joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42faf0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
push edi
mov edi, edx
test edi, edi
mov esi, ecx
je 0x42fc37
cmp byte [edi], 0
je 0x42fc37
call fcn.0042eb00
test eax, eax
je 0x42fc2c
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.00420e60
lea edx, [esp + 8]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42fb30
mov ecx, dword [esi + 0x88c]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esi]
xor edx, edx
call fcn.0055a610
mov eax, dword [0x5f6590]
test eax, eax
je 0x42fb7c
mov ecx, dword [esi]
call fcn.00561000
test eax, eax
je 0x42fb7c
cmp dword [eax + 0x9fc], 0x80
jne 0x42fb7c
mov ecx, dword [esi]
lea edx, [esp + 8]
call fcn.0052c6a0
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42fb83
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x888]
cmp eax, 0xffffffff
mov dword [esi + 0x878], 0
mov dword [esi + 0x87c], 0
je 0x42fc2c
push 0
push edi
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, edi
je 0x42fc37
mov eax, dword [esi + 0x540]
test eax, eax
jne 0x42fc2c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42fc17
mov ecx, dword [esi + 0x874]
push 0
lea edx, [esp + 0xc]
call fcn.004d38f0
test eax, eax
je 0x42fbf2
mov dword [esi + 0x874], eax
mov eax, dword [0x5f92ec]
mov ecx, dword [esi + 0x888]
push 0x23
push 0x801d
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
xor edx, edx
mov ecx, 0x528
call fcn.0041f1a0
mov edx, eax
mov ecx, esi
call fcn.0042f110
pop edi
xor eax, eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret
Function at 0x4308a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x3e8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x430a3c
cmp dword [esi + 0x520], 3
je 0x4308ca
cmp dword [esi + 0x534], 2
jne 0x430a3c
mov edx, dword [esi + 0x888]
push 1
push 1
mov ecx, 0x801d
mov dword [esi + 0x878], ebx
mov dword [esi + 0x87c], ebx
call fcn.0056ab30
test eax, eax
jne 0x430a3c
push ebp
push edi
mov ecx, dword [esi + 0x880]
inc ecx
mov eax, ecx
cmp eax, 0x14
mov dword [esi + 0x880], ecx
jl 0x430929
mov edx, dword [esi + 0x888]
push ebx
push 1
mov ecx, 0x801d
mov dword [esi + 0x880], ebx
call fcn.0056ab30
test eax, eax
jne 0x430a3a
mov ecx, dword [esi + 0x888]
push ebx
push 0x3e6
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x4309ff
cmp edi, ebx
jle 0x430a2e
xor ebp, ebp
cmp edi, ebx
mov byte [esp + edi + 0x10], bl
jle 0x4309d3
mov edi, edi
mov al, byte [esp + ebp + 0x10]
cmp al, 9
je 0x4309ad
cmp al, 0xd
je 0x4309ad
cmp al, 0xa
jne 0x43097c
mov edx, dword [esi + 0x3ec]
mov byte [edx + esi + 4], bl
jmp 0x4309a0
mov ecx, dword [esi + 0x3ec]
mov byte [ecx + esi + 4], al
mov edx, dword [esi + 0x3ec]
inc edx
mov eax, edx
cmp eax, 0x3b5
mov dword [esi + 0x3ec], edx
jl 0x4309ad
mov byte [eax + esi + 4], bl
mov ecx, esi
mov dword [esi + 0x3ec], ebx
call fcn.00430550
mov eax, dword [0x5c81a0]
cmp eax, ebx
je 0x4309d3
cmp esi, eax
je 0x4309c6
mov eax, dword [eax + 0x890]
cmp eax, ebx
jne 0x4309b6
jmp 0x4309d3
cmp dword [esi + 0x520], ebx
je 0x4309d3
inc ebp
cmp ebp, edi
jl 0x430960
mov eax, dword [0x5c81a0]
cmp eax, ebx
je 0x430a3a
lea esp, [esp]
cmp esi, eax
je 0x4308f4
mov eax, dword [eax + 0x890]
cmp eax, ebx
jne 0x4309e0
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x430a3a
xor edx, edx
mov ecx, 0x527
call fcn.0041f1a0
mov edx, eax
mov ecx, esi
call fcn.0042f110
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
mov edx, 0x5a4bec
mov ecx, esi
call fcn.0042f110
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x3e8
ret
Function at 0x4325b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
push 1
mov dword [esi], 0
call edi
test ah, ah
jns 0x4325cb
or dword [esi], 1
push 0x11
call edi
test ah, ah
jns 0x4325d6
or dword [esi], 2
push 0x10
call edi
test ah, ah
jns 0x4325e1
or dword [esi], 4
push 0x12
call edi
test ah, ah
jns 0x4325ec
or dword [esi], 8
push 2
call edi
test ah, ah
jns 0x4325f7
or dword [esi], 0x10
push 4
call edi
test ah, ah
jns 0x432602
or dword [esi], 0x20
pop edi
pop esi
ret

Function at 0x432610
Capabilities:
Log keystrokes via polling

Disassembly:
movzx eax, cx
shr ecx, 0x10
mov dword [0x5bf558], ecx
mov dword [0x5bf554], eax
mov ecx, 0x5c882c
jmp fcn.004325b0
Function at 0x438010
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5c9eac]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5c9eac]
test eax, eax
je 0x43802e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x5c9eac], 0
ret

Function at 0x439420
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5c9eac]
test eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x439434
pop edi
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call ebx
mov eax, dword [0x5c9eac]
test eax, eax
je 0x439451
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x438040
push esi
mov dword [0x5c9eac], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x5f92e8]
push 0xb4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp edi, 1
mov ecx, eax
mov dword [0x5c9eac], ecx
jne 0x439491
mov edx, esi
call fcn.00437df0
jmp 0x43949b
mov edx, 4
call fcn.004254c0
mov ecx, dword [0x5c9eac]
push 8
push ecx
call ebx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov dword [0x5c9eb0], esi
mov eax, 1
pop esi
ret
Function at 0x44d900
Capabilities:
Get hostname
Set socket configuration

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
xor ebx, ebx
cmp eax, ebx
mov esi, edx
je 0x44d929
cmp byte [eax], 0x2d
jne 0x44d9fa
push 0x68
push eax
call fcn.005912e0
add esp, 8
test eax, eax
je 0x44d991
push 0x5a
push esi
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x44daae
mov edi, dword [esp + 0x18]
lea ebp, [edi + 0x840]
mov byte [esi + 0x5a], bl
mov edx, ebp
mov dword [edi + 0x908], ebx
mov byte [edi + 0x8a4], bl
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x44d960
mov ecx, ebp
call fcn.00537a90
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
push 0x33
push eax
push ebp
mov edx, 0x5a4bec
call fcn.00475c40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
mov ecx, dword [edi + 4]
push 0x75
push ecx
call fcn.005912e0
add esp, 8
test eax, eax
je 0x44d9fa
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.004f0d40
test eax, eax
jne 0x44d9c5
mov edx, dword [edi]
push 0xc
push ebx
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0xf2c]
mov eax, dword [esi]
imul ecx, ecx, 0x64
push edx
push ebx
push 0xa
push ebx
push eax
push ebx
push 5
push ebx
push ebx
lea ecx, [ecx + esi + 0xe00]
xor edx, edx
call fcn.00556880
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret 8
mov edx, dword [edi + 4]
cmp edx, ebx
je 0x44daae
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44da10
sub eax, esi
cmp eax, 0x5a
jbe 0x44da21
mov byte [edx + 0x5a], bl
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 4]
lea ecx, [ebp + 0x840]
mov esi, ecx
mov al, byte [edx]
inc edx
mov byte [esi], al
inc esi
cmp al, bl
jne 0x44da30
call fcn.00537a90
mov edx, dword [edi + 8]
cmp edx, ebx
je 0x44daae
mov eax, edx
lea esi, [eax + 1]
jmp 0x44da50
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x44da50
sub eax, esi
cmp eax, 0x5a
jbe 0x44da61
mov byte [edx + 0x5a], bl
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp + 0x908], eax
jne 0x44da8e
pop edi
pop esi
mov dword [ebp + 0x908], ebx
mov byte [ebp + 0x8a4], bl
pop ebp
mov eax, 1
pop ebx
ret 8
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [ebp + 0x908], eax
mov ecx, dword [edi + 8]
lea edx, [ebp + 0x8a4]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x44daa4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
Function at 0x455cc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
mov esi, edx
je 0x455e1f
cmp byte [ecx], 0x40
jne 0x455dc7
mov edx, dword [esp + 0x14]
call fcn.004f11f0
mov ebp, eax
test ebp, ebp
jne 0x455cfc
mov edx, dword [edi]
push 7
push eax
xor ecx, ecx
call fcn.004803b0
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [ebp + 0x760]
test ecx, ecx
lea eax, [ebp + 8]
je 0x455d0a
inc eax
push eax
push 0x5a565c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
mov edx, esi
mov ecx, 2
call fcn.005039a0
mov edx, 0xf
mov ecx, esi
call fcn.00537560
mov dl, 0xa
mov ecx, esi
call fcn.005377e0
mov dl, 0xd
mov ecx, esi
call fcn.005377e0
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x455d50
sub eax, edx
mov edi, eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, edi
jne 0x455db1
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp]
push 0x3b5
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, esi
nop
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x455da4
test cl, cl
je 0x455da0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x455da4
add eax, 2
add edi, 2
test cl, cl
jne 0x455d80
xor eax, eax
jmp 0x455da9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x455e3a
mov eax, dword [ebp]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
push 0x5a6ea4
push ecx
call fcn.005a299c
add esp, 8
neg eax
sbb eax, eax
mov ecx, dword [edi + eax*4 + 8]
add eax, 2
test ecx, ecx
je 0x455e1f
push edi
mov edx, esi
mov ecx, eax
mov byte [esi], 0
call fcn.005039a0
mov dl, 0xa
mov ecx, esi
mov byte [esi + 0xfa], 0
call fcn.005377e0
mov dl, 0xd
mov ecx, esi
call fcn.005377e0
mov edx, 0x5f2018
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x455e13
jmp 0x455e26
mov byte [0x5f2018], 0
mov ecx, dword [0x5f92ec]
call fcn.0048b570
test eax, eax
jne 0x455e3a
call fcn.0041f710
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
Function at 0x459ac0
Capabilities:
Extract resource via kernel32 functions
Get hostname
Log keystrokes via polling
Set socket configuration

Disassembly:
push esi
mov esi, ecx
call fcn.004f0af0
test eax, eax
jne 0x459adf
call fcn.004f0b80
mov esi, eax
test esi, esi
jne 0x459adf
xor ecx, ecx
pop esi
jmp fcn.0041f0a0
mov ecx, esi
call fcn.004f0d40
test eax, eax
jne 0x459aff
mov ecx, esi
call fcn.004f0df0
test eax, eax
jne 0x459aff
mov edx, esi
xor ecx, ecx
pop esi
jmp fcn.00459750
push esi
mov edx, 0xf
mov ecx, 0x5a4bec
call fcn.00458ae0
pop esi
ret
Function at 0x45acf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x1000
call fcn.005925e0
push esi
push edi
push 0x5a5664
push ecx
or esi, 0xffffffff
call fcn.00591d7c
mov edi, eax
add esp, 8
test edi, edi
je 0x45ad84
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00592b23
add esp, 0x10
test eax, eax
jbe 0x45ad75
lea esp, [esp]
xor ecx, ecx
test eax, eax
jbe 0x45ad55
xor edx, edx
mov dl, byte [esp + ecx + 8]
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x5bf568]
shr esi, 8
xor esi, edx
inc ecx
cmp ecx, eax
jb 0x45ad36
cmp eax, 0x1000
jb 0x45ad75
push edi
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00592b23
add esp, 0x10
test eax, eax
ja 0x45ad30
test byte [edi + 0xc], 0x20
push edi
je 0x45ad8f
call fcn.00591c49
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x1000
ret
call fcn.00591c49
add esp, 4
mov eax, esi
pop edi
not eax
pop esi
add esp, 0x1000
ret

Function at 0x45adb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
push edi
mov edi, ecx
jg 0x45adbb
xor eax, eax
pop edi
ret
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jle 0x45ade3
xor ecx, ecx
mov cl, byte [esi + edi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5bf568]
shr eax, 8
xor eax, ecx
inc esi
cmp esi, edx
jl 0x45adc5
pop esi
not eax
pop edi
ret
Function at 0x45adf0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0x2210
call fcn.005925e0
mov edx, 0x20
mov ecx, str.8872df8e01734144s
call fcn.00420430
cmp eax, 0x73824a00
jne 0x45ae1c
mov eax, 3
add esp, 0x2210
ret
mov ecx, dword [0x5f92e8]
push 0x104
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45ae3e
add esp, 0x2210
ret
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x18]
push 0x5a5664
push edx
call fcn.00591d7c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x14], edi
je 0x45af7b
push 0x5a7608
call fcn.005915c3
push edi
push 0x2000
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x22c]
push 1
push eax
or ebp, 0xffffffff
xor esi, esi
call fcn.00592b23
add esp, 0x14
test eax, eax
jbe 0x45af25
xor ebx, ebx
test eax, eax
jbe 0x45aeea
jmp 0x45aea0
cmp esi, dword [esp + 0x10]
jb 0x45aec7
mov ecx, str.8872df8e01734144s
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x45aeb0
mov edx, dword [esp + 0x10]
sub ecx, edi
mov edi, dword [esp + 0x14]
add ecx, edx
cmp esi, ecx
jb 0x45aee4
xor ecx, ecx
mov cl, byte [esp + ebx + 0x220]
xor ecx, ebp
and ecx, 0xff
mov edx, dword [ecx*4 + 0x5bf568]
shr ebp, 8
xor ebp, edx
inc esi
inc ebx
cmp ebx, eax
jb 0x45aea0
cmp eax, 0x2000
jb 0x45af25
push 1
push 0xffffffffffffffce
push edi
call fcn.00592bfe
add esp, 0xc
test eax, eax
push edi
jne 0x45af73
push 0x2000
lea eax, [esp + 0x228]
push 1
push eax
sub esi, 0x32
call fcn.00592b23
add esp, 0x10
test eax, eax
ja 0x45ae95
test byte [edi + 0xc], 0x20
push edi
jne 0x45af73
call fcn.00591c49
not ebp
push ebp
lea ecx, [esp + 0x124]
push str._08lX
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 8
lea edx, [esp + 0x130]
push edx
push str.8872df8e01734144s
call fcn.005a2a05
add esp, 0x1c
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
inc eax
add esp, 0x2210
ret
call fcn.00591c49
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2210
ret
Function at 0x473da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x473e57
push 2
mov dword [ebx], 0
mov eax, dword [0x5f92e8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x5f92e8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x473e57
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x473e55
mov edx, dword [0x5f92ec]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x473e55
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x473e24
movzx ecx, word [esi + 0xe]
lea eax, [ecx - 1]
cmp eax, 7
ja case.0x473e12.3
movzx eax, byte [eax + 0x473e64]
jmp dword [eax*4 + 0x473e5c]
mov eax, 1
shl eax, cl
jmp 0x473e24
xor eax, eax
lea ecx, [eax*4]
movzx eax, word [esi]
movzx edx, cx
push 0
mov ecx, esi
push esi
add ecx, edx
add eax, ecx
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebx], eax
mov edx, dword [0x5f92ec]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
ret

Function at 0x473e70
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x28
push ebp
mov ebp, ecx
test ebp, ebp
push edi
mov edi, edx
je 0x473f5d
lea eax, [esp + 0x18]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x473f5d
push esi
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x473f52
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x473f48
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call ebp
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x473f35
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x14], eax
je 0x473f2e
push eax
push esi
call ebp
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push 0xcc0020
push ecx
mov ecx, dword [edi + 8]
push edx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x18]
push edx
push esi
call ebp
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x1c]
push eax
push ebx
call ebp
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [esp + 0x10]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
add esp, 0x28
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x28
ret
Function at 0x477a30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ebx
push esi
lea eax, [esp + 0xc]
push eax
mov bl, dl
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [esp + esi + 0xc]
lea eax, [esp + esi + 0xc]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0xf], cl
mov byte [eax], bl
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x477a70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x114
push esi
lea eax, [esp + 0x18]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x477aa7
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x477ab1
cmp eax, 2
je 0x477ab1
xor eax, eax
pop esi
add esp, 0x114
ret
movzx eax, word [esp + 4]
pop esi
add esp, 0x114
ret
Function at 0x47e1e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x84
push esi
mov esi, ecx
test esi, esi
mov dword [esp + 4], edx
mov dword [esp + 8], esi
je 0x47e35e
cmp edx, 1
jne 0x47e249
mov edx, 0x64
lea ecx, [esp + 0x24]
call fcn.00420e60
push 0x63
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [0x5eeecc]
test eax, eax
je 0x47e241
lea ecx, [esp + 0x24]
push str.RichEdit20A
push ecx
call fcn.005a299c
add esp, 8
test eax, eax
mov dword [esp + 4], 2
je 0x47e249
mov dword [esp + 4], 0
push ebx
push ebp
push edi
mov ecx, esi
xor ebx, ebx
call fcn.005612d0
mov ecx, eax
call fcn.00561000
test eax, eax
mov dword [esp + 0x18], eax
je 0x47e26a
mov ebx, dword [eax + 0xa0c]
mov ebp, dword [esp + 0x9c]
test ebp, ebp
jle 0x47e315
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x10], 2
jne 0x47e347
