joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3fa0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebp
mov ebx, dword [esp + 0x1c]
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4c3fcf
push eax
push esi
push 0xe11
call fcn.004d6c30
add esp, 0xc
push 0
push ebx
call fcn.004c3eb0
mov eax, dword [0x585fa0]
add esp, 8
test eax, eax
mov dword [esp + 0x10], 0
je 0x4c4023
lea eax, [esp + 0x10]
push eax
push 0x567bf0
push 1
push 0
push 0x527ed8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4c4023
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c4023
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x10]
push 1
push ebx
push eax
mov edx, dword [eax]
call dword [edx + 0x28]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f0
push ebx
call edi
push 1
push ebx
mov esi, eax
call edi
mov ebx, eax
mov dword [esp + 0x14], ebx
call ebp
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4c405c
push eax
push edi
push 0xe12
call fcn.004d6c30
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push esi
call edi
push 0
push ebx
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x80000
push 0
push 0x401
push esi
call edi
push 0
push 1
push 0x402
push esi
call edi
mov bl, byte [esp + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test bl, 1
je 0x4c40af
mov eax, dword [esp + 0x24]
push eax
push 0
call fcn.004c39e0
add esp, 8
push 0x64
call ebp
push 0
push 2
push 0x402
push esi
call edi
test bl, 2
je 0x4c40d5
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0
call fcn.004c3610
add esp, 0xc
push 0x64
call ebp
push 0
push 3
push 0x402
push esi
call edi
test bl, 4
je 0x4c40f9
mov edx, dword [esp + 0x24]
push edx
push 0
call fcn.004c3780
add esp, 8
push 0x64
call ebp
push 0
push 4
push 0x402
push esi
call edi
test bl, 8
je 0x4c4113
call fcn.004c3d70
push 0x64
call ebp
push 0
push 5
push 0x402
push esi
call edi
test bl, 0x10
je 0x4c412d
call fcn.004c3ad0
push 0x64
call ebp
push 0
push 6
push 0x402
push esi
call edi
test bl, 0x20
je 0x4c4147
call fcn.004c3da0
push 0x64
call ebp
push 0
push 7
push 0x402
push esi
call edi
test bl, 0x40
je 0x4c4161
call fcn.004c3dd0
push 0x64
call ebp
push 0
push 8
push 0x402
push esi
call edi
test bl, 0x80
je 0x4c41ab
call fcn.00422810
mov eax, dword [eax + 4]
push 0xffff
push 0x76cf
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.004c3df0
push 0
push 0
push 9
call fcn.00447160
mov ecx, eax
call fcn.00448300
push 0x64
call ebp
push 0x12c
call ebp
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
mov ecx, dword [esp + 0x14]
push 5
push ecx
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c41e7
mov esi, dword [esp + 0x1c]
mov edx, dword [eax]
push 0
push esi
push eax
call dword [edx + 0x28]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4c41eb
mov esi, dword [esp + 0x1c]
push 1
push esi
call fcn.004c3eb0
add esp, 8
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4c4d00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push ebx
push ebp
push esi
push edi
push 0x41e
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov esi, eax
push 0
push 0x1042
push esi
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c4d98
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 4
push ecx
push eax
push 0x104b
push esi
mov dword [esp + 0x24], ebx
call ebp
test eax, eax
je 0x4c4d98
mov edx, dword [esp + 0x30]
push edx
call fcn.004c10f0
mov edi, eax
add esp, 4
test edi, edi
je 0x4c4d80
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebx
push 0x1008
push esi
call ebp
mov eax, dword [esp + 0x3c]
push eax
call fcn.004c4de0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x4c5270
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x5bd7b8]
sub esp, 0x244
test eax, eax
je 0x4c52bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c52bd
mov eax, dword [0x5bd7b8]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4c52a9
mov ecx, dword [0x5bd7b8]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x5bd7b8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
add esp, 0x244
ret
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x42]
mov word [esp + 0x40], 0
push 0x208
rep stosd dword es:[edi], eax
mov ecx, dword [0x58bccc]
stosw word es:[edi], ax
lea eax, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 4]
lea edx, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 8], 0x40
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], str._tp:4
mov dword [esp + 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x4c5353
mov ecx, dword [esp + 0x38]
push 0xbb8
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x244
ret

Function at 0x4c64d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x2f50]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4ca440
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5bd9d8]
push ebx
push ebp
push esi
push edi
cmp eax, 1
mov edi, ecx
jne 0x4ca471
lea ebx, [edi + 0x1e720]
push 0xa
mov ecx, ebx
call fcn.00503550
mov esi, dword [esp + 0x14]
mov ebp, eax
mov eax, dword [ebx]
push esi
push 0xa
mov ecx, ebx
call dword [eax + 0x3c]
jmp 0x4ca490
lea ebx, [edi + 0x13134]
push 0xa
mov ecx, ebx
call fcn.00503550
mov esi, dword [esp + 0x14]
mov edx, dword [ebx]
push esi
push 0xa
mov ecx, ebx
mov ebp, eax
call dword [edx + 0x3c]
test ebp, ebp
je 0x4ca4e2
lea ebx, [edi + 0x14f34]
mov ecx, ebx
call fcn.00409a90
mov ebp, dword [esi + 4]
mov ecx, eax
mov eax, dword [esi + 0xc]
push 0x40
sub eax, ebp
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esi]
mov esi, dword [esi + 8]
sar eax, 1
add eax, ebp
sub esi, edx
add ecx, eax
sub ecx, eax
push ecx
push esi
push eax
mov eax, dword [edi + 0x14f38]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
call fcn.00407830
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ecx, dword [edi + 0x14f38]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4ca500
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5bd9d8]
push ebx
push ebp
push esi
push edi
cmp eax, 1
mov edi, ecx
jne 0x4ca531
lea ebx, [edi + 0x1f610]
push 0x13
mov ecx, ebx
call fcn.00503550
mov esi, dword [esp + 0x14]
mov ebp, eax
mov eax, dword [ebx]
push esi
push 0x13
mov ecx, ebx
call dword [eax + 0x3c]
jmp 0x4ca550
lea ebx, [edi + 0x13134]
push 0x13
mov ecx, ebx
call fcn.00503550
mov esi, dword [esp + 0x14]
mov edx, dword [ebx]
push esi
push 0x13
mov ecx, ebx
mov ebp, eax
call dword [edx + 0x3c]
test ebp, ebp
je 0x4ca5a2
lea ebx, [edi + 0x11db8]
mov ecx, ebx
call fcn.004a3de0
mov ebp, dword [esi + 4]
mov ecx, eax
mov eax, dword [esi + 0xc]
push 0x40
sub eax, ebp
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esi]
mov esi, dword [esi + 8]
sar eax, 1
add eax, ebp
sub esi, edx
add ecx, eax
sub ecx, eax
push ecx
push esi
push eax
mov eax, dword [edi + 0x11dbc]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
call fcn.004a3e00
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ecx, dword [edi + 0x11dbc]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4ce1a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x50]
lea edi, [esi + 0x2145c]
push eax
mov ecx, edi
call fcn.004e77b0
push esi
mov ecx, edi
call fcn.004e8330
lea ecx, [esi + 0x4c]
test ecx, ecx
je 0x4ce1c9
lea eax, [esi + 0x74]
jmp 0x4ce1cb
xor eax, eax
push edi
mov dword [esi + 0x2148c], eax
call fcn.004f1d70
call fcn.00447160
mov ecx, dword [eax + 0x80]
pop edi
test ecx, ecx
pop esi
jne 0x4ce202
mov ecx, 0x56bcc8
call fcn.0040c900
test eax, eax
jne 0x4ce202
call fcn.004d9220
mov ecx, eax
jmp 0x4d96f0
ret
sub esp, 0x454
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x66]
mov word [esp + 0x64], 0
push str.FaceIcon_Bits.dat
rep stosd dword es:[edi], eax
mov ecx, 0x56bcc8
stosw word es:[edi], ax
call fcn.0040c170
push eax
push str._sdata_s
lea eax, [esp + 0x70]
push 0x1ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x78]
push 0
push ecx
call fcn.0043f210
add esp, 0x1c
test eax, eax
je 0x4d988f
push 0
push 0x20
push 3
push 0
push 1
lea edx, [esp + 0x78]
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d988f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4d9797
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
lea edi, [ebp + 2]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
je 0x4d97cd
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, 0x18
jbe 0x4d988f
mov ecx, 6
mov esi, ebx
lea edi, [esp + 0x4c]
add eax, 0xffffffe8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x54]
mov ebp, edx
imul ebp, dword [esp + 0x58]
cmp ebp, eax
ja 0x4d988f
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
xor edi, edi
push edi
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov word [esp + 0x30], 1
mov word [esp + 0x32], 0x20
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_GetDC]
push edi
lea edx, [esp + 0x14]
mov esi, eax
push edi
push edx
lea eax, [esp + 0x2c]
push edi
push eax
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
lea esi, [ebx + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4d988f
mov ecx, dword [esp + 0x14]
push eax
call fcn.004d93f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
Function at 0x4cff10
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1048
call fcn.0051c5a0
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1050]
xor eax, eax
shr ecx, 0x10
cmp ecx, 0x13
jne 0x4cffe7
push edi
mov ecx, 0x411
lea edi, [esp + 0xa]
mov word [esp + 8], ax
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x11db8]
stosw word es:[edi], ax
call fcn.004a3db0
test eax, eax
pop edi
je 0x4cff7a
cmp word [eax], 0
je 0x4cff7a
push 1
push 1
lea edx, [esp + 0xc]
push 0x824
push edx
push eax
push 0xffffffffffffffff
call fcn.004a4470
mov ecx, eax
call fcn.004a4950
jmp 0x4cff94
push 1
lea eax, [esp + 8]
push 0x824
push eax
push 0xffffffffffffffff
call fcn.004a4470
mov ecx, eax
call fcn.004a4a70
cmp word [esp + 4], 0
je 0x4cffe2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x5868f8]
lea edx, [esp + 4]
push ecx
push 0
push 0
push 1
push 1
push 8
push 0
push edx
lea ecx, [esi + 0xedb8]
call fcn.004879e0
call fcn.00422810
mov eax, dword [eax + 4]
push 0
push 0x7612
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
pop esi
add esp, 0x1048
ret 4

Function at 0x4d0380
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x28]
push 0x2008
push 1
push 0x9d99
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x4d0510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x10
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x11
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
test esi, esi
jne 0x4d05a4
test edi, edi
jne 0x4d05a4
test eax, eax
jne 0x4d05a4
mov eax, dword [esp + 0x14]
add eax, 0xffffff90
mov ecx, eax
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*8]
cmp word [eax*8 + 0x59fb0c], di
lea esi, [eax*8 + 0x59fb0c]
je 0x4d05a4
push edi
call dword [sym.imp.USER32.dll_InSendMessageEx]
and eax, 9
cmp al, 1
jne 0x4d058c
push 1
call dword [sym.imp.USER32.dll_ReplyMessage]
push esi
lea ecx, [ebp + 0xedb8]
call fcn.004873f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4d9090
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004d8d80
lea eax, [ebp + 0xc]
push 0x568ec0
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
je 0x4d9170
push ebx
push edi
lea esi, [ebp + 4]
push 1
push 4
push esi
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4d9142
mov eax, dword [esi]
test eax, eax
je 0x4d9142
mov ecx, dword [ebp + 8]
shl ecx, 1
cmp eax, ecx
jge 0x4d9142
mov edx, eax
shl edx, 5
add edx, eax
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d9142
mov eax, dword [esi]
mov edi, ebx
mov ecx, eax
shl ecx, 5
add ecx, eax
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push eax
push ecx
push 0x21
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
add esp, 0x10
cmp eax, ecx
je 0x4d913e
push ebx
mov dword [esi], 0
call fcn.0051c54a
add esp, 4
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp], ebx
test ebx, ebx
pop ebx
je 0x4d916a
mov edx, dword [0x5cb150]
pop edi
mov dword [ebp + 0x214], edx
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x4d9180
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x5646e0
lea eax, [esi + 0xc]
mov dword [esp + 0x10], edi
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4d920a
mov eax, dword [esi]
push ebp
test eax, eax
je 0x4d91f6
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
lea edi, [esi + 4]
push 1
push 4
push edi
call ebp
add esp, 0x10
cmp eax, 1
jne 0x4d91f6
mov ecx, dword [edi]
mov edx, dword [esi]
push ebx
push ecx
push 0x21
push edx
call ebp
mov ecx, dword [edi]
add esp, 0x10
cmp eax, ecx
jne 0x4d91f6
push 0x5cb150
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x5cb150]
mov dword [esp + 0x10], 1
mov dword [esi + 0x214], eax
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4d9630
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
test eax, eax
push esi
je 0x4d96e1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4d96e1
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push 0x18
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4d96e1
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d96e1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x18
push ecx
push esi
mov dword [esp + 0x38], 0
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push 0
push edx
push eax
push ecx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x18
ret 8

Function at 0x4da3e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x521981
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004f7d30
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call fcn.0050a6a0
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 1
call fcn.00492760
lea ecx, [esi + 0x2d0]
mov byte [esp + 0x1c], 2
call fcn.004fe1f0
mov al, byte [esp + 0xf]
lea edx, [esi + 0x2c8]
mov byte [esi + 0x11d0], al
mov dword [esi + 0x11d4], edi
mov dword [esi + 0x11d8], edi
mov dword [esi + 0x11dc], edi
xor ecx, ecx
mov dword [esi], 0x527afc
mov dword [ebx], 0x527ae8
mov dword [edx], ecx
mov eax, esi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x11c0], edi
mov dword [esi + 0x11c4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x11c8], edi
mov dword [esi + 0x11cc], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x11e8], edi
mov dword [esi + 0x11ec], edi
mov dword [esi + 0x28], 0x64
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4dc180
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4dc19e
mov eax, dword [ecx + 8]
push 5
push eax
mov dword [ecx + 0x2c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov dword [ecx + 0x2c], 1
mov ecx, dword [ecx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x4dc7c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x11c4]
test eax, eax
je 0x4dc89c
mov eax, dword [esi + 0x11c0]
test eax, eax
je 0x4dc89c
mov dword [esi + 0x40], 1
mov eax, dword [eax + 4]
test eax, eax
je 0x4dc7fc
push 0x4001
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x11c0]
call fcn.0046a960
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xf8]
mov ecx, dword [esi + 0x11c0]
mov edx, dword [ecx]
call dword [edx + 0x6c]
cmp eax, 0x64
mov dword [esi + 0x28], eax
je 0x4dc835
mov ecx, dword [esi + 0x11c0]
push 0x64
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov ecx, esi
call fcn.004dcee0
mov ecx, esi
call fcn.004dcd60
xor ecx, ecx
mov edx, dword [esi + 0x34]
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x30]
mov dword [esp + 8], ecx
push 0x14
mov dword [esp + 0x10], ecx
push 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x11c0]
push edx
push 0x53
mov dword [esp + 0x24], eax
call fcn.00415670
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
mov ecx, esi
call fcn.004dc090
pop esi
add esp, 0x14
ret
Function at 0x4dff30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x218]
mov esi, dword [esp + 0x214]
lea ecx, [esp + 8]
dec edx
push ecx
push str._s360seWebCacheImages_
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043f620
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4dffa0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push esi
push eax
call fcn.004df860
mov esi, eax
add esp, 4
test esi, esi
jne 0x4dffc2
pop esi
add esp, 0x208
ret
cmp word [esi], 0
je 0x4e001e
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1a
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x21c]
lea edx, [esp + 8]
push esi
mov esi, dword [esp + 0x21c]
push edx
dec eax
push str._s360seWebCache_s.html
push eax
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043f620
add esp, 0x18
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0x4e0890
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x4e08c9
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x50], 1
test ecx, ecx
je 0x4e08c9
push 2
call fcn.00416ca0
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x58]
push 0
push 0
push 1
call fcn.004169d0
pop esi
ret

Function at 0x4e8090
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov edx, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x10], eax
push ecx
push edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
add ecx, 0x32
add eax, 0xa
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
add eax, 0x32
cmp ecx, ebx
mov dword [esp + 0x14], eax
je 0x4e8143
call fcn.00493900
test eax, eax
je 0x4e8143
mov ecx, dword [esi + 0x38]
push ebp
push edi
call fcn.004939c0
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
call fcn.004939c0
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4e8124
push 1
mov ebx, edi
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4e8124
lea ebx, [edi + edi]
mov eax, dword [esp + 0x24]
push 0
mov ecx, dword [esi + 0x38]
push 0
push ebp
push edi
push 0
push ebx
lea edx, [esp + 0x28]
push 0
push edx
push eax
call fcn.00492f10
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret 4