joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f648
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x405076
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x405076
mov esi, dword [eax + 8]
xor edx, edx
sub esi, dword [eax + 4]
sar esi, 2
test esi, esi
je 0x405076
mov eax, dword [eax + 4]
mov ecx, dword [eax]
test ecx, ecx
je 0x404ff5
cmp dword [ecx + 0x58], 0xfb4
je 0x404fff
inc edx
add eax, 4
cmp edx, esi
jne 0x404fe6
jmp 0x405076
test ecx, ecx
je 0x405076
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x1c]
push dword [edi + 0x18]
call fcn.004d4640
push 0x38
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.005481a0
add esp, 0xc
mov dword [ebp - 0x64], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], 1
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x405076
push 2
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00403190
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4
Function at 0x413af0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [0x5daa70]
sub esp, 8
mov eax, dword [edx + 0x1b4]
push esi
cmp eax, dword [edx + 0x1b8]
je 0x413b27
mov esi, 0x7d6
nop dword [eax]
mov ecx, dword [eax]
test ecx, ecx
je 0x413b1c
cmp word [ecx + 0x14], si
je 0x413b30
add eax, 4
cmp eax, dword [edx + 0x1b8]
jne 0x413b10
xor al, al
pop esi
add esp, 8
ret 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
movzx ebx, word [ecx + 0x16]
push edi
movzx edi, word [ecx + 0x18]
push 0x12
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x11
mov dword [esp + 0x10], eax
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [esp + 0x14], eax
call esi
movzx edx, ax
shr edx, 0xf
and dl, 1
cmp dword [esp + 0x1c], edi
jne 0x413ba3
mov cl, bl
shr cl, 4
and cl, 1
cmp cl, byte [esp + 0xc]
jne 0x413ba3
mov al, bl
shr al, 3
and al, 1
cmp al, byte [esp + 0x10]
jne 0x413ba3
shr bl, 2
and bl, 1
cmp bl, dl
jne 0x413ba3
pop edi
pop ebx
mov al, 1
pop esi
add esp, 8
ret 8
pop edi
pop ebx
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x414930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x30], edi
cmp edi, 1
je 0x414951
mov byte [esp + 0xc], 1
cmp edi, 5
jne 0x414956
mov byte [esp + 0xc], 0
mov ebx, dword [esp + 0xc]
push ebx
push 2
push 0x3e9
call fcn.00416350
push ebx
push 3
push 0x3ea
mov ecx, esi
call fcn.00416350
cmp byte [0x5db68c], 0
je 0x41498e
push ebx
push 4
push 0x3eb
mov ecx, esi
call fcn.00416350
push ecx
mov ecx, esi
call fcn.00416450
mov ecx, esi
call fcn.00416540
mov eax, dword [0x5d3a30]
cmp eax, 2
je 0x4149ab
test eax, eax
jne 0x4149d3
cmp edi, 5
jne 0x4149d3
call fcn.0042b990
mov eax, dword [0x5d3a30]
sub eax, 1
je 0x4149c4
sub eax, 2
jne 0x4149d3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415640
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xf060
ja 0x4156d8
je 0x4156af
sub eax, 0xf020
je 0x415691
sub eax, 0x10
jne 0x4156df
mov eax, dword [0x5dad54]
push 0xfffffffffffffff0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, esi
test eax, 0x20000000
je 0x41570f
call fcn.004157e0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x5dad54]
mov eax, dword [eax + 4]
test eax, eax
je 0x415714
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [0x5dad54]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xf120
je 0x4156e8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x5dad54]
push 0xfffffffffffffff0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x20000000
je 0x41570d
call fcn.004158c0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.00415720
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x415ae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5706a0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x28]
xor ecx, ecx
call fcn.00465af0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x415b59
push 2
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00403190
add esp, 0xc
push 0x38
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.005481a0
add esp, 0xc
mov dword [ebp - 0x7c], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x60], 1
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x415ba6
push 2
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00403190
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x415bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5706a0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x28]
mov ecx, 1
call fcn.00465af0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x415c3c
push 2
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00403190
add esp, 0xc
push 0x38
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.005481a0
add esp, 0xc
mov dword [ebp - 0x7c], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x60], 1
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x415c89
push 2
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00403190
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x4160d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5d3070]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x34]
test esi, esi
je 0x416252
mov edx, dword [edi + 0x30]
mov eax, edx
sub eax, 2
je 0x41610f
sub eax, 1
je 0x416108
sub eax, 1
jne 0x41616c
mov al, byte [0x5db003]
jmp 0x41611d
mov al, byte [0x5db002]
jmp 0x41611d
cmp byte [0x5db555], 0
je 0x41616c
mov al, byte [0x5db001]
test al, al
je 0x41616c
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x41616c
mov eax, dword [ecx + 8]
sub eax, dword [ecx + 4]
test eax, 0xfffffffc
je 0x41616c
cmp edx, 2
jne 0x41616c
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x1a8]
mov ecx, dword [edi + 0x34]
push 1
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [edi + 0x34]
push 1
mov eax, dword [ecx]
call dword [eax + 0x188]
mov ecx, dword [edi + 0x34]
push 0
call fcn.00441640
jmp 0x4161e2
mov eax, dword [esi]
push 0
cmp eax, vtable.CViewKeyboard.0
jne 0x416263
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
xorps xmm0, xmm0
push esi
movups xmmword [esp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [edi + 0x34]
mov eax, dword [esi]
mov edx, dword [eax + 0x188]
cmp eax, vtable.CViewKeyboard.0
jne 0x41626d
cmp dword [esi + 0x90], 0
je 0x4161d2
push 0
mov ecx, esi
call dword [eax + 0x19c]
mov eax, dword [esi + 4]
test eax, eax
je 0x4161e2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 8]
xor eax, eax
sub esi, dword [edi + 4]
sar esi, 2
test esi, esi
je 0x416252
mov edx, dword [edi + 4]
mov ecx, dword [edx]
test ecx, ecx
je 0x416203
cmp dword [ecx + 0x58], 0x3e9
je 0x41621c
inc eax
add edx, 4
cmp eax, esi
jne 0x4161f4
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0053f778
add esp, 0x1c
ret
mov eax, dword [ecx]
cmp eax, vtable.RT::CButton.0
jne 0x416278
test dword [ecx + 0x98], 0xf000
setne al
test al, al
je 0x416252
push 0x4b5
mov ecx, edi
call fcn.004d1e40
test eax, eax
je 0x416252
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x1a8]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.0053f778
add esp, 0x1c
ret
mov ecx, esi
call dword [eax + 0x20]
jmp 0x4161a9
push 0
mov ecx, esi
call edx
jmp 0x4161e2
mov eax, dword [eax + 0x1dc]
call eax
jmp 0x416232
Function at 0x4177f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push esi
push edi
push 0x67
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
push edi
push 1
push 0x80
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
je 0x417826
push eax
call ebx
test edi, edi
je 0x41782d
push edi
call ebx
lea ecx, [esi + 0x74]
call fcn.0044e210
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x41784c
mov eax, dword [0x5d3a88]
test eax, eax
cmove eax, esi
mov dword [0x5d3a88], eax
push dword [esp + 0x38]
push dword [0x5daa9c]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x41793b
cmp dword [esi + 4], eax
je 0x41789a
mov edx, dword [esi]
mov ecx, esi
push eax
push ebx
call dword [edx + 0x15c]
mov ecx, esi
call fcn.004179c0
lea ecx, [esi + 0x74]
call fcn.0044e320
mov ecx, 0x5db450
call fcn.00468280
test al, al
jne 0x4178ca
call fcn.0045bc90
test al, al
jne 0x4178ca
lea ecx, [esi + 0x74]
call fcn.0044ed20
jmp 0x4178e9
push 1
lea ecx, [esi + 0x74]
call fcn.004536b0
mov eax, dword [0x5dad54]
mov eax, dword [eax + 4]
test eax, eax
je 0x4178e9
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x5db450
call fcn.00468280
test al, al
jne 0x41791d
call fcn.0045bc90
test al, al
jne 0x41791d
mov edx, 0x5daf68
mov ecx, 0x5daf50
call fcn.00456cf0
test al, al
jne 0x41791d
push 1
lea ecx, [esi + 0x74]
call fcn.00453a50
mov eax, dword [esi + 4]
test eax, eax
je 0x41792b
push eax
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.00417950
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x2c
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x2c

Function at 0x417950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [0x5d3a38], 0xffffffff
je 0x417964
call fcn.0042d930
cmp dword [0x5d3a30], 0xffffffff
je 0x41799f
call fcn.0042a670
call fcn.0042b3d0
call fcn.0042adc0
call fcn.0042a790
mov eax, dword [0x5d3a30]
sub eax, 1
je 0x417990
sub eax, 2
jne 0x41799f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret

Function at 0x429160
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x42919e
push 0x3bc
call fcn.0053f79c
mov ecx, dword [0x5dad54]
add esp, 4
mov dword [esp + 4], eax
mov ecx, dword [ecx + 4]
mov dword [eax], vtable.RT::CTray.0
mov dword [eax + 4], 0x3b8
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0xfa4
mov dword [esi + 4], eax
push ecx
push 0x67
push dword [0x5daa9c]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, dword [esi + 4]
push eax
call fcn.004ee0e0
mov eax, dword [0x5dad54]
pop esi
mov eax, dword [eax + 4]
test eax, eax
je 0x4291cc
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
Function at 0x42b860
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
mov eax, dword [0x5d3070]
xor eax, esp
mov dword [esp + 8], eax
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 1
push 0xb22
mov eax, dword [ecx]
call dword [eax + 0x2c]
xor ecx, ecx
call fcn.0042dde0
push 0
push str.Confirm
push str._Esc__to_continue
push 0
mov byte [0x5db574], 1
mov dword [0x5db57c], 1
mov dword [0x5db54c], 2
mov dword [0x5db570], 0
mov dword [0x5db56c], 0x3f800000
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x42b930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0
push 0x42c140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0053f778
add esp, 0xc
ret
Function at 0x42b990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571440
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x5d3070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push str.Confirm
push str._Esc__to_continue
push 0
call esi
push 0xe
xor eax, eax
mov dword [ebp - 0x10], 7
push str.dialog_results
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
call fcn.00402b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov eax, dword [0x5dad54]
mov edx, 0x2d0
push ecx
mov ecx, dword [eax + 4]
call fcn.0042d620
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x42ba2d
inc eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00403190
add esp, 0xc
mov eax, dword [0x5dad54]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42ba50
push 0x2f13
call fcn.004d1e40
test eax, eax
je 0x42ba50
push 0
mov ecx, eax
call fcn.00445290
push 0
push str.Confirm
push str._Esc__to_continue
push 0
call esi
push 0x18
xor eax, eax
mov dword [ebp - 0x10], 7
push str.dialog_results_next_step
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
call fcn.00402b20
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.0042c480
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x42bab0
inc eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00403190
add esp, 0xc
mov eax, dword [0x5dad54]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42bad3
push 0x2f13
call fcn.004d1e40
test eax, eax
je 0x42bad3
push 1
mov ecx, eax
call fcn.00445290
push 0
push str.Confirm
push str._Esc__to_continue
push 0
call esi
push 0x22
xor eax, eax
mov dword [ebp - 0x10], 7
push str.dialog_results_detailed_statistics
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
call fcn.00402b20
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 2
call fcn.0042c480
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x42bb33
inc eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00403190
add esp, 0xc
mov eax, dword [0x5dad54]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x42bb56
push 0x2f13
call fcn.004d1e40
test eax, eax
je 0x42bb56
push 2
mov ecx, eax
call fcn.00445290
push 0
push str.Confirm
push str._Esc__to_continue
push 0
call esi
push 0x1e
xor eax, eax
mov dword [ebp - 0x28], 7
push str.dialog_results_errors_overview
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], ax
call fcn.00402b20
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 3
call fcn.0042c480
mov eax, dword [ebp - 0x28]
cmp eax, 8
jb 0x42bbaf
push 2
inc eax
push eax
push dword [ebp - 0x3c]
call fcn.00403190
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d930
Capabilities:
Create thread
Hide graphical window

Disassembly:
sub esp, 8
mov eax, dword [0x5d3070]
xor eax, esp
mov dword [esp + 4], eax
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 0
push 0xaf0
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov eax, dword [0x5d3a38]
sub eax, 1
je 0x42d9d8
sub eax, 1
je 0x42d98a
sub eax, 1
jne 0x42da1e
mov ecx, dword [0x5d3a3c]
call fcn.0042dde0
call fcn.0042e340
lea eax, [esp]
push eax
push 0
push 0
push 0x42dcf0
jmp 0x42d9b8
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 0
push 0xb22
mov eax, dword [ecx]
call dword [eax + 0x2c]
xor ecx, ecx
call fcn.0042dde0
call fcn.0042e340
lea eax, [esp]
push eax
push 0
push 0
push 0x42da30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0053f778
add esp, 8
ret
mov ecx, dword [0x5dad54]
add ecx, 0x74
push esi
push dword [0x5d3a3c]
mov eax, dword [ecx]
push 0xb22
call dword [eax + 0x2c]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x5dad54]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0053f778
add esp, 8
ret
Function at 0x43a120
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x5722f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp + 0x208], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
cmp dword [ebp + 0x214], 0x300
mov dword [ebp - 4], eax
jne 0x43a203
lea esi, [ecx + 0x2214]
push ecx
mov ecx, esi
call fcn.004daa00
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.005481a0
add esp, 0xc
lea eax, [ebp]
push 0x104
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp], 0
jne 0x43a1bc
xor ecx, ecx
jmp 0x43a1d1
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a1c2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402b20
cmp dword [ebp - 0x14], 0
je 0x43a1ec
lea ecx, [ebp - 0x24]
call fcn.004a3040
mov eax, dword [ebp - 0x10]
cmp eax, 8
jb 0x43a203
push 2
inc eax
push eax
push dword [ebp - 0x24]
call fcn.00403190
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0053f778
lea esp, [ebp + 0x20c]
pop ebp
ret 4

Function at 0x43e640
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
lea edi, [ecx + 0x9c]
mov ecx, edi
call fcn.004d4c00
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa2
call esi
mov ebx, 0xff00
test bx, ax
je 0x43e6ac
push 0xa4
call esi
test bx, ax
jne 0x43e6ac
push 0xa5
call esi
test bx, ax
jne 0x43e6ac
push 0xd
call esi
test bx, ax
jne 0x43e6ac
mov ecx, dword [0x5dad54]
push dword [esp + 0x10]
add ecx, 0x74
push 0xc25
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
pop edi
pop esi
pop ebx
ret 4
mov ecx, dword [0x5dad54]
push dword [esp + 0x10]
add ecx, 0x74
push 0xc27
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
pop esi
pop ebx
ret 4

Function at 0x449a60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5d3070]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
mov edi, ecx
cmp dword [edi + 0x9c], 0
jne 0x449a8e
xor al, al
pop edi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0053f778
add esp, 0x1c
ret 4
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
push 0x11
mov byte [esp + 0x14], al
call esi
mov ecx, dword [edi + 0x9c]
shr eax, 0xf
and al, 1
mov byte [esp + 0xc], al
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0x34]
call fcn.00514c50
mov esi, dword [edi + 4]
mov bl, al
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x24]
mov al, bl
pop esi
pop ebx
pop edi
xor ecx, esp
call fcn.0053f778
add esp, 0x1c
ret 4
Function at 0x44cf96
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, ecx
push edi
cmp ebx, 0xd
jne 0x44cfad
mov eax, dword [esi + 4]
test eax, eax
je 0x44cfad
push eax
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.00483ff0
mov edi, dword [sym.imp.USER32.dll_GetFocus]
cmp eax, 1
jne 0x44cfe9
cmp ebx, 9
jne 0x44cfe9
call edi
cmp dword [esi + 0x14c], eax
jne 0x44cfd4
lea ecx, [esi + 0x28c]
jmp 0x44cfe4
call edi
cmp dword [esi + 0x290], eax
jne 0x44cfe9
lea ecx, [esi + 0x148]
mov eax, dword [ecx]
call dword [eax + 0x2c]
call fcn.00483ff0
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 2
jne 0x44d045
cmp ebx, 9
jne 0x44d045
push 0x10
call ebp
mov ecx, 0x8000
test cx, ax
jne 0x44d045
call edi
cmp dword [esi + 0x520], eax
jne 0x44d01e
lea ecx, [esi + 0x660]
jmp 0x44d040
call edi
cmp dword [esi + 0x664], eax
jne 0x44d030
lea ecx, [esi + 0x6f8]
jmp 0x44d040
call edi
cmp dword [esi + 0x6fc], eax
jne 0x44d045
lea ecx, [esi + 0x51c]
mov eax, dword [ecx]
call dword [eax + 0x2c]
call fcn.00483ff0
cmp eax, 2
jne 0x44d0b7
cmp ebx, 9
jne 0x44d0df
push 0x10
call ebp
mov ecx, 0x8000
test cx, ax
je 0x44d0bc
call edi
cmp dword [esi + 0x520], eax
jne 0x44d081
mov eax, dword [esi + 0x6f8]
lea ecx, [esi + 0x6f8]
call dword [eax + 0x2c]
jmp 0x44d0bc
call edi
cmp dword [esi + 0x664], eax
jne 0x44d09c
mov eax, dword [esi + 0x51c]
lea ecx, [esi + 0x51c]
call dword [eax + 0x2c]
jmp 0x44d0bc
call edi
cmp dword [esi + 0x6fc], eax
jne 0x44d0bc
mov eax, dword [esi + 0x660]
lea ecx, [esi + 0x660]
call dword [eax + 0x2c]
jmp 0x44d0bc
cmp ebx, 9
jne 0x44d0df
push 0x11
call ebp
mov ecx, 0x8000
test cx, ax
je 0x44d0df
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 2
push 0xa2f
mov eax, dword [ecx]
call dword [eax + 0x2c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc

Function at 0x44ed20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x5db450
call fcn.00468280
test al, al
jne 0x44ed47
call fcn.0045bc90
test al, al
jne 0x44ed47
call fcn.0045a2b0
mov ecx, esi
pop esi
jmp fcn.0044e6f0
mov dword [esi + 0x30], 1
mov eax, dword [0x5dad54]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x44ed92
push 0x4b1
call fcn.004d1e40
test eax, eax
je 0x44ed92
cmp dword [eax + 0xe0], 0
lea edx, [eax + 0xb0]
setne cl
movzx ecx, cl
push ecx
lea ecx, [eax + 0x98]
call fcn.0045a330
add esp, 4
mov ecx, esi
pop esi
jmp fcn.0044e6f0
pop esi
ret