joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542fb3
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov byte [esi + 0x38], 0
mov eax, dword [0x764c14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x542fed
mov eax, dword [0x764c14]
push 0
push esi
push 0x415
push dword [eax + 4]
call dword [0x71f7ac]
push 5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x5438f4
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, eax
cmp byte [edi + 0x39], 0
je 0x543911
push dword [edi + 0x1c]
push dword [0x764c0c]
call fcn.005b9e24
push 0x4e80
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea esi, [edi + 0x18c]
push eax
call fcn.00439cd9
call fcn.00459f7e
push 0x64
push dword [0x75dcbc]
call dword [0x71f77c]
push eax
push 0xfffffffffffffff2
push dword [edi + 0x1c]
call dword [0x71f7b0]
mov eax, dword [edi + 0x3c]
xor ecx, ecx
cmp eax, ecx
je 0x543980
cmp eax, 0x272c
je 0x543980
push 0x2000
push ecx
push ecx
movzx eax, ax
push ecx
push eax
push ecx
call dword [0x71f670]
push eax
call dword [0x71f780]
push eax
lea ecx, [esp + 0x14]
mov eax, esi
call fcn.005bee16
mov ebx, dword [0x71f7c4]
lea ebp, [edi + 0x178]
lea esi, [edi + 0x8c]
mov dword [esp + 0x10], 4
cmp dword [esi + 0x10], 0
jne 0x5439ad
push 0
push dword [ebp]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5439bf
cmp dword [esi + 0x14], 8
jb 0x5439b7
mov eax, dword [esi]
jmp 0x5439b9
mov eax, esi
push eax
push dword [ebp]
call ebx
add ebp, 4
add esi, 0x1c
dec dword [esp + 0x10]
jne 0x54399a
xor ebp, ebp
cmp dword [edi + 0x44], ebp
jle 0x543a16
push ebp
push 0x3e8
push 1
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [esp + 0x14]
push eax
mov esi, edi
call fcn.00543796
cmp dword [eax + 0x18], 8
jb 0x5439fa
mov eax, dword [eax + 4]
jmp 0x5439fd
add eax, 4
push eax
mov eax, dword [edi + 0x4c]
push dword [edi + eax*4 + 0x178]
call ebx
push ebp
push 1
lea ecx, [esp + 0x1c]
call fcn.00410779
cmp dword [edi + 0x68], 8
jb 0x543a21
mov eax, dword [edi + 0x54]
jmp 0x543a24
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x1c]
call ebx
cmp dword [edi + 0x84], 8
jb 0x543a38
mov eax, dword [edi + 0x70]
jmp 0x543a3b
lea eax, [edi + 0x70]
push eax
push dword [edi + 0x188]
call ebx
call fcn.00542fef
push ebp
push dword [edi + 0x1c]
call fcn.0057c20e
pop ecx
pop ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x544068
Capabilities:
Enumerate gui resources

Disassembly:
push 0x60
mov eax, 0x5e1464
call fcn.00523519
mov esi, ecx
mov dword [ebp - 0x50], esi
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00543c9f
cmp dword [ebp + 0x1c], ebx
je 0x54411a
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.0041186e
push 6
pop ecx
xor eax, eax
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
push eax
push 0x543fc6
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x4c], ebx
je 0x5440d5
mov edi, dword [ebp - 0x50]
mov byte [esi + 0x8c0], 1
mov esi, dword [ebp - 0x4c]
call fcn.00543d24
mov esi, edi
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x54], 7
call fcn.00410c09
push ecx
lea eax, [ebp - 0x6c]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
mov byte [ebp - 4], 2
call fcn.0040484b
push 0x769a24
mov ecx, esi
call fcn.004ba3bc
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00410779
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00410779
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00410779
call fcn.0052359c
ret 0x1c
Function at 0x54d126
Capabilities:
Hide graphical window

Disassembly:
mov ecx, esi
call fcn.0054cfb9
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
Function at 0x576d04
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x5e19fb
call fcn.005234b0
xor eax, eax
cmp byte [esi + 0x70], al
setne al
lea eax, [eax + eax + 0x291e]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004af5f0
mov edi, eax
and dword [ebp - 4], 0
mov ebx, dword [esi + 0x134]
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x576d56
cmp dword [edi + 0x18], 8
jb 0x576d4b
mov edi, dword [edi + 4]
jmp 0x576d4e
add edi, 4
push edi
push ebx
call dword [0x71f7c4]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00410779
mov al, byte [esi + 0x70]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
neg al
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0x158]
call edi
mov al, byte [esi + 0x70]
neg al
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
push dword [esi + 0x138]
call edi
mov al, byte [esi + 0x70]
neg al
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
push dword [esi + 0x150]
call edi
call fcn.00523588
ret

Function at 0x57a5f6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x57a626
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x57a621
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x57a64e
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x57a637
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.005229e0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x57a6ff
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x69c920]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x69c920]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x57a742
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, dword [esp + 8]
jne 0x57a74f
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x57a801
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
sub eax, 8
dec edi
jne 0x57a766
pop edi
test eax, eax
je 0x57a81a
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x69c920]
inc ecx
dec eax
jne 0x57a805
mov eax, esi
pop ebx
not eax
pop esi
ret
Function at 0x57cced
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5e1b81
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
and dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.00413890
mov ecx, ebx
neg ecx
sbb ecx, ecx
lea edx, [ebx + 0x20]
and ecx, edx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
lea esi, [eax + 4]
call fcn.00413737
lea eax, [esp + 0x1c]
push 0x27d2
push eax
call fcn.004b9340
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x57cd65
mov eax, dword [eax + 4]
jmp 0x57cd68
add eax, 4
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, 0x4e7c
push edi
push dword [ebx + 4]
mov dword [esp + 0x1c], eax
call esi
push dword [esp + 0x14]
push eax
call dword [0x71f7c4]
push 0
push 1
lea ecx, [esp + 0x24]
call fcn.00410779
push edi
push dword [ebx + 4]
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x4e80
push dword [ebx + 4]
call esi
push eax
lea esi, [ebx + 0x38]
call fcn.00439cd9
lea eax, [ebx + 0x5c]
push eax
lea eax, [ebx + 0x35]
call fcn.004446aa
push 0
push dword [ebx + 4]
call fcn.0057c20e
pop ecx
pop ecx
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
call fcn.0051d97d
pop ecx
mov dword [esp + 0x14], eax
and dword [esp + 0x68], 0
test eax, eax
je 0x57ce34
sub esp, 0x10
mov eax, 0x57c99a
mov dword [esp + 0x2c], eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebx
mov edi, esp
lea esi, [esp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x4c]
push eax
movsd dword es:[edi], dword [esi]
call fcn.00444702
mov byte [esp + 0x68], 1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x1c], 1
call fcn.0041dab1
jmp 0x57ce36
xor eax, eax
push eax
lea ecx, [ebx + 0x60]
mov dword [esp + 0x6c], 2
call fcn.0041d17f
or dword [esp + 0x68], 0xffffffff
test byte [esp + 0x18], 1
je 0x57ce5c
lea ecx, [esp + 0x3c]
call fcn.00447074
xor eax, eax
inc eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x57d022
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret

Function at 0x57d030
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
Function at 0x581a59
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x30]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
call fcn.0043b6d5
cmp dword [esi + 0x3c], ebx
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
jne 0x581b1e
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [esi + 0x40], eax
push dword [esi + 0x3c]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [ebp - 0x2c]
mov dword [esi + 0x44], eax
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push ebx
push ebx
push dword [esi + 0x3c]
call edi
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push 0xcc0020
push ebx
push ebx
push dword [esi + 0x3c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push ebx
push ebx
push dword [ebp + 8]
call edi
lea esi, [ebp - 0x10]
call fcn.00453741
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5823ca
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [0x71f71c]
push esi
mov esi, dword [ebx + 0x4b4]
test esi, esi
push edi
je 0x58248e
lea edi, [ebx + 0x9c]
call fcn.004454cc
mov eax, dword [eax]
cmp dword [eax + 0x28], 0x2887
jne 0x58248e
mov al, byte [0x75ed70]
mov esi, dword [ebx + 0x4b4]
neg al
sbb eax, eax
and eax, 5
mov dword [esp + 0x14], eax
call fcn.004454cc
mov eax, dword [eax]
push dword [esp + 0x14]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x722058
call fcn.004c9164
push eax
call fcn.004252c9
mov esi, dword [ebx + 0x4b4]
movzx eax, al
pop ecx
mov dword [esp + 0x14], eax
call fcn.004454cc
mov eax, dword [eax]
push dword [esp + 0x14]
mov eax, dword [eax]
push dword [eax]
call ebp
push 0x7676f0
mov ecx, 0x721f18
call fcn.004bb2e3
test al, al
je 0x58248e
push 0
call fcn.004c6622
test eax, eax
pop ecx
jne 0x58248e
mov esi, dword [ebx + 0x4b4]
call fcn.004454cc
mov eax, dword [eax]
mov eax, dword [eax]
push 0
push dword [eax]
call ebp
mov esi, dword [ebx + 0x4b0]
test esi, esi
je 0x5824fa
lea edi, [ebx + 0x9c]
call fcn.004454cc
mov eax, dword [eax]
cmp dword [eax + 0x28], 0x292c
jne 0x5824fa
mov al, byte [0x75ed70]
mov esi, dword [ebx + 0x4b0]
neg al
sbb eax, eax
and eax, 5
mov dword [esp + 0x14], eax
call fcn.004454cc
mov eax, dword [eax]
push dword [esp + 0x14]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.004c6622
test eax, eax
pop ecx
jne 0x5824fa
mov esi, dword [ebx + 0x4b0]
call fcn.004454cc
mov eax, dword [eax]
mov eax, dword [eax]
push 0
push dword [eax]
call ebp
push 0
push 0x64
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x583c5a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x6c
mov eax, 0x5e66d4
call fcn.00523519
mov ebx, dword [ebp + 8]
mov ecx, dword [0x71f704]
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
push 3
pop ecx
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x58], ecx
movzx ecx, cl
and ecx, 1
or ecx, 6
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x54], ecx
lea esi, [ebx + 0x5c]
mov dword [ebx], vtable.TeamViewer::COptions_Advanced.0
mov dword [esi], eax
mov dword [ebx + 0x60], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x64], ecx
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], eax
lea ecx, [ebx + 0x7c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [ebx + 0x8c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [ebx + 0x9c]
push 0x11
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, eax
call fcn.00423c0f
lea eax, [ebp - 0x70]
push eax
mov eax, esi
call fcn.004125d6
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x60], 0x2bc
call dword [0x71f5f8]
mov dword [ebx + 0x60], eax
and dword [ebx + 0x68], 0
mov eax, ebx
call fcn.0052359c
ret 8
Function at 0x5873e9
Capabilities:
Set socket configuration

Disassembly:
push 0x6f8
mov eax, 0x5e44ba
call fcn.00523519
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6b4], eax
lea eax, [ebp - 0x34c]
xor ebx, ebx
push eax
mov dword [ebp - 0x6c0], ebx
call fcn.005871e3
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x334], 8
mov eax, dword [ebp - 0x348]
push ebx
jae 0x58742f
lea eax, [ebp - 0x348]
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push ebx
push eax
call fcn.004ac9bc
mov edi, 0x721f18
mov ecx, edi
call fcn.004112c4
mov esi, 0x69dd8c
push esi
lea ecx, [ebp - 0x34c]
call fcn.0040614f
test eax, eax
jne 0x587473
mov ecx, dword [ebp - 0x6b4]
push esi
call fcn.004120e9
jmp 0x587626
sub esp, 0x1c
lea eax, [ebp - 0x34c]
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push eax
call fcn.0041186e
lea eax, [ebp - 0x700]
push eax
call fcn.004adf6c
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x5874a4
mov eax, dword [eax + 4]
jmp 0x5874a7
add eax, 4
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push ebx
push 1
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x6b8], eax
call fcn.004108b7
lea eax, [ebp - 0x6bc]
push eax
push dword [ebp - 0x6b8]
call sub.iphlpapi.dll_GetBestInterface
test eax, eax
je 0x5874fb
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push ebx
push str.Forwarding:_Best_interface_not_found
call fcn.004ac807
mov ecx, edi
call fcn.0041122b
jmp 0x587462
push 0x35c
lea eax, [ebp - 0x6b0]
push ebx
push eax
call fcn.00522720
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x4b0], eax
add esp, 0xc
lea eax, [ebp - 0x6b0]
push eax
call sub.iphlpapi.dll_GetIfEntry
test eax, eax
push ebx
je 0x587540
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push ebx
push str.Forwarding:_Interface_not_found
jmp 0x5874ea
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x330]
push eax
mov dword [ebp - 0x6c0], 0x31c
call sub.iphlpapi.dll_GetIpAddrTable
test eax, eax
je 0x587578
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push ebx
push str.Forwarding:_IP_address_table_not_found
jmp 0x5874ea
mov esi, dword [ebp - 0x330]
lea ecx, [ebp - 0x6e4]
call fcn.004ac634
xor eax, eax
cmp esi, ebx
mov byte [ebp - 4], 1
jbe 0x5875e5
lea ecx, [ebp - 0x328]
mov edx, dword [ecx]
cmp edx, dword [ebp - 0x6bc]
je 0x5875ad
inc eax
add ecx, 0x18
cmp eax, esi
jb 0x587599
jmp 0x5875e5
imul eax, eax, 0x18
mov eax, dword [ebp + eax - 0x32c]
mov ecx, eax
shr ecx, 0x18
push ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
push ecx
movzx ecx, ah
movzx eax, al
push ecx
push eax
lea eax, [ebp - 0x6e4]
push str._d._d._d._d
push eax
call fcn.004ad1c5
add esp, 0x18
push ebx
lea ecx, [ebp - 0x6e4]
call fcn.004acb45
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push ebx
push eax
call fcn.004ac9bc
mov ecx, edi
call fcn.004112c4
push dword [ebp - 0x6e4]
mov ecx, dword [ebp - 0x6b4]
call fcn.004120e9
lea ecx, [ebp - 0x6e4]
call fcn.004ac66a
push ebx
push 1
lea ecx, [ebp - 0x34c]
call fcn.00410779
mov eax, dword [ebp - 0x6b4]
call fcn.0052359c
ret
Function at 0x589a76
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esi + 0x445]
neg al
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push edi
sbb eax, eax
and eax, 5
mov ebp, eax
push ebp
push dword [esi + 0x570]
call ebx
push ebp
push dword [esi + 0x56c]
call ebx
push ebp
lea edi, [esi + 0x574]
push dword [edi]
call ebx
push 0xffffffffffffffff
push 0
call fcn.00437b49
pop edi
pop ebp
pop ebx
ret

Function at 0x589c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push ebx
push edi
lea edi, [esi + 0x604]
cmp byte [edi], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jne 0x589cb3
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.0054b43b
mov byte [ebp + 0xf], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call ebx
test eax, eax
je 0x589c78
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call ebx
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push dword [ebp - 4]
movzx ebx, ax
push dword [ebp - 8]
lea eax, [ebp - 0x18]
shr ebx, 0xf
push eax
and bl, 1
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
setne al
cmp byte [ebp + 0xf], 0
je 0x589cb1
test bl, bl
je 0x589cb1
test al, al
je 0x589cb1
xor eax, eax
inc eax
jmp 0x589cb3
xor eax, eax
mov byte [edi], al
pop edi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x58b606
Capabilities:
Get keyboard layout

Disassembly:
push 0x114
mov eax, 0x5e69cd
call fcn.005234b0
xor esi, esi
push esi
push str.Progman
push esi
push esi
call dword [0x71f724]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call edi
push esi
mov ebx, eax
call edi
cmp eax, ebx
je 0x58b6c8
push 0x100
push ebx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
push esi
push str.KeyboardLayout_changed_to:
lea ecx, [ebp - 0x30]
call fcn.004ac9bc
push esi
push ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], esi
call fcn.004ac7aa
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 1
call fcn.004adc57
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004acb45
push eax
lea ecx, [ebp - 0x120]
call fcn.00403e35
push eax
mov byte [ebp - 4], 3
call fcn.004b9585
pop ecx
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 2
call fcn.00401441
lea ecx, [ebp - 0x54]
call fcn.004ac66a
lea ecx, [ebp - 0x78]
call fcn.004ac66a
lea ecx, [ebp - 0x30]
call fcn.004ac66a
call fcn.00523588
ret

Function at 0x58be26
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0x722276], 0
push esi
je 0x58be4d
call fcn.005b767f
mov esi, eax
call fcn.005b76c0
test al, al
jne 0x58be4d
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x58be98
cmp byte [edi + 0x44b], 0
je 0x58be5b
call fcn.0058990e
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [edi + 4]
call esi
push 2
push dword [edi + 4]
call esi
push 3
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call esi
push 5
push dword [edi + 4]
call esi
push 6
push dword [edi + 4]
call esi
push 7
push dword [edi + 4]
call esi
push edi
call fcn.0058b929
xor eax, eax
pop esi
ret
Function at 0x59000f
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x70b744]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x4c
mov eax, 0x5e2f88
call fcn.005234b0
call fcn.004c1998
cmp eax, 0xa
jl 0x590146
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
xor ebx, ebx
test eax, eax
jne 0x590059
cmp byte [0x722275], bl
je 0x590146
lea eax, [ebp - 0x34]
push eax
call fcn.004c18d5
pop ecx
push ebx
push 0x6a392c
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.004acfec
lea eax, [ebp - 0x10]
push eax
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x59013e
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x10]
call dword [0x71f6dc]
test eax, eax
je 0x59013e
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004120e9
mov byte [ebp - 4], 1
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x5900ba
lea eax, [ebp + 4]
push ebx
push eax
lea ecx, [ebp - 0x58]
call fcn.004ac9bc
mov byte [ebp - 4], 2
mov eax, dword [eax]
push 1
push eax
lea ecx, [ebp - 0x34]
call fcn.004ad5c4
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.004ac66a
cmp esi, 0xffffffff
jne 0x590133
push 0x6a393c
lea ecx, [ebp]
call fcn.0040153d
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x590101
lea eax, [ebp + 4]
push ebx
push eax
call dword [0x71f61c]
push str.SAS.exe
lea ecx, [ebp]
call fcn.0040153d
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x590122
lea eax, [ebp + 4]
push ebx
push eax
lea ecx, [ebp - 0x34]
call fcn.004acb45
push eax
call dword [0x71f618]
push ebx
push 1
lea ecx, [ebp]
call fcn.00410779
lea ecx, [ebp - 0x34]
call fcn.004ac66a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0051d721
add ebp, 0x228
leave
ret