joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ffc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetErrorMode
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40622c
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x40607f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40622c
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x40607f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406248
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x406108
xor eax, eax
push ebp
push 0x406101
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e44
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x4060e6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406268
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x4060e6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406108
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetThreadContext
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetNamedPipeHandleState
push eax
call sub.KERNEL32.DLL_SetEndOfFile
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406222
cmp byte [ebp - 0xd], 0
jne 0x40614f
cmp byte [ebp - 0x12], 0
je 0x406222
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406168
dec ebx
cmp byte [ebx], 0x2e
je 0x406177
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406167
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406222
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4061b4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
test esi, esi
jne 0x406222
cmp byte [ebp - 0xd], 0
je 0x406222
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
test esi, esi
jne 0x406222
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetThreadContext
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4068f4
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40695a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404c0c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403484
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406944
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406961
lea eax, [ebp - 0x10]
call fcn.0040499c
ret
Function at 0x40963c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404e5c
push eax
call sub.user32.dll_MsgWaitForMultipleObjects
test eax, eax
jne 0x40965e
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x409664
Capabilities:
Get keyboard layout

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x409684
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call fcn.00406e6c
test eax, eax
jne 0x409684
call sub.user32.dll_GetKeyboardLayoutList
jmp 0x4096c3
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x40966c
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_EnableScrollBar
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_EnableMenuItem
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.00404c0c
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x409718
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call fcn.00406e6c
test eax, eax
je 0x409735
mov eax, ebx
call fcn.00409664
pop ebx
ret
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret

Function at 0x4098c8
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.00404e5c
push eax
call sub.user32.dll_GetKeyboardLayout
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.00404a8c
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x40adec
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffffe0
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardState
mov cx, word [esp + 0xe]
mov dx, word [esp + 0xa]
mov ax, word [esp + 8]
call fcn.0040ac28
fstp qword [esp + 0x18]
wait
mov ax, word [esp + 0x16]
push eax
mov cx, word [esp + 0x18]
mov dx, word [esp + 0x16]
mov ax, word [esp + 0x14]
call fcn.0040aa88
fadd qword [esp + 0x18]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x20
ret

Function at 0x40ae3c
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xfffffff0
push esp
call sub.user32.dll_GetKeyboardState
mov ax, word [esp]
add esp, 0x10
ret
Function at 0x40d3b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d486
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a34
lea eax, [ebp - 8]
call fcn.00404eac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e5c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d470
mov eax, ebx
call fcn.00402764
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d469
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e5c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d453
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d498
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d453
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d470
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d48d
lea eax, [ebp - 8]
call fcn.0040499c
ret

Function at 0x40e268
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40e2f8
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
test ebx, ebx
je 0x40e2c4
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0040c334
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x4a59c0]
mov dl, 1
mov eax, dword [0x408928]
call fcn.0040cc58
mov edx, eax
jmp 0x40e2d8
mov ecx, dword [0x4a5b14]
mov dl, 1
mov eax, dword [0x408928]
call fcn.0040cc1c
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e2ff
lea eax, [ebp - 0x14]
call fcn.0040499c
ret
Function at 0x4180f4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x418117
add esp, 0xfffffff0
call fcn.00403ed0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x41821d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x41819f
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.00409404
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00417fec
cmp dword [ebx + 4], 0
jge 0x418202
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004098c8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x1c]
call fcn.0040c334
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4a5bc4]
mov dl, 1
mov eax, dword [0x412ca4]
call fcn.0040cc58
call fcn.00404338
jmp 0x418202
movzx edx, di
mov eax, esi
call fcn.00409388
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00417fec
cmp dword [ebx + 4], 0
jge 0x418202
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004098c8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x24]
call fcn.0040c334
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4a54d4]
mov dl, 1
mov eax, dword [0x412d00]
call fcn.0040cc58
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418224
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004049c0
ret
Function at 0x41b84c
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.user32.dll_GetCursorPos
mov edx, dword [0x4a5bc8]
cmp eax, dword [edx]
je 0x41b88f
call sub.user32.dll_GetCursorPos
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x4a5974]
mov dl, 1
mov eax, dword [0x413ddc]
call fcn.0040cc58
call fcn.00404338
test ebx, ebx
jle 0x41b89c
mov eax, ebx
call fcn.0041b80c
jmp 0x41b8a1
call fcn.0041b800
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4a6868
call sub.user32.dll_DrawIconEx
xor eax, eax
push ebp
push 0x41b9da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x4a3410
call sub.user32.dll_FindWindowA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41b9bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x41b8ec
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41b8f0
xor eax, eax
jmp 0x41b8f2
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41b9a5
jmp 0x41b998
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415814
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415704
push 0x4a6868
call sub.user32.dll_InvalidateRect
xor eax, eax
push ebp
push 0x41b985
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41b956
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41b96d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b98c
push 0x4a6868
call sub.user32.dll_DrawIconEx
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41b904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b9c2
mov eax, dword [ebp - 0xc]
call fcn.00403bac
ret

Function at 0x41ba94
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x41baad
add esp, 0xfffffff0
call fcn.00403ed0
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x41bb3e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403b7c
call fcn.0041b834
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], bl
push esi
push 4
lea eax, [esi + 8]
push eax
mov ecx, 0x41b9ec
xor edx, edx
xor eax, eax
call fcn.00404950
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x41bb28
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x10]
call fcn.0040c334
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a5aec]
mov dl, 1
mov eax, dword [0x413ddc]
call fcn.0040cc58
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bb45
lea eax, [ebp - 0x10]
call fcn.0040499c
ret

Function at 0x41eca0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41eca6
ret
Function at 0x420be4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x420c80
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
test ebx, ebx
je 0x420c62
push 0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x400
push ebx
push 0
push 0x1000
call sub.user32.dll_EqualRect
test eax, eax
je 0x420c62
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.00404c0c
mov ecx, dword [ebp - 0x104]
mov dl, 1
mov eax, dword [0x413084]
call fcn.0040cb60
call fcn.00404338
jmp 0x420c67
call fcn.00420b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420c87
lea eax, [ebp - 0x104]
call fcn.0040499c
ret
Function at 0x429070
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, eax
push edx
mov eax, dword [esi + 4]
push eax
call sub.user32.dll_RemovePropA
sub eax, 0xffffffff
je 0x4290a2
dec eax
je 0x42909a
sub eax, 0x80
je 0x429096
sub eax, 0x82
je 0x42909e
jmp 0x4290ae
mov bl, 2
jmp 0x4290b0
xor ebx, ebx
jmp 0x4290b0
mov bl, 1
jmp 0x4290b0
mov bl, 3
call sub.user32.dll_GetKeyboardLayoutList
mov dword [esi + 8], eax
jmp 0x4290b0
mov bl, 3
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x42a470
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x42a59e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.004077ac
test eax, eax
je 0x42a571
xor eax, eax
push ebp
push 0x42a56a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c5c
inc eax
push eax
push 0x2002
call sub.user32.dll_GetWindowDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42a53f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowTextA
mov ebx, eax
xor eax, eax
push ebp
push 0x42a52e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c5c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404e5c
mov edx, ebx
pop ecx
call fcn.00402a10
call fcn.004074ec
mov eax, dword [ebp - 8]
push eax
push 1
call fcn.00407854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a535
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_InsertMenuItemA
ret
mov ecx, dword [0x4a558c]
mov dl, 1
mov eax, dword [0x407f94]
call fcn.0040cc1c
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a5a5
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x42d6ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x42d77e
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.user32.dll_GetWindowDC
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x42d750
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowTextA
xor edx, edx
push ebp
push 0x42d73f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00402a10
mov eax, dword [ebp - 4]
call fcn.0042d5e8
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call fcn.00407854
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d746
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_InsertMenuItemA
ret

Function at 0x42d790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call fcn.0040757c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42d802
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x42d7d6
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, eax
mov eax, ebx
call fcn.00404b94
jmp 0x42d7dd
mov eax, ebx
call fcn.0040499c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d809
cmp dword [ebp - 8], 0
je 0x42d7f9
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_InsertMenuItemA
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x434b14
Capabilities:
Read clipboard data

Disassembly:
push ebx
push ecx
mov ebx, eax
push esp
push ebx
call fcn.004076cc
test eax, eax
je 0x434b40
call sub.user32.dll_GetClipboardData
cmp eax, dword [esp]
jne 0x434b40
push 0
push 0
mov eax, dword [0x4a6b58]
push eax
push ebx
call fcn.00407834
pop edx
pop ebx
ret
xor eax, eax
pop edx
pop ebx
ret

Function at 0x434b48
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x434b9c
push esp
push ebx
call fcn.004076cc
test eax, eax
je 0x434b9c
call sub.user32.dll_GetClipboardData
cmp eax, dword [esp]
jne 0x434b9c
mov eax, dword [0x4a6b54]
call fcn.00404e5c
push eax
call sub.user32.dll_GetWindowPlacement
cmp ax, word [0x4a6b4e]
jne 0x434b93
movzx eax, word [0x4a6b4e]
push eax
push ebx
call fcn.0040763c
mov esi, eax
jmp 0x434b9c
mov eax, ebx
call fcn.00434b14
mov esi, eax
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x4359cc
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x435a26
push esp
push esi
call fcn.004076cc
test eax, eax
je 0x435a26
call sub.user32.dll_GetClipboardData
cmp eax, dword [esp]
jne 0x435a26
mov eax, dword [0x4a6b50]
call fcn.00404e5c
push eax
call sub.user32.dll_GetWindowPlacement
cmp ax, word [0x4a6b4c]
jne 0x435a1a
movzx eax, word [0x4a6b4c]
push eax
push esi
call fcn.0040763c
test eax, eax
setne bl
jmp 0x435a26
mov eax, esi
call fcn.00434b14
test eax, eax
setne bl
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x443114
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44328c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4432a0
call fcn.0040a1b8
mov edx, dword [ebp - 4]
mov eax, 0x4a6b50
call fcn.004049f0
mov eax, dword [0x4a6b50]
call fcn.00404e5c
push eax
call sub.user32.dll_GetUserObjectInformationA
mov word [0x4a6b4c], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4a6664]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.user32.dll_GetCursorPos
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4432b4
call fcn.0040a1b8
mov edx, dword [ebp - 0x10]
mov eax, 0x4a6b54
call fcn.004049f0
mov eax, dword [0x4a6b54]
call fcn.00404e5c
push eax
call sub.user32.dll_GetUserObjectInformationA
mov word [0x4a6b4e], ax
mov eax, dword [0x4a6b54]
call fcn.00404e5c
push eax
call fcn.004077fc
mov dword [0x4a6b58], eax
mov dl, 1
mov eax, dword [0x4131a4]
call fcn.00415a80
mov dword [0x4a6b90], eax
call fcn.00442d18
mov dl, 1
mov eax, dword [0x4349f4]
call fcn.00442b40
mov dword [0x4a6b40], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x44df80]
call fcn.00454bec
mov edx, dword [0x4a5b94]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x44e058]
call fcn.00455cd0
mov edx, dword [0x4a5978]
mov dword [edx], eax
mov eax, dword [0x4a5978]
mov eax, dword [eax]
mov dl, 1
call fcn.004578d0
mov ecx, 0x434d68
mov edx, 0x434d78
mov eax, dword [0x432a74]
call fcn.004151dc
push 0x4432c8
call sub.user32.dll_GetMenuItemCount
mov ebx, eax
test ebx, ebx
je 0x44326e
push 0x4432d0
push ebx
call fcn.00406f5c
mov dword [0x4a3a88], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443293
lea eax, [ebp - 0x10]
call fcn.0040499c
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x4579fc
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457b0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00457984
mov ebx, eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x457a45
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
jne 0x457a45
mov eax, dword [ebp - 4]
call fcn.00457f54
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00455a1c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00434dcc
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4a6be0]
call fcn.00457bbc
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x457ab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x102], 0
je 0x457a9b
lea ecx, [ebp - 5]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x104]
call dword [ebx + 0x100]
cmp byte [ebp - 5], 0
je 0x457aa9
mov eax, dword [ebp - 4]
call fcn.00457920
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x457ac8
call sub.user32.dll_GetCursorPos
mov edx, dword [0x4a5bc8]
cmp eax, dword [edx]
jne 0x457ae6
xor eax, eax
call fcn.0041b84c
test al, al
je 0x457ae6
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x457af1
call fcn.00407944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b13
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004049c0
ret