joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x40af00
xor eax, eax
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x40af19
mov edx, esi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40af10
sub edx, ecx
mov eax, dword [ebp + 8]
not eax
cmp edx, 8
jb 0x40afd7
push edi
mov edi, edx
shr edi, 3
nop dword [eax]
movzx ecx, byte [esi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
movzx ecx, byte [esi + 7]
add esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
sub edi, 1
jne 0x40af30
pop edi
test edx, edx
je 0x40affa
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x455718]
sub edx, 1
jne 0x40afe0
not eax
pop esi
pop ebp
ret

Function at 0x40c090
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
lea edi, [edx + eax]
mov dword [ebp - 4], edi
cmp eax, 0x10
jb 0x40c136
mov esi, dword [ebp + 0x10]
lea eax, [edi - 0x10]
push ebx
mov dword [ebp + 8], eax
lea ebx, [esi + 0x24234428]
lea edi, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
nop word [eax + eax]
imul ecx, dword [edx], 0x7a143589
sub ebx, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub edi, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp + 8]
jbe 0x40c0d0
ror eax, 0xe
rol esi, 0xc
rol edi, 7
add eax, esi
add eax, edi
rol ebx, 1
mov edi, dword [ebp - 4]
add eax, ebx
pop ebx
jmp 0x40c13e
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea esi, [edx + 4]
cmp esi, edi
ja 0x40c16a
nop dword [eax + eax]
imul ecx, dword [edx], 0x3d4d51c3
mov edx, esi
lea esi, [edx + 4]
sub eax, ecx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x40c150
cmp edx, edi
jae 0x40c189
nop
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x40c170
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4125f0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x68], esi
push edi
mov edi, dword [ebp + 8]
cmp ebx, 0xf
jne 0x41262e
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
movups xmm0, xmmword [ebp - 0x4c]
mov esi, eax
mov dword [ebp - 0x68], esi
movups xmmword [ebp - 0x64], xmm0
jmp 0x412671
cmp ebx, 0x85
jne 0x412655
push 0x81
push esi
push edi
call dword [sym.imp.USER32.dll_GetDCEx]
mov esi, eax
lea eax, [ebp - 0x64]
push eax
push edi
mov dword [ebp - 0x68], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x412671
cmp ebx, 0x14
je 0x412666
push edi
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x64]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push esi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
movups xmm0, xmmword [ebp - 0x64]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14]
push 2
push eax
push edi
movups xmmword [ebp - 0x14], xmm0
call esi
push eax
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov esi, dword [ebp - 0x6c]
push 0
push esi
push 0x14
push edi
call fcn.00424fd0
cmp ebx, 0x85
jne 0x4126e7
mov eax, 2
jmp 0x4126f6
xor eax, eax
cmp ebx, 0x14
sete al
lea eax, [eax*4 + 4]
push eax
push esi
push 0x318
push edi
call fcn.00424fd0
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x60]
push 0xcc0020
push 0
push 0
push esi
mov esi, dword [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push 0
push 0
push esi
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x74]
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp ebx, 0xf
jne 0x41276c
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
cmp ebx, 0x14
je 0x412779
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x414f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], edi
test ebx, ebx
je 0x414fc4
mov esi, dword [0x48d5f4]
mov dword [ebp - 0x70], esi
test esi, esi
je 0x414fc4
cmp ebx, 0x10000
jge 0x414fd7
mov edi, dword [ebp + 0x10]
mov eax, ebx
shl eax, 6
xor edx, edx
xor eax, edi
mov dword [ebp - 0x6c], 0x3f1
shl eax, 3
xor eax, ecx
xor eax, dword [ebp + 0x14]
div dword [ebp - 0x6c]
mov esi, dword [esi + edx*4 + 0xe1c]
test esi, esi
je 0x414fc4
cmp dword [esi], ecx
jne 0x414fbd
cmp dword [esi + 8], edi
jne 0x414fbd
cmp dword [esi + 4], ebx
jne 0x414fbd
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x10], eax
je 0x4150b6
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x414fa3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
push str._08X_s_d
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push ebx
push ecx
push 0x25d
push str.D:MyProjectsProPilotLibLibMain.c
push str._08X_s_d
push 0x64
push eax
call fcn.0040b550
lea esi, [ebp - 0x68]
add esp, 0x24
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x415004
sub esi, ecx
mov eax, esi
and eax, 3
je 0x415031
push eax
mov eax, esi
lea ecx, [ebp - 0x68]
and eax, 0xfc
add eax, ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004394d0
mov edi, dword [ebp - 0x6c]
add esp, 0xc
sar esi, 2
test esi, esi
je 0x415041
xor edi, dword [ebp + esi*4 - 0x6c]
dec esi
test esi, esi
jne 0x415038
mov esi, dword [ebp - 0x70]
mov eax, 0x3ce4585
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3f1
sub edi, eax
mov esi, dword [esi + edi*4 + 0xe1c]
test esi, esi
je 0x414fc4
mov edi, dword [ebp - 0x74]
cmp dword [esi], edi
jne 0x41509c
mov eax, dword [ebp + 0x10]
cmp dword [esi + 8], eax
jne 0x41509c
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x10], eax
jne 0x41509c
mov eax, dword [esi + 4]
cmp eax, 0x10000
jl 0x41509c
push ebx
push eax
call fcn.0043d06f
add esp, 8
test eax, eax
je 0x4150b6
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x415070
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x4150d0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push ecx
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x14]
test ebx, ebx
push 0
cmove ebx, eax
mov dword [ebp - 0x40], eax
test esi, esi
mov dword [ebp - 0x24], ebx
cmove esi, ebx
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov ebx, eax
mov eax, dword [0x48d5f4]
test eax, eax
je 0x41514d
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x41514d
push 0
push eax
push ebx
call edi
push ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call esi
push ebx
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
mov eax, dword [0x48d5f4]
mov dword [ebp - 0x2c], esi
test eax, eax
je 0x415184
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x415184
push 0
push eax
push esi
call edi
push ebx
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call edi
push dword [ebp - 0x38]
push esi
call edi
mov esi, eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp + 0xc]
push 0xcc0020
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x2c]
push esi
call edi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4151e8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
test eax, eax
je 0x4151fb
push 0
push eax
push esi
call edi
test esi, esi
je 0x415206
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x415213
push 0
push eax
push ebx
call edi
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x415990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48d5f4]
test eax, eax
je 0x4159cf
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x4159cf
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x4159ba
mov dword [0x48d5f8], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x4159cf
mov eax, dword [eax + 0x1f2c]
test eax, eax
je 0x4159cf
pop ebp
jmp eax
pop ebp
jmp fcn.004157e0
Function at 0x419520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48d5f4]
test eax, eax
je 0x41955f
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x41955f
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x41954a
mov dword [0x48d5f8], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x41955f
mov eax, dword [eax + 0x1f30]
test eax, eax
je 0x41955f
pop ebp
jmp eax
pop ebp
jmp fcn.004192f0
Function at 0x419ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48d5f4]
test eax, eax
je 0x419edf
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x419edf
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x419eca
mov dword [0x48d5f8], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x419edf
mov eax, dword [eax + 0x1f28]
test eax, eax
je 0x419edf
pop ebp
jmp eax
pop ebp
jmp fcn.00419c30

Function at 0x41a660
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4f0268], 0
je 0x41a6c7
mov eax, dword [0x4f0240]
test eax, eax
je 0x41a7b1
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push dword [0x4f0240]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x4f0240]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x4f0240], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
cmp dword [0x4f0248], 0
je 0x41a7a0
push dword [0x4f024c]
push dword [0x4f0250]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x4f0250]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x4f0248]
test eax, eax
je 0x41a70c
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x4f0248], 0
push esi
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [0x4f0240]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetParent]
lea eax, [ebp - 0x14]
push 2
push eax
push dword [0x4f0240]
call esi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 5
push dword [0x4f0240]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
push eax
push dword [0x4f0240]
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [ebp - 0x10]
push dword [0x4f0240]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
call esi
push 0
push 0
push dword [0x4f0240]
call esi
push dword [0x4f0244]
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
push 0x2c
push 0
push 0x4f0240
call fcn.00439a50
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x41a7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov al, byte [esi]
cmp al, 0x20
jne 0x41a7f1
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x41a7e6
mov dword [ebp + 8], esi
cmp al, 0x2d
je 0x41a7f9
cmp al, 0x2b
jne 0x41a80a
xor ecx, ecx
cmp al, 0x2d
mov al, byte [esi + 1]
sete cl
inc esi
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 0x14]
push edi
mov edi, dword [ebp - 0x10]
cmp al, 0x20
jle 0x41a8c5
mov dword [ebp - 4], edi
nop dword [eax]
movzx edx, word [esi]
mov eax, edx
and eax, 0x3030
cmp eax, 0x3030
jne 0x41a877
mov eax, edx
movzx eax, ax
push 0
push 0x64
push dword [ebp - 4]
movzx eax, byte [eax + 0x4d7630]
cdq
push ecx
mov esi, eax
mov edi, edx
call fcn.00438600
add esi, eax
mov ecx, esi
mov esi, dword [ebp + 8]
adc edi, edx
add esi, 2
mov dword [ebp - 4], edi
mov dword [ebp + 8], esi
movzx edx, word [esi]
mov eax, edx
mov dword [ebp - 0x10], eax
and eax, 0x3030
cmp eax, 0x3030
mov eax, edx
je 0x41a833
cmp dl, 0x20
jle 0x41a8bc
cmp dl, 0x2e
je 0x41a8b5
cmp dl, 0x2c
je 0x41a8b5
mov dword [ebp + 8], ecx
mov eax, ecx
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add dword [ebp + 8], eax
movsx eax, dl
adc edi, ecx
cdq
mov ecx, dword [ebp + 8]
shld edi, ecx, 1
add ecx, ecx
add ecx, eax
adc edi, edx
sub ecx, 0x30
sbb edi, 0
mov dword [ebp - 4], edi
jmp 0x41a8b8
mov dword [ebp - 8], esi
inc esi
mov dword [ebp + 8], esi
cmp byte [esi], 0x20
jg 0x41a820
mov edx, edi
call fcn.004386c0
mov eax, dword [ebp - 8]
pop edi
test eax, eax
je 0x41a8df
sub esi, eax
divsd xmm0, qword [esi*8 + 0x4d7598]
cmp dword [ebp - 0xc], 0
pop esi
je 0x41a8ed
xorps xmm0, xmmword [0x4567a0]
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x41ca50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e7a20], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, str.UNKNOWN
je 0x41cbab
test edi, edi
je 0x41cbab
cmp dword [ebp + 8], 1
je 0x41cb4b
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp byte [edi], bl
je 0x41cbab
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x41caa0
sub esi, ecx
lea eax, [esi + 4]
push eax
call fcn.00442d35
mov dword [ebp - 0xc], eax
lea eax, [esi + 1]
push eax
push edi
mov edi, dword [ebp - 0xc]
push edi
call fcn.004394d0
mov eax, esi
add esp, 0x10
and eax, 3
je 0x41cae7
push eax
mov eax, esi
and eax, 0xfc
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.004394d0
mov ebx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
je 0x41caf9
nop
xor ebx, dword [edi + esi*4 - 4]
dec esi
test esi, esi
jne 0x41caf0
mov esi, dword [ebp - 0xc]
mov eax, 0x446f8657
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ebx, eax
mov eax, dword [0x4e7a20]
mov edi, dword [eax + ebx*4 + 4]
test edi, edi
je 0x41cb39
push dword [edi]
push esi
call fcn.004444b3
add esp, 8
test eax, eax
je 0x41cb39
mov edi, dword [edi + 0x1a0]
test edi, edi
jne 0x41cb20
push esi
call fcn.0043d146
add esp, 4
test edi, edi
je 0x41cbab
mov ebx, str.UNKNOWN
