joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500f90
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x5548a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x5d3454]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.0053d471
mov edx, dword [0x5d3454]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x500fea
mov dword [esp + 0x1c], ebx
jmp 0x500ff1
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.0053f788
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.0053b031
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x501042
mov dword [esp + 0x14], ebx
jmp 0x501049
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x501064
mov eax, dword [eax + 0x3c8]
cmp eax, edi
je 0x50105e
cmp eax, 2
jne 0x501064
mov dword [esp + 0x18], edi
jmp 0x501068
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x501076
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0053caa6
mov edi, eax
cmp edi, ebx
jne 0x501086
xor eax, eax
jmp 0x501089
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x5010b1
mov ecx, esi
call fcn.0053f788
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x5010cd
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5010ec
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x5010ec
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.0053aef8
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.0053aef8
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x5056f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x50574a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x50574a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
je 0x50575f
mov eax, dword [esp]
test eax, eax
je 0x505759
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x50576e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x505780
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5057d9
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5057ee
mov eax, dword [esp]
test eax, eax
je 0x5057e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x5057fd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x505810
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x50587b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x50587b
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x505844
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x50586c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x505882
mov eax, dword [esp + 4]
test eax, eax
je 0x50587b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x505891
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x5058a0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x505a2b
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x505a2b
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x505a2b
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x505a2b
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5059ec
cmp dword [esp + 0xc], 0x378
jne 0x5059ec
lea eax, [esp + 0x28]
push eax
push edi
call fcn.0051eff0
add esp, 8
test eax, eax
je 0x505a0c
cmp dword [esp + 0x154], 1
jne 0x505a0c
cmp dword [esp + 0x178], 2
jne 0x505a0c
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x5cfc74
push edx
call fcn.00518025
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push 0x80000002
push eax
push ecx
push edx
mov ecx, esi
call fcn.00505780
test eax, eax
je 0x5059ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5059ff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x5059f6
push eax
call esi
jmp 0x5059f2
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x505a0c
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x505a1b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x505a40
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x505bac
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x505bac
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x505bac
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x505bac
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x505b90
cmp dword [esp + 0x10], 0x378
jne 0x505b90
cmp dword [esp + 0x158], 1
jne 0x505bb9
cmp dword [esp + 0x17c], 2
jne 0x505bb9
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x5cfc74
push ecx
call fcn.00518025
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push 0x80000002
call esi
test eax, eax
jne 0x505b90
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00505bf0
test eax, eax
je 0x505b90
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push 0x80000002
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.005056f0
test eax, eax
je 0x505b90
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x505bb9
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x505ba1
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x505bac
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x505bca
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x505bd5
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x505bf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x505cb1
mov eax, dword [esp + 0x488]
test eax, eax
je 0x505cb1
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x505cb1
cmp dword [esp], 0x378
jne 0x505cb1
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x505cb1
lea edx, [esp + 4]
push edx
call fcn.00505680
add esp, 4
test eax, eax
je 0x505cb1
cmp dword [esp + 0x234], 1
jne 0x505ca3
cmp dword [esp + 0x258], 2
jne 0x505ca3
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x505cb1
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x505cb1
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x505cc0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x505d1f
push esi
call fcn.00505680
add esp, 4
test eax, eax
je 0x505d1f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x505d1f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x505d1f
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x505db0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x505de4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00505cc0
test eax, eax
jne 0x505dfd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00505d30
cmp eax, 1
je 0x505f8a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x505e36
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x505eb2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x505f32
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00505bf0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x505f49
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x505e52
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x505f00
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.005058a0
test eax, eax
je 0x505f32
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x505ece
cmp dword [esp + 0x18], 1
jb 0x505f32
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push 0x80000002
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00505780
cmp eax, 1
je 0x505f7b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x505f59
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x505f32
push ebp
mov ecx, ebx
call fcn.00505fa0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x505f8a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x505fa0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x505fd2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00505d30
test eax, eax
jne 0x505fef
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x506016
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x506064
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00505a40
test eax, eax
jne 0x50604d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x506033
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push 0x80000002
mov ecx, edi
call fcn.00505810
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x506087
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4
Function at 0x530010
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x556dc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00525068
mov eax, dword [0x5a80c0]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00524f9a
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00530b00
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x5300b7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5300ae
cmp al, 0xff
je 0x5300ae
dec al
mov byte [ecx], al
jmp 0x5300b7
push ecx
call fcn.0053ac62
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x5300e8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x5300df
cmp al, 0xff
je 0x5300df
dec al
mov byte [ecx], al
jmp 0x5300e8
push ecx
call fcn.0053ac62
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x53be17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00546d65
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x53be48
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0053be5b
pop edi
pop esi
pop ebx
ret 8

Function at 0x53d471
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x53d4a9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053b39f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0053b377
jmp 0x53d4b5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x53ee39
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x53ee7b
call fcn.00546d65
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x53ee7b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x53ee72
xor eax, eax
jmp 0x53ee83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0053ee89
pop edi
pop esi
pop ebx
ret 4

Function at 0x547295
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5472c3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5472e1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005471fb
jmp 0x5472e1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5472e1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005471fb
test edi, edi
mov eax, edi
jne 0x5472cb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x54a090
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x54a0b8
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x54a0c9
push 2
call edi
test ax, ax
jge 0x54a0c9
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0053caa6
cmp dword [esi + 0x30], ebx
jne 0x54a1a3
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0053caa6
cmp eax, dword [esp + 0x34]
jne 0x54a1a3
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x54a13f
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x54a184
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x54a1a3
cmp eax, 0x205
je 0x54a1a3
cmp eax, 0x201
je 0x54a1a3
cmp eax, 0x204
je 0x54a1a3
cmp eax, ebx
jne 0x54a16a
cmp dword [esp + 0x1c], 0x1b
je 0x54a1a3
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x628c24]
jbe 0x54a199
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x54a0fc
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x426cb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x426d10
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x426e06
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x426d80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x426d55
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x426d65
cmp byte [esp + 0x1e], 0
je 0x426d65
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x426d65
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x4270a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4c77a0
call sym._EnterCriticalSection_4
mov ebx, dword [0x4c77b8]
sub esp, 4
test ebx, ebx
je 0x4270eb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4270e4
test esi, esi
je 0x4270e4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4270c0
mov dword [esp], 0x4c77a0
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret