joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
push 0x1bda
push 0x65b700
push 1
push 0x1c8
push 1
call fcn.005b0ce0
add esp, 0x14
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x44d483
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x44d661
cmp dword [0x7090d4], 0
jne 0x44d496
call fcn.004030cb
mov dword [0x7090d4], eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [0x7090d4]
push edx
call fcn.00401c3f
add esp, 8
cmp dword [0x7090d4], 0
jne 0x44d4d5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
mov eax, dword [ebp - 0x114]
push eax
call fcn.005b16b0
add esp, 8
xor eax, eax
jmp 0x44d661
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
cmp dword [ebp + 8], 0
je 0x44d504
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x114]
add ecx, 4
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
jmp 0x44d51a
push 0xc
push 0
mov ecx, dword [ebp - 0x114]
add ecx, 4
push ecx
call fcn.005b02a0
add esp, 0xc
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0x1c]
mov dword [ecx + 0x20], edx
push 0x40
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x24
push ecx
call fcn.00402725
add esp, 0xc
push 0x104
mov edx, dword [ebp + 0x24]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00402725
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402608
add esp, 4
push 0x40
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x114]
add eax, 0x64
push eax
call fcn.00402725
add esp, 0xc
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp + 0x28]
mov dword [ecx + 0xa4], edx
mov eax, dword [ebp - 0x114]
mov dword [eax + 0xb0], 0
call fcn.0040323d
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0xb4], eax
mov edx, dword [ebp - 0x114]
add edx, 0xb8
push edx
call fcn.00402158
add esp, 4
mov eax, dword [ebp - 0x114]
mov dword [eax + 0xac], 0
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 0x114]
push eax
push 0x44d700
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0xa8], eax
mov edx, dword [ebp - 0x114]
cmp dword [edx + 0xa8], 0
jne 0x44d655
mov eax, dword [ebp - 0x114]
push eax
call fcn.0044d680
add esp, 4
xor eax, eax
jmp 0x44d661
mov ecx, dword [ebp - 0x114]
mov eax, dword [ecx + 0xa8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4a7b40
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x198], 0
push 0x18e
push 0
lea eax, [ebp - 0x196]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x19c], 0
cmp dword [ebp + 0xc], 0
jge 0x4a7b89
mov dword [ebp + 0xc], 0x104
cmp dword [ebp + 8], 0
je 0x4a7b95
cmp dword [ebp + 0xc], 0
jg 0x4a7b9a
mov eax, dword [ebp + 8]
jmp 0x4a7bf3
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
lea edx, [ebp - 0x198]
push edx
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x4a7bcf
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_gethostname
mov dword [ebp - 0x19c], eax
call sub.WSOCK32.dll_WSACleanup
jmp 0x4a7bd3
xor eax, eax
jmp 0x4a7bf3
cmp dword [ebp - 0x19c], 0
jne 0x4a7bec
mov edx, dword [ebp + 8]
push edx
call fcn.005b4690
add esp, 4
test eax, eax
ja 0x4a7bf0
xor eax, eax
jmp 0x4a7bf3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x4c93f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x4c9447
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402158
add esp, 4
cmp dword [ebp + 8], 0
jne 0x4c9463
push 0
call fcn.0040184d
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
jmp 0x4c946a
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x4c9477
xor eax, eax
jmp 0x4c9591
mov dword [ebp - 0xc], 0
push str.SELECT_STORE_PROFILE.STORE_NUM__COMPANY.NAME_FROM_STORE_PROFILE__COMPANY_WHERE_STORE_PROFILE.COMPANY_IDCOMPANY.ID
mov edx, dword [ebp + 8]
push edx
call fcn.00401703
add esp, 8
test eax, eax
je 0x4c9561
mov dword [ebp - 8], 0
jmp 0x4c94a9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
push 2
push 9
push 0xff
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402e6e
add esp, 0x14
test eax, eax
je 0x4c955f
cmp dword [ebp - 8], 0xde
jge 0x4c955f
cmp dword [ebp - 0xc], 0
jne 0x4c955a
lea eax, [ebp - 0x110]
push eax
call fcn.005b8c20
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x4c955a
push 0x6a45ac
lea ecx, [ebp - 0x110]
push ecx
call fcn.005b0770
add esp, 8
test eax, eax
je 0x4c9546
mov edx, dword [ebp + 0x10]
push edx
push 0x6a45b0
lea eax, [ebp - 0x110]
push eax
call fcn.005b0770
add esp, 8
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402725
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040237e
add esp, 4
jmp 0x4c955a
lea eax, [ebp - 0x110]
push eax
push str.:7:GetStoreNumberTAMSii___FAILED:_Store_name_field_not_found:___s_
call fcn.00401014
add esp, 8
jmp 0x4c94a0
jmp 0x4c9575
push str.:7:GetStoreNumberTAMSii___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.00401014
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x4c958e
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401a28
add esp, 4
mov dword [ebp + 8], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x4c97a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x58], 0
push 0x3f
push 0
lea eax, [ebp - 0x57]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x10], 0
call fcn.0040323d
mov dword [ebp - 0x5c], eax
cmp dword [ebp + 8], 0
je 0x4c97fe
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
cmp dword [ebp - 0x10], 0
jne 0x4c983a
push 0
call fcn.0040184d
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c9831
mov edx, 1
test edx, edx
je 0x4c982a
mov eax, 1
jmp 0x4c9969
xor eax, eax
jmp 0x4c9969
mov dword [ebp - 4], 1
jmp 0x4c9841
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00401bdb
add esp, 4
push eax
push str.SELECT_TENDER_TYPE_ACCEPTED_FROM_TENDER_TYPE_PROFILE_WHERE_LOC_d
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00401703
add esp, 0xc
test eax, eax
je 0x4c98c3
mov dword [ebp - 0xc], 0
jmp 0x4c987c
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
push 1
push 9
push 0x3f
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00402e6e
add esp, 0x14
test eax, eax
je 0x4c98c1
cmp dword [ebp - 0xc], 0xde
jge 0x4c98c1
lea edx, [ebp - 0x58]
push edx
call fcn.00402527
add esp, 4
test eax, eax
je 0x4c98bf
mov eax, 1
mov ecx, dword [ebp - 0xc]
shl eax, cl
or eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x4c9873
jmp 0x4c98d7
push str.:7:TAMSii_IsTenderTypesEnabled___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.00401014
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4c98f0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00401a28
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4c98fe
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx], eax
call fcn.0040323d
sub eax, dword [ebp - 0x5c]
push eax
push 0
push 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.00401b5e
add esp, 0xc
push eax
push str.:0:TAMSii_IsTenderTypesEnabled___has_determined__s_in__ums
call fcn.004018ca
add esp, 0xc
mov edx, dword [ebp - 8]
and edx, 1
je 0x4c9953
mov eax, dword [ebp - 8]
and eax, 2
je 0x4c9953
mov ecx, dword [ebp - 8]
and ecx, 8
je 0x4c994d
mov edx, dword [ebp - 8]
and edx, 0x10
je 0x4c994d
mov eax, dword [ebp - 8]
and eax, 4
jne 0x4c9951
xor eax, eax
jmp 0x4c9969
jmp 0x4c9964
mov ecx, dword [ebp - 8]
push ecx
push str.:7:TAMSii_IsTenderTypesEnabled___FAILED:_dwTenderTypesEnabled___d.
call fcn.00401014
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x53bd10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x200
mov byte [ebp - 0x220], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x21f]
push ecx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0
je 0x53bd72
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
test eax, eax
jne 0x53bd79
xor eax, eax
jmp 0x53bf27
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x220]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.005b8260
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x53bdfe
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x220]
cmp ecx, edx
je 0x53bdc7
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.005b16b0
add esp, 8
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2bb
push 0x6c81c4
push 1
mov edx, dword [ebp - 0xc]
add edx, 0xa
push edx
push 1
call fcn.005b0ce0
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x53bdfc
xor eax, eax
jmp 0x53bf27
jmp 0x53bd88
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
push eax
call fcn.00541230
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.005b4690
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jbe 0x53be8a
cmp dword [ebp + 0xc], 0
jl 0x53be78
cmp dword [ebp + 0xc], 0x7fffffff
jge 0x53be78
cmp dword [ebp + 0xc], 0
jl 0x53be5a
cmp dword [ebp + 0xc], 0x7fffffff
jge 0x53be5a
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x224], 1
jmp 0x53be6c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 1
jmp 0x53be8a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x228], 0
push 0x6c81d0
push 0x2ca
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00402f09
add esp, 0x10
test eax, eax
je 0x53bebb
push 0x2ca
mov ecx, dword [ebp + 8]
push ecx
call fcn.00545070
add esp, 8
test eax, eax
jne 0x53bee1
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x220]
cmp edx, eax
je 0x53bedd
push 1
mov ecx, dword [ebp - 8]
push ecx
call fcn.005b16b0
add esp, 8
mov dword [ebp - 8], 0
xor eax, eax
jmp 0x53bf27
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xacc]
push edx
call sub.WSOCK32.dll_send
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005450f0
add esp, 4
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x220]
cmp ecx, edx
je 0x53bf24
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.005b16b0
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x544e70
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00544ff0
add esp, 8
test eax, eax
jne 0x544e96
mov eax, 1
jmp 0x544ec2
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00545040
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x544ed0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00544ff0
add esp, 8
test eax, eax
jne 0x544ef6
mov eax, 2
jmp 0x544f22
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00545040
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x544f30
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00544ff0
add esp, 8
test eax, eax
jne 0x544f56
mov eax, 1
jmp 0x544f82
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00545040
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x58c4b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x268], 0
push 0x103
push 0
lea eax, [ebp - 0x267]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x160], 0
push 0x13c
push 0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x278], 0
xor edx, edx
mov dword [ebp - 0x276], edx
mov dword [ebp - 0x272], edx
mov dword [ebp - 0x26e], edx
mov word [ebp - 0x26a], dx
mov word [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
call fcn.0040323d
sub eax, dword [0x834c08]
cmp eax, 0x493e0
jae 0x58c560
xor eax, eax
jmp 0x58c6f9
call fcn.0040323d
mov dword [0x834c08], eax
call fcn.00403265
test eax, eax
jne 0x58c57a
xor eax, eax
jmp 0x58c6f9
push 0x104
push 0x8343c8
lea ecx, [ebp - 0x268]
push ecx
call fcn.00402725
add esp, 0xc
lea edx, [ebp - 0x268]
push edx
call fcn.00402338
add esp, 4
push str.PAULATempTimeDetectionFile
push 0x6e9770
lea eax, [ebp - 0x268]
push eax
call fcn.0040242d
add esp, 0xc
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x58c5df
xor eax, eax
jmp 0x58c6f9
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14c]
push edx
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x58c622
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x58c633
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 8]
mov dword [edx + 0xc], ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp - 0x278]
mov dword [edx], eax
mov ecx, dword [ebp - 0x274]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x270]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x26c]
mov dword [edx + 0xc], ecx
call fcn.00401a00
add esp, 0x20
cmp eax, 0xdbba0
jle 0x58c6cc
lea edx, [ebp - 0x268]
push edx
call fcn.00402338
add esp, 4
push 0x104
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x268]
push ecx
call fcn.004014f1
add esp, 0xc
lea edx, [ebp - 0x268]
push edx
call fcn.0040255e
add esp, 4
test eax, eax
je 0x58c6cc
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x58c5f7
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x591220
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
and eax, 0x8000
je 0x59124a
xor eax, eax
jmp 0x5912b2
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x1b
jmp 0x591263
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x87
jge 0x5912af
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
and eax, 0x8000
je 0x5912a3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x834ea8]
test edx, edx
jne 0x5912a1
mov eax, dword [ebp - 4]
mov byte [eax + 0x834ea8], 1
mov dword [ebp - 8], 1
jmp 0x5912af
jmp 0x5912ad
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x834ea8], 0
jmp 0x59125a
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x5927f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 8]
mov dword [0x834e40], edx
cmp dword [ebp + 8], 0
je 0x59283e
call fcn.0040323d
mov dword [0x834e44], eax
jmp 0x592870
call fcn.0040323d
sub eax, dword [0x834e44]
cmp eax, 0xde
jae 0x592870
call fcn.0040323d
sub eax, dword [0x834e44]
push eax
push str.:7:CheckForMouseButton___was_called_consecutively_too_quickly:__dms
call fcn.004018ca
add esp, 8
xor eax, eax
jmp 0x59295e
cmp dword [0x834e40], 0
jne 0x59295c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
and eax, 0x8000
je 0x592948
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [ebp - 4], 0
jne 0x5928ab
call fcn.00402dd3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x592946
cmp dword [ebp - 0x10], 0
jne 0x592946
lea edx, [ebp - 0x20]
push edx
call fcn.00402dd3
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
push 6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [ebp - 0x1c]
lea eax, [eax + esi + 3]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
mov ecx, 3
idiv ecx
mov edx, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jle 0x59293f
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x18]
jge 0x59293f
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x1c]
jle 0x59293f
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
jge 0x59293f
mov dword [0x834e24], 1
call fcn.0040323d
mov dword [0x834e28], eax
jmp 0x592946
mov dword [ebp - 0x10], 1
jmp 0x59294f
mov dword [ebp - 0x10], 0
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x592870
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5b0290
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6fb448]
jne 0x5b029a
repz ret
jmp fcn.005c0ab0

Function at 0x5c5020
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6fbf24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5c505b
mov ecx, dword [0x83565c]
push ecx
call fcn.005c4f40
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x6fbf24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5d5020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d5056
push str._path___NULL_
push 0
push 0x50
push str.access.c
push 2
call fcn.005c1750
add esp, 0x14
cmp eax, 1
jne 0x5d5056
int3
cmp dword [ebp - 8], 0
jne 0x5d5097
call fcn.005c1400
mov dword [eax], 0
call fcn.005c13d0
mov dword [eax], 0x16
push 0
push 0x50
push str.access.c
push str._access_s
push str._path___NULL_
call fcn.005c0f40
add esp, 0x14
mov eax, 0x16
jmp 0x5d516f
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff9
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0xc], edx
jne 0x5d50c7
push str.__amode___6____0_
push 0
push 0x51
push str.access.c
push 2
call fcn.005c1750
add esp, 0x14
cmp eax, 1
jne 0x5d50c7
int3
cmp dword [ebp - 0xc], 0
jne 0x5d5105
call fcn.005c1400
mov dword [eax], 0
call fcn.005c13d0
mov dword [eax], 0x16
push 0
push 0x51
push str.access.c
push str._access_s
push str.__amode___6____0_
call fcn.005c0f40
add esp, 0x14
mov eax, 0x16
jmp 0x5d516f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x5d5130
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005c11c0
add esp, 4
call fcn.005c13d0
mov eax, dword [eax]
jmp 0x5d516f
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x5d513c
xor eax, eax
jmp 0x5d516f
mov eax, dword [ebp - 4]
and eax, 1
je 0x5d516d
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x5d516d
call fcn.005c1400
mov dword [eax], 5
call fcn.005c13d0
mov dword [eax], 0xd
call fcn.005c13d0
mov eax, dword [eax]
jmp 0x5d516f
xor eax, eax
mov esp, ebp
pop ebp
ret