00466bb9
jmp 0x40b3b4
cmp al, 0x47
jb 0x40b3a7
cmp al, 0x59
jb 0x40b3ce
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004517d0
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x5c0
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40b368
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c2ad
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp byte [0x5005a0], 0
je 0x40c2e1
jmp 0x40c2c0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
jae 0x40c2e1
add eax, 0x7e4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c2bd
mov esp, ebp
pop ebp
ret 4

Function at 0x40d5a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call fcn.004373c7
call fcn.00420275
push 0x4b2c50
call fcn.004233ed
push 0x4b313c
call fcn.004233ed
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
xor ecx, ecx
push ecx
movzx eax, byte [0x500c97]
push eax
mov ax, word [0x500c95]
push eax
push ecx
push ecx
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x4158ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
imul eax, eax, 4
add eax, 0x4b5fd0
push dword [eax]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b6a68]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
mov esp, ebp
pop ebp
ret 4

Function at 0x418ed4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
call fcn.0045bc49
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x419102
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x41915a
mov dword [ebp - 0xc], 0
jmp 0x419125
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419154
cmp dword [ebp - 0xc], 5
jle 0x419152
xor eax, eax
jmp 0x419161
jmp 0x419156
jmp 0x419158
jmp 0x41911c
jmp 0x41915e
xor eax, eax
jmp 0x419161
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x41923c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x419274
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419274
xor eax, eax
jmp 0x419277
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4193a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4193db
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4193db
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x419704
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
xor eax, eax
mov dword [ebp - 0x6c], eax
call fcn.00426ae0
mov dword [ebp - 0x70], eax
cmp byte [0x4ac63c], 3
je 0x419744
cmp word [ebp + 0xc], 0x56b
jne 0x419744
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
test cx, cx
jne 0x419744
push dword [ebp + 8]
mov ecx, 0x496f38
call fcn.00438fc1
test eax, eax
jne 0x419749
jmp 0x41992a
push 0
call fcn.004759bc
add esp, 4
mov ecx, 0x496f38
call fcn.0045386e
call fcn.0041e5f6
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x41976e
jmp dword [eax*4 + 0x41992e]
cmp dword [0x496f54], 0
je 0x4197e7
cmp dword [ebp - 0x70], 0
je 0x4197e7
push 1
call fcn.0040c755
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b47c
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.0042d5d3
nop
nop
nop
push 0
push dword [ebp - 0x68]
push 0x48b48c
call fcn.0042d5d3
nop
nop
nop
xor eax, eax
mov dword [0x496f54], eax
push 1
jmp 0x41985f
cmp dword [0x496f50], 0
je 0x41985d
cmp dword [ebp - 0x70], 0
je 0x41985d
push 1
call fcn.0040c755
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b494
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x64]
push edx
nop
nop
nop
nop
nop
nop
call fcn.0042d5d3
push 0
push dword [ebp - 0x68]
push 0x48b4a4
call fcn.0042d5d3
xor eax, eax
mov dword [0x496f50], eax
push 0
call fcn.00461cf6
jmp 0x4198d9
cmp dword [0x496f4c], 0
je 0x4198d4
cmp dword [ebp - 0x70], 0
je 0x4198d4
push 0
call fcn.0040c755
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b4ac
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.0042d5d3
nop
nop
nop
push 0
push dword [ebp - 0x68]
push 0x48b4bc
call fcn.0042d5d3
nop
nop
nop
xor eax, eax
mov dword [0x496f4c], eax
call fcn.00461c8f
nop
nop
jmp case.default.0x41976e
push 1
mov ecx, 0x492f90
call fcn.0041856a
mov dword [ebp - 0x6c], eax
test eax, eax
je case.default.0x41976e
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0042c858
add esp, 4
mov dword [0x4ae4c0], 1
cmp dword [ebp - 0x6c], 0
jne 0x41992a
mov byte [0x496f48], 0
call fcn.0042c88d
push eax
call fcn.004759bc
mov esp, ebp
pop ebp
ret
Function at 0x41993e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call fcn.0045386e
mov ecx, 0x500a6e
mov dword [ecx], 0x496f30
mov dword [ecx + 4], 0x496f58
mov dword [ecx + 8], 0x496f5c
mov dword [ecx + 0xc], 0x496f34
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
jmp 0x419989
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x4199c1
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + eax*4], 0
jne 0x419986
push eax
push 0x4195aa
push dword [0x4b6a68]
push 0x129
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
jmp 0x419986
mov dword [ebp - 8], 0x1b8
mov dword [ebp - 0xc], 0x280
call fcn.00437c50
mov byte [ebp - 4], 0
jmp 0x4199dd
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jae 0x419a49
push 1
push 0x32
push 0x32
mov edx, dword [ebp - 8]
sub edx, 0x32
push edx
mov eax, dword [ebp - 4]
imul edx, eax, 0x32
add edx, 0x32
mov ecx, dword [ebp - 0xc]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 8], 0
jne 0x419a49
push 5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x4199da
push 0
call fcn.00423971
jmp 0x4199da
call fcn.004768c0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x10], 0
mov esp, ebp
pop ebp
ret 4

Function at 0x41e6e7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x3e9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x41e731
push dword [0x4b6a68]
push 0x152
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x500e45], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x41fddc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push dword [ecx + 8]
push 0
push 0x5087fe
sub esp, 0x20
jmp 0x41fdf7
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp al, 3
jae 0x41fe39
add eax, 0x7e2
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0xc]
push 5
lea ecx, [ebp + ecx*8 - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0xc]
cmp al, 2
jne 0x41fe2e
cmp byte [0x5005a0], 1
je 0x41fe39
lea ecx, [ebp + eax*8 - 0x30]
cmp byte [ecx], 0
je 0x41fea8
jmp 0x41fdf4
lea ecx, [ebp - 0x30]
push ecx
call fcn.00465c27
test al, al
jne 0x41fe4d
mov eax, 0x500e30
jmp 0x41fead
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
inc byte [edx]
shl eax, 4
add eax, ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xc], 0
jmp 0x41fe6c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp al, 3
jae 0x41fe8e
lea ecx, [ebp + eax*8 - 0x30]
push ecx
mov ecx, dword [ebp - 0x14]
imul edx, eax, 5
add ecx, edx
add ecx, 2
push ecx
call fcn.0047fc7d
add esp, 8
jmp 0x41fe69
mov ecx, dword [ebp - 8]
movzx eax, word [ecx]
mov ecx, dword [ebp - 0x14]
mov word [ecx], ax
push 2
push ecx
push eax
call fcn.0044cdd4
xor eax, eax
inc eax
jmp 0x41feb7
mov eax, 0x500e1c
push eax
push 0
call fcn.0042f699
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x421897
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov cl, byte [ecx + 1]
call fcn.004061f9
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0x43
je 0x4218c8
cmp byte [ecx], 0x42
je 0x4218c8
push dword [ecx + 0xd]
push dword [ecx + 1]
call fcn.00435829
add esp, 8
jmp 0x4218d2
mov ecx, dword [ebp - 0x14]
push 2
call fcn.00406670
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + 0xd]
call fcn.004061f9
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00403b96
push 8
mov ecx, 0x4b1b18
call fcn.0042c45f
push 1
push 8
mov ecx, 0x4b69b0
call fcn.0047467a
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x254]
and eax, 0xc0
cmp eax, 0xc0
je 0x421948
mov ecx, dword [ebp - 0x18]
call fcn.00403360
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2cb
call fcn.0040659b
mov eax, dword [ebp - 0x10]
push dword [eax + 0x2cc]
push dword [eax + 0x2cb]
mov ecx, 0x4b4250
call fcn.0045503f
call fcn.0041e5db
mov ecx, 0x4b4250
call fcn.0045461c
mov ecx, dword [ebp - 0x14]
call fcn.0043fcc9
mov ecx, dword [ebp - 0x14]
call fcn.00403360
mov edx, dword [eax]
mov dword [ebp - 4], edx
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0044fa1f
add esp, 8
push dword [ebp - 4]
call fcn.0044fa7e
add esp, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
mov eax, 0x3000
call fcn.004015b1
mov dword [ebp - 8], eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
movzx eax, byte [ebp - 0x1f]
push eax
mov al, byte [ebp - 0x20]
push eax
call fcn.004036f9
call fcn.0040159c
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + 2], 1
jne 0x421a02
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
call fcn.0041e5f6
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
mov ecx, dword [ebp - 0x10]
push dword [ecx + 1]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004238fe
jmp 0x421a25
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 1]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451347
call fcn.0041e5f6
call fcn.0042c4e0
call fcn.0047eb97
mov dword [ebp - 0x14], eax
push 1
push 0x27
mov ecx, 0x4b69b0
call fcn.0047467a
cmp byte [0x505fdc], 0
jne 0x421a64
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx]
call fcn.00484002
push ecx
push 0x48b8a8
push 2
call fcn.0042f699
add esp, 0xc
call fcn.0047eb97
sub eax, dword [ebp - 0x14]
mov ecx, 0x14
sub ecx, eax
cmp ecx, 0
jle 0x421a83
push ecx
mov ecx, 0x4b1b18
call fcn.0042c45f
call fcn.0042c4e0
push 0
push dword [ebp - 8]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451913
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x429898
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040b913
cmp al, 2
jne 0x4298dd
call fcn.00429ffb
call fcn.004298f7
movzx eax, ax
mov dword [ebp - 4], eax
and eax, 8
test eax, eax
je 0x4298d8
push 0
push dword [0x4ffa70]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
jmp 0x4298e3
mov ax, word [0x4abf9c]
mov esp, ebp
pop ebp
ret

Function at 0x429cae
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
jmp 0x429cb9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x429cd0
push 0
mov edx, dword [ebp - 8]
push dword [edx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x429cb6
leave
ret

Function at 0x429ed8
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [0x4b6a60]
push 0x40d307
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4cea0c], eax
leave
ret
Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
mov ecx, 0x4ac63c
call fcn.004cee12
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00418c30
push eax
call fcn.00476715
nop
nop
nop
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.0040d273
test al, al
je 0x42c2db
mov ecx, 0x4b2b98
call fcn.004332d8
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
mov ecx, 0x4b2b98
call fcn.00433325
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x492f90
call fcn.00417980
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4aab94], 0
call fcn.0040bb87
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret