joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41840c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, dword [ecx + 0x48]
mov eax, dword [ecx + 0x44]
mov edi, ecx
cmp dword [ecx + 0x40], 0
je 0x418439
call fcn.00432499
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x418446
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, 1
test esi, esi
je 0x418486
cmp word [esi + 2], 0xffff
mov eax, dword [esi]
jne 0x418466
mov cx, word [esi + 0x12]
mov eax, dword [esi + 0xc]
mov dx, word [esi + 0x14]
jmp 0x41846e
mov cx, word [esi + 0xa]
mov dx, word [esi + 0xc]
test eax, 0x1801
jne 0x418484
test cx, cx
jne 0x418484
test dx, dx
mov eax, 1
je 0x418486
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x418d20
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
cmp dword [eax + 4], 0x100
jne 0x418d65
cmp dword [eax + 8], 0x70
jne 0x418d65
mov eax, dword [eax + 0xc]
shr eax, 0x10
test ah, 0x40
jne 0x418d65
push 0x10
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
test ax, ax
jl 0x418d65
push 0x11
call esi
test ax, ax
jl 0x418d65
push 0x12
call esi
test ax, ax
mov eax, 1
jge 0x418d67
xor eax, eax
pop esi
ret 4

Function at 0x41c4a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov edi, ecx
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x41c4e3
call fcn.00432499
mov ebp, dword [eax + 0xc]
push 0xf0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41c4e3
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41c4da
xor eax, eax
jmp 0x41c4eb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041c4f2
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41e595
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
sub esp, 4
test eax, eax
push esi
jne 0x41e5a8
xor eax, eax
jmp 0x41e5d0
push 0
lea edx, [ebp - 4]
push edx
push eax
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e5cd
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041f237
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x41e5d7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
push edi
mov edi, ecx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41e61f
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41e60e
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041f237
cmp dword [ebp - 4], esi
je 0x41e61f
push dword [edi + 0xc]
push 0xffffffffffffffff
push 0xd
call fcn.0041f312
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x41e9e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push str.CLSID
mov dword [ebp - 4], esi
push 0x80000000
call edi
test eax, eax
jne 0x41ea8d
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41ea84
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push str.InProcServer32
push dword [ebp - 8]
call edi
test eax, eax
jne 0x41ea7b
mov edi, 0x104
mov ecx, dword [ebp + 0xc]
push edi
call fcn.0041cf70
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edi
lea edi, [ebp - 0x10]
push edi
push eax
push ecx
push esi
push 0x44127c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0041cfc5
push dword [ebp - 0xc]
cmp esi, 1
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41ea97
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x41ebf4
call fcn.0040a088
sub esp, 0x16c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 0x10]
push 0x800
push 0x160
lea eax, [ebp - 0x178]
push eax
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x18], ebx
push edi
mov dword [ebp - 4], ebx
mov byte [esi], bl
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x41eafb
test byte [ebp - 0x16e], 1
je 0x41eafb
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push 0x43aa80
push ebx
push 0x43aa70
call fcn.0041e80d
test eax, eax
jge 0x41eb22
mov dword [ebp - 4], 0xffffffff
call fcn.0041ebfe
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x184]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push eax
push 0x43aa60
mov eax, dword [ecx]
push dword [ebp - 0x10]
call dword [eax]
test eax, eax
jl 0x41ebe4
mov eax, 0
test edi, edi
je 0x41eb68
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [eax + 1]
lea eax, [eax*2 + 5]
and al, 0xfc
call fcn.004096f0
mov eax, esp
push ebx
push edi
push eax
call fcn.0041d089
push 0
mov ecx, dword [ebp - 0x14]
push eax
mov eax, dword [ecx]
push dword [ebp - 0x14]
call dword [eax + 0x14]
test eax, eax
jl 0x41ebd9
mov eax, dword [ebp + 8]
test eax, eax
jne 0x41eb85
xor eax, eax
jmp 0x41eb88
mov eax, dword [eax + 0x1c]
push 2
mov ecx, dword [ebp - 0x10]
push eax
mov eax, dword [ecx]
push dword [ebp - 0x10]
call dword [eax + 0x4c]
test eax, eax
jl 0x41ebd9
push 0
mov ecx, dword [ebp - 0x10]
push 0
mov eax, dword [ecx]
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x10]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x14]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ebfe
mov eax, 1
jmp 0x41eb09
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x41eafb
Function at 0x41ec06
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41ece5
call fcn.0040a088
sub esp, 0x150
lea eax, [ebp - 0x18]
push ebx
push esi
push edi
mov ebx, 0x104
push eax
mov edi, dword [ebp + 8]
push edi
mov esi, dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x41ec53
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x10]
xor ebx, ebx
call fcn.0041ca88
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
push edi
call fcn.0041ecf7
push ebx
lea eax, [ebp - 0x14]
push ebx
lea ecx, [ebp - 0x1c]
push eax
push ecx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x41ec92
mov dword [ebp - 4], 0xffffffff
call fcn.0041ecef
jmp 0x41ec3e
test byte [ebp - 0x14], 2
jne 0x41ec9f
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x14], 4
jne 0x41eccf
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41eccf
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ecef
mov eax, 1
jmp 0x41ec40

Function at 0x41fa10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
push 0x118
push 0
mov esi, dword [ebp + 8]
push esi
call fcn.0040a030
add esp, 0xc
lea ecx, [esi + 0x12]
push 0x104
push dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [edi + 4]
cmp ecx, 0xffffffff
je 0x41fac5
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x14]
push eax
push edx
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x41fa62
xor eax, eax
jmp 0x41faca
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x41fa79
xor eax, eax
jmp 0x41faca
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
mov byte [esi + 0x10], 0
call fcn.00416f66
mov eax, dword [eax]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
lea edi, [esi + 8]
push ecx
mov dword [esi], eax
lea ecx, [ebp - 4]
call fcn.00416f66
mov ecx, dword [eax]
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
mov dword [edi], ecx
push eax
lea ecx, [ebp - 4]
call fcn.00416f66
mov eax, dword [eax]
cmp dword [esi], 0
mov dword [esi + 4], eax
jne 0x41fabe
mov dword [esi], eax
cmp dword [edi], 0
jne 0x41fac5
mov dword [edi], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42181b
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
test al, 1
je 0x421841
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xa0]
test eax, eax
jne 0x421857
xor eax, eax
jmp 0x42185c
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x20]
call dword [eax + 0xa0]
test eax, eax
mov eax, 0
je 0x42185c
mov eax, 1
pop esi
ret
Function at 0x421ced
Capabilities:
Get common file path
Get disk size
Timestomp file

Disassembly:
mov eax, 0x421ea4
call fcn.0040a088
sub esp, 0x248
mov dword [ebp - 0x14], ecx
add ecx, 0x10
push esi
mov dword [ebp - 0x18], ecx
call fcn.0041cb68
test byte [ebp + 0xd], 0x10
je 0x421dd1
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 8]
call fcn.0041fad2
test eax, eax
je 0x421dd1
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.0041ca88
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call fcn.0041ecf7
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x34]
push eax
lea edx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push edx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x421d6e
mov esi, dword [ebp - 0x34]
imul esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x144]
add eax, eax
cmp eax, esi
jge 0x421dc5
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x254]
push eax
push ecx
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ecx, dword [ebp - 0x1c]
push 0x105
mov byte [ecx], 0
mov ecx, dword [ebp - 0x18]
call fcn.0041cf70
push eax
lea ecx, [ebp - 0x254]
push 0
push 0x43a8b4
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
call fcn.0041cfc5
mov dword [ebp - 4], 0xffffffff
call fcn.00421eae
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
cmp dword [ecx - 8], 0
je 0x421eb6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041e453
test eax, eax
je 0x421eb6
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.0041cd36
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
push eax
lea edx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x14]
push edx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x421e4c
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x150]
push eax
push ecx
call fcn.0041fb8c
add esp, 8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
push ecx
push edx
push eax
mov ecx, dword [ebp - 0x14]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], eax
push eax
push eax
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
push dword [ebp - 0x10]
call fcn.0041941f
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x10]
push esi
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
test eax, eax
je 0x421e94
push esi
mov eax, dword [ebp - 0x18]
push 4
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
push esi
call fcn.0041945f
add esp, 4
mov eax, 1
jmp 0x421ecf
mov ecx, dword [ebp - 0x18]
call fcn.0041cb68
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.0041e453
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4227a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, 0x100
cmp edi, eax
ja 0x4227e7
push eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, edi
jne 0x4227e7
push esi
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4227f1
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x423633
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
cmp dword [ecx + 0x7c], 0
mov esi, ecx
je 0x42367b
push dword [ebp + 8]
call fcn.00432a83
mov esi, eax
test esi, esi
jne 0x423655
xor eax, eax
jmp 0x4236a6
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
sbb eax, eax
neg eax
jmp 0x4236a6
push dword [ebp + 0x10]
push 0x4414a4
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x10]
push dword [esi + 0x90]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424282
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push esi
mov eax, dword [ecx + 0x60]
mov ebx, dword [ecx + 0x6c]
push edi
mov esi, ecx
push ebp
mov edi, ebx
imul edi, edi, 0xc
push dword [esi + 0x48]
sub dword [esp + 0x2c], eax
mov eax, dword [esi + 0x78]
push dword [esp + 0x2c]
add eax, edi
sub eax, 0xc
push eax
call fcn.00424248
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x4242bf
xor eax, eax
jmp 0x424353
cmp dword [esi + 0x70], 0
je 0x4242e0
lea ecx, [ebx + 0xea00]
mov eax, dword [esi]
push ecx
push 0
mov ecx, esi
call dword [eax + 0xd0]
test eax, eax
jne 0x4242e0
xor eax, eax
jmp 0x424353
xor ebp, ebp
inc dword [esi + 0x6c]
cmp dword [esi + 0x68], ebp
jle 0x42432e
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x7c]
mov eax, dword [esp + 0x14]
push 0
mov edx, dword [ecx + eax + 8]
mov ecx, esi
mov dword [esp + 0x20], edx
push dword [esp + 0x20]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esi]
push dword [esi + 0x3c]
push ebx
push ebp
call dword [eax + 0xc0]
test eax, eax
je 0x42435d
add dword [esp + 0x14], 0xc
inc ebp
cmp dword [esi + 0x68], ebp
jg 0x4242f6
mov ecx, dword [esi + 0x78]
mov eax, dword [esp + 0x28]
mov dword [ecx + edi - 8], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x78]
mov dword [edx + edi + 4], ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xc4]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
test ebp, ebp
jle 0x424374
mov eax, dword [esi]
mov edi, dword [eax + 0xd4]
dec ebp
push ebx
push ebp
mov ecx, esi
call edi
test ebp, ebp
jne 0x424369
cmp dword [esi + 0x70], 0
je 0x42438f
add ebx, 0xea00
mov ecx, esi
push ebx
call fcn.00419483
mov ecx, eax
mov eax, dword [eax]
call dword [eax + 0x60]
xor eax, eax
dec dword [esi + 0x6c]
jmp 0x424353
Function at 0x42709f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4270bf
xor eax, eax
jmp 0x427217
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4270d4
xor eax, eax
jmp 0x427217
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
add edi, 0x40
push edi
call fcn.0040a470
add esp, 4
mov esi, eax
test esi, esi
jne 0x4270f2
xor eax, eax
jmp 0x427217
push edi
push dword [ebp - 0xc]
push esi
call fcn.0040a700
add esp, 0xc
mov edi, dword [esi]
mov dword [ebp - 8], 0x10
add edi, esi
xor ecx, ecx
mov edx, 0x439e90
mov eax, dword [edi]
cmp dword [edx], eax
je 0x427125
add edx, 8
inc ecx
cmp edx, 0x439eb0
jb 0x427113
jmp 0x42717a
cmp dword [ebp + 0x10], 0
je 0x42713d
cmp dword [ecx*8 + 0x439e94], 0x12
je 0x42717a
mov dword [edi], 0xffffff
jmp 0x42717a
mov ebx, dword [ecx*8 + 0x439e94]
push ebx
call dword [sym.imp.USER32.dll_GetSysColor]
movzx eax, ah
push ebx
mov dword [ebp - 4], eax
shl dword [ebp - 4], 8
call dword [sym.imp.USER32.dll_GetSysColor]
movzx eax, al
shl eax, 0x10
push ebx
or dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSysColor]
shr eax, 0x10
movzx ecx, al
or dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [edi], edx
add edi, 4
dec dword [ebp - 8]
jne 0x42710a
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
call dword [sym.imp.USER32.dll_GetDC]
push ebx
mov dword [ebp - 0x10], eax
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 8], eax
test eax, eax
je 0x427200
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 8]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, 1
mov cl, byte [esi + 0xe]
push 0xcc0020
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push 0
shl edx, cl
push esi
lea eax, [eax + edx*4 + 0x28]
push eax
push ebx
push edi
push 0
push 0
push ebx
push edi
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.0040a350
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4297c1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call fcn.0041a675
test eax, eax
je 0x4297e2
mov eax, 1
jmp 0x4299cb
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x4297f8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00419cd6
test byte [esi + 0x64], 0x20
mov dword [ebp - 4], eax
jne 0x42981b
cmp edi, 0x201
je 0x42981b
cmp edi, 0x202
jne 0x429985
cmp edi, 0x200
jb 0x42982b
cmp edi, 0x209
jbe 0x429843
cmp edi, 0xa0
jb 0x429985
cmp edi, 0xa9
ja 0x429985
call fcn.00431ee6
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0x14
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x28
lea ecx, [ebp - 0x3c]
push 0
push ecx
call fcn.0040a030
add esp, 0xc
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x28
push ecx
mov ebx, dword [esi]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
mov ecx, esi
call dword [ebx + 0x6c]
cmp dword [ebp - 0x18], 0xffffffff
mov ebx, eax
je 0x4298a4
push dword [ebp - 0x18]
call fcn.0040a350
add esp, 4
cmp edi, 0x201
jne 0x4298bb
test byte [ebp - 0x35], 0x80
je 0x4298bb
mov dword [ebp - 0xc], 1
jmp 0x4298c2
mov dword [ebp - 0xc], 0
cmp edi, 0x201
je 0x4298e0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4298e0
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x100]
test ebx, ebx
jl 0x42994f
cmp dword [ebp - 0xc], 0
jne 0x42994f
cmp edi, 0x202
jne 0x429911
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xe4]
push 0xc8
mov ecx, esi
push 0xe001
call fcn.00429564
jmp 0x42997c
test byte [esi + 0x60], 8
jne 0x429942
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x429942
mov eax, dword [ebp - 8]
cmp dword [eax + 0x100], ebx
je 0x42997c
push 0x12c
mov ecx, esi
push 0xe000
call fcn.00429564
jmp 0x42997c
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0xe4]
jmp 0x42997c
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x429962
cmp dword [ebp - 0xc], 0
je 0x42997c
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xe4]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 8]
mov dword [eax + 0x100], ebx
mov ecx, esi
call fcn.0041b6d4
test eax, eax
je 0x42999a
cmp dword [eax + 0x50], 0
je 0x42999a
xor eax, eax
jmp 0x4299cb
cmp dword [ebp - 4], 0
je 0x4299c1
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
mov ebx, dword [ecx]
call dword [ebx + 0x98]
test eax, eax
jne 0x4299d4
mov ecx, dword [ebp - 4]
call fcn.0041b557
mov dword [ebp - 4], eax
test eax, eax
jne 0x4299a0
push dword [ebp + 8]
mov ecx, esi
call fcn.0041c6b7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x4299cb
Function at 0x42c964
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
je 0x42c9fa
mov ebp, 0x18000000
push ebx
call fcn.00419d00
mov esi, eax
test esi, esi
je 0x42c9eb
mov eax, dword [edi + 0x1c]
cmp eax, ebx
je 0x42c9eb
push ebx
push eax
call fcn.0042c7b8
test eax, eax
je 0x42c9eb
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [esp + 0x14], 0
jne 0x42c9d4
mov ecx, eax
and ecx, ebp
cmp ecx, 0x10000000
jne 0x42c9cd
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
or byte [esi + 0x24], 2
jmp 0x42c9eb
cmp dword [esp + 0x14], 0
je 0x42c9eb
test ebp, eax
jne 0x42c9eb
test byte [esi + 0x24], 2
je 0x42c9eb
push 4
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x24], 0xfd
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
jne 0x42c984
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x432125
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4321c0
call fcn.0040a088
sub esp, 4
xor eax, eax
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.CNoTrackObject.0
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov esi, ecx
push 0xa
lea ecx, [esi + 0x30]
call fcn.00417524
lea ecx, [esi + 0x4c]
push 0xa
mov byte [ebp - 4], 1
call fcn.00417524
lea ecx, [esi + 0x68]
push 0xa
mov byte [ebp - 4], 2
call fcn.00416ff8
mov byte [ebp - 4], 3
mov eax, esi
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x419403
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret