joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c441
Capabilities:
Initialize winhttp library
Reference http user-agent string

Disassembly:
push 0x17c
mov eax, 0x64cfe1
call fcn.005b47af
mov esi, ecx
call fcn.0042bdda
xor eax, eax
mov word [esi + 0xd8], 0x100
xor ebx, ebx
mov word [esi + 0x18], ax
lea ecx, [esi + 0x28]
mov dword [esi + 0x60], ebx
call fcn.0042bd2c
xor eax, eax
mov dword [ebp - 0x14], 7
mov edi, str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_30.0.1599.69_Safari_537.36
mov dword [ebp - 0x18], ebx
push edi
mov word [ebp - 0x28], ax
call fcn.005ff18e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040a315
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x42c51d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 1
push 3
lea ecx, [ebp - 0xd8]
mov dword [esi + 0x60], eax
call fcn.004078ff
push dword [esi + 0x60]
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 1
push str.WinHttpOpen_last_error
push eax
call fcn.00412133
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0xd8]
push eax
push str.Http::init
push 0x221
push str.D:_build6c589d3ff8507062_srccommonNetworkHttp.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xd8]
jmp 0x42c58e
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x42c595
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 1
push 3
lea ecx, [ebp - 0x188]
mov dword [esi + 0x60], eax
call fcn.004078ff
push dword [esi + 0x60]
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 2
push str.WinHttpSetTimeouts_last_error
push eax
call fcn.00412133
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x188]
push eax
push str.Http::init
push 0x228
push str.D:_build6c589d3ff8507062_srccommonNetworkHttp.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x188]
call fcn.0040843a
jmp 0x42c597
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
mov al, bl
call fcn.005b4759
ret
Function at 0x42d364
Capabilities:
Resolve dns

Disassembly:
push 0xf8
mov eax, 0x64d180
call fcn.005b47af
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
mov esi, dword [ebp + 8]
and dword [ebp - 0x54], 0
push ebx
push eax
call fcn.0040d0f1
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x42d391
mov eax, dword [eax]
push eax
call sub.WS2_32.dll_gethostbyname
push 0
push 1
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00409d92
test edi, edi
jne 0x42d40f
push 1
push 3
lea ecx, [ebp - 0x104]
call fcn.004078ff
push ebx
lea eax, [ebp - 0xf4]
mov dword [ebp - 4], edi
push 0x688a30
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00410ade
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push str.Http::resolveHost
push 0x1e8
push str.D:_build6c589d3ff8507062_srccommonNetworkHttp.cpp
push edi
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x104]
call fcn.0040843a
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jmp 0x42d48a
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov eax, dword [edi + 0xc]
mov ebx, ecx
mov dword [ebp - 4], 1
cmp dword [eax], ecx
je 0x42d477
push 4
push dword [eax]
lea eax, [ebp - 0x44]
push eax
call fcn.005f2e80
add esp, 0xc
push dword [ebp - 0x44]
call sub.WS2_32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00415a94
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0042630c
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00409de7
mov eax, dword [edi + 0xc]
inc ebx
lea eax, [eax + ebx*4]
cmp dword [eax], 0
jne 0x42d42a
lea eax, [ebp - 0x50]
mov ecx, esi
push eax
call fcn.0041b913
lea ecx, [ebp - 0x50]
call fcn.00409ec4
mov eax, esi
call fcn.005b4759
ret
Function at 0x430be3
Capabilities:
Hide graphical window

Disassembly:
push 0x48
mov eax, 0x64da6b
call fcn.005b47af
mov edi, ecx
push 0
push dword [edi + 0x2e4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x48
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp - 0x54], eax
and dword [ebp - 4], 0
test eax, eax
je 0x430c2a
push 0x434
push 0x6892bc
push dword [0x739c04]
mov ecx, eax
call fcn.00443bf3
jmp 0x430c2c
xor eax, eax
movaps xmm0, xmmword [0x6894a0]
lea ecx, [ebp - 0x50]
or dword [ebp - 4], 0xffffffff
push ecx
push dword [edi + 4]
mov ecx, eax
mov dword [edi + 0x858], eax
movups xmmword [ebp - 0x50], xmm0
call fcn.00444071
push 5
push 0x23
push 0x190
push 0x3c
push 0x3c
push dword [edi + 4]
lea esi, [edi + 0x860]
mov ecx, esi
call fcn.00446022
and dword [ebp - 0x18], 0
xor eax, eax
push 0x6892c8
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005ff18e
pop ecx
push eax
push 0x6892c8
lea ecx, [ebp - 0x28]
call fcn.0040a315
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0044804b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00409de7
and dword [ebp - 0x30], 0
xor eax, eax
push 0x688fc0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.005ff18e
pop ecx
push eax
push 0x688fc0
lea ecx, [ebp - 0x40]
call fcn.0040a315
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.004479a9
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00409de7
push 5
push dword [edi + 0x864]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.005b4759
ret

Function at 0x430d14
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 0x864]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x2e4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x858]
test ecx, ecx
je 0x430d43
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x105
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
ret
Function at 0x439a3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x739c04]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x10c], ecx
push esi
inc edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x439bab
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x439bab
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x439bab
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x439baa
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x439b24
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00439bc5
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x104]
cmove edi, ecx
cmp dword [ebp - 0x108], eax
je 0x439b9c
push dword [ebp - 0x108]
call fcn.005ff296
pop ecx
jmp 0x439b9c
mov ecx, 0x1234
cmp cx, ax
jne 0x439b9c
or dword [ebp - 0x130], 0xffffffff
lea eax, [ebp - 0x104]
push 3
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x108], eax
call fcn.00439bc5
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x439b76
push eax
call fcn.005ff296
pop ecx
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x439a9b
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.005b4733
mov esp, ebp
pop ebp
ret 4
Function at 0x43ba30
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x43bb9c
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x43bb9b
cmp eax, 0x29
jne 0x43ba68
cmp dword [esi + 0x10], 0
jne 0x43bb9b
test dword [esi + 0x50], edx
je 0x43bba8
cmp eax, 0x2e
jne 0x43ba83
push 5
lea ecx, [esi + 0x24]
call fcn.0043d3db
mov ecx, esi
call fcn.0043d41b
jmp 0x43bb86
cmp eax, 0x5c
jne 0x43bae0
mov ecx, esi
call fcn.0043d41b
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x43bab6
cmp word [esi + 0x48], 0x62
jne 0x43bab6
push 4
lea ecx, [esi + 0x24]
call fcn.0043d3db
mov ecx, esi
call fcn.0043d41b
jmp 0x43bb8d
test eax, eax
je 0x43bad4
cmp word [esi + 0x48], 0x42
jne 0x43bad4
push 4
lea ecx, [esi + 0x24]
call fcn.0043d3db
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x43baaa
mov ecx, esi
call fcn.0043bbb0
jmp 0x43bb86
cmp eax, 0x5b
jne 0x43bb04
mov ecx, esi
call fcn.0043d41b
mov ecx, esi
call fcn.0043bf71
cmp dword [esi + 0x4c], 0x5d
je 0x43ba77
push 4
jmp 0x43bbaa
cmp eax, 0x28
jne 0x43bb2c
mov ecx, esi
call fcn.0043d41b
mov ecx, esi
call fcn.0043d80b
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x43bba8
mov ecx, esi
call fcn.0043d41b
jmp 0x43bb82
cmp eax, 0x5e
jne 0x43bb38
push 2
jmp 0x43baa2
cmp eax, 0x24
jne 0x43bb44
push 3
jmp 0x43baa2
cmp eax, 0x2a
je 0x43bba4
cmp eax, 0x2b
je 0x43bba4
cmp eax, 0x3f
je 0x43bba4
cmp eax, 0x7b
je 0x43bba4
cmp eax, 0x7d
jne 0x43bb62
test dword [esi + 0x50], edx
je 0x43bba0
cmp eax, 0x5d
jne 0x43bb6c
test dword [esi + 0x50], edx
je 0x43bafd
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0043b3be
mov ecx, esi
call fcn.0043d41b
mov bl, 1
test bl, bl
je 0x43bb8d
mov ecx, esi
call fcn.0043d446
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x43ba42
pop ebx
mov al, cl
pop esi
ret
push 6
jmp 0x43bbaa
push 0xa
jmp 0x43bbaa
push 5
call fcn.0059cef5
int3

Function at 0x43e06f
Capabilities:
Create process on windows

Disassembly:
push 0x1c
mov eax, 0x64ec2d
call fcn.005b47af
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 4], edi
mov esi, 0x68a84c
mov dword [ebp - 0x18], edi
push esi
mov word [ebp - 0x28], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a315
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00425662
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00409de7
test bl, bl
je 0x43e0e6
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 5
cmovae eax, dword [ebp + 8]
push edi
push edi
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
lea ecx, [ebp + 8]
call fcn.00409de7
call fcn.005b4759
ret 0x18
Function at 0x441dfd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x441ef7
cmp byte [edi + 0x388], 0
jne 0x441f76
push ebx
lea eax, [ebp - 0x14]
push eax
lea ebx, [edi + 0x118]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.0043191e
lea esi, [edi + 0x264]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x441ea5
push eax
push dword [edi + 4]
lea ecx, [edi + 0x260]
call fcn.0043e662
lea eax, [ebp - 0x24]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
dec ecx
mov eax, edx
mov dword [edi + 0x38c], ecx
sub eax, ecx
mov dword [ebp - 0x28], edx
dec eax
mov ecx, esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.0043115a
mov eax, dword [edi + 0x38c]
mov ecx, ebx
sub dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0043115a
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x14c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push 1
push eax
call fcn.0043115a
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [edi + 0x260]
call fcn.0043f6e3
mov byte [edi + 0x388], 1
pop ebx
jmp 0x441f76
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x441f76
cmp byte [edi + 0x388], 0
je 0x441f76
lea eax, [ebp - 0x14]
push eax
lea esi, [edi + 0x118]
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 4]
call fcn.0043191e
mov eax, dword [edi + 0x38c]
mov ecx, esi
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0043115a
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x14c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push 1
push eax
call fcn.0043115a
push 0
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [edi + 0x388], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005b4733
mov esp, ebp
pop ebp
ret 4
Function at 0x443f86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
mov byte [ebp - 1], 0
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x443fb1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
jmp 0x44401e
push ebx
push edi
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x443fc6
xor al, al
jmp 0x44401d
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x444013
cmp dword [ebp + 0x10], 0
push edi
push dword [esi + 0x20]
jne 0x443feb
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x44400f
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp + 0x14]
cmp ecx, eax
jl 0x444013
push ecx
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.005f2e80
add esp, 0xc
mov byte [ebp - 1], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, byte [ebp - 1]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x444071
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
cmp byte [ebx + 0x30], 0
lea edi, [ebx + 0x38]
mov dword [ebx + 0x24], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x4440c7
cmp dword [ebx + 0x28], 1
jbe 0x4440c7
xor ecx, ecx
cmp dword [ebx + 0x14], ecx
jne 0x4440c7
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
push eax
push 4
push ebx
push 0x4442d7
push ecx
push ecx
call fcn.00626e6f
add esp, 0x18
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x4440c0
mov al, 1
jmp 0x4440c9
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x446f23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [0x739c04]
jb 0x446f3d
mov eax, dword [eax]
push eax
movzx eax, word [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x446f5a
xor eax, eax
jmp 0x446fe4
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x446f53
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x446f53
push dword [ebp + 0xc]
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x446fd8
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x446fd1
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.005f2e80
add esp, 0xc
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x446fca
push ebx
push dword [ebp + 0xc]
call fcn.00446a6b
pop ecx
pop ecx
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450039
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
movsx edx, ax
shr eax, 0x10
push esi
push edi
mov esi, ecx
mov ebx, dword [ebp + 0x14]
movsx ecx, ax
lea edi, [ebp - 0x18]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1012
push dword [esi + 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x4500a3
cmp dword [ebp - 0x14], 8
jne 0x4500a3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4500a3
push dword [ebp - 0x10]
mov ecx, esi
call fcn.0044fa08
mov ecx, dword [ebp - 4]
xor eax, eax
and dword [ebx], 0
xor ecx, ebp
pop edi
pop esi
inc eax
pop ebx
call fcn.005b4733
mov esp, ebp
pop ebp
ret 0x10
Function at 0x450c70
Capabilities:
Hide graphical window

Disassembly:
push 0x58
mov eax, 0x650f31
call fcn.005b47af
mov ebx, ecx
mov edi, dword [0x739c04]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
push 1
mov esi, 0x80
push esi
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [ebx + 4]
push dword [edi]
mov dword [ebx + 0x20], eax
call esi
push dword [ebx + 0x20]
push 0
push 0x80
push dword [edi]
call esi
call fcn.0040afed
lea eax, [ebp - 0x28]
push eax
call fcn.004e2437
pop ecx
cmp dword [eax + 0x14], 8
jb 0x450cde
mov eax, dword [eax]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
push 0
mov ecx, edi
call fcn.0042faf9
push 0x4da
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea edi, [ebx + 0x58]
mov dword [edi], eax
lea eax, [ebx + 0x24]
push eax
push dword [0x739c04]
push 0x6894e0
push 0x4d9
call fcn.00599d8c
add esp, 0x10
lea eax, [ebp - 0x64]
mov ecx, edi
push dword [ebx + 0x28]
push eax
call fcn.00431947
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x28
push dword [ebx + 0x30]
lea esi, [ebx + 0x60]
push 0
push 0
push dword [ebx + 4]
mov ecx, esi
call fcn.00446022
push 0x27a86b
mov ecx, esi
call fcn.00447898
mov eax, dword [ebx + 4]
mov dword [esi + 0x4c], eax
lea eax, [ebp - 0x38]
push eax
mov byte [esi + 0x4b], 1
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 4]
call fcn.0043191e
mov eax, dword [ebx + 0x34]
mov ecx, edi
add eax, 0x28
mov dword [ebp - 0x34], 0x28
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.0043115a
lea eax, [ebp - 0x60]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 5
push 0x14
push dword [ebp - 0x58]
lea edi, [ebx + 0x148]
push 0xa
push 0
push esi
mov ecx, edi
call fcn.0044610f
mov eax, dword [ebx + 4]
push 7
pop ebx
mov byte [edi + 0x4b], 1
mov dword [edi + 0x4c], eax
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, 0x68c7f8
mov word [ebp - 0x28], ax
push esi
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a315
lea eax, [ebp - 0x28]
xor esi, esi
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0044804b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00409de7
mov dword [ebp - 0x40], esi
xor eax, eax
mov esi, str._color:_ffffff_text_align:_center_background_color:_6BA827_font:_Open_Sans__10__
mov dword [ebp - 0x3c], ebx
push esi
mov word [ebp - 0x50], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x50]
call fcn.0040a315
xor ebx, ebx
lea eax, [ebp - 0x50]
inc ebx
mov ecx, edi
push eax
mov dword [ebp - 4], ebx
call fcn.004479a9
push 0
push ebx
lea ecx, [ebp - 0x50]
call fcn.00409de7
xor eax, eax
call fcn.005b4759
ret 0x10

Function at 0x45276f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004526ca
Function at 0x45543b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0040afed
mov ecx, eax
call fcn.004e2d3e
test al, al
je 0x455470
push 0
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0045390d
mov ecx, esi
call fcn.00455d89
mov ecx, esi
call fcn.00455dd2
jmp 0x455482
push 5
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0045384b
xor eax, eax
pop esi
ret

Function at 0x45649e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, ecx
push edi
mov edi, dword [0x739c04]
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
push 1
mov esi, 0x80
push esi
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea edi, [ebx + 4]
push dword [edi]
mov dword [ebx + 0x20], eax
call esi
push dword [ebx + 0x20]
push 0
push 0x80
push dword [edi]
call esi
call fcn.0040afed
lea eax, [ebp - 0x1c]
push eax
call fcn.004e2437
pop ecx
cmp dword [eax + 0x14], 8
jb 0x456513
mov eax, dword [eax]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00409de7
push 0
mov ecx, edi
call fcn.0042faf9
push 0x491
push dword [edi]
lea esi, [ebx + 0x24]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esi], eax
lea eax, [ebx + 0x28]
push eax
push dword [0x739c04]
push 0x6894e0
push 0x9b
call fcn.00599d8c
add esp, 0x10
lea eax, [ebp - 0x20]
mov ecx, esi
push dword [ebx + 0x2c]
push eax
call fcn.00431947
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b4733
mov esp, ebp
pop ebp
ret 0x10