joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402470
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push ebx
mov edi, ecx
call dword [0x40d010]
or eax, eax
je 0x40251c
push esi
push eax
pop edx
push ebx
pop ecx
call fcn.00402a80
push eax
pop ebx
add esp, 4
or ebx, ebx
je 0x40251c
movzx ecx, word [ebx]
push 0
push 0
push 0
push 0
push ecx
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
mov esi, eax
test esi, esi
js 0x402525
mov eax, dword [edi]
pushfd
xor ecx, ecx
inc ecx
popfd
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4024e7
push esi
mov ecx, edi
call fcn.00402830
movzx eax, word [ebx]
push 0
push 0
push esi
push dword [edi]
push eax
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x402525
mov dword [ecx - 0xc], esi
mov ecx, dword [edi]
pop edi
mov byte [esi + ecx], 0
pop esi
push 1
pop eax
pushal
popal
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00402bb0
int3

Function at 0x407030
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
sub edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x40706c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407064
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40706e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407054
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407140
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x407154
sub eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40716f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x407702
Capabilities:
Authenticate hmac

Disassembly:
add byte [ebx + 2], ah
add dword [eax], eax
add byte [ecx], al
adc dword [eax], eax
jne 0x40770f
add dword [eax], eax
add byte [ecx], al
adc eax, dword [eax]
nop
add al, byte [ecx]
add byte [eax], al
add dword [0x103b300], ebx
add byte [eax + eax*4], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
cmp eax, 0x3306
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add al, bl
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], cl
add ah, dh
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add byte [0], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ebp + 8], bl
or byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add cl, ah
invalid
add byte [eax], al
add byte [eax], al
add al, 0
add eax, dword [eax]
add eax, 0x7000300
add byte [esi], al
add byte [eax], cl
add byte [esi], al
add byte [eax], al
add byte [eax], al
cmp al, 0x4d
outsd dx, dword [esi]
jne 0x40780a
add byte ds:[ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x407817
je 0x4077d9
dec ebp
popal
jae 0x407817
jne 0x407821
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x407818
imul ebp, dword [esi + 0x65], 0x78652e72
add byte gs:[ebx + 0x6f], al
outsb dx, byte [esi]
jae 0x407839
popal
outsb dx, byte [esi]
je 0x40783c
add byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x407840
outsd dx, dword [esi]
jo 0x407809
inc ebx
jo 0x407881
imul ebp, dword [edi + 0x6e], 0x646e6148
insb byte es:[edi], dx
add byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x407892
inc ebp
jb 0x407892
jo 0x4078ad
Function at 0x40776c
Capabilities:
Authenticate hmac

Disassembly:
add byte [ebx + 2], ah
add dword [eax], eax
add byte [ecx], al
adc dword [eax], eax
jne 0x40770f
add dword [eax], eax
add byte [ecx], al
adc eax, dword [eax]
nop
add al, byte [ecx]
add byte [eax], al
add dword [0x103b300], ebx
add byte [eax + eax*4], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
cmp eax, 0x3306
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add al, bl
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], cl
add ah, dh
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add byte [0], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ebp + 8], bl
or byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add cl, ah
invalid
add byte [eax], al
add byte [eax], al
add al, 0
add eax, dword [eax]
add eax, 0x7000300
add byte [esi], al
add byte [eax], cl
add byte [esi], al
add byte [eax], al
add byte [eax], al
cmp al, 0x4d
outsd dx, dword [esi]
jne 0x40780a
add byte ds:[ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x407817
je 0x4077d9
dec ebp
popal
jae 0x407817
jne 0x407821
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x407818
imul ebp, dword [esi + 0x65], 0x78652e72
add byte gs:[ebx + 0x6f], al
outsb dx, byte [esi]
jae 0x407839
popal
outsb dx, byte [esi]
je 0x40783c
add byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x407840
outsd dx, dword [esi]
jo 0x407809
inc ebx
jo 0x407881
imul ebp, dword [edi + 0x6e], 0x646e6148
insb byte es:[edi], dx
add byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x407892
inc ebp
jb 0x407892
jo 0x4078ad
Function at 0x4079e6
Capabilities:
Authenticate hmac

Disassembly:
popal
add byte fs:[ebx + 0x65], dl
je 0x407a3d
jb 0x407a58
outsd dx, dword [esi]
jb 0x407a5b
je 0x407a6d
inc ebx
insb byte es:[edi], dx
popal
jae 0x407a6c
add byte [edi + 0x65], al
je 0x407a41
jne 0x407a72
jb 0x407a67
outsb dx, byte [esi]
je 0x407a55
jb 0x407a76
arpl word [ebp + 0x73], sp
jae 0x407a0c
inc edi
je 0x407a60
jb 0x407a81
arpl word [ebp + 0x73], sp
jae 0x407a6e
outsd dx, dword [esi]
jb 0x407a85
imul ebp, dword [esi + 0x67], 0x53746553
imul edi, dword [edx + 0x65], 0x53007845
je 0x407a7b
jb 0x407a9c
arpl word [ebp + 0x73], sp
jae 0x407a89
outsd dx, dword [esi]
jb 0x407aa0
imul ebp, dword [esi + 0x67], 0x53746553
imul edi, dword [edx + 0x65], 0x2e007845
jp 0x407aa4
inc ebp
js 0x407a42
add byte [esi], ch
arpl word cs:[edi + ebp*2 + 0x72], si
arpl word [edi + ebp*2 + 0x72], si
add byte [esi + 0x61], dh
insb byte es:[edi], dx
jne 0x407ab2
pop edi
pop edi
add byte [ebp + 0x66], al
popal
jne 0x407ac2
insb byte es:[edi], dx
je 0x407a58
push ebx
inc ebp
dec ebp
pop edi
inc esi
inc ecx
dec ecx
dec esp
inc ebx
push edx
dec ecx
push esp
dec ecx
inc ebx
inc ecx
dec esp
inc ebp
push edx
push edx
dec edi
push edx
push ebx
add byte [ebx + 0x45], dl
dec ebp
pop edi
dec esi
dec edi
inc ecx
dec esp
dec ecx
inc edi
dec esi
dec ebp
inc ebp
dec esi
push esp
inc esi
inc ecx
push ebp
dec esp
push esp
inc ebp
pop eax
inc ebx
inc ebp
push eax
push esp
add byte [ebx + 0x45], dl
dec ebp
pop edi
dec esi
dec edi
inc edi
push eax
inc esi
inc ecx
push ebp
dec esp
push esp
inc ebp
push edx
push edx
dec edi
push edx
inc edx
dec edi
pop eax
add byte [ebx + 0x45], dl
push ebx
inc ebp
dec ebp
pop edi
dec esi
dec edi
dec edi
push eax
inc ebp
dec esi
inc esi
dec ecx
dec esp
inc ebp
inc ebp
push edx
push edx
dec edi
push edx
inc edx
dec edi
pop eax
add byte [ecx + 0x6c], al
insb byte es:[edi], dx
add byte [ebx + 0x6f], ah
outsb dx, byte [esi]
je 0x407b21
imul ebp, dword [esi + 0x65], 0x69614d72
outsb dx, byte [esi]
jb 0x407b12
popal
imul ebp, dword [esi], 0x65637845
add byte [ebp + 0x78], al
arpl word [ebp + 0x70], sp
invalid
imul ebp, dword [edi + 0x6e], 0x79725400
push esp
outsb dx, byte [esi]
dec esi
outsd dx, dword [esi]
push ebp
imul eax, dword [eax], 0x53726557

Function at 0x407ac8
Capabilities:
Authenticate hmac

Disassembly:
add byte [ebp + 0x78], al
arpl word [ebp + 0x70], sp
je 0x407b39
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [edx + esi*2 + 0x79], dl
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
push ebp
imul eax, dword [eax], 0x6f706552
Function at 0x40b0bc
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x40b0f6
arpl word [edi + 0x6d], bp
das
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [edx + eax*4], al
add dword [eax], eax
inc esp
xor edi, dword [esi]
pop eax
call 0xd9156610
jecxz 0x40b15f
std
invalid
or al, 0x68
pushal
out dx, eax
cmp cl, byte [eax + 0x70]
jmp 0x6f587e6
and ecx, ebp
sub edi, ecx
into
fimul dword [ecx + 0x59ad39c0]
shr dword [ecx], 1
mov byte [0xcc65390a], al
out dx, al
cld
jg 0x40b171
push ebx
notrack jmp 0x8bedf445
loop 0x40b175
adc al, 0x18
xor dword [esi + 0x65b3a8c6], esp
cmp eax, 0x775925a7
add esi, dword [ebx]
push 0xea746498
je 0x40b14c
shr dword [esi + ebp - 0x64], 0x12
das
pop esp
dec edi
mov byte [esi + 0x49dc0fcd], dl
adc byte [esi - 0x1ee1cedd], 0x99
xchg esi, eax
and esi, dword [ecx]
push ds
loope 0x40b110
adc dh, byte [edi + 0x3f33bc7c]
mov dword [0x4e291e13], eax
cmp dl, 0x78
and byte [ebx - 0x20f73257], 0xc3
mov byte [esi + esi - 0x74], ah
jp 0x40b175
jbe 0x40b1bc
xchg al, dh
jmp 0x8aa7c3ba
xlatb
or dword [esi - 0x66], edi
xchg ebp, eax
hlt
Function at 0x405dcc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4a1b84]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x47a296
call fcn.0044ec9e
mov esi, dword [ebp + 0x214]
xor ebx, ebx
push 0x4a3358
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
call fcn.00401059
push 0x206
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 1
mov word [ebp], bx
call fcn.0044f7a0
add esp, 0xc
push ebx
push 0x23
lea eax, [ebp]
push eax
push ebx
call dword [0x480340]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004030e7
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004059fa
push 0x5c
push eax
call fcn.004057ed
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 0xd], al
call fcn.00401027
cmp byte [ebp - 0xd], bl
je 0x405e7c
push 0x483ed8
mov ecx, esi
call fcn.00405a41
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044ec8f
add ebp, 0x20c
leave
ret

Function at 0x405fba
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4a1b84]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x47a32f
call fcn.0044ec9e
mov eax, dword [ebp + 0x218]
mov edi, dword [ebp + 0x214]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x21c]
xor ebx, ebx
push 0x206
mov dword [ebp - 0x20], eax
lea eax, [ebp + 2]
push ebx
push eax
mov word [ebp], bx
call fcn.0044f7a0
add esp, 0xc
push 0x4a3358
lea ecx, [ebp - 0x14]
call fcn.00401059
push ebx
push ebx
lea eax, [ebp]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [0x480340]
mov esi, eax
cmp esi, ebx
je 0x406091
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004030e7
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.004059fa
push 0x5c
push eax
call fcn.004057ed
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 0xd], al
call fcn.00401027
cmp byte [ebp - 0xd], bl
je 0x406075
push 0x483ed8
lea ecx, [ebp - 0x14]
call fcn.00405a41
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
call fcn.00405a41
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push edi
call fcn.00405288
add esp, 0xc
mov esi, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401027
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044ec8f
add ebp, 0x20c
leave
ret
Function at 0x406308
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x88
mov eax, 0x47a3ec
call fcn.0044ec9e
push dword [ebp + 8]
call dword [0x480384]
test eax, eax
je 0x4063ae
call dword [0x4803ac]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
call fcn.0040574c
push dword [eax]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004060c1
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x406364
push dword [ebp - 0x94]
call fcn.0044ee1c
pop ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
inc eax
push eax
push 2
call dword [0x4802d0]
mov esi, eax
push esi
call dword [0x4802d4]
push dword [ebp - 0x10]
push eax
call fcn.0044ff40
pop ecx
pop ecx
push esi
call dword [0x4802d8]
push esi
push 1
call dword [0x48037c]
call dword [0x4803c0]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401027
xor eax, eax
inc eax
jmp 0x4063b0
xor eax, eax
call fcn.0044ed76
ret

Function at 0x40b44f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [0x48002c]
test eax, eax
jne 0x40b4b7
cmp dword [ebp + 0x10], 1
je 0x40b490
cmp dword [ebp + 0x10], 2
je 0x40b490
push 0xd
pop eax
jmp 0x40b4b7
test edi, edi
mov eax, dword [ebp - 4]
je 0x40b4b1
test eax, eax
je 0x40b4ad
test al, 1
jne 0x40b48b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40b4b1
jmp 0x40b48b
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4132e3
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov esi, ecx
push dword [esi]
call dword [0x4803dc]
mov ecx, dword [esp + 0xc]
lea edi, [eax + 1]
push edi
call fcn.004017a2
push edi
push eax
push dword [esi]
call dword [0x4803d8]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.0041182c
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x413700
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x47b32d
call fcn.0044ec9e
mov esi, ecx
mov edi, 0x4a3358
push edi
lea ecx, [ebp - 0x10]
call fcn.00401059
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x14]
call fcn.00401059
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x3b0]
mov byte [ebp - 4], 1
call fcn.004132e3
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0x348]
call fcn.004132e3
mov edi, dword [ebp - 0x10]
push edi
push dword [esi + 4]
call fcn.00406308
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [0x480348]
lea ecx, [esi - 0x10]
call fcn.00401027
lea ecx, [edi - 0x10]
call fcn.00401027
call fcn.0044ed76
ret

Function at 0x4180cf
Capabilities:
Hide graphical window

Disassembly:
push esi
push dword [ecx + 0x10]
push dword [ecx + 0xc]
call dword [0x480420]
mov esi, eax
test esi, esi
je 0x4180f6
push esi
call dword [0x4803fc]
test eax, eax
je 0x4180f6
push 0
push esi
call dword [0x4803f4]
pop esi
ret
Function at 0x41b454
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x4804c8]
test eax, eax
je 0x41b49e
push 0x11
call dword [0x4804b0]
test ax, ax
jl 0x41b497
cmp dword [esp + 8], 0x1b
jne 0x41b47e
push 0
push 2
jmp 0x41b489
cmp dword [esp + 8], 0xd
jne 0x41b497
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [0x48038c]
and dword [esi + 0x300], 0
pop esi
ret 0xc

Function at 0x41d5f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [0x4803f8]
xor ebx, ebx
lea edi, [esi + 0x278]
cmp dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x41d623
call dword [0x480494]
mov dword [edi], ebx
mov eax, dword [esi + 0x26c]
cmp eax, ebx
je 0x41d6ef
push eax
call fcn.00414f9b
mov edi, eax
cmp edi, ebx
pop ecx
je 0x41d6a4
push 2
push ebx
push edi
mov ecx, esi
call fcn.0041d180
mov eax, dword [esi + 0x26c]
cmp eax, dword [esi + 0x268]
jne 0x41d6a4
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.0041174a
mov eax, dword [edi + 0x40]
cmp eax, ebx
je 0x41d693
cmp word [eax], bx
je 0x41d693
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [0x480348]
jmp 0x41d6a4
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x41d6a4
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [esi + 0x26c], ebx
je 0x41d6ef
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [0x480438]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [0x480410]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [0x48038c]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42137a
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x4804c8]
test eax, eax
je 0x4213c4
push 0x11
call dword [0x4804b0]
test ax, ax
jl 0x4213bd
cmp dword [esp + 8], 0x1b
jne 0x4213a4
push 0
push 2
jmp 0x4213af
cmp dword [esp + 8], 0xd
jne 0x4213bd
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [0x48038c]
and dword [esi + 0x300], 0
pop esi
ret 0xc

Function at 0x42495e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x4804c8]
test eax, eax
je 0x4249a8
push 0x11
call dword [0x4804b0]
test ax, ax
jl 0x4249a1
cmp dword [esp + 8], 0x1b
jne 0x424988
push 0
push 2
jmp 0x424993
cmp dword [esp + 8], 0xd
jne 0x4249a1
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [0x48038c]
and dword [esi + 0x300], 0
pop esi
ret 0xc
Function at 0x42502f
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [esp + 0xc], edi
jne 0x425064
mov eax, dword [0x4a3184]
cmp eax, edi
je 0x425052
mov ebx, dword [eax + 4]
jmp 0x425054
xor ebx, ebx
cmp ebx, edi
jne 0x425064
call dword [0x480364]
mov ebx, eax
cmp ebx, edi
je 0x425089
call dword [0x480490]
cmp ebx, eax
je 0x425089
push ebx
call dword [0x4804c8]
test eax, eax
je 0x425089
push edi
push ebx
call dword [0x4803b4]
mov dword [esp + 0xc], 1
push dword [esp + 0x1c]
mov ecx, esi
push ebx
mov dword [esi + 0x2fc], edi
call fcn.00424e19
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x4250b3
push 1
push ebx
call dword [0x4803b4]
xor eax, eax
jmp 0x42519a
push eax
call fcn.00423885
cmp dword [esp + 0x20], edi
pop ecx
mov dword [esp + 0x10], eax
jne 0x4250cd
push ebx
lea ecx, [esi + 4]
call fcn.0041adb0
cmp dword [esi + 0x2f8], edi
je 0x42513f
push ebp
push edi
call dword [0x4803b8]
push eax
call dword [0x4803bc]
mov ebp, eax
call dword [0x48027c]
push edi
push edi
push edi
push 0x2001
mov dword [esp + 0x30], eax
call dword [0x4804c0]
push 0x43
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x34]
call dword [0x480400]
cmp ebp, dword [esp + 0x20]
je 0x425122
push 1
push ebp
push dword [esp + 0x28]
call dword [0x480448]
push dword [esp + 0x1c]
call dword [0x48044c]
cmp ebp, dword [esp + 0x20]
je 0x42513e
push edi
push ebp
push dword [esp + 0x28]
call dword [0x480448]
pop ebp
mov ecx, esi
call fcn.00423ba2
push 0x97
push edi
push edi
push edi
push edi
push edi
push dword [esi + 4]
mov dword [esi + 0x2fc], edi
call dword [0x480400]
cmp dword [esp + 0xc], edi
je 0x425184
push 1
push ebx
call dword [0x4803b4]
cmp ebx, edi
je 0x425184
call dword [0x480364]
cmp eax, dword [esi + 4]
jne 0x425184
push ebx
call dword [0x480468]
push dword [esp + 0x10]
call fcn.00423885
pop ecx
push dword [esi + 4]
call dword [0x480390]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x425edf
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [0x4804c8]
test eax, eax
je 0x425f29
push 0x11
call dword [0x4804b0]
test ax, ax
jl 0x425f22
cmp dword [esp + 8], 0x1b
jne 0x425f09
push 0
push 2
jmp 0x425f14
cmp dword [esp + 8], 0xd
jne 0x425f22
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [0x48038c]
and dword [esi + 0x300], 0
pop esi
ret 0xc
Function at 0x4265b0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [esp + 0xc], edi
jne 0x4265e5
mov eax, dword [0x4a3184]
cmp eax, edi
je 0x4265d3
mov ebx, dword [eax + 4]
jmp 0x4265d5
xor ebx, ebx
cmp ebx, edi
jne 0x4265e5
call dword [0x480364]
mov ebx, eax
cmp ebx, edi
je 0x42660a
call dword [0x480490]
cmp ebx, eax
je 0x42660a
push ebx
call dword [0x4804c8]
test eax, eax
je 0x42660a
push edi
push ebx
call dword [0x4803b4]
mov dword [esp + 0xc], 1
push dword [esp + 0x1c]
mov ecx, esi
push ebx
mov dword [esi + 0x2fc], edi
call fcn.0042639a
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x426634
push 1
push ebx
call dword [0x4803b4]
xor eax, eax
jmp 0x42671b
push eax
call fcn.00423885
cmp dword [esp + 0x20], edi
pop ecx
mov dword [esp + 0x10], eax
jne 0x42664e
push ebx
lea ecx, [esi + 4]
call fcn.0041adb0
cmp dword [esi + 0x2f8], edi
je 0x4266c0
push ebp
push edi
call dword [0x4803b8]
push eax
call dword [0x4803bc]
mov ebp, eax
call dword [0x48027c]
push edi
push edi
push edi
push 0x2001
mov dword [esp + 0x30], eax
call dword [0x4804c0]
push 0x43
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x34]
call dword [0x480400]
cmp ebp, dword [esp + 0x20]
je 0x4266a3
push 1
push ebp
push dword [esp + 0x28]
call dword [0x480448]
push dword [esp + 0x1c]
call dword [0x48044c]
cmp ebp, dword [esp + 0x20]
je 0x4266bf
push edi
push ebp
push dword [esp + 0x28]
call dword [0x480448]
pop ebp
mov ecx, esi
call fcn.00425797
push 0x97
push edi
push edi
push edi
push edi
push edi
push dword [esi + 4]
mov dword [esi + 0x2fc], edi
call dword [0x480400]
cmp dword [esp + 0xc], edi
je 0x426705
push 1
push ebx
call dword [0x4803b4]
cmp ebx, edi
je 0x426705
call dword [0x480364]
cmp eax, dword [esi + 4]
jne 0x426705
push ebx
call dword [0x480468]
push dword [esp + 0x10]
call fcn.00423885
pop ecx
push dword [esi + 4]
call dword [0x480390]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x426e16
Capabilities:
Create process on windows

Disassembly:
push 8
xor eax, eax
push eax
push eax
push str.http:__bbs.duba.net_forum_6412_1.html
push str.open
push eax
call dword [0x480348]
ret

Function at 0x4287e5
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x47cb53
call fcn.0044ec9e
mov esi, ecx
push 0x4a3358
lea ecx, [ebp - 0x10]
call fcn.00401059
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
add esi, 0x40
push eax
mov ecx, esi
call fcn.004132e3
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], 0
jne 0x428825
push 0
push dword [esi]
call dword [0x4803f4]
lea ecx, [edi - 0x10]
call fcn.00401027
call fcn.0044ed76
ret