joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5debe5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], vtable.CFont.0
push 0x58
push dword [esi + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push 0x600c2c
push eax
push 0x60
push 0x50
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00574e60
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [edi]
mov ecx, edi
push ebx
push esi
mov dword [ebp - 0x30], eax
call dword [edx + 0x70]
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [esi]
push ebx
call dword [eax + 0x74]
mov edi, dword [ebp - 0x24]
mov ecx, edi
push eax
call dword [esi + 0x30]
mov eax, dword [ebx + 0xb0]
sub eax, 0x10
push eax
call fcn.00405ebd
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 0x80]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x88]
push 0x25
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x8c]
push ecx
mov dword [ebp - 0x14], eax
mov ecx, edi
push dword [esi - 0xc]
mov eax, dword [edi]
push esi
mov byte [ebp - 4], 1
call dword [eax + 0x68]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4beae8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x30]
call dword [eax + 0x28]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], vtable.CFont.0
call fcn.00415fe6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret 8

Function at 0x4c6e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 8
je 0x4c6e7d
cmp esi, 0x21
jb 0x4c6e5c
cmp esi, 0x2e
jbe 0x4c6e7d
cmp esi, 0x43
je 0x4c6e70
cmp esi, 0x56
je 0x4c6e70
cmp esi, 0x58
je 0x4c6e70
cmp esi, 0x5a
jne 0x4c6eaf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4c6eaf
mov eax, dword [edi + 0x20]
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], esi
call fcn.0056ca68
test eax, eax
je 0x4c6eaf
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4c7690
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x74]
test eax, eax
je 0x4c7827
mov eax, dword [edi + 0x134]
test eax, eax
je 0x4c7827
cmp dword [eax + 0x20], 0
je 0x4c7827
cmp dword [eax + 0x80], 0
je 0x4c76d0
pop edi
mov eax, 2
pop esi
pop ebp
ret 8
mov esi, dword [ebp + 8]
cmp esi, 0xd
je 0x4c7827
cmp esi, 9
je 0x4c7827
cmp esi, 0x1b
jne 0x4c7719
lea eax, [edi + 0x154]
mov ecx, edi
push eax
call fcn.004c8410
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x70]
mov ecx, dword [edi + 0xc0]
xor eax, eax
pop edi
pop esi
cmp dword [ecx + 0xe0], 2
sete al
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
test ax, ax
jns 0x4c7754
push 0x11
call ebx
test ax, ax
js 0x4c7754
mov ecx, dword [edi + 0xc0]
call fcn.004cac00
test eax, eax
je 0x4c7754
movzx ecx, si
push ecx
mov ecx, eax
call fcn.004a5b40
test eax, eax
jne 0x4c780f
mov ecx, edi
call fcn.004b4400
test eax, eax
je 0x4c77e6
cmp dword [edi + 0x16c], 0
je 0x4c77e6
cmp esi, 0x26
je 0x4c7776
cmp esi, 0x28
jne 0x4c77e6
mov ecx, edi
call fcn.004c6aa0
test eax, eax
jne 0x4c77e6
mov edx, dword [edi]
cmp esi, 0x26
mov ecx, edi
sete al
lea eax, [eax*2 - 1]
push eax
push 1
call dword [edx + 0x16c]
mov esi, dword [edi + 0x134]
test esi, esi
je 0x4c780f
mov esi, dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x4c780f
mov edi, dword [edi + 0x134]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [edi + 0x20]
call esi
push 0
push 0
push 0xb7
push dword [edi + 0x20]
call esi
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
mov ecx, dword [edi + 0x160]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x4c77fe
push ebx
push esi
call fcn.0050c680
test eax, eax
jne 0x4c780f
mov ecx, dword [edi + 0x134]
push ebx
push esi
call fcn.004c6e40
test eax, eax
je 0x4c781b
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
pop ebx
pop edi
mov eax, 2
pop esi
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4cc190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov ecx, dword [esi + 0xe4]
call fcn.004b07a0
mov edi, eax
mov eax, dword [esi + 0xbc]
cmp eax, 0xffffffff
je 0x4cc1f1
cmp dword [esi + 0xe8], 5
jne 0x4cc1f1
cmp dword [esi + 0xe0], 1
jne 0x4cc1f1
test edi, edi
je 0x4cc1d0
cmp dword [edi + 0x40], eax
je 0x4cc1f9
cmp eax, dword [esi + 0xb8]
jne 0x4cc1e6
mov eax, dword [esi]
mov ecx, esi
push 0
push 0xffffffffffffffff
call dword [eax + 0x170]
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004cd2b0
test edi, edi
je 0x4cc2bf
push ebx
mov ecx, esi
call fcn.004caed0
test eax, eax
jne 0x4cc2a8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd8]
test eax, eax
je 0x4cc2a8
push esi
push 0x65dcdc
call fcn.00576758
add esp, 8
test eax, eax
je 0x4cc2a8
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4cc2a8
mov ecx, esi
call fcn.004cac00
mov ebx, eax
test ebx, ebx
je 0x4cc2a8
cmp dword [ebx + 0x60], 0
je 0x4cc2a8
mov ecx, dword [ebx + 0x74]
cmp dword [ecx + 0x44], 0
je 0x4cc2a8
push 1
mov ecx, ebx
call fcn.004a6ca0
push 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004cd2b0
mov eax, dword [esi]
mov ecx, esi
push 0
push 0xffffffffffffffff
call dword [eax + 0x170]
push dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
call dword [eax + 0x110]
push 0
mov ecx, ebx
call fcn.004a6ca0
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0x54]
mov ecx, ebx
call fcn.004a4430
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
call dword [eax + 0xf4]
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, esi
call fcn.005674c6
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4d35b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x4d3530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
test eax, eax
je 0x4d35fd
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d3610
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x4d3695
push edi
push dword [esi + 0x14]
mov dword [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [esi + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4d3684
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4d3650
cmp dword [ebp - 4], 0x103
jne 0x4d3683
mov eax, dword [esi + 0xc]
inc edi
cmp edi, 0xa
ja 0x4d367a
push 0x64
push eax
call ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x4d3650
jmp 0x4d3683
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d5220
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0690
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x65eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
mov dword [esi], vtable.CXTPPropExchangeIniFile.0
jne 0x4d5268
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], 0
je 0x4d5268
cmp dword [esi + 0x4c], 0
je 0x4d5268
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 0x48]
or edi, 0xffffffff
sub edx, 0x10
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d5285
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x44]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4d529d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.004d51b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d5840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp dword [ebx + 0x34], 0
jne 0x4d5993
mov eax, dword [ebx + 0x44]
cmp dword [eax - 0xc], 0
je 0x4d5993
push esi
push edi
call fcn.004d5830
mov eax, dword [ebx + 0x44]
mov esi, 0x1f40
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xc], eax
mov edx, 2
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005649e3
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ebx
push dword [eax + 0x48]
push esi
push ebx
call edi
test eax, eax
je 0x4d5988
lea ecx, [esi - 2]
cmp eax, ecx
jne 0x4d58c4
push ebx
add esi, esi
call fcn.005649de
add esp, 4
jmp 0x4d587e
mov edx, 2
test ebx, ebx
je 0x4d5883
mov esi, dword [ebp - 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, edx
test ax, ax
jne 0x4d58d3
sub esi, ecx
sar esi, 1
je 0x4d5985
mov eax, dword [ebp - 0xc]
cmp eax, esi
ja 0x4d5962
mov ecx, dword [ebp - 4]
lea edi, [eax + eax]
mov edx, ebx
mov ecx, dword [ecx + 0x44]
sub edi, 4
jb 0x4d5911
mov edi, edi
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4d5916
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4d5900
cmp edi, 0xfffffffc
je 0x4d5943
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4d5962
cmp edi, 0xfffffffd
je 0x4d5943
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4d5962
cmp edi, 0xfffffffe
je 0x4d5943
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4d5962
cmp edi, 0xffffffff
je 0x4d5943
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4d5962
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x4d5951
cmp word [ebx + eax*2], 0x5c
jne 0x4d5962
mov eax, dword [ebp - 4]
push dword [eax + 0x48]
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ebx, [ebx + esi*2]
add ebx, 2
mov esi, ebx
lea ecx, [esi + 2]
lea ecx, [ecx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4d5970
sub esi, ecx
sar esi, 1
jne 0x4d58e7
mov ebx, dword [ebp - 8]
push ebx
call fcn.005649de
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5bc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
call dword [eax + 0x88]
test eax, eax
je 0x4d5c72
cmp dword [esi + 0x28], 0
jne 0x4d5c05
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [edi]
push 3
push 0
push dword [ebp + 8]
push dword [esi + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d5c72
mov ecx, dword [edi]
test ecx, ecx
jne 0x4d5c40
push dword [ebp + 0xc]
call fcn.005a199c
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [edi]
jmp 0x4d5c4a
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, dword [ebp + 0xc]
jb 0x4d5c72
lea eax, [ebp + 0xc]
push eax
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d5c72
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d86a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
jne 0x4d8731
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], 0
jne 0x4d872a
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4d874c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x603808
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4d874c
lea edx, [ebp - 0x20c]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4d8704
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
lea ecx, [esi + 0x48]
push edx
push eax
call fcn.00405684
mov dword [esi + 0x4c], 1
mov dword [esi + 0x38], 1
mov ecx, dword [esi + 0x48]
xor eax, eax
pop edi
pop esi
cmp dword [ecx - 0xc], eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00599f9c
mov esp, ebp
pop ebp
ret

Function at 0x4ddeb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004ddd70
mov dword [ebp - 4], eax
test eax, eax
je 0x4dded7
push 5
push dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004ddbf0
test eax, eax
jne 0x4ddefa
call fcn.005710c5
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
test eax, eax
je 0x4ddf0b
push 5
push dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.004ddbf0
test eax, eax
je 0x4ddf0b
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ddf50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4de018
call fcn.004ddd70
mov esi, eax
movzx eax, word [ebp + 0xc]
push 0x17
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4ddfa0
call fcn.005710c5
mov esi, dword [eax + 0xc]
test esi, esi
je 0x4de018
movzx eax, word [ebp + 0xc]
push 0x17
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4de018
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4de018
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4de018
lea esi, [esi*2 + 2]
mov ecx, ebx
push esi
call fcn.004d7f90
mov edi, eax
test edi, edi
je 0x4de018
push esi
push 0
push edi
call fcn.0059dbb0
add esp, 0xc
push esi
push edi
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.004191b1
xor eax, eax
test esi, esi
pop edi
pop esi
setg al
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x4de0c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
call fcn.00404f33
mov edi, dword [ebp + 0xc]
mov eax, edi
mov ebx, dword [ebp + 8]
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4de1ab
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4de1ab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4de1ab
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4de13b
cmp esi, ecx
jae 0x4de1ab
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4de125
cmp esi, ecx
jae 0x4de1ab
movzx edi, word [esi]
test edi, edi
je 0x4de1ab
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push edi
call fcn.004ddc30
lea ecx, [edi + edi]
add esi, 2
test ecx, ecx
je 0x4de19a
test eax, eax
je 0x4de18a
push ecx
test esi, esi
je 0x4de17f
push esi
push eax
call fcn.0059d630
add esp, 0xc
mov ecx, ebx
push edi
call fcn.004191b1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 0
push eax
call fcn.0059dbb0
add esp, 0xc
call fcn.005a1c31
mov dword [eax], 0x16
call fcn.005a1920
push edi
mov ecx, ebx
call fcn.004191b1
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x4de5e0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0ab2
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], eax
call fcn.0056509a
mov eax, dword [ebp - 0x208]
lea esi, [eax + 0x44]
mov dword [ebp - 4], 0
lea edi, [eax + 0x98]
mov dword [eax], vtable.CXTPToolTipContext.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CFont.0
lea ebx, [eax + 0xa0]
mov dword [ebx + 4], 0
mov dword [ebx], vtable.CFont.0
push 0
mov byte [ebp - 4], 2
mov dword [eax + 0x60], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x208]
cdq
sub eax, edx
sar eax, 1
push 0x2c
mov dword [ecx + 0x3c], eax
lea eax, [ecx + 0x64]
push 0
push eax
call fcn.0059dbb0
add esp, 0xc
call fcn.004d37d0
mov ecx, eax
call fcn.004d2d80
mov ecx, dword [ebp - 0x208]
push 0
push 0
push 0
push 0
push esi
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x90], 0xffffffff
mov dword [ecx + 0x94], 0xffffffff
mov dword [ecx + 0x38], 1
mov dword [ecx + 0x40], 2
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x208]
push 0x1f0
push 0
mov dword [eax + 0x58], 0xffffffff
mov dword [eax + 0x54], 0xffffffff
mov dword [eax + 0x5c], 0xffffffff
lea eax, [ebp - 0x200]
push eax
call fcn.0059dbb0
add esp, 0xc
mov dword [ebp - 0x204], 0x1f4
lea eax, [ebp - 0x204]
push 0
push eax
push 0x1f4
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0xb8], 0x190
call fcn.004de4e0
mov ecx, eax
call fcn.004ddc80
mov esi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov byte [ebp - 0xb1], al
lea eax, [ebp - 0xc8]
push eax
call esi
push eax
mov ecx, edi
call fcn.00571b9a
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0x2bc
push eax
call esi
push eax
mov ecx, ebx
call fcn.00571b9a
mov ecx, dword [ebp - 0x208]
mov eax, ecx
mov dword [ecx + 0xa8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x4e06c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 1
call esi
test ax, ax
js 0x4e07cd
push 2
call esi
test ax, ax
js 0x4e07cd
push 4
call esi
test ax, ax
js 0x4e07cd
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x88]
xor esi, esi
test eax, eax
jle 0x4e07cd
lea ebx, [ebx]
test esi, esi
js 0x4e07f3
cmp esi, eax
jge 0x4e07f3
mov eax, dword [ebx + 0x84]
mov edi, dword [eax + esi*4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e07be
push dword [edi + 0x20]
call fcn.0056787f
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
test byte [edi + 8], 1
push eax
je 0x4e078d
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4e0792
call fcn.00571bc6
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4e07be
test byte [edi + 8], 1
jne 0x4e07e0
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
push 0
call fcn.004e1f60
cmp eax, dword [edi + 0x20]
je 0x4e07e0
mov eax, dword [ebx + 0x88]
inc esi
cmp esi, eax
jl 0x4e0730
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
call fcn.00564a96
int3

Function at 0x4e2190
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push edi
mov ecx, 7
lea edi, [ebp - 0x24]
mov esi, ebx
push eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
push 0
push 0x410
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebx + 0x14]
add ecx, 0xfffffe00
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
cmp ecx, 0xd
ja 0x4e21ed
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
movzx ecx, si
movzx eax, dx
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x407
push dword [edi + 0x20]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8