joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40604e
Capabilities:
Print debug messages

Disassembly:
push 0x14
push 0x408098
call fcn.00403c84
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
cmp dword [0x40a1d8], esi
je 0x40607c
push 0x40a1c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], esi
xor eax, eax
mov word [0x40aa00], ax
mov edi, 0x40aa00
cmp dword [ebp + 0x14], esi
je 0x4060ab
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push 0x3fd
push edi
call fcn.00405047
xor eax, eax
mov word [0x40b1fa], ax
mov ebx, 0x400
cmp word [0x40aa00], si
je 0x4060c5
push 0x401af0
push ebx
push edi
call fcn.00404255
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x4060ca
sub eax, ecx
sar eax, 1
mov ecx, ebx
sub ecx, eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.004050bc
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0
je 0x4060fe
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.00405286
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push dword [esi]
call fcn.004052c5
cmp dword [esi], 0
jne 0x406116
cmp dword [esi + 0x18], 0
je 0x406127
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00405348
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
call fcn.004054fa
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 8]
movzx eax, word [esi + 4]
push eax
call fcn.0040562e
mov ecx, dword [esi + 8]
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x40615b
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004061f2
cmp dword [esi + 0x18], ebx
je 0x4061cc
cmp dword [esi + 0x1c], ebx
je 0x4061cc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x406184
call fcn.004067d4
test eax, eax
je 0x4061cc
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4024a0
push 0x3ff
push 0x40a200
call fcn.00404296
add esp, 0x20
push 0x402410
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call ebx
push 0x40a200
call ebx
push 0x402380
call ebx
cmp dword [esi + 0x18], 0
je 0x4061e4
push dword [esi + 0x1c]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00405cd4
call fcn.00403cc9
ret
Function at 0x4062b1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x40900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push ebx
push edi
mov dword [ebp - 0xf8], 0xf0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406325
cmp dword [ebp - 0xf8], 2
jb 0x406356
mov eax, dword [ebp - 0xf4]
and eax, 0xffdf
cmp eax, 0x4e
je 0x406320
cmp eax, 0x59
jne 0x406356
mov dword [esi], 1
jmp 0x406356
and dword [esi], 0
jmp 0x406356
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0x4e
mov word [ebp - 0xf4], ax
xor eax, eax
push 4
mov word [ebp - 0xf2], ax
lea eax, [ebp - 0xf4]
push eax
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f0d
leave
ret 0xc

Function at 0x4072d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x407307
lea ecx, [ebp - 0xc]
call fcn.0040724e
push 0x408138
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__CxxThrowException
mov eax, esi
pop esi
leave
ret
Function at 0x4078d0
Capabilities:
Print debug messages

Disassembly:
push 8
push 0x408190
call fcn.00403c84
push 0x40b2cc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [0x40b24e], bl
jne 0x407957
push 0x40b258
push 0x20119
push ebx
push dword [0x409150]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x40794b
mov dword [0x40b258], ebx
push 0x403220
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, ebx
jle 0x407934
movzx esi, si
or esi, 0x80070000
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x40900c
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
mov eax, esi
jmp 0x407965
call fcn.00407481
mov byte [0x40b24e], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.0040796d
xor eax, eax
call fcn.00403cc9
ret 4

Function at 0x4079b5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x40900c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x40b24c], 0
push esi
mov esi, dword [ebp + 8]
je 0x407a39
push edi
mov edi, 0x40b264
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x404]
push 0x200
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x408], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp eax, 0x8007007a
jne 0x407a18
mov eax, dword [esi]
lea ecx, [ebp - 0x408]
push ecx
mov ecx, esi
call dword [eax + 4]
test eax, eax
jl 0x407a31
push dword [ebp - 0x408]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x4032f8
call esi
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403f0d
leave
ret 4
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
pop ebp
ret
push ebp
mov ebp, esp
fldlg2
js 0x401e73
mov esi, dword [ebp - 0xd]
popal
lea eax, [ebp - 0x78]
push 0x71
push eax
aaa
call fcn.004086de
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push eax
push ecx
add edx, 0x40
push 0x440d4ac
lahf
rcl dword [0x3583c10a], 0xd2
lodsb al, byte [esi]
add al, byte [ecx - 0x2d]
add esp, 0x14
push ds
cmp eax, dword [ebx - 0x715faff0]
rol byte [eax - 0x43], cl
stc
adc eax, 0xb9c164
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
jae 0x401e26
nop
nop
nop
nop
nop
nop
sbb dword [eax - 0x74aa6f70], edx
in al, dx
adc dword [ebp - 0x74a9dbec], 0x75
or byte [edi - 0x2c], dl
inc esi
adc al, 0x89
inc ebp
or al, dh
dec ecx
dec ebx
je 0x401eb7
mov dword [0x410ba0], eax
mov dword [0x413ba4], edx
mov edi, dword [ebx]
mov eax, dword [esi + 0x14]
test eax, eax
jnp 0x401ec5
inc esi
adc al, 0x85
sar byte [ebx - 6], 0x75
inc eax
jne 0x401f0d
mov ecx, dword [esi + 0x6f]
mov word [eax], es
pushfd
add byte [ecx], cl
call fcn.00408c70
mov dword [esi + 0x663808a6], ebx
mov dword [esi + 0x83c], edi
invalid
mov ecx, dword [esi + 0xda0838]
mov eax, dword [0x40d028]
mov edx, dword [0x40d02c]
add ecx, eax
mov eax, dword [esi + 0x83c]
adc eax, edx
cmp edi, eax
jg 0xc1d615
adc al, 8
cmp ecx, dword [esi]
psadbw mm3, mm3
add byte [ecx], ch
add byte [ebx + 0x1d8e1856], cl
xor al, dl
sti
add byte [ebx + 0x308d0446], cl
sub dword [eax], eax
mov edx, dword [esi + 0x18]
mov ds, word [0xfbd030]
mov eax, dword [esi + 4]
lea esi, [eax]
inc edx
add edx, ebx
push ecx
popal
push eax
call 0x968ac0
test eax, eax
je 0x401f60
scasd eax, dword es:[edi]
in eax, dx
or esi, dword [esi + ebp + 0x3d]
push 0x74000afd
daa
cmp eax, 0x9f0afcd9
je 0x401f8a
add byte [edi + 0x3d], dh
frndint
or bl, byte [edi + 0x574c2074]
dec esp
push edi
aaa
or al, byte [eax]
je 0x401f8a
cmp eax, 0xa0824
je 0x401f38
cmp eax, 0xafc18
je 0x401f8a
cmp eax, 0xb23b3
jne 0xd22030
mov eax, dword [ebp + 8]
mov ebx, dword [0x6302a0]
mov edi, dword [0x1e02a4]
add ebx, eax
adc edi, 0
mov dword [0x4152a0], ebx
mov eax, dword [0xa202a43d]
add byte [ebx + 0x4e9918b3], cl
adc al, 3
shr byte [ebx], 1
enter 0x5689, 0x18
xchg esi, eax
dec esi
adc al, 0xf
test esp, ebp
adc bh, bh
push edi
mov dword [esi + 8], 0xa
call 0x37405a00
mov dword [0x99528], eax
mov dword [0x9343d8a4], edx
mov edx, dword [esi + 4]
mov dword [esi + 0x840], eax
mov ecx, dword [0x410ba4]
add al, byte [ecx]
add dword [eax], 0xf0458900
push es
pop ds
hlt
Function at 0x408680
Capabilities:
Get number of processors

Disassembly:
arpl word [eax + 0x42], cx
push edi
bound ebx, qword [eax + 0x52]
popal
push esp
push esi
pop edx
popal
arpl word [ecx], si
je fcn.004086e0
dec edi
push edi
push 0x706b564e
push esi
push 0x49
xor dword [ecx + esi + 0x64], edx
dec eax
push ebx
imul ebp, dword [eax + 0x68], 0x52
xor byte [edx + 0x61], bl
push esi
imul edx, dword [esi + 0x77], 0x56
inc esi
jo 0x4086f8
inc edi
inc esi
push 0x62
inc edi
push edx
jp 0x408710
imul esp, dword [edi + esi*2 + 0x54], 0x6c
pop ecx
js 0x408714
pop eax
push 0x526e4d57
push 0x5a465459
push esi
dec esi
jae 0x40872b
inc esi
push edx
imul edx, dword [ebx + 0x45], 0x6d565a4a
je 0x408733
push ebx
xor dword [edi + eax*2 + 0x62], esp
inc edi
bound eax, qword [esi + 0x56]
pop ecx