xor eax, eax
cmp ebx, 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], eax
jne 0x47e2c8
mov dword [esp + 0x24], 0x4b0
jmp 0x47e2d5
mov ecx, dword [esp + 0x18]
call fcn.0048f950
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x20]
push ecx
push 0x45e
push edx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x47e347
cmp ebx, 2
jne 0x47e33d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
mov ecx, esi
call fcn.005586f0
mov edi, eax
test edi, edi
jne 0x47e32c
xor ebx, ebx
jmp 0x47e280
mov eax, dword [esp + 0x98]
pop edi
pop ebp
pop ebx
mov byte [eax], 0
pop esi
add esp, 0x84
ret 8
push ebp
push edi
push esi
call fcn.005911a0
push edi
call fcn.0059112a
add esp, 0x10
mov byte [esi + ebp - 1], 0
cmp byte [esi], 0
jne 0x47e35b
mov ecx, dword [esp + 0x14]
push esi
push ebp
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov byte [esi + ebp - 1], 0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x84
ret 8
Function at 0x480210
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, edx
mov edi, esi
mov dword [esp + 0x14], ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x480224
mov eax, 0x5bfa54
sub edi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x480235
sub eax, edx
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x10], 0
je 0x4802c7
test edi, edi
jle 0x4802c7
mov ecx, esi
call fcn.0047fd40
mov ecx, esi
call fcn.0047fd80
movzx ecx, byte [edi + esi - 1]
dec edi
sub ecx, 0x78
test ecx, ecx
jle 0x48026d
sub edi, ecx
movzx eax, byte [edi + esi - 1]
dec edi
sub eax, 0x6e
dec edi
mov dword [esp + 0x10], eax
movzx eax, byte [edi + esi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [edi + esi], 0
jle 0x48028e
sub eax, ebp
mov edi, esi
lea edx, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x480293
sub edi, edx
test eax, eax
jl 0x480364
cmp eax, ebp
jg 0x480364
xor ecx, ecx
test edi, edi
jle 0x4802c7
mov dl, byte [eax + 0x5bfa54]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x4802c2
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x4802b2
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4802d0
sub eax, edx
lea ecx, [eax - 1]
test ecx, ecx
jle 0x4802fb
dec ecx
shr ecx, 1
lea eax, [esi + 1]
inc ecx
mov dl, byte [eax - 1]
mov bl, byte [eax]
mov byte [eax - 1], bl
mov byte [eax], dl
add eax, 2
dec ecx
jne 0x4802e7
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.0047fd80
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x480325
lea ebx, [ebx]
mov dl, byte [eax + 0x5bfa54]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x480320
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x480310
test ebx, ebx
je 0x480399
xor ecx, ecx
xor ebx, ebx
test edi, edi
jle 0x480350
movzx eax, byte [ebx + esi]
add ecx, eax
cmp ecx, 0x1e
jl 0x48034b
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, edi
jl 0x480331
cmp ecx, dword [esp + 0x10]
je 0x480399
cmp dword [esp + 0x14], 1
jne 0x480388
push 0
call fcn.005949a6
cmp ebx, 1
jne 0x480370
push 0
call fcn.005949a6
mov eax, dword [str.None]
mov dword [esi], eax
mov cl, byte [0x5a8088]
pop edi
mov byte [esi + 4], cl
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [str.None]
mov dword [esi], ecx
mov dl, byte [0x5a8088]
mov byte [esi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x482360
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3e8
push esi
mov esi, edx
test esi, esi
push edi
mov edi, ecx
je 0x482420
cmp byte [esi], 0
je 0x482420
mov edx, 0x3e7
lea ecx, [esp + 8]
call fcn.00420e60
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482393
mov eax, dword [edi + 0x540]
test eax, eax
je 0x4823e9
mov ecx, dword [edi + 0x88c]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [edi]
xor edx, edx
call fcn.0055a610
mov eax, dword [0x5f6590]
test eax, eax
je 0x4823e9
mov ecx, dword [edi]
call fcn.00561000
test eax, eax
je 0x4823e9
cmp dword [eax + 0x9fc], 0x80
jne 0x4823e9
mov ecx, dword [edi]
lea edx, [esp + 8]
call fcn.0052c6a0
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4823f0
sub eax, edx
push 0
mov esi, eax
mov eax, dword [edi + 0x888]
push esi
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x3e8
ret
pop edi
mov eax, 1
pop esi
add esp, 0x3e8
ret