joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444010
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x1a8]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x44405c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00432580
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.00443c20
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x444190
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebp
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebp, dword [eax + 0x188]
jne 0x4442e0
push ebx
push esi
push edi
lea ebx, [ebp + 0x1cb0]
lea edi, [ebp + 0x1eb0]
mov dword [edi], ebx
cmp ebx, edi
jae 0x4441cb
mov byte [ebx], 0xff
inc dword [edi]
mov eax, dword [edi]
jmp 0x4441cd
mov eax, ebx
cmp eax, edi
jae 0x4441e1
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4441e1
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x1c]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x44424b
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [esp + 0x10]
mov dword [ebp + 0x1eb4], eax
sub eax, ebx
sub eax, 2
mov dword [edi], ebx
push eax
lea eax, [ebp + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.00443d20
add esp, 0x10
push 0
push 3
push ebx
mov ebx, dword [esp + 0x24]
push dword [ebx + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x44429f
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00432580
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb3]
push eax
push ebx
call fcn.00444080
add esp, 0xc
lea eax, [ebp + 0x1cb7]
push 0
push 2
push eax
push dword [ebx + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4442dd
call edi
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00432580
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x4456c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x587388]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
lea eax, [esp + 4]
push ebp
push esi
push edi
mov esi, dword [ebx + 0x618]
mov edi, dword [ebx]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x445745
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.00503c30
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x445780
push str.Received_too_short_packet
push edi
call fcn.00432580
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca2e2
add esp, 0x88
ret
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax]
movzx eax, byte [eax + 1]
shl ecx, 8
or ecx, eax
mov dword [esi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x4457a1
jmp dword [ecx*4 + 0x4458b0]
cmp edx, 4
jle case.0x4457a1.4
mov ebp, dword [esi + 0x15c]
movzx ecx, byte [ebp + 2]
movzx eax, byte [ebp + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [esi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4457a1.4
lea eax, [edx - 4]
push eax
lea eax, [ebp + 4]
push eax
push 1
push ebx
call fcn.00432300
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4457ff
push 5
push esi
call fcn.00446180
add esp, 8
mov eax, ebp
jmp 0x445767
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x90], eax
adc dword [edi + 0x94], edx
push dword [edi + 0x94]
push dword [edi + 0x90]
push edi
call fcn.0043df70
jmp 0x445886
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x15c]
add eax, 4
mov dword [esi + 8], ecx
push eax
push 0x544720
push edi
call fcn.004326a0
jmp 0x445886
lea eax, [edx - 2]
push eax
mov eax, dword [esi + 0x15c]
add eax, 2
push eax
push esi
call fcn.00445450
add esp, 0xc
test eax, eax
je case.0x4457a1.4
jmp 0x445767
push str.Internal_error:_Unexpected_packet
push 0x548b04
push edi
call fcn.00432580
add esp, 0xc
push ebx
call fcn.0043e380
add esp, 4
test eax, eax
je 0x445765
push 5
push esi
call fcn.00446180
add esp, 8
mov eax, 0x2a
jmp 0x445767
Function at 0x44c200
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x587388]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x10
mov ebp, dword [esi + 0x1ac]
or edi, 0xffffffff
mov ebx, dword [esi]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x44c259
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push esi
call fcn.00433010
add esp, 8
cmp edi, 0xffffffff
jne 0x44c28e
push str.Error_accept__ing_server_connect
push ebx
call fcn.00432580
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ca2e2
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.004326a0
push 1
mov byte [esi + 0x398], 0
push edi
mov dword [esi + 0x1ac], edi
call fcn.00454130
mov byte [esi + 0x1b9], 1
add esp, 0x10
mov eax, dword [ebx + 0x210]
test eax, eax
je 0x44c2f5
push 1
push edi
push dword [ebx + 0x214]
call eax
add esp, 0xc
test eax, eax
je 0x44c2f5
push esi
call fcn.0044c7a0
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ca2e2
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ca2e2
add esp, 0x18
ret
Function at 0x44e050
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
lea eax, [ecx - 0xc8]
xor esi, esi
mov edx, dword [ebx]
cmp eax, 0x64
jb 0x44e07d
push str.Couldnt_set_desired_mode
push edx
call fcn.00432580
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x44e094
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.004326a0
add esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push edi
cmp eax, 0x13
jne 0x44e0af
push ebx
call fcn.0044df60
add esp, 4
mov esi, eax
pop edi
pop ebp
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x44e1bc
mov esi, dword [ebx]
xor edi, edi
cmp dword [esi + 0x3a0], 2
jne 0x44e124
mov eax, dword [esi + 0x4a44]
test eax, eax
je 0x44e124
cmp byte [eax], 0
je 0x44e124
push 0x2f
push eax
call fcn.00502830
add esp, 8
test eax, eax
je 0x44e124
push dword [esi + 0x4a44]
call dword [0x58722c]
mov edi, eax
add esp, 4
test edi, edi
je 0x44e176
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e101
sub ecx, edx
cmp byte [ecx + edi - 1], 0x2f
je 0x44e124
push 0x2f
push edi
call fcn.00502960
add esp, 8
test eax, eax
je 0x44e124
mov byte [eax + 1], 0
mov ecx, dword [esi + 0x410]
test ecx, ecx
jne 0x44e142
cmp byte [esi + 0x3b5], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x53eb3e
test edi, edi
mov eax, edx
cmovne eax, edi
push eax
mov eax, 0x548b94
cmove eax, edx
push eax
push ecx
push 0x5451d0
call fcn.00434a50
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x44e182
push edi
call dword [0x587224]
add esp, 4
pop edi
mov esi, 0x1b
pop ebp
mov eax, esi
pop esi
pop ebx
ret
push ebp
lea eax, [ebx + 0x618]
push 0x548b04
push eax
call fcn.00459d30
push edi
mov esi, eax
call dword [0x587224]
push ebp
call dword [0x587224]
add esp, 0x14
test esi, esi
jne 0x44e1e9
pop edi
pop ebp
mov eax, esi
mov dword [ebx + 0x68c], 0x1f
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x44e1d5
push 0xd
push 1
push ebx
call fcn.0044db10
add esp, 0xc
mov esi, eax
pop edi
pop ebp
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x44e1e9
push 0xe
push 1
push ebx
call fcn.0044db10
add esp, 0xc
mov esi, eax
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret
Function at 0x452500
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x587388]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00518a88
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x452565
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x452565
lea eax, [esp]
push eax
call dword [0x58722c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ca2e2
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor eax, eax
xor ecx, esp
call fcn.004ca2e2
add esp, 0x108
ret
Function at 0x4558b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 3
jne 0x4558d9
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4558c8
pop edi
pop esi
ret
push dword [ecx + 8]
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call eax
jmp 0x45590d
mov eax, dword [esi + 8]
test eax, eax
jne 0x4558fd
push 0x544990
push dword [ecx + 8]
call fcn.0050d814
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4558fd
pop edi
or eax, 0xffffffff
pop esi
ret
push eax
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call fcn.0050790e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x45592f
mov eax, dword [esi + 8]
test eax, eax
je 0x455929
push eax
call fcn.005070d1
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
ret
Function at 0x45bf90
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x45bfa0
sub esi, ecx
lea ebp, [esi + esi]
push ebp
call dword [0x587220]
mov edi, eax
add esp, 4
test edi, edi
jne 0x45bfc7
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x45bfe0
nop dword [eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x45bfd0
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x45c05a
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x45c04e
push 0
push ebp
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x587224]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45c080
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x587388]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x45c180
push esi
mov esi, dword [esp + 0x38]
push 8
mov dword [esp + 0x18], 0x208
mov dword [esp + 0x1c], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [esp + 0x24], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [esp + 0x25], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [esp + 0x26], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [esp + 0x27], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [esp + 0x28], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [esp + 0x29], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [esp + 0x20], 8
mov byte [esp + 0x2a], al
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2f], cl
call fcn.00460580
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x45c192
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ca2e2
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
push dword [esp + 8]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
xor ecx, esp
call fcn.004ca2e2
add esp, 0x24
ret
Function at 0x4605e0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004605f0

Function at 0x460870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x46087c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00460890

Function at 0x461450
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x587220]
mov edi, eax
add esp, 4
test edi, edi
jne 0x461477
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4614c2
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4614c6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x461526
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4614e5
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x461557
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x54fd40
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x54fd41
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x461530
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x46282f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x587388]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, eax
shr ecx, 0x10
mov dword [ebp - 0x214], edi
test cx, cx
je 0x462893
add edi, 0x28
cmp word [eax], 0x3c
mov ecx, edi
jne 0x462885
push eax
call fcn.0048b911
test al, al
jne 0x4628f0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ca2e2
leave
ret 8
push 0
push eax
call fcn.0048b95f
test al, al
je 0x462872
jmp 0x4628f0
push edx
push eax
call fcn.00464a29
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x462872
push esi
call fcn.00464a29
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4628c3
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x462872
push 0
push esi
add edi, 0x28
call fcn.00464a29
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.0048bc52
test al, al
je 0x462872
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.0048b80f
sub esp, 0x20c
mov esi, eax
mov edi, esp
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call fcn.00462543
jmp 0x462874
Function at 0x464f1d
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x464f40
or esi, 1
push 2
call edi
test ax, ax
jns 0x464f4c
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x464f58
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x464f64
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x46955d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x469589
cmp esi, dword [edi + 0x108]
je 0x469589
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x46966f
test eax, eax
je 0x4695f0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x148]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call fcn.00469096
and dword [edi + 0x108], 0
test esi, esi
je 0x46966f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x46966f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x108]
test al, al
je 0x46966f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x46966f
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x148]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call fcn.00469096
pop edi
pop esi
leave
ret 4
Function at 0x47171b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x11c]
mov edi, dword [ebp + 8]
test al, al
jne 0x47175c
mov eax, dword [edi]
sub eax, 9
cmp eax, 0xc
ja 0x47175c
mov ecx, dword [esi + 0x6d4]
push edi
test ecx, ecx
je 0x471750
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x47193b
mov ecx, esi
call fcn.0046ccdf
jmp 0x47193b
cmp dword [edi], 0x13
jne 0x471786
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x47193b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov ecx, esi
call fcn.004736f0
jmp 0x47193b
cmp dword [edi], 3
push ebx
push 0xd
pop ebx
jne 0x4717b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x4717b6
cmp word [edi + 0x14], bx
jne 0x4717b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov ecx, esi
call fcn.004736f0
jmp 0x47193a
cmp dword [edi], ebx
jne 0x471804
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x47193a
push 0x11
lea edi, [esi + 0x6c0]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x471847
mov ebx, dword [edi]
mov ecx, esi
call fcn.00472caf
mov ecx, edi
test al, al
je 0x471862
call dword [ebx + 0x10]
neg al
mov ecx, edi
sbb al, al
inc al
movzx eax, al
push eax
jmp 0x471864
mov ecx, dword [esi + 0x6d4]
test ecx, ecx
je 0x471821
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [eax + 0x458], 0
je 0x471821
cmp dword [edi], 0xf
je 0x4717ba
cmp dword [edi], 0xe
jne 0x47186c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x47193a
xor eax, eax
push eax
push eax
push eax
push str.itemclick
jmp 0x471916
mov esi, dword [edi]
mov ecx, edi
call dword [esi + 0x10]
neg al
mov ecx, edi
sbb al, al
inc al
movzx eax, al
push eax
call dword [esi + 0x18]
jmp 0x47193a
push 1
call dword [ebx + 0x14]
jmp 0x47193a
cmp dword [edi], 0xb
jne 0x4718ac
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x114]
test al, al
je 0x47193a
or dword [esi + 0x6d0], 8
mov ecx, esi
call fcn.004736f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
test al, al
je 0x47193a
xor eax, eax
push eax
push eax
push eax
push str.mouseenter
jmp 0x471916
cmp dword [edi], 0xa
jne 0x4718e2
mov eax, dword [esi + 0x6d0]
test al, 8
je 0x47193a
and eax, 0xfffffff7
mov ecx, esi
mov dword [esi + 0x6d0], eax
call fcn.004736f0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
test al, al
je 0x47193a
xor eax, eax
push eax
push eax
push eax
push str.mouseleave
jmp 0x471916
cmp dword [edi], 0x1b
jne 0x4718f6
push 0
push dword [edi + 0x1c]
push dword [edi + 0x18]
push str.timer
jmp 0x471916
cmp dword [edi], 0x14
jne 0x471921
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
test al, al
je 0x471921
push 0
push dword [edi + 0x1c]
push dword [edi + 0x18]
push str.menu
mov ecx, dword [esi + 0x44]
push esi
call fcn.00469096
jmp 0x47193a
mov ecx, dword [esi + 0x6d4]
push edi
test ecx, ecx
je 0x471933
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x47193a
mov ecx, esi
call fcn.0046a738
pop ebx
pop edi
pop esi
pop ebp
ret 4