Function at 0x4086de
Capabilities:
Get number of processors

Disassembly:
arpl word [eax + 0x42], cx
push edi
bound ebx, qword [eax + 0x52]
popal
push esp
push esi
pop edx
popal
arpl word [ecx], si
je fcn.004086e0
dec edi
push edi
push 0x706b564e
push esi
push 0x49
xor dword [ecx + esi + 0x64], edx
dec eax
push ebx
imul ebp, dword [eax + 0x68], 0x52
xor byte [edx + 0x61], bl
push esi
imul edx, dword [esi + 0x77], 0x56
inc esi
jo 0x4086f8
inc edi
inc esi
push 0x62
inc edi
push edx
jp 0x408710
imul esp, dword [edi + esi*2 + 0x54], 0x6c
pop ecx
js 0x408714
pop eax
push 0x526e4d57
push 0x5a465459
push esi
dec esi
jae 0x40872b
inc esi
push edx
imul edx, dword [ebx + 0x45], 0x6d565a4a
je 0x408733
push ebx
xor dword [edi + eax*2 + 0x62], esp
inc edi
bound eax, qword [esi + 0x56]
pop ecx

Function at 0x408db0
Capabilities:
Get number of processors

Disassembly:
outsd dx, dword [esi]
xor byte [edx + 0x44], bl
inc esi
dec edx
inc esi
pop edx
jne 0x408e10
insd dword es:[edi], dx
insb byte es:[edi], dx
push ebx
pop edx
pop ecx
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401087
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
lea eax, [ebp - 0x118]
push eax
mov edi, 0x104
push edi
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push dword [ebp + 8]
call fcn.00401401
call fcn.0040dfdb
test eax, eax
je 0x4010d6
push 0x10
push 0x469ede
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4012b8
cmp dword [0x47e6d0], 0
push ebx
push esi
jne 0x401106
push 0xffffffffffffffff
push dword [0x47e6d8]
mov esi, 0x47fee8
push 1
call fcn.004063e5
mov al, byte [0x4745ac]
mov byte [0x47feea], al
mov ebx, 0x47e6e4
jmp 0x40115c
lea eax, [ebp - 2]
push eax
push 0x47e6d0
mov esi, 0x47e6e4
mov ebx, 0x47fee8
call fcn.004069b1
test al, al
jne 0x401131
mov dword [0x4745c4], 1
jmp 0x4012a9
mov al, byte [0x47fee8]
mov byte [0x47e6d4], al
mov al, byte [0x47fee9]
push 0x47e6cc
mov byte [ebp - 1], al
lea eax, [ebp - 0x220]
push eax
push edi
mov ebx, 0x47e6e4
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
push dword [0x47e6d0]
push ebx
call fcn.00418e5f
test eax, eax
je 0x401192
mov edi, 0x47fee8
call fcn.00406538
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov dword [0x4745c4], 1
jmp 0x4012b6
cmp byte [ebp - 1], 1
jne 0x401244
cmp byte [0x47e6a5], 1
jne 0x401244
call fcn.0040d6d0
test al, al
jne 0x401244
push edi
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp byte [ebp - 2], 0
je 0x40121d
mov edi, 0x469f48
push edi
lea esi, [ebp - 0x10]
call fcn.0040e021
push ebx
mov eax, esi
call fcn.0040e1f0
push edi
mov eax, esi
call fcn.0040e1f0
push 1
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x220]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [ebp - 0x10]
call fcn.0044db10
pop ecx
jmp 0x40129f
push 1
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x220]
push eax
push str.runas
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40129f
call fcn.004012bd
call fcn.00401390
cmp byte [0x47e6d4], 0
jne 0x401261
mov edi, 0x47ef28
call fcn.00409d4e
push 1
mov eax, 0x47e7f0
call fcn.00418fbf
cmp byte [0x47e6d4], 0
jne 0x40129f
mov edi, 0x47f6b4
mov esi, dword [edi]
test esi, esi
je 0x401294
push dword [esi + 8]
call fcn.0044db10
push esi
call fcn.0044db10
and dword [edi], 0
pop ecx
pop ecx
add edi, 4
cmp edi, 0x47fed0
jl 0x40127b
mov edi, 0x47fee8
call fcn.00406538
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x401e61
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
push 1
push dword [esi]
call fcn.004036bd
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
xor ebp, ebp
push ebp
push 0x25
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x10], ebp
push eax
jge 0x401eb1
push 0x25
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
jmp 0x401ed3
push 0x27
push 0x100
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push 0x25
call edi
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push dword [esi]
call ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebp
push dword [esi]
call fcn.004036bd
pop edi
pop ebp
mov al, 1
pop ebx
ret 4

Function at 0x40231f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xb0
push dword [ebx]
call esi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x40234c
xor al, al
jmp 0x402360
push edi
push 0
push 0
push 0xe
push dword [ebx]
call esi
mov edi, eax
test edi, edi
jne 0x402366
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [edi + 0x101]
push eax
call fcn.0044daa6
pop ecx
push eax
mov dword [ebp - 4], eax
lea eax, [edi + 1]
push eax
push 0xd
push dword [ebx]
call esi
test eax, eax
je 0x4023b3
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x402393
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp + 8]
push ecx
call fcn.0040e132
mov bl, 1
push dword [ebp - 4]
call fcn.0044db10
pop ecx
mov al, bl
jmp 0x40235f
xor bl, bl
jmp 0x4023a6
Function at 0x403422
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp byte [esi + 8], 0
push edi
je 0x40345a
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esi + 0x30], eax
jne 0x403453
mov dword [esi + 0x3c], edi
xor eax, eax
jmp 0x40356b
mov dword [ebp - 4], 1
cmp byte [esi + 4], 0
mov edi, dword [sym.imp.USER32.dll_GetClassNameA]
push ebx
mov ebx, 0x100
je 0x403499
push ebx
lea eax, [ebp - 0x40c]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.0044dfd0
test eax, eax
pop ecx
pop ecx
jne 0x403496
mov dword [ebp - 8], 1
inc dword [ebp - 4]
cmp byte [esi + 7], 0
je 0x403504
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push eax
push ebx
call edi
mov edi, dword [esi + 0x18]
lea eax, [ebp - 0x40c]
push eax
call fcn.0044e140
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.0044e07f
add esp, 0x10
test eax, eax
jne 0x4034ff
inc dword [esi + 0x40]
push dword [esi + 0x40]
lea eax, [ebp - 0x40c]
push eax
push str._s_u
push eax
call fcn.0044e1cb
push dword [esi + 0x18]
lea eax, [ebp - 0x40c]
push eax
call fcn.0044dfd0
add esp, 0x18
test eax, eax
je 0x403560
inc dword [ebp - 4]
jmp 0x403507
mov ebx, dword [ebp + 8]
cmp byte [esi + 6], 0
je 0x403539
push 0x400
lea eax, [ebp - 0x40c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.0044dfd0
test eax, eax
pop ecx
pop ecx
je 0x403560
inc dword [ebp - 4]
cmp byte [esi + 5], 0
je 0x403558
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x403555
inc dword [esi + 0x40]
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x34]
jne 0x403555
inc dword [ebp - 8]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jne 0x403567
mov dword [esi + 0x3c], ebx
xor eax, eax
jmp 0x40356a
xor eax, eax
inc eax
pop ebx
pop edi
leave
ret 4

Function at 0x4036bd
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 1
jne 0x4036e8
lea eax, [ebp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x403703
push 1
jmp 0x4036ea
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop ebp
ret 8
Function at 0x4037bd
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x469ede
call fcn.0040e132
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xe
push dword [ebp]
call ebx
mov esi, eax
test esi, esi
jne 0x4037ef
mov esi, 0x7fff
lea eax, [esi + 2]
push eax
call fcn.0044daa6
pop ecx
mov edi, eax
push edi
lea eax, [esi + 1]
push eax
push 0xd
push dword [ebp]
call ebx
test eax, eax
mov byte [edi + esi], 0
jle 0x40382b
mov eax, dword [esp + 0x18]
push edi
call fcn.0040e132
mov bl, 1
push edi
call fcn.0044db10
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 8
xor bl, bl
jmp 0x40381b
Function at 0x403f09
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp byte [ebx + 0xb], 0
je 0x403f29
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp byte [ebx + 9], 0
push esi
mov esi, 0x400
je 0x403f62
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [ebx + 0x58]
lea ecx, [ebp - 0x418]
push ecx
push eax
call fcn.0044dfd0
test eax, eax
pop ecx
pop ecx
jne 0x403f5f
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 6], 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
je 0x403ff8
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call edi
cmp byte [ebx + 0xc], 0
jne 0x403fa1
lea eax, [ebp - 0x418]
push eax
call fcn.0044e140
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
mov eax, dword [ebx + 0x10]
dec eax
je 0x403fd7
dec eax
je 0x403fc0
dec eax
jne 0x403ff5
push dword [ebx + 0x14]
lea eax, [ebp - 0x418]
push eax
call fcn.0044dfd0
pop ecx
pop ecx
jmp 0x403fee
push dword [ebx + 0x14]
lea eax, [ebp - 0x418]
push eax
call fcn.0044e3a0
test eax, eax
pop ecx
pop ecx
je 0x403ff5
jmp 0x403ff2
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push eax
lea eax, [ebp - 0x418]
push eax
push ecx
call fcn.0044e07f
add esp, 0xc
test eax, eax
jne 0x403ff5
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 7], 0
je 0x404065
push esi
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x418]
push eax
lea esi, [ebp - 0x14]
call fcn.0040e021
lea esi, [ebx + 0x2c]
lea edi, [ebp - 0x14]
call fcn.00405a34
push dword [ebp - 0x14]
call fcn.0044db10
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
pop ecx
je 0x404062
mov ecx, dword [esi]
cmp ecx, edi
je 0x404062
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0x28]
push edi
push dword [esi + 0xc]
push ecx
push edi
push eax
call fcn.0044ca2c
add esp, 0x20
cmp eax, edi
mov dword [esi + 0x18], eax
jle 0x404062
inc dword [ebp - 4]
mov dword [esi + 0x18], edi
inc dword [ebp - 8]
cmp byte [ebx + 8], 0
pop edi
je 0x404088
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x404085
push dword [ebp + 8]
mov esi, ebx
call fcn.004040d0
test al, al
je 0x404085
inc dword [ebp - 4]
inc dword [ebp - 8]
cmp byte [ebx + 0xa], 0
je 0x4040a7
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x4040a4
inc dword [ebx + 0x68]
mov eax, dword [ebx + 0x68]
cmp eax, dword [ebx + 0x64]
jne 0x4040a4
inc dword [ebp - 4]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x4040c8
lea eax, [ebp + 8]
push eax
lea esi, [ebx + 0x78]
call fcn.0041f030
inc dword [ebx + 0x6c]
xor eax, eax
cmp byte [ebx + 4], al
sete al
jmp 0x4040cb
xor eax, eax
inc eax
pop esi
leave
ret 4
Function at 0x40412c
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40414a
mov eax, dword [esp + 0xc]
cmp byte [eax + 5], 1
jne 0x4041ce
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push 0
push 0
push 0xe
push dword [esp + 0x24]
call ebx
mov esi, eax
test esi, esi
jne 0x404169
mov esi, 0x7fff
lea ebp, [esi + 1]
push ebp
call fcn.0044daa6
pop ecx
mov edi, eax
push edi
push ebp
push 0xd
push dword [esp + 0x24]
call ebx
test eax, eax
pop ebp
mov byte [edi + esi], 0
pop ebx
jg 0x404197
xor esi, esi
inc esi
push edi
call fcn.0044db10
pop ecx
mov eax, esi
jmp 0x4041d1
mov esi, dword [esp + 0xc]
cmp byte [esi + 0xc], 0
jne 0x4041b0
push edi
call fcn.0044e140
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push dword [esi + 0x20]
push edi
call fcn.0044e3a0
test eax, eax
pop ecx
pop ecx
je 0x4041c7
mov byte [esi + 0x70], 1
xor esi, esi
jmp 0x40418c
push edi
call fcn.0044db10
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
ret 8