joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440a8e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5ec569
call fcn.0059d590
sub esp, 0x138
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call sub.MFC42.DLL_AfxVariantInit
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x440c02
mov ecx, dword [esi + 0x60]
cmp ecx, ebx
je 0x440b0a
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [esi + 0x60]
cmp ecx, ebx
je 0x440b0a
mov eax, dword [ecx]
push 1
mov byte [ebp - 4], 1
call dword [eax + 4]
jmp 0x440b04
mov dword [ebp - 4], ebx
mov dword [esi + 0x60], ebx
push 0x40
call sub.MFC42.DLL_operatornew
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
cmp edi, ebx
mov byte [ebp - 4], 3
je 0x440b30
mov ecx, edi
call fcn.0059d1ee
mov dword [edi], 0x615528
mov eax, edi
jmp 0x440b32
xor eax, eax
mov dword [esi + 0x60], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], bl
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x2c]
push 0xa
sub ecx, dword [ebp - 0x34]
pop eax
push ebx
push ebx
sub ecx, 0xf
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x30]
push ebx
push 0x64
push esi
sub ecx, eax
lea eax, [ebp - 0x44]
push eax
push 0x50000000
mov dword [ebp - 0x38], ecx
mov ecx, dword [esi + 0x60]
push ebx
push 0x615518
mov dword [ebp - 0x40], 0x50
call sub.MFC42.DLL_CWnd::CreateControl
test eax, eax
je 0x440c02
mov al, byte [0x68f370]
push 0x3f
mov byte [ebp - 0x144], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x143]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x144]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x144]
push str.Help_
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x144]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x24]
mov ecx, dword [esi + 0x60]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004e4e8c
push 5
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x44aefd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
and byte [ebp - 0x84], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x83]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov edi, 0x80
push eax
lea eax, [ebp - 0x84]
push edi
push eax
push 2
mov ecx, ebx
call fcn.0044d8ff
test al, al
jne 0x44af56
call dword [sym.imp.GraphicData.dll_GameDataSetQuery]
mov edx, dword [eax]
push 0x271c
jmp 0x44b02f
cmp dword [0x68f510], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jbe 0x44af86
call esi
sub eax, dword [0x68f510]
cmp eax, 0x2710
jae 0x44af86
call dword [sym.imp.GraphicData.dll_GameDataSetQuery]
mov edx, dword [eax]
push 0xc34b
jmp 0x44b02f
call esi
lea esi, [ebx + 0x160]
mov dword [0x68f510], eax
mov ecx, esi
call fcn.0044de4e
test eax, eax
jle 0x44b022
mov ecx, esi
call fcn.0044de4e
cmp eax, edi
jg 0x44b022
mov esi, dword [sym.imp.GraphicData.dll_GameDataSetQuery]
call esi
mov edx, dword [eax]
push str.English
mov ecx, eax
call dword [edx + 0x34]
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x44affe
call esi
mov edx, dword [eax]
push str.French
mov ecx, eax
call dword [edx + 0x34]
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x44affe
call esi
mov edx, dword [eax]
push str.Spanish
mov ecx, eax
call dword [edx + 0x34]
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x44b019
lea ecx, [ebx + 0x160]
call fcn.0044de4e
cmp eax, 0xe
jle 0x44b019
call esi
mov edx, dword [eax]
push 0x2c88
jmp 0x44b02f
mov ecx, ebx
call fcn.0044cf9c
jmp 0x44b03c
call dword [sym.imp.GraphicData.dll_GameDataSetQuery]
mov edx, dword [eax]
push 0x271e
mov ecx, eax
call dword [edx + 0x3c]
push eax
mov ecx, ebx
call fcn.0044b0ac
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44cb0a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 4], esi
cmp byte [esi + 0xb2], bl
je 0x44cc9e
push str.AccountBind
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
jne 0x44cc9e
push ebx
mov ecx, esi
call fcn.0044b068
mov al, byte [0x68f370]
push 0x40
mov byte [ebp - 0x210], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
mov esi, 0x103
push eax
push esi
mov byte [ebp - 0x10d], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x210]
push eax
push str._sAccountBind.exe
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x1f
mov byte [ebp - 0x8c], bl
pop ecx
mov dword [ebp - 0xc], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov edi, 0x80
push eax
lea eax, [ebp - 0x10c]
push edi
push eax
push 3
call fcn.0044d8ff
test al, al
je 0x44cc9e
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x8c]
push edi
push eax
push 4
call fcn.0044d8ff
test al, al
je 0x44cc9e
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x313]
mov byte [ebp - 0x314], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov ecx, edi
call fcn.0044d84b
push eax
push 0x679f08
push dword [ebp - 8]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp - 0xc]
push eax
push str._s__d__s__d__s__d
lea eax, [ebp - 0x314]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x24
lea eax, [ebp - 0x314]
push 5
push ebx
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [edi + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.AccountBind
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
cmp eax, ebx
je 0x44cc9e
cmp edi, ebx
je 0x44cc99
mov edi, dword [edi + 0x20]
jmp 0x44cc9b
xor edi, edi
mov dword [eax + 0x24], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44d6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x104]
cmp eax, dword [ebx + 0x108]
je 0x44d7f1
call fcn.0044de2f
test al, al
je 0x44d7f1
mov esi, dword [ebx + 0x104]
mov ecx, ebx
call fcn.0044d84b
push eax
push esi
call fcn.00595a26
pop ecx
test al, al
pop ecx
je 0x44d7f1
cmp dword [ebx + 0xa0], 0xffffffff
je 0x44d7f1
push 9
mov esi, str.SOFTWARETqdigitalConquerAccounts_
pop ecx
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x37
xor eax, eax
pop ecx
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
stosb byte es:[edi], al
call fcn.0044d84b
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
dec eax
mov edi, 0x103
jne 0x44d750
push edi
lea eax, [ebp - 0x14c]
push 0x679e74
push eax
call esi
add esp, 0xc
push edi
lea eax, [ebp - 0x14c]
push dword [ebx + 0x104]
push eax
call esi
and byte [ebp - 0x250], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x24f]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x14c]
push str.tqDir
push eax
call fcn.005959a0
add esp, 0x1c
test al, al
je 0x44d7f1
lea eax, [ebp - 0x250]
push 0
push eax
call dword [sym.imp.MSVCRT.dll__open]
pop ecx
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x44d7f1
mov eax, dword [ebx + 0xa0]
push 0
cdq
push 0xa
push edx
push eax
call fcn.0059d870
mov ebx, dword [ebp - 8]
mov esi, eax
mov edi, edx
add esi, 0x10
adc edi, 0
push 0
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll__lseeki64]
add esp, 0x10
cmp esi, eax
jne 0x44d7e9
cmp edi, edx
je 0x44d7f9
push ebx
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
and byte [ebp - 0x48], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x47]
push 0xa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__read]
push ebx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__close]
add esp, 0x10
test esi, esi
je 0x44d7f1
cmp esi, 0xffffffff
je 0x44d7f1
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x48]
push 0x676adc
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [ebp - 4]
add esp, 0xc
jmp 0x44d7f4
Function at 0x44de85
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push 0x40
xor bl, bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
mov byte [ebp - 0x21c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str._s.
lea eax, [ebp - 0x21c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCRT.dll__findfirst]
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x44dee5
mov al, 1
jmp 0x44df44
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x44df24
lea eax, [ebp - 0x104]
push 0x67a184
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x44df24
lea eax, [ebp - 0x104]
push 0x67a180
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x44df3a
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.MSVCRT.dll__findnext]
pop ecx
test eax, eax
pop ecx
je 0x44dee5
mov bl, 1
push esi
call dword [sym.imp.MSVCRT.dll__findclose]
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4651fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x5f2da6
call fcn.0059d590
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xe9
call sub.MFC42.DLL_CDialog::CDialog
xor edi, edi
lea ecx, [esi + 0x98]
mov dword [ebp - 4], edi
call fcn.004df254
lea ecx, [esi + 0x1f0]
mov byte [ebp - 4], 1
call fcn.004df254
lea ecx, [esi + 0x348]
mov byte [ebp - 4], 2
call fcn.004df254
lea ecx, [esi + 0x4a0]
mov byte [ebp - 4], 3
call fcn.004df254
lea ecx, [esi + 0x5f8]
mov byte [ebp - 4], 4
call fcn.004df254
lea ecx, [esi + 0x750]
mov byte [ebp - 4], 5
call fcn.004df254
lea ecx, [esi + 0x8a8]
mov byte [ebp - 4], 6
call fcn.004df254
lea ecx, [esi + 0xa00]
mov byte [ebp - 4], 7
call fcn.004df254
lea ecx, [esi + 0xb58]
mov byte [ebp - 4], 8
call fcn.004df254
lea ecx, [esi + 0xcb0]
mov byte [ebp - 4], 9
call fcn.004df254
lea ecx, [esi + 0xe08]
mov byte [ebp - 4], 0xa
call fcn.004df254
lea ecx, [esi + 0xf60]
mov byte [ebp - 4], 0xb
call fcn.004df254
lea ecx, [esi + 0x10b8]
mov byte [ebp - 4], 0xc
call fcn.004b269a
lea ecx, [esi + 0x1174]
mov byte [ebp - 4], 0xd
call fcn.004b269a
lea ecx, [esi + 0x1230]
mov byte [ebp - 4], 0xe
call fcn.004b269a
lea ecx, [esi + 0x12ec]
mov byte [ebp - 4], 0xf
call fcn.004b269a
lea ecx, [esi + 0x13a8]
mov byte [ebp - 4], 0x10
call fcn.004b269a
lea ecx, [esi + 0x1464]
mov byte [ebp - 4], 0x11
call fcn.004b269a
lea ecx, [esi + 0x1520]
mov byte [ebp - 4], 0x12
call fcn.004a8328
lea ecx, [esi + 0x15bc]
mov byte [ebp - 4], 0x13
call fcn.004a8328
lea ecx, [esi + 0x1658]
mov byte [ebp - 4], 0x14
call fcn.004a8328
lea ecx, [esi + 0x16f4]
mov byte [ebp - 4], 0x15
call fcn.004a8328
lea ecx, [esi + 0x1790]
mov byte [ebp - 4], 0x16
call fcn.004a8328
lea ecx, [esi + 0x182c]
mov byte [ebp - 4], 0x17
call fcn.004a8328
lea ecx, [esi + 0x18c8]
mov byte [ebp - 4], 0x18
call fcn.004a8328
lea ecx, [esi + 0x1964]
mov byte [ebp - 4], 0x19
call fcn.004a8328
lea ecx, [esi + 0x1a00]
mov byte [ebp - 4], 0x1a
call fcn.004a8328
lea ecx, [esi + 0x1a9c]
mov byte [ebp - 4], 0x1b
call fcn.004a8328
lea ecx, [esi + 0x1b38]
mov byte [ebp - 4], 0x1c
call fcn.004a8328
lea ecx, [esi + 0x1bd4]
mov byte [ebp - 4], 0x1d
call fcn.004a8328
lea ecx, [esi + 0x1c70]
mov byte [ebp - 4], 0x1e
call fcn.004a8328
lea ecx, [esi + 0x1d0c]
mov byte [ebp - 4], 0x1f
call fcn.004a8328
lea ecx, [esi + 0x1da8]
mov byte [ebp - 4], 0x20
call fcn.004a8328
lea ecx, [esi + 0x1e44]
mov byte [ebp - 4], 0x21
call fcn.004a8328
lea ecx, [esi + 0x1ee0]
mov byte [ebp - 4], 0x22
call fcn.004a8328
lea ecx, [esi + 0x1f7c]
mov byte [ebp - 4], 0x23
call fcn.004a8328
push 0x2132b
mov dword [esi], 0x618110
mov dword [esi + 0x64], edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
fldz
mov dword [esi + 0x70], eax
mov dword [esi + 0x94], edi
fstp dword [esi + 0x90]
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x60], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x487d2e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x5f5d36
call fcn.0059d590
sub esp, 0x104
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push 0x15e
call sub.MFC42.DLL_CDialog::CDialog
xor ebx, ebx
lea ecx, [esi + 0x80]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 1
call fcn.00402cc4
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 2
call fcn.00402cc4
lea ecx, [esi + 0xbc]
mov byte [ebp - 4], 3
call fcn.004a8328
lea ecx, [esi + 0x158]
mov byte [ebp - 4], 4
call fcn.004a8328
lea ecx, [esi + 0x1f4]
mov byte [ebp - 4], 5
call fcn.004df254
lea ecx, [esi + 0x34c]
mov byte [ebp - 4], 6
call fcn.004df254
lea ecx, [esi + 0x4a4]
mov byte [ebp - 4], 7
call fcn.004df254
lea ecx, [esi + 0x5fc]
mov byte [ebp - 4], 8
call fcn.004df254
lea ecx, [esi + 0x754]
mov byte [ebp - 4], 9
call fcn.004df254
lea ecx, [esi + 0x8ac]
mov byte [ebp - 4], 0xa
call fcn.004df254
lea ecx, [esi + 0xa04]
mov byte [ebp - 4], 0xb
call fcn.004df254
lea ecx, [esi + 0xb5c]
mov byte [ebp - 4], 0xc
call fcn.004df254
lea ecx, [esi + 0xcb4]
mov byte [ebp - 4], 0xd
call fcn.004df254
lea edi, [esi + 0xe0c]
mov byte [ebp - 4], 0xe
mov ecx, edi
call fcn.0059d1ee
mov dword [edi], 0x616ec8
push ebx
mov byte [ebp - 4], 0xf
mov dword [esi], 0x61bb88
mov dword [esi + 0xb8], ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x94], eax
xor eax, eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], ebx
push 0x3f
lea edi, [ebp - 0x10f]
pop ecx
mov byte [ebp - 0x110], bl
rep stosd dword es:[edi], eax
fldz
fstp dword [esi + 0x70]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
mov byte [esi + 0xb4], bl
push eax
push 0xff
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
cmp byte [ebp + eax - 0x111], 0x5c
pop ecx
jne 0x487edf
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [ebp + eax - 0x111], bl
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x110]
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [esi + 0x80]
call fcn.004029af
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4ab723
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
mov ecx, 0x68f8c0
jmp 0x4ab716
mov eax, 0x5f9083
call fcn.0059d590
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0x50]
call fcn.004ad357
xor ebx, ebx
lea ecx, [esi + 0x70]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea eax, [esi + 0x7c]
lea ecx, [ebp - 0xd]
push ebx
push ecx
lea ecx, [eax + 8]
mov byte [ebp - 4], 2
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004ece61
lea eax, [esi + 0x88]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 5
call fcn.004ad481
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 6
call fcn.004ad481
push 6
mov edi, 0x68f370
pop eax
mov byte [ebp - 4], 7
push 0xb
mov dword [esi + 4], eax
fldz
pop ecx
mov dword [esi + 0xc], eax
fstp dword [esi + 0x44]
push 8
mov dword [esi], 0x61f990
pop eax
mov dword [esi + 8], ecx
fldz
push edi
mov dword [esi + 0x10], 0xc
fstp dword [esi + 0x48]
mov dword [esi + 0x14], 7
mov dword [esi + 0x18], 0xd
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0x10
mov dword [esi + 0x2c], 0xa
mov dword [esi + 0x30], 0x13
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], 0x15
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x68], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x70]
call fcn.004029af
lea eax, [esi + 0x5c]
push ebx
push eax
push str.State
mov edi, str.GuiSetup.ini
push str.AutoWrite
push edi
call fcn.00594e29
lea eax, [esi + 0x64]
push ebx
push eax
push str.Status
push str.ExtraWrite
push edi
call fcn.00594e29
mov ecx, dword [ebp - 0xc]
add esp, 0x28
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ae0de
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x5f950a
call fcn.0059d590
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x18]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push eax
call fcn.00402c6e
and dword [ebp - 4], 0
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.00402c6e
add edi, 0x30
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 1
call fcn.004ae153
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4ae58f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5f95b3
call fcn.0059d590
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
lea eax, [ebp - 0xd]
mov ebx, 0x68f370
push eax
push ebx
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.00402bfa
lea eax, [ebp - 0xd]
lea ecx, [esi + 0x24]
push eax
push ebx
mov byte [ebp - 4], 3
call fcn.00402bfa
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4b0362
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
push 0x2a
xor edi, edi
call fcn.004b0404
test eax, eax
jne 0x4b0380
push 0x36
mov ecx, esi
call fcn.004b0404
test eax, eax
je 0x4b0383
push 1
pop edi
mov al, byte [esp + 0xc]
cmp al, 0x10
jb 0x4b038f
cmp al, 0x19
jbe 0x4b039f
cmp al, 0x1e
jb 0x4b0397
cmp al, 0x26
jbe 0x4b039f
cmp al, 0x2c
jb 0x4b03c7
cmp al, 0x32
ja 0x4b03c7
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0xff
test ax, ax
je 0x4b03ba
test edi, edi
je 0x4b03be
test ax, ax
jne 0x4b03c3
test edi, edi
je 0x4b03c3
push 1
pop eax
jmp 0x4b03c9
xor eax, eax
jmp 0x4b03c9
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x4b11c4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_CWnd::GetDlgCtrlID
push eax
push esi
mov ecx, 0x68f8c0
call fcn.004abe2b
lea edi, [esi + 0x40]
mov ecx, edi
call fcn.004b0f68
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0x18]
sub eax, dword [ebp + 8]
mov byte [esi + 0x74], cl
mov bl, byte [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov byte [esi + 0x51], bl
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [esi + 0x15b0], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [esi + 0x15b4], eax
mov al, byte [ebp + 0x10]
movzx ecx, al
mov byte [esi + 0x50], al
mov eax, dword [ebp - 4]
sub eax, ecx
sub eax, dword [ebp - 0xc]
inc eax
cdq
idiv ecx
movzx ecx, bl
mov byte [esi + 0x52], al
mov eax, dword [ebp - 8]
sub eax, ecx
sub eax, dword [ebp - 0x10]
inc eax
cdq
idiv ecx
xor edx, edx
xor ecx, ecx
mov byte [esi + 0x53], al
lea eax, [esi + 0x1180]
mov dword [eax - 0x500], edx
mov byte [esi + ecx + 0x1080], dl
mov dword [eax], edx
mov dword [eax - 0xd00], edx
mov dword [eax - 0x1100], 3
inc ecx
add eax, 4
cmp ecx, 0x100
jl 0x4b1260
mov edi, dword [ebp + 0x1c]
cmp edi, edx
je 0x4b12a8
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x1fb8]
call fcn.004029af
push 1
pop eax
pop edi
mov dword [esi + 0x15a0], eax
mov dword [esi + 0x15a4], eax
pop esi
pop ebx
leave
ret 0x18