joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4727c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55566a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.004139f0
xor ebp, ebp
mov dword [esp + 0x14], vtable.CList_class_CWizDockingPaneBase___class_CWizDockingPaneBase__.0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x38], ebp
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
mov ecx, esi
call edx
cmp dword [esp + 0x20], ebp
jne 0x472838
lea eax, [esp + 0x14]
push eax
jmp 0x472882
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x47284c
call fcn.004dcd9a
mov eax, dword [eax + 8]
cmp eax, ebp
je 0x472858
lea edx, [eax - 0x20]
jmp 0x47285a
xor edx, edx
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x40], eax
cmp eax, ebp
je 0x47287d
lea esp, [esp]
mov ecx, eax
mov eax, dword [eax]
cmp dword [ecx + 8], edx
je 0x4728a7
cmp eax, ebp
jne 0x472870
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x3c], 0xffffffff
call fcn.00424a70
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
mov ebx, dword [ecx + 0x10]
cmp ebx, ebp
je 0x47287d
mov edx, dword [esp + 0x44]
mov edi, dword [edx + 0x90]
cmp edi, ebp
je 0x47291d
lea esp, [esp]
mov eax, edi
mov eax, dword [eax + 8]
mov edi, dword [edi]
cmp eax, ebp
je 0x4728d0
lea ecx, [eax - 0x54]
jmp 0x4728d2
xor ecx, ecx
cmp dword [ecx + 0x98], ebp
je 0x472919
mov eax, dword [ecx + 0x90]
xor edx, edx
cmp eax, ebp
setne dl
cmp edx, ebp
je 0x472847
mov eax, dword [eax + 8]
cmp eax, ebp
je 0x472919
lea esi, [eax - 0x20]
cmp esi, ebp
je 0x472919
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x472919
mov edx, eax
mov eax, dword [eax]
cmp dword [edx + 8], esi
je 0x472914
cmp eax, ebp
jne 0x472905
jmp 0x472919
cmp dword [edx + 0x10], ebx
je 0x472927
cmp edi, ebp
jne 0x4728c0
lea ecx, [esp + 0x14]
push ecx
jmp 0x472882
lea eax, [esp + 0x14]
call fcn.00472750
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.00424a70
mov eax, 1
jmp 0x472891
Function at 0x474c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55470a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
xor edi, edi
cmp eax, 1
je 0x474cbf
cmp eax, 3
je 0x474cbf
xor ebx, ebx
jmp 0x474cc4
mov ebx, 1
cmp eax, edi
je 0x474cd1
mov dword [esp + 0x5c], edi
cmp eax, 1
jne 0x474cd9
mov dword [esp + 0x5c], 1
lea ecx, [esp + 0x24]
call fcn.004139f0
mov dword [esp + 0x24], vtable.CList_class_CWizDockingPaneBase___class_CWizDockingPaneBase__.0
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0xa
push edi
push edi
lea esi, [esp + 0x2c]
mov dword [esp + 0x50], edi
call fcn.00424970
mov ecx, dword [esp + 0x54]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x474d28
mov dword [ecx], eax
jmp 0x474d2c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x24]
cmp ebx, edi
je 0x474d5c
push edi
push eax
call fcn.00424970
mov dword [eax + 8], ebp
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
je 0x474d52
mov dword [ecx], eax
mov dword [esp + 0x2c], eax
jmp 0x474d7f
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
jmp 0x474d7f
mov edx, dword [esp + 0x28]
push edx
push edi
call fcn.00424970
mov dword [eax + 8], ebp
mov ecx, dword [esp + 0x28]
cmp ecx, edi
je 0x474d77
mov dword [ecx + 4], eax
jmp 0x474d7b
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
lea esi, [esp + 0x14]
call fcn.00478c80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x6c]
push ebp
push eax
lea eax, [esp + 0x3c]
call fcn.004749c0
add esp, 0x18
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00424a70
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x47df80
Capabilities:
Check os version

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0047c7d0
fld dword [0x58e1a0]
mov eax, dword [esi + 0x110]
mov ecx, dword [esi + 0xac]
fstp dword [esi + 0x230]
mov dword [esi + 0x21c], ecx
mov dword [esi + 0x228], eax
mov edi, dword [esi + 0xb0]
push 0x1c
call dword [sym.imp.USER32.dll_GetSysColor]
fld dword [0x58e1a0]
test byte [0x5c0bc8], 1
fst dword [esi + 0x210]
mov dword [esi + 0x1fc], edi
mov dword [esi + 0x208], eax
mov edx, dword [esi + 0xec]
mov eax, dword [esi + 0xc8]
mov dword [esi + 0x238], edx
mov dword [esi + 0x244], eax
jne 0x47e02c
or dword [0x5c0bc8], 1
fstp st(0)
push 0x114
push 0
push 0x5c0a90
call fcn.0050bed0
add esp, 0xc
push 0x5c0a90
mov dword [0x5c0a90], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
fld dword [0x58e1a0]
cmp dword [0x5c0aa0], 1
jne 0x47e07a
cmp dword [0x5c0a94], 4
jne 0x47e07a
cmp dword [0x5c0a98], 0xa
jae 0x47e07a
mov eax, dword [esi + 0xb0]
fst dword [esi + 0x210]
mov dword [esi + 0x1fc], eax
mov dword [esi + 0x208], eax
mov eax, dword [esi + 0xac]
fstp dword [esi + 0x230]
pop edi
mov dword [esi + 0x21c], eax
mov dword [esi + 0x228], eax
pop esi
ret
pop edi
fstp st(0)
pop esi
ret
Function at 0x47ef30
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x55829a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], 0
mov eax, dword [ecx]
mov edx, dword [eax + 0x140]
call edx
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov edi, dword [esi + 0x78]
mov ebp, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x48]
test ebp, ebp
je 0x47efa3
call fcn.00415ef0
jmp 0x47efa8
call fcn.0040fe70
mov ecx, dword [esi + 0x1ac]
sub eax, edi
dec eax
test ebp, ebp
je 0x47efe7
sub dword [esp + 0x28], eax
mov eax, dword [esi + 0x4c]
add dword [esp + 0x20], ecx
cmp eax, 0xffffffff
jne 0x47efc8
mov eax, dword [esi + 0x48]
push eax
lea ecx, [esp + 0x4c]
call fcn.0040fe70
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x30]
add eax, 2
push eax
push ecx
push edx
jmp 0x47f015
add dword [esp + 0x24], ecx
sub ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 0x2c], ebx
cmp eax, 0xffffffff
jne 0x47effc
mov eax, dword [esi + 0x48]
push eax
add ebx, 2
push ebx
lea ecx, [esp + 0x50]
call fcn.00415ef0
mov ecx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x58]
push eax
push ecx
mov edi, dword [esp + 0x54]
mov ecx, edi
call fcn.004fbebc
mov edx, dword [esp + 0x44]
mov ecx, dword [edx + 0x1a4]
test ecx, ecx
je 0x47f049
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
lea edx, [esp + 0x1c]
push edx
call eax
mov dword [esp + 0x38], 0
mov ebx, 1
jmp 0x47f064
push 0x574340
lea ecx, [esp + 0x44]
call fcn.00402df0
mov dword [esp + 0x38], 1
mov ebx, 2
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.00401800
mov dword [esp + 0x38], 2
test bl, 2
je 0x47f08b
lea ecx, [esp + 0x40]
and ebx, 0xfffffffd
call fcn.00407f90
mov byte [esp + 0x38], 4
test bl, 1
je 0x47f09e
lea ecx, [esp + 0x1c]
call fcn.00407f90
cmp dword [esi + 0x24], 0
je 0x47f0b8
mov ecx, dword [esp + 0x44]
cmp dword [ecx + 0x194], 0
je 0x47f0b8
mov eax, 1
jmp 0x47f0ba
xor eax, eax
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov edx, dword [esi]
mov edx, dword [edx + 0x7c]
push ebp
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov ebx, dword [esp + 0x40]
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x44]
add ecx, 0x54
mov dword [eax + 8], ebx
mov ebx, dword [esp + 0x48]
push ecx
push edi
mov ecx, esi
mov dword [eax + 0xc], ebx
call edx
lea ecx, [esp + 0x18]
call fcn.00407f90
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
Function at 0x483d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x556248
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x4c]
mov ecx, ebp
mov dword [ebp + 8], 0
call fcn.004f53b3
test esi, esi
je 0x483ded
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x483ded
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x483ded
cmp ebx, 0xa
jb 0x483ded
push 0
push ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.00501498
push ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x48], 0
call fcn.00483e10
lea ecx, [esp + 0x10]
mov esi, eax
mov dword [esp + 0x44], 0xffffffff
call fcn.00501812
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
Function at 0x48b583
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x1a4], 0
push edi
mov dword [esp + 0x10], esi
je 0x48b5d0
cmp dword [esp + 0x18], 0x28
jne 0x48b5d0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x48b5cb
mov ebp, dword [esi + 0xfc]
cmp dword [ebp + 0x2c], 0
mov ebx, dword [esi + 0xcc]
jne 0x48b5e9
or edi, 0xffffffff
mov edx, dword [esp + 0x10]
cmp edi, dword [edx + 0xcc]
mov esi, edx
jg 0x48b5d0
call fcn.00487b30
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0044bd30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea edi, [ebx + 1]
xor esi, esi
cmp edi, ebx
je 0x48b5bd
mov eax, dword [ebp + 0x2c]
cmp edi, eax
jl 0x48b609
cmp ebx, 0xffffffff
je 0x48b5ba
test esi, esi
jne 0x48b5ba
xor edi, edi
lea esi, [edi + 1]
jmp 0x48b61d
test edi, edi
jge 0x48b61d
test esi, esi
jne 0x48b5ba
lea edi, [eax - 1]
mov esi, 1
test edi, edi
jl 0x48b631
cmp edi, eax
jge 0x48b631
test edi, edi
jl 0x48b66a
cmp edi, eax
jge 0x48b66a
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + edi*4]
jmp 0x48b633
xor ecx, ecx
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
push 8
call eax
test eax, eax
je 0x48b660
test edi, edi
jl 0x48b651
cmp edi, dword [ebp + 0x2c]
jge 0x48b651
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx + edi*4]
jmp 0x48b653
xor eax, eax
test byte [eax + 0xd4], 2
je 0x48b5bd
inc edi
cmp edi, ebx
jne 0x48b5f2
jmp 0x48b5bd
call fcn.004dcd9a
int3

Function at 0x48bb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55b5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
and eax, 0x40ffff
mov dword [edi + 0x54], eax
test eax, 0x2800
jne 0x48bbf0
test eax, 0x8200
jne 0x48bbfe
test eax, 0x1400
jne 0x48bbf7
mov eax, str.wizBarRight
push eax
lea ecx, [esp + 0x10]
call fcn.00402df0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.004139f0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 0
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.00405840
push eax
push str.WizDockBar
mov ecx, edi
call fcn.004de722
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00407f90
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
mov eax, 0x585300
jmp 0x48bb82
mov eax, str.wizBarLeft
jmp 0x48bb82
mov eax, str.wizBarBottom
jmp 0x48bb82
Function at 0x490f80
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 4
push 0
push 0x490ea0
push 0
push 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
test eax, eax
je 0x490fbf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ecx
ret

Function at 0x490fd0
Capabilities:
Terminate thread

Disassembly:
push ecx
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x491045
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esi + 0xc], 1
mov dword [esp + 0x10], edi
call ebx
test eax, eax
je 0x491033
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0xc], 0x103
jne 0x491032
mov edx, dword [esi + 8]
inc edi
cmp edi, 0xa
ja 0x491029
push 0x64
push edx
call ebp
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call ebx
test eax, eax
jne 0x491000
jmp 0x491032
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebp
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop ebx
pop edi
pop ecx
ret

Function at 0x493ff0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
cmp dword [esi + 4], 0
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
jne 0x494021
call ebx
push eax
call fcn.004100b0
push eax
push 0x4941c0
push 2
call edi
mov dword [esi + 4], eax
cmp dword [esi + 8], 0
jne 0x49403c
call ebx
push eax
call fcn.004100b0
push eax
push 0x494150
push 4
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49405f
lea ecx, [eax + 8]
test ecx, ecx
je 0x494056
cmp dword [ecx], ebp
je 0x49405b
mov eax, dword [eax]
test eax, eax
jne 0x494043
jmp 0x49405f
call fcn.004dcd9a
test eax, eax
jne 0x494087
mov eax, dword [esi + 0x18]
add esi, 0x10
push eax
call fcn.0046a700
mov dword [eax + 8], ebp
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x494081
pop edi
mov dword [ecx], eax
mov dword [esi + 8], eax
pop esi
pop ebp
pop ebx
ret 4
mov dword [esi + 4], eax
mov dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x495d00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x495ea3
lea ecx, [esp + 0x10]
call fcn.004139f0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x100]
call fcn.004160a0
mov edx, dword [edi + 0xc4]
mov eax, dword [edi + 0xc8]
mov ecx, dword [edi + 0xcc]
mov ebx, dword [edi + 0xc0]
mov esi, dword [edi + 0x194]
mov dword [esp + 0x24], edx
mov edx, dword [edi + 0x198]
push 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x495dc1
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x28]
jl 0x495d9d
sub eax, ebx
cdq
idiv dword [edi + 0x184]
mov esi, dword [edi + 0x174]
inc eax
cmp esi, eax
jl 0x495d9d
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jl 0x495dc1
sub eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x178]
cdq
idiv dword [edi + 0x188]
inc eax
cmp ecx, eax
jl 0x495dc5
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi + 0x194]
mov edx, dword [edi + 0x198]
cmp esi, eax
jne 0x495dd9
cmp ecx, edx
je 0x495e48
mov eax, dword [edi + 0x180]
mov dword [edi + 0x198], ecx
mov ecx, dword [edi + 0x17c]
push eax
push ecx
push 1
mov dword [edi + 0x194], esi
call fcn.00495f40
mov ecx, dword [edi + 0x100]
mov dword [edi + 0x19c], 1
mov edx, dword [ecx]
mov eax, dword [edx + 0x17c]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
mov edx, dword [edx + 0xf4]
push eax
push ecx
mov ecx, edi
mov dword [edi + 0x19c], 0
call edx
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.0048ec80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea ecx, [esp + 0x1c]
call fcn.00410030
mov eax, dword [edi + 0x17c]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x180]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
jne 0x495e6f
cmp eax, edx
je 0x495ea3
push 1
mov esi, edi
mov dword [edi + 0x17c], ecx
mov dword [edi + 0x180], eax
call fcn.0048ec10
mov ecx, dword [edi + 0x100]
test ecx, ecx
je 0x495ea3
push 0x1006
call fcn.0044d480
lea esi, [esp + 0x24]
mov ecx, edi
call fcn.0048f360
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.0048ec80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4aa6b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x557200
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b3940]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, 0x55
mov edi, edx
mov edx, eax
mov ecx, 0xaa
mov word [esp + 0x28], ax
mov eax, ecx
mov word [esp + 0x2a], cx
mov ecx, edx
mov word [esp + 0x2c], dx
mov edx, eax
mov word [esp + 0x2e], ax
mov eax, ecx
mov word [esp + 0x30], cx
mov ecx, edx
mov word [esp + 0x36], cx
lea ecx, [esp + 0x1c]
mov word [esp + 0x32], dx
mov word [esp + 0x34], ax
call fcn.0040e430
lea edx, [esp + 0x28]
push edx
push 1
push 1
push 8
push 8
mov dword [esp + 0x5c], 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x20]
call fcn.004f535b
lea ecx, [esp + 0xc]
call fcn.0040e200
mov dword [esp + 0xc], vtable.CBrush.0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 1
call fcn.00410b40
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x10]
call fcn.004f535b
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004f5446
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x220]
cmp eax, 0xffffffff
jne 0x4aa7a7
mov eax, dword [ebx + 0x21c]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x2c]
mov ecx, esi
call eax
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x25c]
cmp eax, 0xffffffff
jne 0x4aa7c8
mov ebx, dword [ebx + 0x258]
jmp 0x4aa7ca
mov ebx, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
push ebx
mov ecx, esi
call eax
mov ecx, edi
mov ebx, eax
call fcn.0040fe70
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.00415ef0
mov edx, dword [esp + 0x24]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
push 0xf00021
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004f5446
mov edx, dword [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 0x2c]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ebx
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
call fcn.004f53b3
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 0
call fcn.00418450
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0040e1e0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0050bb49
mov esp, ebp
pop ebp
ret
Function at 0x4b2510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xd8], 0
push edi
mov dword [esp + 0xc], esi
je 0x4b2532
mov eax, esi
call fcn.004b30e0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00410aa0
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
sub ebx, dword [esp + 0x14]
push 0xffffffffffffffec
mov ecx, esi
call fcn.00410aa0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x400000
je 0x4b2572
mov ecx, dword [esp + 0x18]
sub ecx, edi
mov dword [esp + 0x10], ecx
jmp 0x4b257a
sub edi, dword [esp + 0x10]
mov dword [esp + 0x10], edi
xor edi, edi
add esi, 0xe8
mov edx, dword [esp + 0x10]
push ebx
push edx
call fcn.004b60e0
test eax, eax
jne 0x4b25c3
inc edi
add esi, 0x60
cmp edi, 2
jl 0x4b2582
mov eax, dword [ebp + 8]
cmp eax, 9
je 0x4b25ba
cmp eax, 8
je 0x4b25ba
cmp eax, 0x14
je 0x4b25ba
cmp eax, 0x15
je 0x4b25ba
mov ecx, dword [esp + 0xc]
call fcn.004dfcca
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
push ebx
push eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 0x14]
xor ecx, ecx
test ax, ax
setl cl
mov edi, esi
push ecx
push edx
call fcn.004b6670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b4320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x554c38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3940]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x40]
mov eax, esi
mov ecx, ebp
call fcn.00425be0
test eax, eax
je 0x4b437b
mov ebx, dword [esp + 0x44]
mov ecx, esi
mov edx, ebp
call fcn.00425e00
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 2
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4b443b
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4b443b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4b443b
movzx eax, word [edi + 0xe]
mov edx, dword [esp + 0x44]
movzx esi, ax
imul esi, dword [edi + 4]
add esi, 0x1f
sar esi, 3
and esi, 0xfffffffc
imul esi, dword [edi + 8]
xor ecx, ecx
cmp ax, 0x20
sete cl
push ebx
push ebp
mov dword [esp + 0x1c], 0
mov dword [edx], ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + 0x28]
cmp eax, ecx
jb 0x4b44dc
lea ecx, [esp + 0x20]
call fcn.004f4b7f
xor ebx, ebx
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebx
call fcn.00410b70
cmp word [edi + 0xe], 0x18
jb 0x4b44a6
push 0x34
call fcn.00511344
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x4b4451
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f5108
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 0x28
push edi
push 0x28
push ebp
call fcn.0050bbc3
add esp, 0x10
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
mov dword [ebp + 0x14], esi
mov eax, dword [esp + 0x34]
push ebp
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
test ebx, ebx
je 0x4b449b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4b449b
push esi
add edi, 0x28
push edi
push esi
push eax
call fcn.0050bbc3
add esp, 0x10
mov dword [esp + 0x14], ebx
push ebp
call fcn.00511267
add esp, 4
jmp 0x4b44cb
push edi
call fcn.004b4210
mov esi, eax
add esp, 4
push esi
mov eax, edi
call fcn.004b42b0
add esp, 4
mov dword [esp + 0x14], eax
cmp esi, ebx
je 0x4b44cb
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.004f5108
mov esi, dword [esp + 0x1c]
push esi
call fcn.00403bc0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret