joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40268b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401042
sub eax, edx
lea esi, [eax + 1]
push esi
call dword [sym.imp.MSVCR90.dll_malloc]
push esi
mov edi, eax
push 0
push edi
call sub.MSVCR90.dll_memset
push ebx
push 0x403238
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea ecx, [esp + 0x14]
call sub.mfc90.dll_Ordinal_406
lea eax, [edi + 4]
mov dword [esp + 0x140], 0
mov ebx, dword [sym.imp.MSVCR90.dll_strchr]
push 0x5c
push eax
call ebx
push 0x104
lea ecx, [esp + 0x38]
push 0
push ecx
mov esi, eax
call sub.MSVCR90.dll_memset
add esp, 0x14
test esi, esi
je 0x4010f2
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, esi
sub edx, edi
push edx
lea eax, [esp + 0x30]
push edi
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push 0
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x1c]
call sub.mfc90.dll_Ordinal_2490
test eax, eax
jne 0x4010e1
push eax
lea edx, [esp + 0x30]
push edx
call ebp
lea eax, [esi + 1]
push 0x5c
push eax
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x4010b2
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x140], 0xffffffff
call sub.mfc90.dll_Ordinal_665
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00401d82
add esp, 0x130
ret
Function at 0x401420
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1911c
call fcn.004025a0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x19118], eax
push ebx
push ebp
mov ebp, dword [esp + 0x19128]
push esi
mov esi, dword [sym.imp.MSVCR90.dll_fread]
push edi
push 4
lea eax, [esp + 0x14]
push 1
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebx
call esi
add esp, 0x10
test eax, eax
je 0x40159e
jmp 0x401474
mov ebp, dword [esp + 0x14]
cmp dword [esp + 0xc], ebx
je 0x40159e
push 0x104
lea ecx, [esp + 0x1c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebp
lea edx, [esp + 0x1c]
push 0x403238
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, ebp
add esp, 0xc
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4014b0
sub eax, ecx
mov ecx, dword [esp + 0xc]
push edi
push ecx
lea edx, [esp + eax + 0x20]
push 1
push edx
call esi
push edi
push 4
lea eax, [esp + 0x28]
push 1
push eax
mov dword [esp + 0x30], ebx
call esi
lea ecx, [esp + 0x38]
call section..text
lea ecx, [esp + 0x38]
push 0x40325c
push ecx
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebp, eax
add esp, 0x28
cmp ebp, ebx
je 0x401572
push ebx
push ebx
push ebp
call dword [sym.imp.MSVCR90.dll_fseek]
mov eax, dword [esp + 0x1c]
add esp, 0xc
jmp 0x401516
mov esi, dword [sym.imp.MSVCR90.dll_fread]
sub eax, ebx
cmp eax, 0x19000
jbe 0x401524
mov eax, 0x19000
push edi
push eax
lea edx, [esp + 0x128]
push 1
push edx
call esi
mov esi, eax
add esp, 0x10
test esi, esi
jle 0x401554
push ebp
push esi
lea eax, [esp + 0x128]
push 1
push eax
add ebx, esi
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
test esi, esi
je 0x40155e
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x401510
push ebp
call dword [sym.imp.MSVCR90.dll_fclose]
mov esi, dword [sym.imp.MSVCR90.dll_fread]
add esp, 4
xor ebx, ebx
jmp 0x401583
mov ecx, dword [esp + 0x10]
push 1
push ecx
push edi
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push edi
push 4
lea edx, [esp + 0x14]
push 1
push edx
mov dword [esp + 0x1c], ebx
call esi
add esp, 0x10
test eax, eax
jne 0x401470
mov ecx, dword [esp + 0x19124]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401d82
add esp, 0x1911c
ret
Function at 0x4015c0
Capabilities:
Acquire debug privileges
Enumerate processes
Get file system object information
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x4025f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x2c8]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
xor edi, edi
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x18]
mov dword [esp + 0x2d0], edi
call dword [sym.imp.mfc90.dll_Ordinal_316]
push edi
push 2
mov byte [esp + 0x2d8], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x20], eax
cmp eax, edi
je 0x401767
lea ecx, [esp + 0x3c]
push ecx
push eax
mov dword [esp + 0x44], 0x128
call sub.KERNEL32.dll_Process32First
lea edx, [esp + 0x1c]
push edx
push 0xf01ff
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4016ba
lea eax, [esp + 0x24]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4016b3
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push edi
push edi
push edi
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x2c]
push edi
push ecx
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 2
mov dword [esp + 0x4c], edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 0x1c]
push edx
call ebx
cmp esi, edi
je 0x401767
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4016d0
push 0x101
push 0x160
lea eax, [esp + 0x16c]
push eax
push 0
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0x4032b8
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401750
mov ecx, dword [esp + 0x18]
push ecx
push eax
call dword [sym.imp.MSVCR90.dll__stricmp]
add esp, 8
test eax, eax
jne 0x401750
xor edi, edi
mov edx, dword [esp + 0x44]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401750
push 1
push esi
call ebp
push esi
mov edi, eax
call ebx
test edi, edi
je 0x40172a
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x3c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4016d0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, edi
mov ecx, dword [esp + 0x2c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.00401d82
add esp, 0x2c0
ret
Function at 0x4017b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
push esi
push edi
push 0x10
call sub.mfc90.dll_Ordinal_798
add esp, 4
test eax, eax
je 0x4017d4
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov esi, eax
jmp 0x4017d6
xor esi, esi
push 0x44
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR90.dll_memset
mov edx, dword [esp + 0x5c]
add esp, 0xc
push esi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x30], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov edi, eax
call sub.mfc90.dll_Ordinal_800
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x44
ret
Function at 0x401830
Capabilities:
Copy file
Delete file
Read .ini file
Read file on windows

Disassembly:
sub esp, 0x68c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x688], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x170]
push str._s.copy
push edx
call esi
add esp, 0xc
push 0
lea eax, [esp + 0x170]
push eax
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
lea edx, [esp + 0x384]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.MSVCR90.dll__splitpath]
add esp, 0x14
lea edx, [esp + 0x37c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48c]
push 0x403250
push ecx
call esi
lea edx, [esp + 0x494]
push edx
lea eax, [esp + 0x288]
push str._sguopaidata.ini
push eax
call esi
add esp, 0x1c
push 0x32
lea ecx, [esp + 0x34]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x274]
push edx
push 0x32
lea eax, [esp + 0x38]
push eax
push 0
push str.VERSION
push str.DATA
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x16c]
push 0x403258
push ecx
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, dword [sym.imp.MSVCR90.dll_fseek]
push 2
mov edi, eax
push 0
push edi
call ebx
add esp, 0x14
push 1
push 0xfffffffffffffffc
push edi
call ebx
add esp, 0xc
mov dword [esp + 0x1c], 0
push edi
mov ebp, dword [sym.imp.MSVCR90.dll_fread]
push 4
lea edx, [esp + 0x24]
push 1
push edx
call ebp
mov eax, dword [esp + 0x2c]
push 0
push eax
push edi
call ebx
add esp, 0x1c
push edi
push 1
lea edx, [esp + 0x1c]
xor ecx, ecx
push 1
push edx
mov word [esp + 0x24], cx
call ebp
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 0x14
cmp eax, 1
jne 0x4019b3
lea ecx, [esp + 0x37c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x594]
push str._s_s
push eax
call esi
add esp, 0x10
call fcn.004015c0
push edi
xor eax, eax
push 0xe
lea ecx, [esp + 0x28]
push 1
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], ax
mov byte [esp + 0x3e], al
call ebp
lea edx, [esp + 0x494]
push edx
call fcn.00401420
add esp, 0x14
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x274]
push ecx
lea edx, [esp + 0x24]
push edx
push str.VERSION
push str.DATA
call esi
lea eax, [esp + 0x274]
push eax
lea ecx, [esp + 0x34]
push ecx
push str.OVERSION
push str.DATA
call esi
lea edx, [esp + 0x58c]
push edx
call fcn.004017b0
mov ecx, dword [esp + 0x69c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401d82
add esp, 0x68c
ret
Function at 0x401a70
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x108
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 4
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00401d82
add esp, 0x108
ret
Function at 0x401d82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401d8c
repz ret
jmp fcn.0040203d
Function at 0x7a411e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7a413e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a412a
add dl, dl
jne 0x7a4149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a419a
xor eax, eax
add dl, dl
jne 0x7a4156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7a423b
add dl, dl
jne 0x7a4165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a4170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a417b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a4186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7a4190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7a4135
mov eax, 1
add dl, dl
jne 0x7a41a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7a41b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a419f
sub eax, ebx
mov ebx, 1
jne 0x7a41e6
mov ecx, 1
add dl, dl
jne 0x7a41cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7a41d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a41c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a4135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7a41fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7a4208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7a41f4
cmp eax, 0x7d00
jae 0x7a422b
cmp eax, 0x500
jb 0x7a4226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a4135
cmp eax, 0x7f
ja 0x7a422e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7a4135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7a425c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7a4135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x44a1b7
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], eax
mov eax, dword [0x533644]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44a201
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x14]
push eax
call fcn.004e3c00
add esp, 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x44a21f
jmp 0x44a319
lea eax, [ebp - 0x30]
push eax
push 0x18
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x44a248
mov dword [ebp - 0x34], 1
jmp 0x44a24f
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 0
je 0x44a25e
jmp 0x44a319
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00447b00
add esp, 4
test eax, eax
je 0x44a2a3
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.004e4256
add esp, 8
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_DPtoLP]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0x96
push 0x96
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 4
push 4
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x18], 0
push 0
push 1
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 6
mov eax, dword [ebp + 8]
push eax
call fcn.0044803b
add esp, 0x1c
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x18], 0
je 0x44a331
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x38], 0
je 0x44a341
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x34]
jmp 0x44a349
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46271c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x462801
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4627fb
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4627fb
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
jle 0x4627e7
cmp dword [ebp - 0x10], 0xfa00
jle 0x4627b6
mov dword [ebp - 0x18], 0xfa00
jmp 0x4627bc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00522244
add esp, 0xc
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
jmp 0x462793
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 8]
jmp 0x462809
pop edi
pop esi
pop ebx
leave
ret
Function at 0x472d8e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0xffffffff
jne 0x472dcd
jmp case.0x472ec3.4
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov dword [ebp - 0x14], eax
jmp 0x472eaa
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor ecx, ecx
mov cl, ah
test ecx, ecx
je case.0x472ec3.0
jmp case.0x472ec3.4
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cmp eax, 9
jne 0x472e4a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor ecx, ecx
mov cl, ah
test ecx, ecx
jne 0x472e32
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cmp eax, 0x26
jne 0x472e3e
mov dword [ebp - 0x10], 1
jmp 0x472e45
mov dword [ebp - 0x10], 0
jmp 0x472e6e
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cmp eax, 0x26
jne 0x472e67
mov dword [ebp - 0x10], 1
jmp 0x472e6e
mov dword [ebp - 0x10], 0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00472c76
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x472e99
mov eax, dword [ebp - 8]
push eax
call fcn.004addd5
add esp, 4
mov dword [ebp - 8], 1
jmp case.0x472ec3.4
sub dword [ebp - 0x14], 9
cmp dword [ebp - 0x14], 0x1f
ja case.0x472ec3.4
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + 0x472ede]
jmp dword [ecx*4 + 0x472eca]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
jmp 0x472f1d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a5312
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [0x531b6c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [0x52c400], eax
mov dword [0x52c404], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [0x52d9f8], eax
mov dword [0x52d9fc], ecx
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0x52cfd0
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x5a]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x56]
push eax
push 0
push 0
push 0x52d8d0
call dword [sym.imp.USER32.dll_SetRect]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor ecx, ecx
mov cl, ah
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4a53aa
mov dword [0x531af0], 0x17
jmp 0x4a53b4
mov dword [0x531af0], 0x18
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a85d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call fcn.0049c470
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
push 0
mov eax, dword [0x531be4]
push eax
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
mov eax, dword [0x531be8]
push eax
push 0x69
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x28
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4a8650
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a89f1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
call fcn.0049c470
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x533660], eax
push 0
mov eax, dword [0x531be4]
push eax
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x28
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x533644]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004e3c5c
add esp, 8
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
jmp 0x4a8a5d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a95c2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x154], eax
jmp 0x4a96b4
push 0x105
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x108]
push eax
mov eax, dword [0x533640]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x4a96e0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x4a964f
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4a96e0
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004a9582
add esp, 8
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x4a96e0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x4a96e0
cmp dword [ebp - 0x154], 1
je 0x4a95dc
cmp dword [ebp - 0x154], 2
je 0x4a9623
cmp dword [ebp - 0x154], 0xf
je 0x4a9654
jmp 0x4a9694
pop edi
pop esi
pop ebx
leave
ret 0x10