joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0x3f
push edi
jne 0x401403
xor edi, edi
push edi
push 0x42c398
push str.ERROR:_Cannot_create_ANY_MORE_threads___
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401447
push 8
call fcn.0041600f
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
lea ecx, [ebp - 4]
push ecx
xor edi, edi
push edi
push eax
push 0x40121b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x40143c
push edi
push 0x42c398
push str.ERROR:_Cannot_create_thread___
jmp 0x4013f8
mov ecx, dword [esi]
mov dword [esi + ecx*4 + 4], eax
inc dword [esi]
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x4093b9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4093c7
push 0xd
pop eax
jmp 0x4093fa
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4093ce
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40a7d8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4351b4]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00414330
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a831
cmp dword [ebp - 0x7c], 5
jae 0x40a82d
cmp dword [ebp - 0x7c], 4
jne 0x40a831
cmp dword [ebp - 0x78], 0x5a
jb 0x40a831
xor eax, eax
jmp 0x40a834
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00414319
add ebp, 0x98
leave
ret

Function at 0x40aa2a
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
push edi
push str.Kernel32
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x40aa7c
push str.CreateToolhelp32Snapshot
push eax
call edi
push str.Process32FirstW
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.Process32NextW
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
cmp dword [esi + 8], ebx
je 0x40aa8b
cmp dword [esi + 0xc], ebx
je 0x40aa8b
cmp dword [esi + 0x10], ebx
jne 0x40aacf
cmp dword [esi + 4], ebx
je 0x40aacf
push str.ntdll.dll
call ebp
mov dword [esi], eax
cmp eax, ebx
je 0x40aacf
push str.ZwQuerySystemInformation
push eax
call edi
push 0x42ceb0
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push 0x42cec0
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push 0x42cecc
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
pop edi
pop ebp
mov eax, esi
pop ebx
ret

Function at 0x40aaf5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 4], esi
je 0x40ab50
cmp dword [edi + 8], esi
je 0x40ab22
cmp dword [edi + 0xc], esi
je 0x40ab22
cmp dword [edi + 0x10], esi
je 0x40ab22
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0040ab73
mov edi, eax
jmp 0x40ab4c
cmp dword [edi + 0x14], esi
je 0x40ab4a
cmp dword [edi + 0x1c], esi
je 0x40ab4a
cmp dword [edi + 0x18], esi
je 0x40ab4a
cmp dword [edi + 0x20], esi
je 0x40ab4a
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
mov ebx, edi
call fcn.0040ac51
mov edi, eax
pop ebx
jmp 0x40ab4c
xor edi, edi
cmp edi, esi
jne 0x40ab54
xor al, al
jmp 0x40ab6d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 1
sete al
pop edi
pop esi
pop ebp
ret 4
Function at 0x40b650
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x427c70
call fcn.0041921e
xor eax, eax
mov dword [ebp - 4], eax
push 0x42cee4
push eax
lea ebx, [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.0041365a
push eax
call fcn.00416a4b
mov edi, eax
xor ebx, ebx
pop ecx
pop ecx
cmp edi, ebx
je 0x40b6fe
push 2
push ebx
push edi
call fcn.00416aec
push edi
call fcn.00416d0e
push ebx
push ebx
push edi
mov esi, eax
call fcn.00416aec
lea eax, [esi + 1]
push eax
call fcn.00414293
mov ebx, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414293
push edi
push esi
push 1
push ebx
mov dword [ebp - 0x14], eax
call fcn.0041701c
push edi
mov byte [ebx + esi], 0
call fcn.004170b0
add esp, 0x38
lea eax, [esi + esi + 1]
mov esi, dword [ebp - 0x14]
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x40b6f7
mov dword [ebp - 0x10], esi
push ebx
call fcn.0041430e
pop ecx
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
call fcn.004135bd
mov eax, dword [ebp - 0x10]
call fcn.004192bd
ret
Function at 0x40eed3
Capabilities:
Resolve dns

Disassembly:
push 0x44
mov eax, 0x4284cc
call fcn.00419287
mov esi, ecx
add esi, 4
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x24], esi
cmp eax, edi
je 0x40eef8
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [esi], edi
push 0x20
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.00414330
add esp, 0xc
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp + 8], edi
je 0x40ef4f
push dword [ebp + 8]
call ebx
push edi
inc eax
cdq
push 2
push edx
push eax
call fcn.004236a0
mov esi, eax
add eax, 0x80000000
adc edx, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], edx
jne 0x40ef4f
cmp eax, 0xffffffff
jbe 0x40ef54
mov dword [ebp - 0x1c], edi
jmp 0x40ef8e
cmp esi, 0x400
jg 0x40ef72
push esi
call fcn.0040ee26
pop ecx
test al, al
je 0x40ef72
mov eax, esi
call fcn.004201f0
mov eax, esp
jmp 0x40ef7e
push esi
lea esi, [ebp - 0x14]
call fcn.0040ee9b
mov esi, dword [ebp - 0x20]
push 3
push esi
push dword [ebp + 8]
mov esi, eax
call fcn.0040edf3
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0xc], edi
je 0x40efb7
push dword [ebp + 0xc]
call ebx
push edi
inc eax
cdq
push 2
push edx
push eax
call fcn.004236a0
mov ebx, eax
add eax, 0x80000000
adc edx, edi
mov dword [ebp - 0x2c], edx
jne 0x40efb7
cmp eax, 0xffffffff
jbe 0x40efbb
xor eax, eax
jmp 0x40efef
cmp ebx, 0x400
jg 0x40efd9
push ebx
call fcn.0040ee26
pop ecx
test al, al
je 0x40efd9
mov eax, ebx
call fcn.004201f0
mov eax, esp
jmp 0x40efe2
push ebx
lea esi, [ebp - 0x14]
call fcn.0040ee9b
push 3
push ebx
push dword [ebp + 0xc]
mov esi, eax
call fcn.0040edf3
cmp dword [ebp - 0x1c], edi
je 0x40f02b
cmp eax, edi
je 0x40f02b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x50]
push ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], edi
je 0x40f027
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
push eax
mov dword [ebp - 0x14], esi
call fcn.00415e8a
pop ecx
cmp esi, edi
jne 0x40f014
mov eax, ebx
jmp 0x40f052
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], edi
je 0x40f04f
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
push eax
mov dword [ebp - 0x14], esi
call fcn.00415e8a
pop ecx
cmp esi, edi
jne 0x40f03c
or eax, 0xffffffff
lea esp, [ebp - 0x60]
call fcn.004192d1
ret 8
Function at 0x40f172
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x40f184
mov al, 1
jmp 0x40f1f6
mov eax, dword [esi + 0x40]
mov byte [ebp - 1], 1
cmp eax, 0xffffffff
jne 0x40f194
xor al, al
jmp 0x40f1f6
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x40f1f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40f1ea
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f1ed
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00414330
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x40f1f0
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8

Function at 0x40f63b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x40f662
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x40f709
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x40f680
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x40f708
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40f6c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x40f6fa
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x40f6fd
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40f6f4
mov bl, 1
jmp 0x40f6fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc
Function at 0x4107e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x410804
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x4108cc
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x410826
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x4108cb
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call fcn.00414330
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x410889
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x4108bd
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4108c0
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x4108b7
mov bl, 1
jmp 0x4108c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
leave
ret 4
Function at 0x411685
Capabilities:
Initialize winsock library

Disassembly:
push 0
mov eax, 0x42804a
call fcn.0041921e
mov esi, dword [ebp + 8]
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00408917
mov ecx, edi
call fcn.00408b10
xor ebx, ebx
cmp eax, ebx
jge 0x4116b1
push eax
call fcn.004097a3
mov dword [ebp - 4], ebx
lea edi, [esi + 0x28]
mov ecx, edi
call fcn.00408917
mov ecx, edi
call fcn.00408b10
cmp eax, ebx
jl 0x4116ab
mov byte [ebp - 4], 1
or dword [esi + 0x40], 0xffffffff
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x437658], ebx
je 0x411707
push 0x4374c8
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x437658], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004192bd
ret 4

Function at 0x411715
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411779
cmp dword [ebp + 0xc], 1
je 0x411751
cmp dword [ebp + 0xc], 2
je 0x411751
push 0xd
pop eax
jmp 0x411779
mov eax, dword [ebp - 4]
test edi, edi
je 0x411773
test eax, eax
je 0x41176e
test al, 1
jne 0x41174c
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x411773
jmp 0x41174c
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x411dac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x411dc3
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x411df8
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x411df4
cmp edi, eax
jae 0x411df8
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x411de6
cmp edi, eax
jb 0x411dfc
xor eax, eax
jmp 0x411e05
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x413ecc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4379b8], 0
push esi
jne 0x413e3f
call fcn.00413d65
test eax, eax
je 0x413e82
mov eax, dword [0x4379b8]
cmp eax, 1
jne 0x413e60
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x413e82
pop esi
ret
push eax
call dword [0x4379c0]
test eax, eax
jne 0x413eca
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x413e86
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4379b8]
call dword [0x4379c0]
mov edi, eax
test edi, edi
je 0x413eab
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x413ec7
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4379b8]
call dword [0x4379bc]
add edi, 0x10
cmp edi, esi
jb 0x413eb3
mov eax, edi
pop edi
pop esi
ret
jmp 0x413e2c

Function at 0x414319
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4351b4]
jne 0x414323
repz ret
jmp fcn.004192e0

Function at 0x42193d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419967
and dword [ebp - 4], 0
cmp dword [0x43850c], 0
mov ebx, eax
jne 0x4219ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421a9f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421a9f
push eax
call fcn.004198f5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43850c], eax
call esi
push eax
call fcn.004198f5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438510], eax
call esi
push eax
call fcn.004198f5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438514], eax
call esi
push eax
call fcn.004198f5
pop ecx
mov dword [0x43851c], eax
test eax, eax
je 0x4219ee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004198f5
pop ecx
mov dword [0x438518], eax
mov eax, dword [0x438518]
cmp eax, ebx
je 0x421a46
cmp dword [0x43851c], ebx
je 0x421a46
push eax
call fcn.00419970
push dword [0x43851c]
mov esi, eax
call fcn.00419970
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421a46
test edi, edi
je 0x421a46
call esi
test eax, eax
je 0x421a3d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421a3d
test byte [ebp - 0xc], 1
jne 0x421a46
or dword [ebp + 0x10], 0x200000
jmp 0x421a7f
mov eax, dword [0x438510]
cmp eax, ebx
je 0x421a7f
push eax
call fcn.00419970
pop ecx
test eax, eax
je 0x421a7f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421a7f
mov eax, dword [0x438514]
cmp eax, ebx
je 0x421a7f
push eax
call fcn.00419970
pop ecx
test eax, eax
je 0x421a7f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43850c]
call fcn.00419970
pop ecx
test eax, eax
je 0x421a9f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421aa1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
push edi
mov ecx, dword [esi]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x64]
call eax
test al, al
jne 0x405060
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov dword [ebp + 8], eax
mov edi, eax
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 0xc]
push eax
push edi
mov ecx, 0x4ef2b8
call fcn.00489000
push eax
push str._s__d____d
call fcn.00419f30
mov ecx, dword [esi]
mov edi, eax
add esp, 0x10
mov eax, dword [ecx]
mov eax, dword [eax + 0x58]
call eax
test al, al
je 0x4050de
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov ecx, dword [ebp - 4]
mov esi, eax
mov ecx, dword [ecx]
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
push ebx
push esi
mov ecx, 0x4ef2b8
call fcn.00489000
push eax
push str._s__s___d____d_
call fcn.00419f30
add esp, 0x14
mov ebx, eax
push edi
call fcn.004bf8aa
add esp, 4
mov edi, ebx
push esi
call fcn.004bf8aa
mov ebx, dword [ebp - 8]
add esp, 4
mov esi, dword [ebp - 4]
test ebx, ebx
jne 0x40510b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, esi
push 4
and eax, 1
push eax
push edi
call fcn.00467aa0
push edi
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0xc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x56c02c]
mov byte [ebx + 0x10], 0
cmp eax, 2
je 0x40513d
cmp eax, 0x17
je 0x40513d
cmp eax, 0x1f
je 0x40513d
mov dword [ebp - 4], 0
cmp eax, 0x27
jne 0x405144
mov dword [ebp - 4], 1
mov esi, dword [ebx + 4]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp byte [ebp - 4], 0
mov ecx, eax
je 0x405160
or ecx, 0x500000
jmp 0x405166
and ecx, 0xffafffff
cmp ecx, eax
je 0x405174
push ecx
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push edi
mov ecx, ebx
call fcn.00484280
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4064d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov bh, dl
mov byte [ebp - 1], bh
test edi, edi
je 0x4066cd
mov bl, byte [ebp + 8]
test bl, bl
je 0x4064f4
mov bh, 1
mov byte [ebp - 1], bh
cmp dword [0x56b084], 0
je 0x406528
mov ecx, dword [0x569758]
xor eax, eax
test ecx, ecx
je 0x406528
mov edx, dword [0x569764]
nop
cmp dword [edx + eax*4], edi
je 0x40651c
inc eax
cmp eax, ecx
jb 0x406510
jmp 0x406528
test eax, eax
jne 0x406528
test bl, bl
je 0x4066cd
mov dl, 1
mov ecx, edi
call fcn.0045e0b0
mov eax, dword [edi + 0x344]
test eax, eax
je 0x40654b
push 0xffffffffffffffff
push eax
mov byte [edi + 0x348], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi]
mov byte [edi + 0x348], 0
test ecx, ecx
je 0x4065a0
mov eax, dword [ecx]
call dword [eax + 0x78]
mov ecx, dword [edi]
test eax, eax
je 0x40657a
test ecx, ecx
je 0x406572
mov eax, dword [ecx]
call dword [eax + 0x78]
mov byte [eax + 0x24], 1
jmp 0x4065a0
xor eax, eax
mov byte [eax + 0x24], 1
jmp 0x4065a0
test ecx, ecx
je 0x4065a0
mov eax, dword [ecx]
call dword [eax + 0x80]
test eax, eax
je 0x4065a0
mov ecx, dword [edi]
test ecx, ecx
je 0x40659a
mov eax, dword [ecx]
call dword [eax + 0x80]
jmp 0x40659c
xor eax, eax
mov byte [eax + 0x50], 0
cmp dword [edi + 0x308], 0
je 0x4065b0
mov ecx, edi
call fcn.004095f0
cmp dword [0x569758], 1
mov ecx, edi
sete bl
mov byte [ebp - 2], bl
call fcn.00402020
test bl, bl
je 0x4065cc
test bh, bh
je 0x4065d7
push 0
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_ShowWindow]
test bl, bl
je 0x406601
test bh, bh
je 0x4065fa
mov eax, dword [0x56be3c]
mov eax, dword [eax + 0xf4]
cmp dword [eax], 0
jne 0x4065fa
cmp dword [edi + 4], 1
jbe 0x4065fa
call fcn.00405660
call fcn.00481a60
jmp 0x406628
mov ebx, dword [edi + 4]
xor esi, esi
test ebx, ebx
je 0x406622
lea ebx, [ebx]
mov edx, dword [edi + 0x10]
mov ecx, edi
mov edx, dword [edx + esi*4]
call fcn.004021f0
inc esi
cmp esi, ebx
jne 0x406610
mov bh, byte [ebp - 1]
mov bl, byte [ebp - 2]
push 0
push 0
push 0x1309
push dword [edi + 0x100]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x108]
call fcn.0040be50
lea ecx, [edi + 4]
mov dword [edi + 0x58], 0
mov dword [edi], 0
call fcn.00466c20
cmp byte [ebp + 8], 0
je 0x40666c
mov ecx, edi
call fcn.00404520
jmp 0x4066bd
test bl, bl
je 0x4066ac
test bh, bh
jne 0x4066ac
push 0
xor dl, dl
mov ecx, edi
call fcn.004060d0
add esp, 4
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x569758]
xor eax, eax
test ecx, ecx
je 0x4066bd
mov edx, dword [0x569764]
lea ecx, [ecx]
cmp dword [edx + eax*4], edi
je 0x4066bd
inc eax
cmp eax, ecx
jb 0x4066a0
jmp 0x4066bd
mov esi, dword [edi + 0x5c]
mov ecx, edi
call fcn.00404520
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
test bl, bl
je 0x4066cd
test bh, bh
je 0x4066cd
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret