joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41afe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e94e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41b016
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41d740
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x43ee44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x4063f0
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d771
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x434850
lea edi, [ebp + 0x14]
push ecx
call fcn.00408600
call fcn.0041c040
mov bl, al
test bl, bl
je 0x41d7ab
cmp byte [ebp + 0x169], 0
jne 0x41d7ab
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d7c3
mov ebx, dword [ebp + 0x11c]
jmp 0x41d7c5
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404bf0
mov ecx, dword [0x43ee44]
push esi
push 0x4063f0
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041b1d0
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00421d8e
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x41e510
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42f52e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
lea esi, [edi + 4]
xor ebx, ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
lea esi, [edi + 0x10]
mov dword [esp + 0x18], ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov dword [edi + 0x20], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], 4
mov dword [edi + 0x28], vtable.CObjectVector_struct_CArc_.0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], 4
mov dword [edi + 0x3c], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov byte [edi + 0x58], bl
lea esi, [edi + 0x64]
mov byte [esp + 0x18], 3
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x41f630
Capabilities:
Set registry value

Disassembly:
mov eax, 0x200c
call fcn.0042bd90
mov eax, dword [0x43c024]
xor eax, esp
mov dword [esp + 0x2008], eax
push 0x2000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00428760
add esp, 0xc
push 0x2000
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.00421d7f
add esp, 0x200c
ret

Function at 0x41f6e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x43c024]
xor eax, esp
mov dword [esp + 0x418], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00428760
add esp, 0xc
push 0x208
lea edx, [esp + 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00428760
push str.Applications_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.004228d8
lea eax, [esp + 0x228]
push 0x5c
push eax
call fcn.00422947
add eax, 2
push eax
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.004229d4
add esp, 0x2c
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp]
push 2
lea edx, [esp + 8]
push edx
push 1
xor ecx, ecx
push ecx
push str.IsHostApp
push eax
mov word [esp + 0x1c], cx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00421d7f
add esp, 0x41c
ret
Function at 0x421d7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c024]
jne 0x421d89
repz ret
jmp fcn.00422c02

Function at 0x4277e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004241f1
and dword [ebp - 4], 0
cmp dword [0x43ecd8], 0
mov ebx, eax
jne 0x427896
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x427947
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x427947
push eax
call fcn.0042417f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ecd8], eax
call esi
push eax
call fcn.0042417f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43ecdc], eax
call esi
push eax
call fcn.0042417f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ece0], eax
call esi
push eax
call fcn.0042417f
pop ecx
mov dword [0x43ece8], eax
test eax, eax
je 0x427896
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042417f
pop ecx
mov dword [0x43ece4], eax
mov eax, dword [0x43ece4]
cmp eax, ebx
je 0x4278ee
cmp dword [0x43ece8], ebx
je 0x4278ee
push eax
call fcn.004241fa
push dword [0x43ece8]
mov esi, eax
call fcn.004241fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4278ee
test edi, edi
je 0x4278ee
call esi
test eax, eax
je 0x4278e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4278e5
test byte [ebp - 0xc], 1
jne 0x4278ee
or dword [ebp + 0x10], 0x200000
jmp 0x427927
mov eax, dword [0x43ecdc]
cmp eax, ebx
je 0x427927
push eax
call fcn.004241fa
pop ecx
test eax, eax
je 0x427927
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x427927
mov eax, dword [0x43ece0]
cmp eax, ebx
je 0x427927
push eax
call fcn.004241fa
pop ecx
test eax, eax
je 0x427927
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ecd8]
call fcn.004241fa
pop ecx
test eax, eax
je 0x427947
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x427949
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42eb13
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x42eb4e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x42eb35
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x42eb46
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x42eb50
inc edi
add eax, 0x28
cmp edi, esi
jb 0x42eb2b
xor eax, eax
pop edi
pop esi
ret
Function at 0x4014d8
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x473258
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xec]
test edi, edi
je 0x4014f1
mov eax, dword [edi + 4]
test eax, eax
jne 0x40162e
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004670ea
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
mov ebx, eax
push ecx
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0046d29f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
sub ecx, eax
sub edx, ebp
mov dword [esi + 0xac], ecx
mov dword [esi + 0xb0], edx
mov eax, dword [ebx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0046cd56
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.0046ccb4
test esi, esi
mov dword [esp + 0x3c], 0
jne 0x40156f
xor eax, eax
jmp 0x401572
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x28]
call fcn.0046cd6b
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
sub eax, ebx
sub ecx, edx
push eax
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.0046d691
test edi, edi
je 0x4015b2
mov edi, dword [edi + 4]
mov edx, dword [esp + 0x28]
push edi
push edx
call fcn.0046ceac
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x20]
sub ecx, ebx
sub eax, edx
test esi, esi
jne 0x4015db
xor ebp, ebp
jmp 0x4015de
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push ebx
push ebp
push eax
mov eax, dword [esp + 0x3c]
push ecx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
pop ebp
pop ebx
test edi, edi
je 0x401600
mov edi, dword [edi + 4]
mov ecx, dword [esp + 0x20]
push edi
push ecx
call fcn.0046ceac
mov eax, dword [esp + 8]
mov edx, dword [esi + 4]
push edx
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0046cde9
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x401aa0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x473330
push eax
mov dword fs:[0], esp
push esi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0046a293
lea ecx, [esp + 0x18]
mov byte [esp + 0xc], 0
call fcn.0046a293
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0xffffffff
call fcn.0046a293
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x402380
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x403050
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x473483
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
push edi
or ebp, 0xffffffff
mov edi, 0x49063c
mov ecx, ebp
xor eax, eax
xor ebx, ebx
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x22c], ebx
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x10], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x234]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
je 0x40319c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x120]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4031f1
mov ecx, 0x40
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x490bc8]
mov dword [esp + 0x14], eax
mov byte [esp + 0x22c], 1
call fcn.0046ffed
mov esi, dword [eax + 4]
push 0x104
push 0x104
lea ecx, [esp + 0x1c]
call fcn.0046a484
mov ecx, dword [esi + 0x68]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
lea ecx, [esp + 0x18]
call fcn.0046a4d3
mov edx, dword [esp + 0x14]
mov ecx, ebp
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x1c]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x18], esi
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [edx - 8]
lea ecx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x23c]
push ecx
push 1
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40317f
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x403184
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x22c], bl
call fcn.0046a293
jmp 0x4031f1
lea eax, [esp + 0x10]
lea ecx, [esp + 0x120]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4031f1
mov edx, dword [esp + 0x238]
mov eax, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4031e6
mov ecx, dword [esp + 0x238]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x238]
mov dword [esp + 0x22c], ebp
call fcn.0046a293
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret 8
Function at 0x40326e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4734c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x490bc8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [0x49ade0]
push 0x49069c
push ecx
lea edx, [esp + 0x10]
xor ebx, ebx
push 0x490694
push edx
mov dword [esp + 0x30], ebx
call fcn.00465868
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.0046a008
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x49068c
mov byte [esp + 0x30], 1
call fcn.0046a301
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401aa0
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esi + 0x2d8], eax
call fcn.0046a008
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490678
mov byte [esp + 0x30], 3
call fcn.0046a301
push ecx
mov byte [esp + 0x30], 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401aa0
mov dword [esi + 0x2dc], eax
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0046a008
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x49066c
mov byte [esp + 0x30], 5
call fcn.0046a301
push ecx
mov byte [esp + 0x30], 6
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401aa0
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esi + 0x2e0], eax
mov dword [esp + 0x20], 0xffffffff
call fcn.0046a293
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x4033b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x490bc8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [0x49ade0]
push 0x49069c
push ecx
lea edx, [esp + 0x10]
xor ebx, ebx
push 0x490694
push edx
mov dword [esp + 0x30], ebx
call fcn.00465868
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.0046a008
mov ecx, dword [esi + 0x2d8]
mov byte [esp + 0x24], 1
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x49068c
call fcn.0046a301
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401b20
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046a008
mov eax, dword [esi + 0x2dc]
mov byte [esp + 0x24], 3
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490678
call fcn.0046a301
push ecx
mov byte [esp + 0x30], 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401b20
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0046a008
mov eax, dword [esi + 0x2e0]
mov byte [esp + 0x24], 5
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x49066c
call fcn.0046a301
mov byte [esp + 0x2c], 6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x490684
call fcn.0046a301
mov byte [esp + 0x30], bl
call fcn.00401b20
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0046a293
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret

Function at 0x41b188
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x474898
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x41b243
call fcn.0041b120
mov ecx, dword [esi]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x41b243
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41b243
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41b243
lea ecx, [esp + 8]
call fcn.00465d06
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 1
push 0
push 0x19
push edx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0
call fcn.00465d98
mov esi, dword [esi]
push esi
call fcn.0046d67c
test eax, eax
je 0x41b201
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00465d2f
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x41c940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x474a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x34]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 8]
call fcn.0041cec0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sub esp, 0x10
mov dword [esp + 0x30], 0
mov ecx, esp
push esi
mov dword [ecx], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x48]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x18]
call fcn.0041cfa0
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.00418e30
mov ecx, dword [esp + 0x18]
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x427c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x100]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x427d09
mov edi, dword [esi + 0x34]
xor eax, eax
mov al, byte [esp + 0x11]
cmp al, 2
jne 0x427d09
test edi, edi
je 0x427d09
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push ebp
lea ecx, [esi + 4]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x427cb5
mov eax, dword [edi + 0x2c]
jmp 0x427cda
mov edx, dword [esi + 0x34]
mov ecx, ebp
mov eax, dword [edx + 0x58]
test eax, eax
jne 0x427cc3
mov ecx, ebx
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x427cd8
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x427cda
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.00427bf0
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x427d00
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x427d09
push 0
mov ecx, esi
call fcn.00427af0
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x43b680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4771ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x490bc8]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x28], 1
call fcn.00465868
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.0046a008
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0046a293
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x440d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0043fea0
mov ecx, eax
jmp fcn.00440e10