joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56c94d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push dword [0x4c59fc]
mov edx, dword [esp]
push esi
mov esi, esp
add esi, 4
add esi, 4
push esi
push dword [esp + 4]
pop esi
pop dword [esp]
pop esp
push esi
push esp
mov esi, dword [esp]
add esp, 4
add esi, 4
sub esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], ebx
push ecx
push dword [esp]
mov ebx, dword [esp]
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
add esp, 4
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edi
mov edi, esp
add edi, 4
add edi, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
jmp fcn.0054dd52
jns 0x56c982
aad 0x42
pop esi
add eax, 0x719c394a
salc
mov bl, 0xc5
push 0x38
invalid
in al, 0xc9
sub byte [ecx + 0x6763b76], ch
xchg ecx, eax
outsd dx, dword [esi]
wait
mov al, byte [0x22caabbb]
inc ebp
cmp bh, byte [esi + 0x24]
sub dword [edx + ebx*8 + 0x2d], edi
add al, dl
sub esp, 4
mov dword [esp], esi
push 0x335d4e46
mov dword [esp], eax
mov eax, 0x1ff06f38
mov dword [esp + 4], eax
pop eax
mov dword [esp], eax
push 0x390a99df
mov dword [esp], ebx
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
push dword [esp]
mov eax, dword [esp]
add al, 0x24
push ebx
mov ebx, esp
add ebx, 4
push edi
mov edi, 4
add ebx, edi
pop edi
xchg dword [esp], ebx
pop esp
add esp, 4
push ecx
mov dword [esp], ebp
mov dword [esp], eax
mov eax, esp
add eax, 4
push ebx
mov ebx, 4
sub eax, ebx
pop ebx
xchg dword [esp], eax
pop esp
mov dword [esp], ecx
push esi
mov dword [esp], edi
push ebx
mov ebx, 0x356cbfbb
mov dword [esp + 4], ebx
pop ebx
mov dword [esp], ecx
sub ecx, 0x696fe7b2
add ecx, eax
push ebp
mov ebp, 0x19fe0e83
shl ebp, 5
push esi
mov esi, 0x7ffd4cc3
push edx
mov edx, 0x7bbd246b
and esi, edx
pop edx
neg esi
sub esi, 0x3df76db7
add esi, 0x90065aa8
sub ebp, esi
mov esi, dword [esp]
add esp, 4
add ecx, ebp
pop ebp
push dword [esp]
pop ecx
push ebx
mov ebx, esp
add ebx, 4
push edx
mov edx, 4
add ebx, edx
pop edx
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
jmp 0x572daf
push ecx
mov ecx, esp
add ecx, 4
push esi
mov esi, 4
sub ecx, esi
pop esi
xchg dword [esp], ecx
pop esp
mov dword [esp], eax
pop dword [0x4c4eb8]
jmp 0x57e36f
call fcn.004a8db0
jmp 0x52564c
Function at 0x10001000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
mov edi, ecx
lea esi, [ebp + 8]
lea eax, [ebp - 0x1ac]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x10001077
mov word [ebp - 0x1c], 2
movzx eax, word [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
lea ebx, [ebp - 0x18]
mov ecx, esi
call fcn.10001090
push ebx
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [ebp - 0x1c]
push 0x10
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
setne bl
jmp 0x10001079
xor ebx, ebx
mov ecx, esi
call fcn.100010a0
mov eax, ebx
add esp, 0x1a0
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c

Function at 0x100010c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100010fd
mov edi, ecx
mov ebx, dword [ebp + 8]
nop word cs:[eax + eax]
push 0
push esi
push ebx
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10001101
add ebx, eax
sub esi, eax
jne 0x100010e0
mov eax, dword [ebp + 0xc]
jmp 0x10001106
xor eax, eax
jmp 0x10001106
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10001110
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000114d
mov edi, ecx
mov ebx, dword [ebp + 8]
nop word cs:[eax + eax]
push 0
push esi
push ebx
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10001151
add ebx, eax
sub esi, eax
jne 0x10001130
mov eax, dword [ebp + 0xc]
jmp 0x10001156
xor eax, eax
jmp 0x10001156
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10001ba0
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10012a90
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea esi, [ebp + 0xc]
sub esp, 0x14
movaps xmm0, xmmword [0x10015080]
movups xmmword [esp + 4], xmm0
mov dword [esp], str.Mozilla_5.0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x10001c9b
mov ecx, esi
mov esi, eax
call fcn.10001090
sub esp, 0x18
movaps xmm0, xmmword [0x10015090]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10001cb0
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x44]
call fcn.10001e10
lea esi, [ebp - 0x814]
mov dword [ebp - 0x2c], edi
nop
lea eax, [ebp - 0x28]
push eax
push 0x7d0
push esi
push dword [ebp - 0x20]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10001ccc
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10001c7e
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x44]
push eax
push esi
call fcn.10001e50
cmp dword [ebp - 0x28], 0
mov edi, dword [ebp - 0x2c]
lea esi, [ebp - 0x814]
jne 0x10001c40
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x24]
call esi
mov ecx, edi
lea eax, [ebp - 0x44]
push eax
call fcn.10001ed0
jmp 0x10001cef
mov dword [ebp - 0x10], 0
mov ecx, edi
push 0x100165c0
call fcn.10001d60
jmp 0x10001cf7
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x10], 0
mov ecx, edi
push 0x100165c0
call fcn.10001d60
jmp 0x10001cf7
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x10], 1
mov ecx, edi
push 0x100165c0
call fcn.10001d60
lea ecx, [ebp - 0x44]
call fcn.100010a0
lea esi, [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.100010a0
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10002130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x200
mov esi, dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10002160
lea edi, [ebp - 0x208]
push 0x100
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
push edi
jmp 0x10002167
mov ecx, esi
push 0x100165de
call fcn.10002020
mov eax, esi
add esp, 0x200
pop esi
pop edi
pop ebp
ret
Function at 0x10009250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10012b10
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
mov dword fs:[0], ecx
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x20]
mov ecx, edi
push ebx
push eax
call fcn.10009320
add esp, 8
lea ebx, [esi + 4]
mov ecx, edi
call fcn.10001260
push ebx
push 0
push eax
push 0x100093c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x100092dd
lea esi, [ebp - 0x20]
mov ecx, esi
call fcn.10009460
mov ecx, esi
call fcn.10009470
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebx], 0
mov dword [ebp - 0x10], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
nop word cs:[eax + eax]
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x20]
call fcn.10009470
add esp, 0x18
pop ebp
ret
Function at 0x10012800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100131d0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
lea edi, [ebp - 0x20]
push eax
push edi
call fcn.100128d0
add esp, 8
lea ebx, [esi + 4]
mov ecx, edi
call fcn.10001260
push ebx
push 0
push eax
push 0x10012910
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1001288a
lea esi, [ebp - 0x20]
mov ecx, esi
call fcn.1000a1f0
mov ecx, esi
call fcn.100129a0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebx], 0
mov dword [ebp - 0x10], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
nop word cs:[eax + eax]
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x20]
call fcn.100129a0
add esp, 0x18
pop ebp
ret

Function at 0x10013a60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10013a3c
pop esi
leave
ret 8
Function at 0x4014a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x49d5cc]
test eax, eax
je 0x4014d4
cmp dword [eax + 0x1fc], 0
jne 0x401671
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push 0
push 0
push 0
push esi
mov dword [0x49d428], 0
call ebx
test eax, eax
je 0x401652
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40160a
mov ecx, dword [0x49d544]
xor ebx, ebx
test ecx, ecx
je 0x401553
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
test eax, eax
je 0x401553
nop dword [eax + eax]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x401604
cmp dword [ebp - 4], ebx
je 0x401553
mov ecx, dword [0x49d544]
jmp 0x401530
mov eax, dword [0x49d5cc]
test eax, eax
je 0x4015f6
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x4015f6
push dword [0x49d5a0]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x401591
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x4015a2
cmp eax, 0x104
jne 0x4015f2
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x4015f2
cmp edi, 0x11
je 0x4015f2
mov ecx, dword [0x49d5cc]
test ecx, ecx
je 0x4015f2
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x4015f2
cmp eax, 0x104
je 0x4015d9
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x4015d9
xor edx, edx
jmp 0x4015de
mov edx, 1
push ecx
mov ecx, dword [0x49d5a8]
push edi
call fcn.00459dc0
add esp, 8
test eax, eax
jne 0x401604
test ebx, ebx
jne 0x401604
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401638
test al, 1
je 0x40161e
cmp dword [esi + 4], 0x111
je 0x401651
test al, 2
je 0x40162b
cmp dword [esi + 4], 0x201
je 0x401651
test al, 4
je 0x401638
cmp dword [esi + 4], 0x202
je 0x401651
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401500
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x49d430
push 0
push 0xb
push 0
call dword [sym.imp.MMFS2.dll_Ordinal_31]
mov dword [0x49d428], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push 0x104
mov esi, ecx
call fcn.004646b4
mov edi, eax
add esp, 8
test edi, edi
je 0x409fb6
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
mov esi, eax
call fcn.004646ca
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42f360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, edx
push edi
push 0
mov edi, ecx
movzx eax, word [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
call ebx
test eax, eax
jne 0x42f395
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx eax, word [ebp - 4]
sub eax, 0
je 0x42f3df
sub eax, 2
jne 0x42f38c
mov eax, dword [esi]
sub eax, 0
je 0x42f3bb
sub eax, 2
je 0x42f3b4
xorps xmm0, xmm0
jmp 0x42f3c4
movsd xmm0, qword [esi + 8]
jmp 0x42f3c4
movd xmm0, dword [esi + 8]
cvtdq2pd xmm0, xmm0
push 0
lea eax, [ebp - 8]
movsd qword [ebp - 0x18], xmm0
push eax
push 8
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
sub eax, 0
je 0x42f3f6
sub eax, 2
je 0x42f3ef
xor eax, eax
jmp 0x42f3f9
cvttsd2si eax, qword [esi + 8]
jmp 0x42f3f9
mov eax, dword [esi + 8]
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push edi
push 0
push eax
push 2
lea eax, [ebp - 4]
mov edi, ecx
push eax
push edi
mov esi, edx
call ebx
test eax, eax
je 0x4310ba
cmp dword [ebp - 8], 2
jb 0x4310ba
movsx eax, word [ebp - 4]
mov dword [esi], eax
sub eax, 0
je 0x43108f
sub eax, 1
je 0x4310ba
sub eax, 1
jne 0x4310ba
push eax
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x18]
push eax
push edi
call ebx
test eax, eax
je 0x4310ba
cmp dword [ebp - 8], 8
jb 0x4310ba
movsd xmm0, qword [ebp - 0x18]
mov eax, 1
movsd qword [esi + 8], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call ebx
test eax, eax
je 0x4310ba
cmp dword [ebp - 8], 4
jb 0x4310ba
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x442a50
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [0x49d5d4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0x440
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x40], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x442b65
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x442b53
call fcn.00425950
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x442af2
push 0
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x442af2
push 0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x442b30
cmp dword [ebp + 8], 0x103
jne 0x442b30
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.004014a0
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x442af8
test bx, bx
je 0x442b4e
mov edi, dword [ebp - 4]
push 5
push dword [edi + 0x10]
call esi
mov eax, dword [edi + 0x4c4]
test eax, eax
je 0x442b4e
push 5
push eax
call esi
call fcn.00425a50
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44af90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x104], ecx
sub ecx, dword [esi + 0x58]
add eax, ecx
mov dword [esi + 0x108], edx
sub edx, dword [esi + 0x5c]
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x64]
add eax, edx
mov dword [esi + 0x118], ecx
mov dword [esi + 0x124], eax
mov ecx, esi
mov eax, dword [esi + 0xdc]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0xe8]
mov dword [esi + 0x11c], edx
mov edx, 1
mov dword [esi + 0x110], eax
pop esi
pop ebp
jmp fcn.0044b000
Function at 0x456910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 1], 0
xor edi, edi
lea ecx, [ebp - 0x10]
push edi
push ecx
push 1
lea ecx, [ebp - 1]
mov eax, edx
push ecx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x456999
cmp byte [ebp - 1], 0
je 0x456994
push dword [ebx + 0x2ac]
mov edx, dword [ebx + 0x44]
mov ecx, ebx
push edi
call fcn.00455dd0
mov ecx, dword [ebx + 0x2a4]
add esp, 8
test ecx, ecx
je 0x456999
call fcn.00401410
mov ecx, dword [ebx + 0x2a4]
xor edx, edx
mov esi, eax
call fcn.00404e80
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.004310d0
mov ecx, esi
mov edi, eax
call fcn.00401410
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x457f30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x49d5d4]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [ebp - 4], edx
test ebx, ebx
jne 0x457f50
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
cmp edx, 0x100
jne 0x457f9b
cmp dword [ebp + 8], 9
jne 0x457ff6
cmp dword [ebx + 0x518], ecx
jle 0x457ff6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
test ax, ax
js 0x457f86
call fcn.00433a20
jmp 0x457f8b
call fcn.00433be0
test eax, eax
je 0x457ff1
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 5
jne 0x457ff6
mov eax, dword [ebx + 0x18]
test byte [eax + 0x14], 0x10
je 0x457ff6
cmp byte [ebx + 0x4c8], cl
je 0x457ff6
mov esi, dword [ebx + 0x1278]
xor edi, edi
cmp dword [ebx + 0x3c], ecx
jle 0x457ff6
nop
mov eax, dword [esi]
test eax, eax
jne 0x457fd0
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x457fc6
test byte [eax + 0x7c], 4
jne 0x457fe8
test dword [eax + 0x78], 0x2b0
je 0x457fe8
push eax
mov eax, dword [eax + 0x8c]
call eax
inc edi
add esi, 8
cmp edi, dword [ebx + 0x3c]
jl 0x457fc0
mov edx, dword [ebp - 4]
xor ecx, ecx
movsx eax, word [ebx + 0x1d8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x458033
xor esi, esi
test eax, eax
jle 0x458033
lea edi, [ebx + 0x1dc]
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push ebx
call eax
movsx ecx, ax
test cl, 0x5c
jne 0x458033
mov edx, dword [ebp - 4]
inc esi
add edi, 4
cmp esi, dword [ebp - 0xc]
jl 0x458010
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [0x49d5a8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 4], eax
test eax, eax
je 0x458067
push 0
push dword [0x49d5a8]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push esi
push edi
push 0x304
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 0
push dword [0x49d5a8]
call ebx
mov esi, eax
test esi, esi
je 0x4580b7
nop dword [eax + eax]
push 0x100
push 0
push 0
push esi
call edi
push 2
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x4580a0
mov eax, dword [0x49d5cc]
cmp dword [eax + 0x1fc], 0
jne 0x45810e
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
lea eax, [ebp - 0x20]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x45810e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x4580f0
push dword [0x49d5a4]
call dword [sym.imp.MMFS2.dll_Ordinal_35]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x458131
push 5
push dword [0x49d5a8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret