joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a3d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x50c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa4], 0
push 0x80
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.00402610
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x6490
push ecx
call fcn.0040cf90
add esp, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
jmp 0x48a44a
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jge 0x48a48e
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x98]
movsx edx, byte [ecx + 0x6490]
push edx
call fcn.004a0c90
add esp, 4
test eax, eax
jne 0x48a48c
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x98]
movsx ecx, byte [eax + 0x6490]
cmp ecx, 0x2e
je 0x48a48c
jmp 0x48a48e
jmp 0x48a43b
mov edx, dword [ebp - 0x98]
cmp edx, dword [ebp - 0x9c]
jne 0x48a4d7
mov eax, dword [ebp + 8]
add eax, 0x6490
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x5c90
push ecx
call fcn.0040ce90
add esp, 8
push 0x400
push 0
mov edx, dword [ebp + 8]
add edx, 0x6490
push edx
call fcn.00402610
add esp, 0xc
xor eax, eax
jmp 0x48a5f4
push 0x59a600
push 0x5a8d60
call fcn.0048a1d0
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x6490
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x48a5b7
mov ecx, dword [ebp + 8]
add ecx, 0x6490
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0xa0], eax
push 0x10
push 0
lea edx, [ebp - 0x94]
push edx
call fcn.00402610
add esp, 0xc
mov eax, 2
mov word [ebp - 0x94], ax
mov ecx, dword [ebp - 0xa0]
mov dx, word [ecx + 8]
mov word [ebp - 0x94], dx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xa8], ecx
push 4
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.00402b10
add esp, 0xc
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
je 0x48a59d
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040ce90
add esp, 8
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp + 8]
add eax, 0x5c90
push eax
call fcn.0040ce90
add esp, 8
jmp 0x48a5dc
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x5c90
push edx
call fcn.0040ce90
add esp, 8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0xa4], eax
push 0x59a600
push 0x5a8d60
call fcn.0048a170
add esp, 8
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014c7
mov esp, ebp
pop ebp
ret
Function at 0x48a610
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x50c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa4], 0
push 0x80
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.00402610
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x6090
push ecx
call fcn.0040cf90
add esp, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
jmp 0x48a68a
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x9c]
jge 0x48a6ce
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x98]
movsx edx, byte [ecx + 0x6090]
push edx
call fcn.004a0c90
add esp, 4
test eax, eax
jne 0x48a6cc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x98]
movsx ecx, byte [eax + 0x6090]
cmp ecx, 0x2e
je 0x48a6cc
jmp 0x48a6ce
jmp 0x48a67b
mov edx, dword [ebp - 0x98]
cmp edx, dword [ebp - 0x9c]
jne 0x48a717
mov eax, dword [ebp + 8]
add eax, 0x6090
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x6890
push ecx
call fcn.0040ce90
add esp, 8
push 0x400
push 0
mov edx, dword [ebp + 8]
add edx, 0x6090
push edx
call fcn.00402610
add esp, 0xc
xor eax, eax
jmp 0x48a834
push 0x59a600
push 0x5a8d60
call fcn.0048a1d0
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x6090
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x48a7f7
mov ecx, dword [ebp + 8]
add ecx, 0x6090
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0xa0], eax
push 0x10
push 0
lea edx, [ebp - 0x94]
push edx
call fcn.00402610
add esp, 0xc
mov eax, 2
mov word [ebp - 0x94], ax
mov ecx, dword [ebp - 0xa0]
mov dx, word [ecx + 8]
mov word [ebp - 0x94], dx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xa8], ecx
push 4
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.00402b10
add esp, 0xc
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
je 0x48a7dd
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.0040ce90
add esp, 8
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp + 8]
add eax, 0x6890
push eax
call fcn.0040ce90
add esp, 8
jmp 0x48a81c
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x6890
push edx
call fcn.0040ce90
add esp, 8
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0xa4], eax
push 0x59a600
push 0x5a8d60
call fcn.0048a170
add esp, 8
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014c7
mov esp, ebp
pop ebp
ret
Function at 0x48ccb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [0x50fb8c]
mov dword [eax + 0x5884], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x5888], 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5888]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x5884
push edx
push 0x1001
push 0xffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5880]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov edx, dword [ebp + 8]
mov dword [edx + 0x588c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x588c], 0
jne 0x48cd6c
mov ecx, dword [ebp + 8]
mov edx, dword [0x50fb8c]
mov dword [ecx + 0x5884], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x5888], 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5888]
push edx
mov eax, dword [ebp + 8]
add eax, 0x5884
push eax
push 0x1002
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5880]
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x588c], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x588c], 0
je 0x48ce14
cmp dword [0x50fb80], 0
je 0x48ce14
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x4c67
push eax
mov ecx, dword [0x50fb8c]
push ecx
push str.Client_Set_Socket_Recv_Buffer_Size___d___s
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
call fcn.004010f0
add esp, 0x10
mov eax, dword [0x50fb80]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x4867
push ecx
push 0x50fc3d
call fcn.004a01c0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
mov eax, dword [ebp - 4]
push eax
push 0x2c1
push str.Client_Set_Recv_Socket_Buffer_Size
call fcn.004a14b0
add esp, 0x10
mov ecx, dword [0x50fb80]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
push 0x50fc3d
call fcn.004a01c0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x48ce20
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [0x50fba0]
mov dword [eax + 0x5878], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x587c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x5888], 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5888]
push edx
mov eax, dword [ebp + 8]
add eax, 0x5878
push eax
push 0x80
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5880]
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x588c], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x588c], 0
je 0x48cf32
cmp dword [0x50fb80], 0
je 0x48cf32
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x4c67
push eax
mov ecx, dword [0x50fba0]
push ecx
push str.Client_Set_Socket_Linger_Option___d___s
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
call fcn.004010f0
add esp, 0x10
mov eax, dword [0x50fb80]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x4867
push ecx
push 0x50fc3d
call fcn.004a01c0
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
mov eax, dword [ebp - 4]
push eax
push 0x2c1
push str.Client_Set_Socket_Linger_Option
call fcn.004a14b0
add esp, 0x10
mov ecx, dword [0x50fb80]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x4867
push edx
push 0x50fc3d
call fcn.004a01c0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x49b6e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00461100
mov eax, dword [0x50c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1010], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1010], 0x1000
lea eax, [ebp - 0x1024]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1018]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jne 0x49b82a
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x49b7e9
lea ecx, [ebp - 0x1014]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49b7e5
mov ecx, dword [ebp - 0x1014]
push ecx
call fcn.0049b6e0
add esp, 4
test eax, eax
jne 0x49b7d6
xor eax, eax
jmp 0x49b82f
mov edx, dword [ebp - 0x1014]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49b7e9
xor eax, eax
jmp 0x49b82f
mov dword [ebp - 0x1010], 0x1000
lea eax, [ebp - 0x1024]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1018]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x100c], eax
jmp 0x49b76f
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014c7
mov esp, ebp
pop ebp
ret
Function at 0x4edd00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov dword [0x5a40e0], 1
jmp 0x4edd1c
mov eax, dword [0x5a40e0]
add eax, 1
mov dword [0x5a40e0], eax
cmp dword [0x5a40e0], 0xff
jge 0x4edd93
mov ecx, dword [0x5a40e0]
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [0x5a7370], ax
mov edx, dword [0x5a40e0]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [0x5a86ea], ax
movsx eax, word [0x5a7370]
test eax, eax
jge 0x4edd8e
movzx ecx, word [0x5a40e0]
push ecx
call fcn.004edc50
add esp, 4
mov edx, dword [0x5a40e0]
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [0x5a7370], ax
mov eax, dword [0x5a40e0]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [0x5a86ea], ax
jmp 0x4edd0f
pop ebp
ret

Function at 0x4f0180
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [0x5a40f8], 0
jne 0x4f01a9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004f0060
jmp 0x4f0245
push 0x597b0c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5a5074], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4f01e9
mov eax, dword [0x5a5074]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4f01a9
mov ecx, dword [0x59c8b4]
add ecx, dword [0x59f8fc]
mov dword [0x59bfe4], ecx
mov edx, dword [0x59f8fc]
add edx, 1
mov dword [0x59f8fc], edx
mov eax, dword [0x5a5074]
mov dword [0x5a86fc], eax
jmp 0x4f0218
push 0
imul ecx, dword [0x5a40f8], 0x3e8
push ecx
mov edx, dword [0x59bfe4]
push edx
mov eax, dword [0x5a4ca8]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [0x5a86fc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4f2c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00402610
add esp, 0xc
mov dword [ebp - 0x54], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402610
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x4000008
push 0
push 0
push 0
push 0x5a46a0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4f2c70
push 0x50040
push 0x5a80a0
push str.StreetPerfect_Hotkey_Proxy_Server_Failed_To_Start
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4f2c75
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4f2c80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00402610
add esp, 0xc
mov dword [ebp - 0x58], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402610
add esp, 0xc
push 0x59868c
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f2ce3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x4f2d2b
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0x4000008
push 0
push 0
push 0
push 0x5a42a0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4f2d26
push 0x50040
push 0x5a80a0
push str.StreetPerfect_Hotkey_Proxy_Wizard_Failed_To_Start
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4f2d2b
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4f2d30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0x2710
push 0x598840
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x4f2e6f
push 0
push 0x80000080
push 3
push 0
push 3
push 0xc0000000
push 0x598810
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a7d70], eax
cmp dword [0x5a7d70], 0xffffffff
jne 0x4f2d90
cmp dword [ebp + 8], 0
je 0x4f2d89
push 0x5987e0
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f2e84
mov dword [0x5a508c], 0
push 0
push 0x5a508c
push 1
push 0x5987dc
mov eax, dword [0x5a7d70]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x5a508c], 0
push 0
push 0x5a508c
push 0x5987b0
call fcn.0040cf90
add esp, 4
push eax
push 0x5a4aa0
mov ecx, dword [0x5a7d70]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [0x5a7d70]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x5a508c], 0
je 0x4f2e58
cmp dword [ebp + 8], 0
je 0x4f2e4f
push 0x598784
push 0x5a4aa0
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f2e26
push str.StreetPerfect_Development_Hotkey_Proxy_Client_Running_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f2e4f
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Running_r_n
call fcn.004e41b0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x5a7368], 0x51
push 1
call fcn.004f3280
add esp, 4
mov eax, 1
jmp 0x4f2e84
cmp dword [ebp + 8], 0
je 0x4f2e6b
push 0x5986e0
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f2e84
cmp dword [ebp + 8], 0
je 0x4f2e82
push 0x5986b0
call fcn.004e41b0
add esp, 4
xor eax, eax
pop ebp
ret
Function at 0x4f2fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x50c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x208], 0
push 0
call fcn.004f2d30
add esp, 4
test eax, eax
jne 0x4f2ff5
cmp dword [ebp + 8], 0
je 0x4f2fee
push str.StreetPerfect_Hotkey_Proxy_Client_Not_Found_r_n
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f3155
push 0
push 0x4f2e90
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
mov dword [0x59db50], 0
push 0
push 0x4f2f20
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
cmp dword [0x59db50], 0
je 0x4f3035
push 0
push 0x4f2e90
push 0
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push 0x5a4aa0
lea eax, [ebp - 0x204]
push eax
call fcn.0040ce90
add esp, 8
push 0x2710
push str..pipeB2D6372A_BE7E_46DC_A057_654B8F27B689
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x4f3153
push 0
push 0x80000080
push 3
push 0
push 3
push 0xc0000000
push 0x598944
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a7d70], eax
cmp dword [0x5a7d70], 0xffffffff
jne 0x4f30a6
cmp dword [ebp + 8], 0
je 0x4f309f
push str.StreetPerfect_Hotkey_Proxy_Client_Not_Responding_r_n
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f3155
push 0
push 0x5a508c
push 1
push 0x59890c
mov ecx, dword [0x5a7d70]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x5a7d70]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x208], 0
jmp 0x4f30eb
mov eax, dword [ebp - 0x208]
add eax, 0x3e8
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x2710
jge 0x4f3153
push 0
call fcn.004f2d30
add esp, 4
test eax, eax
jne 0x4f3146
cmp dword [ebp + 8], 0
je 0x4f313f
push 0x5988e0
lea ecx, [ebp - 0x204]
push ecx
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f3132
push str.StreetPerfect_Development_Hotkey_Proxy_Client_Stopped_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f313f
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Stopped_r_n
call fcn.004e41b0
add esp, 4
mov eax, 1
jmp 0x4f3155
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4f30da
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004014c7
mov esp, ebp
pop ebp
ret
Function at 0x4f3170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], 0
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.00402610
add esp, 0xc
mov dword [ebp - 0x58], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402610
add esp, 0xc
push 0
call fcn.004f2d30
add esp, 4
test eax, eax
je 0x4f31c6
push str.StreetPerfect_Hotkey_Proxy_Client_Previously_Started_r_n
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f3279
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x4000008
push 0
push 0
push 0
push 0x5a5780
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4f31ff
push str.StreetPerfect_Hotkey_Proxy_Client_Failed_To_Start_r_n
call fcn.004e41b0
add esp, 4
xor eax, eax
jmp 0x4f3279
mov dword [ebp - 4], 0
jmp 0x4f3214
mov ecx, dword [ebp - 4]
add ecx, 0x3e8
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x2710
jge 0x4f3277
push 0
call fcn.004f2d30
add esp, 4
test eax, eax
je 0x4f326a
cmp dword [ebp + 8], 0
je 0x4f3263
push 0x598a44
push 0x5a4aa0
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f3256
push str.StreetPerfect_Development_Hotkey_Proxy_Client_Started_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f3263
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Started_r_n
call fcn.004e41b0
add esp, 4
mov eax, 1
jmp 0x4f3279
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4f3208
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7a2f7e64
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x602a6c4b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x40153f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40162d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040153f
test eax, eax
jne 0x4016c7
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40215e
sub eax, 0x4016fc
mov dword [esp], 0x4016fc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c7
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401442
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014c9
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401e61
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x54e353e3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x530b1d25
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219