mov ecx, dword [edi + 4]
mov eax, 0x446f8657
mov esi, dword [ebp + 0x10]
test ecx, ecx
cmovne ebx, ecx
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov eax, dword [edi + ecx*4 + 0xc]
test eax, eax
je 0x41cb98
cmp esi, dword [eax]
je 0x41cb95
mov eax, dword [eax + 8]
test eax, eax
jne 0x41cb77
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 4]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380f8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, str.UNKNOWN
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x422fb0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x479bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi]
cmp ecx, 0xf
jne 0x422fe6
lea ecx, [ebp - 0x54]
push ecx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
movups xmm0, xmmword [ebp - 0x4c]
mov ebx, eax
movups xmmword [ebp - 0x64], xmm0
jmp 0x423033
cmp ecx, 0x85
jne 0x42300f
push 0x81
push dword [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetDCEx]
mov ebx, eax
lea eax, [ebp - 0x64]
push 0
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetUpdateRect]
jmp 0x423033
cmp ecx, 0x14
jne 0x42301e
mov ebx, dword [edi + 0x24]
lea ecx, [ebp - 0x64]
push ecx
push eax
jmp 0x42302d
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, eax
lea eax, [ebp - 0x64]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x58]
mov esi, eax
sub ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push ebx
mov dword [ebp - 0x68], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
movups xmm0, xmmword [ebp - 0x64]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x14]
push 2
push eax
push dword [edi]
movups xmmword [ebp - 0x14], xmm0
call esi
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov esi, dword [ebp - 0x68]
push edi
mov dword [edi + 0x18], esi
call fcn.004232c0
mov eax, dword [edi + 0x10]
add esp, 4
cmp dword [eax], 5
jne 0x4230b5
call fcn.00415230
test dword [eax + 4], 0x20000
jne 0x4230da
xor eax, eax
cmp dword [edi + 0x2c], 0x85
setne al
lea eax, [eax*2 + 2]
push eax
push esi
push 0x318
push dword [edi]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x60]
push 0xcc0020
push 0
push 0
push esi
push eax
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x64]
push eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
call fcn.00422e10
push edi
call fcn.004232c0
add esp, 8
push dword [ebp - 0x6c]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [edi + 0x2c]
pop esi
cmp eax, 0xf
jne 0x42313b
lea eax, [ebp - 0x54]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x423149
cmp eax, 0x14
je 0x423149
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov dword [edi + 0x18], 0
xor ecx, ebp
pop edi
pop ebx
call fcn.004380f8
mov esp, ebp
pop ebp
ret
Function at 0x427950
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, si
lea eax, [esi - 0x70]
cmp ax, 0xb
ja 0x42797f
lea eax, [edi - 0x6f]
push eax
push 0x456f34
push 0x4e826c
call fcn.00401030
add esp, 0xc
jmp 0x427a1f
push 0x32
push 0x4e826c
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
or eax, 0x100
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x427a1f
call fcn.00415230
test eax, eax
je 0x427a1f
call fcn.00415230
cmp dword [eax], 0
je 0x427a1f
mov eax, dword [0x48d5e0]
push ebx
test eax, eax
je 0x4279c7
mov ebx, dword [eax + 0x190]
jmp 0x4279cd
mov ebx, dword [0x48d5e4]
call fcn.00415230
test eax, eax
je 0x4279e2
call fcn.00415230
mov eax, dword [eax]
mov dword [ebp + 8], eax
jmp 0x4279e9
mov dword [ebp + 8], 0
push str.Error_getting_virtual_key_name_for_scan_key__02X:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00408c60
add esp, 8
push eax
push edi
push str.Error_getting_virtual_key_name_for_scan_key__02X:__s
push dword [0x48d5e0]
push ebx
push 0
push 0x62
push str.D:MyProjectsProPilotLibMainMenu.c
push 2
call dword [ebp + 8]
add esp, 0x28
pop ebx
pop edi
cmp si, 0xd
pop esi
jne 0x427a3d
push 0x20
push 0x4e826c
call fcn.00444792
add esp, 8
test eax, eax
je 0x427a3d
inc eax
jmp 0x427a42
mov eax, 0x4e826c
cmp byte [eax], 0
mov dword [0x4e82a0], eax
je 0x427a5b
inc eax
push eax
call fcn.0044466c
mov eax, dword [0x4e82a0]
add esp, 4
pop ebp
ret