joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46188c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4618a3
add esp, 0xfffffff0
call fcn.00403be0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041acc8
mov eax, dword [0x523340]
cmp word [eax + 2], 0
jne 0x4618cb
mov eax, dword [0x523340]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463354
mov eax, dword [0x523400]
cmp word [eax + 2], 0
jne 0x4618e5
mov eax, dword [0x523400]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00463560
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412aac]
call fcn.0040388c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412aac]
call fcn.0040388c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412aac]
call fcn.0040388c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41f3ec]
call fcn.00427028
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x461a9c
mov eax, dword [0x523248]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004273fc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x463c20
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x523248]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d56c
test eax, eax
je 0x4619ec
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409598
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d5a0
test eax, eax
je 0x461a00
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404958
mov byte [ebx + 0xd4], 0
push ebx
push 0x462e9c
call fcn.0041be44
mov dword [ebx + 0xc8], eax
mov eax, dword [0x523100]
cmp byte [eax], 0
jne 0x461a51
mov eax, ebx
call fcn.00461be0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00463dfc
mov eax, ebx
call fcn.0046495c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x461a91
call fcn.00403c38
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461e60
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x52757c]
cmp dword [eax + 0x30], 0
je 0x461f0a
cmp dword [ebx + 0x94], 0
jne 0x461f04
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x461df0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461f04
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x461eca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461f04
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414e58
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x461ed9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x462c24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x462c59
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047d8
jmp 0x462c66
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040473c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x463fe0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46404e
mov eax, esi
call fcn.0044e1b8
test al, al
je 0x46404e
mov eax, dword [ebx + 0x84]
call fcn.0044de18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46404e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x464042
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044de18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00446238
jmp 0x46404e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00463e1c
pop esi
pop ebx
ret

Function at 0x464a54
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b9c
xor eax, eax
push ebp
push 0x464add
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2e
je 0x464a91
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x464af8
call fcn.004049f8
push 0x4410
push 0x160
lea eax, [ebp - 0x164]
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00404bac
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404958
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464ae4
lea eax, [ebp - 4]
call fcn.004046e8
ret
Function at 0x47c1b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c268
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x10d], 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x105
lea eax, [ebp - 0x10d]
push eax
lea eax, [ebp - 0x114]
mov edx, ebx
call fcn.004048d0
lea eax, [ebp - 0x114]
mov edx, 0x47c280
call fcn.004049b4
mov eax, dword [ebp - 0x114]
call fcn.00404bac
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x47c248
lea eax, [ebp - 0x10d]
call fcn.0040955c
mov ecx, eax
lea edx, [ebp - 0x10d]
mov eax, esi
call fcn.004047d8
jmp 0x47c24f
mov eax, esi
call fcn.004046e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c26f
lea eax, [ebp - 0x114]
call fcn.004046e8
ret
Function at 0x40e19c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.004106c0
mov eax, dword [0x416038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea eax, [ebp - 0x10010]
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push eax
xor edi, edi
push edi
push edi
push esi
call ebx
test eax, eax
je 0x40e232
cmp dword [ebp + 0xc], edi
je 0x40e1e5
push edi
push edi
push edi
push dword [ebp + 0xc]
push esi
call ebx
test eax, eax
je 0x40e232
cmp dword [ebp + 0x10], edi
jbe 0x40e21f
mov ecx, 0x10000
push 0
lea eax, [ebp - 0x10008]
push eax
push ecx
lea eax, [ebp - 0x10004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e21f
mov ecx, 0x10000
cmp dword [ebp - 0x10008], ecx
jne 0x40e21f
add edi, ecx
cmp edi, dword [ebp + 0x10]
jb 0x40e1ef
push 0
push 0
push dword [ebp - 0x1000c]
push dword [ebp - 0x10010]
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410238
mov esp, ebp
pop ebp
ret

Function at 0x40ffd7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x416094]
test eax, eax
je 0x40ffee
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410048
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll__vscprintf]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x410047
inc edi
lea eax, [ebp - 4]
push edi
push eax
call fcn.00401416
mov esi, dword [ebp - 4]
pop ecx
pop ecx
test esi, esi
je 0x410047
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.MSVCR120.dll__vsnprintf]
add esp, 0x10
mov byte [esi + edi - 1], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.mozglue.dll_free]
pop ecx
pop edi
push 0x414794
push 2
call dword [sym.imp.MSVCR120.dll__dup]
pop ecx
push eax
call dword [sym.imp.MSVCR120.dll__fdopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41007c
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR120.dll_vfprintf]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4987b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7e000]
push edi
jmp 0x4987ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4987d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4987c0
mov eax, 1
add ebx, ebx
jne 0x4987e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4987f4
jne 0x498813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498813
dec eax
add ebx, ebx
jne 0x498800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4987d8
add ebx, ebx
jne 0x49880f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x498865
xor ecx, ecx
sub eax, 3
jb 0x49882b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49889a
sar eax, 1
mov ebp, eax
jmp 0x498836
add ebx, ebx
jne 0x498836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498804
inc ecx
add ebx, ebx
jne 0x498844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498804
add ebx, ebx
jne 0x498851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x498846
jne 0x498862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x498846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x498884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x498876
jmp 0x4987c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x498884
add edi, ecx
jmp 0x4987c6
pop esi
mov edi, esi
mov ecx, 0x609
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4988a2
cmp byte [edi], 0xb
jne 0x4988a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4988a7
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x49891f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa56c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5870]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4988d4
mov ecx, edi
jns 0x498903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa5878]
or eax, eax
je 0x498919
mov dword [ebx], eax
add ebx, 4
jmp 0x4988f1
call dword [esi + 0xa5874]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x498950
cmp al, 0xef
ja 0x498943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x498925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x498932
mov ebp, dword [esi + 0xa587c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x498984
sub esp, 0xffffff80
jmp 0x419a90
Function at 0x404735
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406928
call fcn.0040545b
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048ac
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048a5
cmp dword [ebx + edi*4], 0
je 0x404898
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404898
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x404892
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404892
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x404892
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.004028a2
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x404883
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x404883
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x404883
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x404883
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a3b
mov byte [ebp - 0x231], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401780
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x40479b
push ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.00405416
ret

Function at 0x404ace
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.004028a2
pop ecx
push 2
call dword [sym.imp.kernel32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404735
test al, al
jne 0x404afd
xor eax, eax
inc eax
jmp 0x404b0c
push esi
call fcn.00404935
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40b4ca
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
xor ebp, ebp
cmp dword [esp + 8], ebp
je 0x40b4e4
push dword [esp + 8]
push 0x40b439
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x40b537
push esi
mov esi, dword [0x41e8cc]
cmp esi, ebp
je 0x40b536
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40b52e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp dword [esi + 0x10], ebp
je 0x40b521
push 3
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x41e8cc
call fcn.00419ad7
pop ecx
pop ecx
cmp ebx, ebp
mov esi, ebx
jne 0x40b4f1
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x40c893
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push dword [edi]
xor esi, esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.DLL_GetClientRect]
cmp dword [ebp + 0xc], esi
jne 0x40c8c6
push dword [edi]
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], 1
test byte [edi + 0x14], 8
je 0x40c9b6
call dword [sym.imp.USER32.DLL_GetFocus]
cmp dword [edi], eax
jne 0x40c9b6
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push ebx
mov ebx, dword [ebp - 0x10]
sub ebx, dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp - 4], eax
jle 0x40c9a1
cmp ebx, esi
jle 0x40c9a1
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov edi, eax
cmp edi, esi
je 0x40c99e
push ebx
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x40c997
push eax
push edi
call dword [sym.imp.GDI32.DLL_SelectObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp eax, esi
je 0x40c94a
push 4
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push esi
push edi
call dword [sym.imp.USER32.DLL_DrawStateA]
jmp 0x40c95d
push esi
call dword [sym.imp.GDI32.DLL_GetStockObject]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.USER32.DLL_FillRect]
push 2
pop eax
add dword [ebp - 0x1c], eax
add dword [ebp - 0x18], eax
sub dword [ebp - 0x14], eax
sub dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.USER32.DLL_DrawFocusRect]
push 0xcc0020
push esi
push esi
push edi
push ebx
push dword [ebp - 4]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.DLL_BitBlt]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.DLL_DeleteObject]
push edi
call dword [sym.imp.GDI32.DLL_DeleteDC]
mov edi, dword [ebp + 8]
pop ebx
cmp dword [ebp - 8], esi
je 0x40c9b2
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.USER32.DLL_ReleaseDC]
pop edi
pop esi
leave
ret
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x40c9d2
push 4
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.DLL_DrawStateA]
jmp 0x40c9a2
push esi
call dword [sym.imp.GDI32.DLL_GetStockObject]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.DLL_FillRect]
jmp 0x40c9a2

Function at 0x40c9f9
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push edi
push 1
xor edi, edi
call esi
test ax, ax
jns 0x40ca0d
inc edi
push 2
call esi
test ax, ax
jns 0x40ca19
or edi, 2
push 4
call esi
test ax, ax
jns 0x40ca25
or edi, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x40ca2a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, eax
call dword [sym.imp.USER32.DLL_GetMessagePos]
push 0xfffffffffffffff4
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.DLL_GetWindowLongA]
push str.PB_WindowID
push dword [edi]
mov dword [ebp - 0xc], eax
call fcn.0040eccb
push eax
call dword [sym.imp.USER32.DLL_GetPropA]
push dword [0x41ea58]
dec eax
mov dword [ebp - 8], eax
call fcn.004196d8
mov esi, eax
movsx eax, bx
mov dword [ebp - 0x14], eax
shr ebx, 0x10
movsx eax, bx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.USER32.DLL_ScreenToClient]
mov edi, dword [sym.imp.USER32.DLL_GetKeyState]
push 0x10
call edi
mov ebx, 0x8000
test bx, ax
je 0x40caa8
mov dword [ebp - 4], 1
push 0x12
call edi
test bx, ax
je 0x40cab5
or dword [ebp - 4], 2
push 0x11
call edi
test bx, ax
je 0x40cac2
or dword [ebp - 4], 4
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
call fcn.0040c9f9
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
push 0x40c9e9
push esi
push dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
push dword [ebp - 0xc]
mov dword [esi + 0x14], eax
movzx eax, byte [ebp + 0x14]
push 0x332c
mov dword [esi + 0x18], eax
call fcn.0041088a
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e75e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [0x41ee90]
call fcn.004194e9
mov ebx, eax
call fcn.0040e9a8
xor edi, edi
cmp dword [0x41eda0], edi
jne 0x40e8bd
mov esi, 0x98
push esi
push edi
push 0x41ed08
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x41ed0c], esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RICHED20.DLL
mov dword [0x41ed08], 0x16
mov dword [0x41ed28], 0x40e070
mov dword [0x41ed20], 0x40e20c
mov dword [0x41ed24], 0x40e239
mov dword [0x41ed3c], 0x40e14e
mov dword [0x41ed34], 0x40e179
mov dword [0x41ed30], 0x40e193
mov dword [0x41ed48], 0x40e261
mov dword [0x41ed4c], 0x40e2d2
mov dword [0x41ed70], 0x40e401
mov dword [0x41ed74], 0x40e42d
mov dword [0x41ed84], 0x40e3db
mov dword [0x41ed80], 0x40e34c
call esi
cmp eax, edi
mov dword [0x41eda4], eax
jne 0x40e83d
push str.RICHED32.DLL
call esi
mov eax, dword [0x41e8d8]
cmp eax, edi
je 0x40e8b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push eax
call esi
push str.CloseThemeData
push dword [0x41e8d8]
mov dword [0x41ecfc], eax
call esi
push str.GetThemeBackgroundContentRect
push dword [0x41e8d8]
mov dword [0x41ecf8], eax
call esi
push str.IsThemeBackgroundPartiallyTransparent
push dword [0x41e8d8]
mov dword [0x41ecf4], eax
call esi
push str.DrawThemeParentBackground
push dword [0x41e8d8]
mov dword [0x41ecf0], eax
call esi
push str.DrawThemeBackground
push dword [0x41e8d8]
mov dword [0x41ecec], eax
call esi
mov dword [0x41ece8], eax
mov dword [0x41eda0], 1
mov eax, dword [0x41e8d4]
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
cmp dword [0x41eda4], edi
mov ecx, str.RichEdit20A
jne 0x40e8e2
mov ecx, str.RichEdit
mov edx, dword [ebp + 0x1c]
push edi
push dword [0x41e524]
or edx, 0x503111c4
push 0xffffffffffffffff
push dword [ebx]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push edi
push ecx
push eax
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov esi, eax
cmp esi, edi
je 0x40e99f
push dword [ebp + 8]
push dword [0x41ee8c]
call fcn.00419377
push 0x10
mov ebx, eax
or dword [ebx + 0x18], 0xffffffff
or dword [ebx + 0x14], 0xffffffff
push 8
push dword [0x41e520]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push str.PB_ClientRect
push esi
call dword [sym.imp.USER32.DLL_SetPropA]
push edi
push 0xffffffffffffffff
push 0xc5
push esi
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x40e648
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.DLL_SetWindowLongA]
push 0x37
push edi
push edi
push edi
push edi
push edi
push esi
mov dword [0x41ed00], eax
call dword [sym.imp.USER32.DLL_SetWindowPos]
push 0x541
push edi
push edi
push esi
call dword [sym.imp.USER32.DLL_RedrawWindow]
call fcn.0040f272
push 0x41ed08
push esi
push ebx
push dword [ebp + 8]
call fcn.0040ec50
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x18