joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4175f0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, ecx
movzx edx, bx
mov eax, edx
cmp edx, 0x11c
ja 0x417668
je 0x417664
sub eax, 0x1d
cmp eax, 0x36
ja case.0x417679.286
movzx eax, byte [eax + 0x41771c]
jmp dword [eax*4 + 0x4176d0]
mov al, 0xa0
pop ebx
ret
mov al, 0xa2
pop ebx
ret
mov al, 0xa4
pop ebx
ret
mov al, 0x6a
pop ebx
ret
mov al, 0x6d
pop ebx
ret
mov al, 0x6b
pop ebx
ret
mov al, 0x2e
pop ebx
ret
mov al, 0xc
pop ebx
ret
mov al, 0x2d
pop ebx
ret
mov al, 0x26
pop ebx
ret
mov al, 0x28
pop ebx
ret
mov al, 0x25
pop ebx
ret
mov al, 0x27
pop ebx
ret
mov al, 0x24
pop ebx
ret
mov al, 0x23
pop ebx
ret
mov al, 0x21
pop ebx
ret
mov al, 0x22
pop ebx
ret
mov al, 0x13
pop ebx
ret
mov al, 0xd
pop ebx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x417679.286
movzx eax, byte [eax + 0x41777c]
jmp dword [eax*4 + 0x417754]
mov al, 0xa1
pop ebx
ret
mov al, 0xa3
pop ebx
ret
mov al, 0xa5
pop ebx
ret
mov al, 0x5b
pop ebx
ret
mov al, 0x5c
pop ebx
ret
mov al, 0x90
pop ebx
ret
mov al, 0x6f
pop ebx
ret
mov al, 0x5d
pop ebx
ret
mov al, 0x2c
pop ebx
ret
test ebx, 0x100
je 0x4176c1
movzx eax, dl
push 1
or eax, 0xe000
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x4176cd
push 1
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
pop ebx
ret

Function at 0x4177c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov dword [0x4dee30], ecx
mov esi, 1
mov eax, 0x4dee30
mov edx, dword [eax]
shr edx, 0x1e
xor edx, dword [eax]
imul ecx, edx, 0x6c078965
add ecx, esi
inc esi
mov dword [eax + 4], ecx
add eax, 4
cmp eax, 0x4df7ec
jl 0x4177d1
mov dword [0x4d9bc8], 1
mov dword [0x4dd278], 1
pop esi
ret

Function at 0x417810
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4dd278], 0
push esi
push edi
mov esi, 0x4dee30
jne 0x41782d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.004177c0
mov dword [0x4d9bc8], 0x270
mov edi, 0xe3
mov dword [0x4dee2c], 0x4dee30
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub edi, 1
jne 0x417846
mov edi, 0x18c
nop dword [eax]
mov eax, dword [esi + 4]
lea esi, [esi + 4]
mov ecx, dword [esi - 4]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, dword [esi - 4]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x390]
mov dword [esi - 4], ecx
sub edi, 1
jne 0x417880
mov ecx, dword [esi]
mov eax, dword [0x4dee30]
xor ecx, eax
and ecx, 0x7ffffffe
and al, 1
xor ecx, dword [esi]
movzx eax, al
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret
Function at 0x4178f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d9bc8], 1
jne 0x4178fe
call fcn.00417810
mov eax, dword [0x4dee2c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4dee2c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x417940
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4d9bc8], 1
jne 0x41794e
call fcn.00417810
mov eax, dword [0x4dee2c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4dee2c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d3230]
mulsd xmm0, qword [0x4d30a0]
ret

Function at 0x418380
Capabilities:
Write clipboard data

Disassembly:
cmp byte [ecx + 0x17], 0
jne 0x418389
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x17], 2
jne 0x4183a2
cmp dword [0x4dec1c], 0
je 0x4183a2
mov ecx, 0x4dec10
jmp fcn.00404e90
and byte [ecx + 0x15], 0x86
cmp byte [esp + 4], 0
mov al, byte [ecx + 0x15]
je 0x4183b5
or al, 1
mov byte [ecx + 0x15], al
mov eax, 1
ret 4
Function at 0x41c1b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4d89bc]
push ebx
add eax, 4
mov ebx, ecx
push ebp
imul eax, eax, 0x108
