joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419b70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e43ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebp, [esi + 8]
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x12c], edi
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x10]
push edi
push edi
lea eax, [esp + 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [esi + 4], edi
mov edi, dword [esp + 0x13c]
mov dword [esi], 0x4ed010
lea ecx, [esp + 0x18]
push eax
mov edx, dword [edi]
push ecx
push edx
mov byte [esp + 0x140], 1
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
mov ecx, ebp
push edi
call fcn.0047d35a
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x419c22
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esi + 0xc]
call fcn.0047d36c
jmp 0x419c3d
lea edx, [esp + 0x10]
lea edi, [esi + 0xc]
push edx
mov ecx, edi
call fcn.0047d36c
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call sub.MFC42.DLL_CString::operator_1
mov ebp, dword [ebp]
push 0
push 0x80
push 3
push 0
push 7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x419c7f
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [esp + 0x18]
mov ecx, ebx
push edx
call sub.MFC42.DLL_COleDateTime::operator
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 4
Function at 0x41c870
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2004
call fcn.0047dd00
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push connect
mov edi, ecx
push str.C:WINDOWS_system32_spooldriverscolor_sRGB_Color_Space_Profile.icm
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41c8ad
pop edi
or eax, eax
pop esi
add esp, 0x2004
ret
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x14]
push 0x2000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41c8d7
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x2004
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 8]
add edx, 0x10
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [eax], 0x8773
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
mov dword [eax + 4], ecx
mov word [eax + 8], 1
mov dword [eax + 0xc], edx
push eax
mov eax, dword [edi + 4]
push eax
call sub.gdiplus.dll_GdipSetPropertyItem
test eax, eax
je 0x41c91a
mov dword [edi + 8], eax
pop edi
xor eax, eax
pop esi
add esp, 0x2004
ret

Function at 0x41cc50
Capabilities:
Disable firewall features via registry on windows
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
lea ecx, [esp + 0x10]
mov dword [esp], 4
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
setne al
push connect
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ccd0
mov ecx, dword [esp + 0x10]
lea edx, [esp]
push edx
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.EnableFirewall
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 4]
push edx
push eax
push 4
push 0
push str.EnableFirewall
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
ret

Function at 0x41d350
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.softwareGWZTech
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41d375
xor eax, eax
pop ecx
ret
mov edx, dword [esp + 0xc]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x41d3a4
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
Function at 0x41d450
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x41d498
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push ebp
call sub.WSOCK32.dll_send
cmp eax, 1
jge 0x41d492
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x41d49f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d494
add esi, eax
cmp esi, edi
jl 0x41d466
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x41d4b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x41d4f8
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push ebp
call sub.WSOCK32.dll_recv
cmp eax, 1
jge 0x41d4f2
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x41d4ff
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d4f4
add esi, eax
cmp esi, edi
jl 0x41d4c6
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x41d510
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d52d
xor eax, eax
pop esi
add esp, 0x14
ret
lea eax, [esp + 4]
push 4
push eax
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x18], 0x4b000
call sub.WSOCK32.dll_setsockopt
lea ecx, [esp + 4]
push 4
push ecx
push 0x1002
push 0xffff
push esi
call sub.WSOCK32.dll_setsockopt
lea edx, [esp + 4]
push 4
push edx
push 0x1005
push 0xffff
push esi
mov dword [esp + 0x18], 0x1f40
call sub.WSOCK32.dll_setsockopt
lea eax, [esp + 4]
push 4
push eax
push 0x1006
push 0xffff
push esi
call sub.WSOCK32.dll_setsockopt
mov edx, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push eax
call sub.WSOCK32.dll_htons
lea ecx, [esp + 8]
push 0x10
push ecx
push esi
mov word [esp + 0x16], ax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x41d5e8
or eax, eax
pop esi
add esp, 0x14
ret
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x41d660
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x4e49c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x52f8f4], 1
jne 0x41d6b5
mov eax, dword [0x52f8f0]
pop edi
mov ecx, dword [esp + 0x408]
mov dword fs:[0], ecx
add esp, 0x414
ret
push ebp
push esi
push str.127.0.0.1
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x41c], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x14]
push 0x400
push eax
mov byte [esp + 0x424], 1
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x41d74a
lea ecx, [esp + 0x14]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
test edi, edi
je 0x41d74a
mov ebp, dword [sym.imp.MSVCRT.dll__mbscmp]
xor esi, esi
mov edx, dword [edi + 0xc]
mov eax, dword [esi + edx]
test eax, eax
je 0x41d74a
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
lea ecx, [esp + 0x10]
call fcn.0047d36c
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call ebp
add esp, 8
test eax, eax
je 0x41d740
add esi, 4
jmp 0x41d70c
mov dword [0x52f8f0], 1
mov esi, dword [0x52f8f0]
lea ecx, [esp + 0xc]
mov dword [0x52f8f4], 1
mov byte [esp + 0x41c], 0
call fcn.0047d354
lea ecx, [esp + 0x10]
mov dword [esp + 0x41c], 0xffffffff
call fcn.0047d354
mov ecx, dword [esp + 0x414]
mov eax, esi
pop esi
pop ebp
pop edi
mov dword fs:[0], ecx
add esp, 0x414
ret
Function at 0x421200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4bb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], esp
push ecx
push edx
call fcn.004483a0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0044b150
mov ecx, dword [ebx + 0xc]
add esp, 8
mov edx, dword [ecx + 0x180]
push edx
push edi
push esi
call fcn.00449670
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x30]
add esp, 0xc
push eax
push ecx
push 0
push 0
push 0
push edx
call sub.ipl.dll_iplSetROI
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428f58
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e5110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x9c]
lea ecx, [esp + 8]
add eax, 0x1cc
mov byte [esp + 0x1c], 2
push eax
call fcn.0047d35a
mov ecx, dword [esi + 0x98]
add ecx, 0x5e8
push ecx
lea ecx, [esp + 8]
call fcn.0047d36c
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x428fc7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
test eax, eax
jne 0x428fcb
xor eax, eax
jmp 0x428fce
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push 1
push ecx
mov ecx, dword [esp + 0x10]
push edx
push ecx
push str.Open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x42902d
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.0047d354
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 0
call fcn.0047d354
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0047d354
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov edx, dword [esi + 0x98]
push edi
mov edi, dword [esi + 0xa0]
add edx, 0x5e8
push edx
lea ecx, [esp + 0x18]
add edi, 0x68
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push esi
push eax
mov ecx, edi
mov byte [esp + 0x28], 3
call fcn.00419480
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call fcn.0047d354
mov ecx, edi
call fcn.00419420
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.0047d354
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.0047d354
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0047d354
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x42a810
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e5410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
push edi
mov edx, ecx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
mov edx, dword [edx + 4]
mov ecx, dword [esp + 0x218]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov edx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x200
push eax
push 0x52e658
push ecx
push edx
mov dword [esp + 0x224], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
pop edi
jle 0x42a8d4
mov ecx, dword [esp + 0x218]
lea eax, [esp]
push eax
call fcn.0047d36c
lea ecx, [esp + 0x210]
mov byte [esp + 0x208], 0
call fcn.0047d354
lea ecx, [esp + 0x214]
mov dword [esp + 0x208], 0xffffffff
call fcn.0047d354
mov eax, 1
mov ecx, dword [esp + 0x200]
mov dword fs:[0], ecx
add esp, 0x20c
ret 0xc
lea ecx, [esp + 0x210]
mov byte [esp + 0x208], 0
call fcn.0047d354
lea ecx, [esp + 0x214]
mov dword [esp + 0x208], 0xffffffff
call fcn.0047d354
mov ecx, dword [esp + 0x200]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x20c
ret 0xc
Function at 0x42a920
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e5430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
push ebx
push edi
mov edx, ecx
xor ebx, ebx
mov dword [esp + 0x210], ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], bl
rep stosd dword es:[edi], eax
mov edx, dword [edx + 4]
mov ecx, dword [esp + 0x21c]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
mov edx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x200
push eax
push 0x52e658
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, ebx
jle 0x42a9d1
lea eax, [esp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov ecx, dword [esp + 0x224]
add esp, 4
mov byte [esp + 0x210], bl
mov dword [ecx], eax
lea ecx, [esp + 0x218]
call fcn.0047d354
lea ecx, [esp + 0x21c]
mov dword [esp + 0x210], 0xffffffff
call fcn.0047d354
mov eax, 1
jmp 0x42a9fd
lea ecx, [esp + 0x218]
mov byte [esp + 0x210], bl
call fcn.0047d354
lea ecx, [esp + 0x21c]
mov dword [esp + 0x210], 0xffffffff
call fcn.0047d354
xor eax, eax
mov ecx, dword [esp + 0x208]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20c
ret 0xc
Function at 0x435f30
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push 1
lea eax, [esp + 0x18]
push 4
mov ebp, ecx
push eax
xor edi, edi
call ebx
add esp, 0x10
lea ecx, [esp + 0x10]
push 4
push ecx
mov ecx, ebp
call fcn.00435b20
mov ebp, eax
mov al, byte [esi + 0xc]
test al, 0x10
jne 0x435f8a
cmp edi, ebp
jge 0x435f8c
push esi
push 1
lea edx, [esp + 0x20]
push 1
push edx
mov byte [esp + 0x28], 0
call ebx
add edi, eax
mov al, byte [esi + 0xc]
add esp, 0x10
test al, 0x10
je 0x435f69
cmp edi, ebp
pop edi
pop esi
pop ebp
pop ebx
jne 0x435f98
mov al, 1
pop ecx
ret 4
xor al, al
pop ecx
ret 4
Function at 0x436820
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push esi
push ebx
push 1
lea eax, [esp + 0x18]
push 4
mov esi, ecx
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x10]
push 4
push ecx
mov ecx, esi
call fcn.00435b20
mov esi, dword [esp + 0x14]
test eax, eax
mov dword [esi], eax
jle 0x43688f
push edi
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi]
mov edi, eax
mov edx, ecx
mov eax, 0xfefefefe
shr ecx, 2
mov dword [esi + 4], edi
push ebx
rep stosd dword es:[edi], eax
mov ecx, edx
push 1
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
call ebp
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop esi
pop ebp
mov al, 1
pop ebx
ret 8

Function at 0x4368a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e6608
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
push eax
push 1
lea ecx, [esp + 0x10]
push 0x1a
push ecx
xor bl, bl
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x4369d3
push esi
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x30], 0
xor esi, esi
mov dl, byte [esp + esi + 0xc]
lea ecx, [esp + 0x38]
push edx
call sub.MFC42.DLL_CString::operator_2
inc esi
cmp esi, 4
jb 0x4368f1
mov eax, dword [esp + 0x38]
push str.8BPS
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x4369ac
lea ecx, [esp + 0x10]
push 2
push ecx
mov ecx, edi
call fcn.00435b20
cmp eax, 1
jne 0x4369ac
xor ecx, ecx
mov al, al
test al, al
je 0x43694b
mov dl, byte [esp + ecx + 0x12]
test dl, dl
je 0x436945
xor al, al
inc ecx
cmp ecx, 6
jb 0x436937
test al, al
mov bl, al
je 0x4369ac
lea edx, [esp + 0x18]
push 2
push edx
mov ecx, edi
call fcn.00435b20
mov esi, dword [esp + 0x3c]
push 4
mov ecx, edi
mov word [esi], ax
lea eax, [esp + 0x1e]
push eax
call fcn.00435b20
lea ecx, [esp + 0x1e]
push 4
push ecx
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00435b20
lea edx, [esp + 0x22]
push 2
push edx
mov ecx, edi
mov dword [esi + 8], eax
call fcn.00435b20
mov word [esi + 0xc], ax
lea eax, [esp + 0x24]
push 2
push eax
mov ecx, edi
call fcn.00435b20
mov word [esi + 0xe], ax
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0047d354
pop esi
mov al, bl
pop edi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov ecx, dword [esp + 0x24]
mov al, bl
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x43d010
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e72f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov ecx, dword [esp + 0x14]
push 0x52fa28
lea eax, [esp + 4]
push 4
push eax
push ecx
push str.AccelSection
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
jne 0x43d070
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.0047d354
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [esp]
mov ecx, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0xc], 0xffffffff
shr edx, 0x10
mov word [ecx], dx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov word [edx], ax
call fcn.0047d354
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43d0b0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4e7335
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x128]
mov edi, 1
test ebp, ebp
mov dword [esp + 0x11c], edi
jne 0x43d125
mov esi, dword [esp + 0x124]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x11c], 0
call fcn.0047d354
mov eax, esi
jmp 0x43d2a9
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyExA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyNameTextA]
stosb byte es:[edi], al
mov al, byte [ebp]
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayout]
test al, 8
je 0x43d17d
push 0
call edi
push eax
push 0
push 0x11
call esi
lea ecx, [esp + 0x18]
push 0x100
shl eax, 0x10
push ecx
push eax
call ebx
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_1
test byte [ebp], 0x10
je 0x43d1c5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x43d19c
push 0x52330c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0
call edi
push eax
push 0
push 0x12
call esi
lea ecx, [esp + 0x18]
push 0x100
shl eax, 0x10
push ecx
push eax
call ebx
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_1
test byte [ebp], 4
je 0x43d20d
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x43d1e4
push 0x52330c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0
call edi
push eax
push 0
push 0x10
call esi
lea ecx, [esp + 0x18]
push 0x100
shl eax, 0x10
push ecx
push eax
call ebx
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_1
test byte [ebp], 1
je 0x43d27a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x43d22c
push 0x52330c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0
call edi
xor ecx, ecx
push eax
mov cx, word [ebp + 2]
push 0
push ecx
call esi
xor ecx, ecx
mov cx, word [ebp + 2]
add ecx, 0xffffffdf
cmp ecx, 0xd
ja case.0x43d252.34
xor edx, edx
mov dl, byte [ecx + 0x43d2cc]
jmp dword [edx*4 + 0x43d2c4]
or ah, 1
lea ecx, [esp + 0x18]
push 0x100
shl eax, 0x10
push ecx
push eax
call ebx
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
mov byte [esp + 0x120], 0
call fcn.0047d354
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x43e050
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e05a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x43e080
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43e08a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
ret 0xc

Function at 0x43e9a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e7700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov ebp, ecx
call fcn.0041cfd0
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push str.ExpSetting
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString_2
push str.Language
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
push str.ExpLanguage.ini
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
push eax
push 0x3e8
push 0x3e8
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x52e658
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x43ea60
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0xc]
push ecx
lea ecx, [ebp + 0x60]
call fcn.0047d35a
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.0047d354
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0047d354
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call fcn.0047d354
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0047d354
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x4416a0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x4416e0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x1a0], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x442d40
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x442d80
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x24c], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret

Function at 0x443aa0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x443ae0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x248], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
pop ecx
ret