push esi
push edi
push eax
call fcn.00495d48
add esp, 4
mov dword [0x4db440], eax
test eax, eax
jne 0x41c1db
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [0x4d89c0]
mov edi, eax
push 0x403cd0
push 0x4ef6d80
push 0xe
push dword [0x4db780]
mov ecx, 0x42
mov dword [0x4d89c0], eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
call edi
cmp dword [ebx], 0
jne 0x41c218
mov ebp, 1
jmp 0x41c319
mov eax, dword [0x4d89c0]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [eax + 0xec], 0
call esi
cmp byte [0x4db43d], 0
mov ecx, dword [0x4d89c0]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], 0x64
jne 0x41c265
push 0x403c30
push 0x64
push 0xb
push dword [0x4db780]
call edi
test eax, eax
setne byte [0x4db43d]
mov byte [ebx + 0xadd], 1
call esi
inc dword [0x4db76c]
mov dword [ebx + 0xafc], eax
mov dword [ebx + 0xaf8], eax
mov ecx, dword [0x4de01c]
cmp ecx, dword [0x4de020]
jne 0x41c299
call fcn.00405473
mov ecx, dword [0x4de01c]
cmp ecx, dword [0x4de018]
jb 0x41c2ae
mov eax, dword [0x4de700]
mov dword [ecx], eax
mov ecx, dword [0x4de01c]
add ecx, 0xc
mov dword [0x4de01c], ecx
push 0
push 0
mov dword [ecx], 0
mov dword [ecx + 4], str.Auto_execute
mov dword [ecx + 8], 0
mov ecx, dword [ebx]
push 1
call fcn.0042c440
sub dword [0x4de01c], 0xc
mov ebp, eax
dec dword [0x4db76c]
cmp byte [0x4db43d], 0
je 0x41c312
push 0xb
push dword [0x4db780]
call dword [sym.imp.USER32.dll_KillTimer]
movzx ecx, byte [0x4db43d]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov byte [0x4db43d], cl
mov byte [ebx + 0xadd], 0
mov ebx, dword [0x4d89c0]
cmp dword [ebx + 0x104], 0
je 0x41c372
mov eax, dword [ebx + 0x104]
cmp dword [eax + 8], 6
jne 0x41c33c
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx + 0x104]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41c352
push eax
call fcn.00495d53
add esp, 4
push 0x10
push dword [ebx + 0x104]
call fcn.00490a1e
mov dword [ebx + 0x104], 0
add esp, 8
mov ebx, dword [0x4d89c0]
mov ecx, ebx
call fcn.004011c0
push 1
push 0
mov byte [ebx + 0xec], 1
mov ecx, 0x42
mov esi, ebx
mov edi, 0x4db448
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4db768]
push 0xffffffffffffffff
push 0x4b41e8
mov word [ebx + 0xec], 0x101
mov dword [ebx + 0xe0], 0
mov byte [ebx + 0xee], 0
mov dword [ebx + 0x2c], closesocket
call fcn.0047b2f0
cmp word [0x4dd210], 0
jne 0x41c40f
cmp dword [0x4dc260], 0
jne 0x41c40f
cmp dword [0x4db79c], 0
jne 0x41c40f
cmp dword [0x4db798], 0
jne 0x41c40f
cmp byte [0x4db791], 0
jne 0x41c40f
test ebp, ebp
mov ecx, 2
mov eax, 9
cmove eax, ecx
mov ecx, 0x4de0d0
push 0
push eax
call fcn.0041c630
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x41c630
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x12c
cmp byte [0x4df834], 0
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0xa98], eax
jne 0x41c81a
cmp byte [ebx + 0xadc], 0
je 0x41c81a
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4db768]
push 0
push 1
mov dword [0x4e00a0], eax
call fcn.00401490
push 0x7f
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0049ef24
inc dword [0x4db76c]
xor eax, eax
mov word [esp + 0x13a], ax
add esp, 0xc
mov eax, dword [0x4d89c0]
mov ecx, 0x42
add eax, 0x108
mov esi, 0x4db448
mov edi, eax
mov dword [0x4d89c0], eax
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4de0d0
mov dword [eax + 0x2c], 0
call fcn.0041c0b0
cmp dword [0x4db77c], 0
xorps xmm0, xmm0
movlpd qword [0x4debb8], xmm0
je 0x41c6ea
push 0x4db558
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x4de01c]
mov esi, dword [0x4d89b8]
mov dword [0x4d89b8], 0
mov byte [0x4df834], 1
cmp ecx, dword [0x4de020]
jne 0x41c71a
call fcn.00405473
mov ecx, dword [0x4de01c]
cmp ecx, dword [0x4de018]
jb 0x41c72f
mov eax, dword [0x4de700]
mov dword [ecx], eax
mov ecx, dword [0x4de01c]
add ecx, 0xc
mov byte [0x4da3a8], 0
mov dword [0x4de01c], ecx
mov al, 1
mov dword [esp + 0xc], eax
mov dword [ecx], 0
mov dword [ecx + 4], str.OnExit
mov dword [ecx + 8], 0
mov ecx, dword [ebx + 0xa8c]
test ecx, ecx
je 0x41c782
call fcn.00401500
test eax, eax
mov eax, dword [esp + 0xc]
je 0x41c782
xor ecx, ecx
movzx eax, al
cmp byte [0x4da3a8], cl
cmove eax, ecx
mov dword [esp + 0xc], eax
mov byte [0x4da3a8], 1
test al, al
je 0x41c7e3
mov dword [esp + 0x18], 0
call fcn.004497a0
mov dword [esp + 0x10], eax
lea ecx, [ebx + 0xa58]
mov eax, dword [0x4e00a0]
cdq
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [ebx + 0xa8c], eax
mov dword [esp + 0x28], 1
sete al
mov dword [esp + 0x24], edx
push eax
push 2
lea eax, [esp + 0x18]
push eax
call fcn.00473150
mov edx, dword [esp + 0xc]
movzx ecx, dl
xor edx, edx
cmp eax, 3
cmove ecx, edx
mov al, cl
sub dword [0x4de01c], 0xc
test al, al
mov eax, dword [ebp + 8]
mov byte [0x4df834], 0
jne 0x41c856
cmp eax, 3
je 0x41c856
lea ecx, [esp + 0x30]
call fcn.00403aa0
mov dword [0x4d89b8], esi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x4da3a8], 0
jne 0x41c861
cmp eax, 9
jne 0x41c861
mov eax, dword [0x4ddf68]
mov ecx, dword [0x4e00a0]
pop edi
pop esi
cmp word [eax], 0
mov eax, 8
mov byte [0x4da3a8], 1
cmovne ecx, dword [ebp + 0xc]
mov dword [0x4e00a0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.0041c870
push dword [ebp + 0xc]
push eax
call fcn.0041c870
int3
Function at 0x422360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov eax, 0x20
mov dword [esp + 0xc], 0x90028
push esi
push edi
mov edi, dword [esp + 0x44]
lea edx, [esp + 0x10]
mov word [esp + 0x10], ax
mov ebp, ecx
mov ax, word [0x4d9ba8]
mov ecx, edi
mov word [esp + 0x12], ax
mov dword [esp + 0x18], 0x3e003c
mov dword [esp + 0x1c], 0x3d003a
mov dword [esp + 0x20], 0x2d002b
mov dword [esp + 0x24], 0x2f002a
mov dword [esp + 0x28], 0x7e0021
mov dword [esp + 0x2c], 0x7c0026
mov dword [esp + 0x30], 0x5b005e
mov dword [esp + 0x34], 0x3f002e
mov dword [esp + 0x38], 0x7b
call fcn.004053e1
mov esi, eax
test esi, esi
je 0x4223ec
cmp esi, edi
jbe 0x422424
sub esi, 2
jmp 0x422406
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4223f1
sub ecx, edx
lea esi, [edi - 2]
sar ecx, 1
lea esi, [esi + ecx*2]
cmp esi, edi
jbe 0x422424
nop word [eax + eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x42241d
cmp eax, 9
jne 0x422424
sub esi, 2
cmp esi, edi
ja 0x422410
mov ebx, esi
sub ebx, edi
sar ebx, 1
inc ebx
cmp ebx, 0xfd
jbe 0x422453
cmp byte [esp + 0x48], 0
je 0x422447
push edi
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, ebp
call fcn.004354a0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
push ebx
push edi
mov edi, dword [esp + 0x48]
push edi
call fcn.0049ef24
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x432430
Capabilities:
Check http status code

Disassembly:
mov eax, dword [0x4d89c0]
push esi
mov esi, ecx
mov dword [0x4de700], esi
cmp byte [eax + 0xf9], 0
je 0x432478
mov eax, dword [0x4dd290]
mov dword [eax*4 + 0x4dd8d8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4dd290]
mov dword [ecx*4 + 0x4dd298], eax
inc ecx
xor eax, eax
cmp ecx, 0x190
cmovge ecx, eax
mov dword [0x4dd290], ecx
push 0
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0045ec60
cmp eax, 1
jne 0x432492
mov ecx, esi
pop esi
jmp fcn.00431000
pop esi
ret
Function at 0x434d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 0
mov dword [esp + 4], eax
mov edx, ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x2c], str.What
mov dword [esp + 8], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x44], 0
push esi
mov esi, 8
test eax, eax
jne 0x434de0
movzx ecx, byte [edx]
lea eax, [ecx*8]
sub eax, ecx
mov eax, dword [eax*2 + 0x4d8e68]
movzx ecx, word [edx + 2]
mov dword [esp + 0x40], eax
mov eax, dword [0x4dd280]
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0x4ce70c
mov dword [esp + 0x68], 0
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x60], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x78], 0
mov dword [esp + 0x70], str.Line
mov dword [esp + 0x88], 1
mov dword [esp + 0x84], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x90], str.Message
mov dword [esp + 0xa8], 0
test eax, eax
je 0x434ea9
cmp word [eax], 0
je 0x434ea9
mov esi, 0xa
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb0], str.Extra
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc0], eax
mov edx, esi
lea ecx, [esp + 8]
call fcn.00470050
pop esi
add esp, 0xcc
ret 0xc
Function at 0x4354a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x400c
call fcn.004ab360
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x630]
test ecx, ecx
je 0x4354d5
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004351a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ebx, 0x4cea60
test eax, eax
mov esi, 0x4c602c
cmovne ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
cmovne esi, eax
cmp byte [0x4debaf], 0
je 0x43555c
cmp byte [0x4debac], 0
jne 0x43555c
mov ecx, dword [edi + 0x26c]
mov eax, dword [0x4dd280]
push ebx
push dword [edi + 0x270]
push dword [eax + ecx*4]
push str._s___d__:____s_n
push 2
call fcn.00498e1f
add esp, 4
push eax
call fcn.00436a40
add esp, 0x14
cmp word [esi], 0
je 0x4356d6
push esi
push str._____Specifically:__s_n
push 2
call fcn.00498e1f
add esp, 4
push eax
call fcn.00436a40
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [edi + 0x270]
lea eax, [esp + 0x1c]
push str.Error_at_line__u
push 0x2000
push eax
call fcn.004782d0
add eax, eax
lea edx, [esp + 0x28]
add edx, eax
mov ecx, 0x2000
sar eax, 1
add esp, 0x10
sub ecx, eax
mov dword [esp + 0x10], edx
mov eax, dword [edi + 0x26c]
test eax, eax
je 0x4355d5
mov edx, dword [edi + 0x26c]
mov eax, dword [0x4dd280]
push dword [eax + edx*4]
mov edx, dword [esp + 0x14]
push str._in_include_file___s_
push ecx
push edx
call fcn.004782d0
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
add esp, 0x10
lea edx, [edx + eax*2]
mov eax, edx
mov dword [esp + 0x10], edx
sub eax, ecx
mov ecx, 0x2000
sar eax, 1
sub ecx, eax
push 0x4cea8c
push ecx
push edx
call fcn.004782d0
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
add esp, 0xc
lea ecx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ecx
sub eax, edx
mov edx, 0x2000
sar eax, 1
sub edx, eax
cmp word [esi], 0
je 0x43565d
mov ecx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x14], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435610
sub ecx, dword [esp + 0x14]
mov eax, 0x4c90ac
sar ecx, 1
cmp ecx, 0x64
mov ecx, 0x4c602c
cmovbe eax, ecx
push eax
push esi
push str.Line_Text:___1.100s_s_nError:
push edx
push dword [esp + 0x20]
call fcn.004782d0
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2c]
add esp, 0x14
lea ecx, [ecx + eax*2]
mov eax, ecx
sub eax, edx
mov edx, 0x2000
sar eax, 1
sub edx, eax
cmp byte [edi + 0xade], 0
mov eax, str.The_script_was_not_reloaded__the_old_version_will_remain_in_effect.
mov esi, str.The_program_will_exit.
cmove eax, esi
push eax
push ebx
push str._s_n_n_s
push edx
push ecx
call fcn.004782d0
add esp, 0x14
cmp dword [0x4de054], 0
je 0x4356be
push str.stderr
lea eax, [esp + 0x1c]
mov ecx, 0x4de018
push eax
call fcn.004084a1
cmp dword [0x4de054], 2
je 0x4356d6
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 0
xorps xmm3, xmm3
lea ecx, [esp + 0x20]
mov edx, 0x10000
call fcn.0047ce40
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435f50
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3cc
push ebx
mov ebx, dword [esp + 0x3d4]
push ebp
push esi
push edi
mov ebp, ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x435f80
push 0x64
lea ecx, [esp + 0x114]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x435f8a
xor eax, eax
mov word [esp + 0x110], ax
mov esi, dword [0x4deb6c]
xor eax, eax
mov word [esp + 0x10], ax
test esi, esi
je 0x436038
nop
cmp byte [esi + 0x11], 0
je 0x435fd8
mov ecx, dword [esi]
call fcn.00473080
sub eax, 0
je 0x435fbe
sub eax, 1
je 0x435fbe
mov eax, 0x4cdf9c
jmp 0x435fc3
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4cee40
lea eax, [esp + 0x18]
push 0x7d
push eax
call fcn.00478320
add esp, 0x10
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x435fa0
cmp word [esp + 0x10], si
je 0x436038
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435ff0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7b
jbe 0x436029
mov esi, 0x7f
lea edi, [esp + 0x10]
sub esi, ecx
lea edi, [edi + ecx*2]
push esi
push 0x4c90ac
push edi
call fcn.0049ef24
add esp, 0xc
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x436038
cmp word [esp + ecx*2 + 0xe], 0x20
jne 0x436038
xor eax, eax
mov word [esp + ecx*2 + 0xe], ax
mov eax, dword [0x4db440]
cmp byte [eax + 0xf8], 0
je 0x436056
cmp byte [0x4debad], 0
jne 0x436056
mov esi, 1
jmp 0x436058
xor esi, esi
mov eax, dword [0x4db76c]
cmp eax, 1
jle 0x436067
lea edi, [eax - 1]
jmp 0x436069
xor edi, edi
mov cl, 1
call fcn.00416310
lea edx, [esp + 0x1d8]
mov cl, al
call fcn.00416720
mov ecx, dword [0x4db76c]
mov edx, 0x4c602c
push eax
push dword [0x4db784]
mov eax, dword [0x4db550]
push ecx
sub eax, esi
cmp ecx, 1
push eax
mov eax, str.__preempted:_they_will_resume_when_the_current_thread_finishes_
mov ecx, 0x4c7cf0
cmovle eax, edx
cmp dword [0x4db798], 0
push eax
push edi
lea eax, [esp + 0x28]
mov edx, 0x4c7ce8
push eax
push dword [0x4deb74]
mov eax, ecx
push dword [0x4deb78]
cmovne eax, edx
cmp dword [0x4db79c], 0
push eax
cmovne ecx, edx
lea eax, [esp + 0x138]
push ecx
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push 0xfffe
push ebx
call fcn.004782d0
add eax, eax
mov edi, 0xfffe
add ebx, eax
add esp, 0x3c
sar eax, 1
mov edx, edi
sub edx, eax
mov ecx, ebx
call fcn.0040e1c0
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436110
sub ecx, edx
mov eax, str._r_nPress__F5__to_refresh.
sar ecx, 1
cmp dword [0x4db794], 0
lea esi, [ebx + ecx*2]
mov ecx, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
cmove eax, ecx
push eax
mov eax, esi
sub eax, ebp
sar eax, 1
sub edi, eax
push edi
push esi
call fcn.004782d0
add esp, 0xc
lea eax, [esi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3cc
ret 8
Function at 0x43b8e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x18]
mov esi, ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004486e0
mov edi, eax
test edi, edi
je 0x43b9b7
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.0047cc50
mov dword [esp + 0xc], eax
test eax, eax
je 0x43b9b7
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test esi, esi
je 0x43b959
cmp esi, dword [0x4de014]
je 0x43b959
mov ecx, edi
call fcn.0047d150
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
test al, al
jne 0x43b95f
push 1
push esi
push dword [0x4de014]
call edi
test eax, eax
setne bl
jmp 0x43b95f
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x43b99a
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
mov eax, dword [0x4d89c0]
mov ecx, dword [eax + 0x58]
cmp ecx, 0xffffffff
jle 0x43b99a
mov edx, 1
call fcn.004016e0
test bl, bl
je 0x43b9a9
push 0
push esi
push dword [0x4de014]
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x43b9e4
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x4c602c
push 0
push 0x4c8740
mov ecx, esi
call fcn.00434ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43c710
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.00419f70
mov ebx, eax
test ebx, ebx
jne 0x43c745
push esi
push eax
push str.Parameter_1_invalid.
mov ecx, edi
call fcn.004351a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x43c751
jmp dword [eax*4 + 0x43c940]
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
je 0x43c768
call fcn.00458e30
jmp 0x43c76e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov ecx, dword [0x4db768]
call fcn.00401330
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
call fcn.00458e30
mov edi, eax
test edi, edi
je case.0x43c80e.67
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je case.0x43c80e.67
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test esi, esi
push 0x18
cmovne ecx, edi
push 0
push ecx
jmp 0x43c773
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
call fcn.0049e62e
movzx eax, ax
add esp, 4
add eax, 0xffffffbf
cmp eax, 0x11
ja case.0x43c80e.67
movzx eax, byte [eax + 0x43c970]
jmp dword [eax*4 + 0x43c954]
mov esi, 0x40
jmp 0x43c83d
mov esi, 0x4000
jmp 0x43c83d
mov esi, 0x20
jmp 0x43c83d
mov esi, 0x8000
jmp 0x43c83d
mov esi, 0x80
jmp 0x43c83d
mov esi, 0x100
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
je 0x43c84d
call fcn.00458e30
jmp 0x43c853
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
test edi, edi
je case.0x43c80e.67
push edi
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je case.0x43c80e.67
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test esi, esi
push 0x18
cmovne ecx, edi
push 0
push ecx
jmp 0x43c773
mov ecx, dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp word [ecx], 0
je 0x43c8c4
mov byte [esp + 0xf], 0
call fcn.00417e30
mulsd xmm0, qword [0x4d3108]
cvttsd2si esi, xmm0
mov dword [esp + 0x10], esi
call edi
jmp 0x43c8d5
mov eax, dword [esp + 0x14]
mov byte [esp + 0xf], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
nop dword [eax]
mov ecx, dword [ebp + 0xc]
call fcn.00458e30
mov esi, eax
cmp ebx, 4
jne 0x43c8fd
test esi, esi
je 0x43c905
push 0x18
push 0
push esi
jmp 0x43c773
test esi, esi
je case.0x43c80e.67
cmp byte [esp + 0xf], 0
jne 0x43c923
call edi
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
sub ecx, eax
cmp ecx, 5
jle 0x43c8f3
mov edx, 1
lea ecx, [edx + 0x63]
call fcn.004016e0
jmp 0x43c8e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc