joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4484f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], bl
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov eax, esi
je 0x44851e
add eax, 1
cmp byte [eax], bl
jne 0x448517
sub eax, esi
lea ecx, [esp + 0x10]
je 0x448672
push esi
call fcn.0047cc30
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x448548
test al, 0x10
jne 0x44866e
push 0x20000
lea ecx, [esp + 0x1c]
call fcn.0047be00
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push esi
push ecx
push edx
call fcn.00434df0
mov esi, dword [esp + 0x28]
add esp, 0xc
cmp byte [esi], bl
mov edi, esi
je 0x4485cf
cmp byte [esi], 0x5c
jne 0x4485c3
mov bl, byte [esi + 1]
add esi, 1
push edi
lea ecx, [esp + 0x14]
mov byte [esi], 0
call fcn.0047cc30
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44859f
test al, 0x10
jne 0x4485bd
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4485bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44862f
mov byte [esi], bl
xor ebx, ebx
jmp 0x4485c6
add esi, 1
cmp byte [esi], 0
jne 0x448573
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.00445690
add esp, 8
push edi
lea ecx, [esp + 0x14]
call fcn.0047cc30
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4485fb
test al, 0x10
jne 0x44866e
mov ecx, dword [esp + 0x14]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44866e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x44866e
call esi
push eax
push edi
push str.CreateDirectory___s__NULL_:_GetLastError__:__d._n
push str.mu_make_sure_path_exists
push 0xc0a
jmp 0x448646
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateDirectory___s__NULL_:_GetLastError__:__d._n
push str.mu_make_sure_path_exists
push 0xbec
push str.._srcmu.cpp
call fcn.00434250
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.0047ca90
lea ecx, [esp + 0x18]
call fcn.0047ca90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.0047ca90
lea ecx, [esp + 0x18]
call fcn.0047ca90
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448c00
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x448c1a
mov eax, esi
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push eax
push 0x448b90
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 8]
push ecx
push str.best_window__08x_n
call fcn.00433c50
mov eax, dword [esp + 0x10]
add esp, 8
pop esi
add esp, 8
ret
Function at 0x449880
Capabilities:
Get hostname

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x4498d8
cmp word [esp + 4], 0
lea eax, [esp + 4]
je 0x4498b9
lea ecx, [ecx]
add eax, 2
cmp word [eax], 0
jne 0x4498b0
lea edx, [esp + 4]
push 0
sub eax, edx
sar eax, 1
push 1
push eax
mov eax, edx
push eax
call fcn.0047bb60
add esp, 0x10
add esp, 0x20c
ret
xor eax, eax
add esp, 0x20c
ret

Function at 0x4498f0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x449948
cmp word [esp + 4], 0
lea eax, [esp + 4]
je 0x449929
lea ecx, [ecx]
add eax, 2
cmp word [eax], 0
jne 0x449920
lea edx, [esp + 4]
push 0
sub eax, edx
sar eax, 1
push 1
push eax
mov eax, edx
push eax
call fcn.0047bb60
add esp, 0x10
add esp, 0x208
ret
xor eax, eax
add esp, 0x208
ret

Function at 0x449a50
Capabilities:
Get disk information

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x208
cmp byte [ecx], 0
mov eax, ecx
je 0x449a69
add eax, 1
cmp byte [eax], 0
jne 0x449a61
push esi
push 0
push 1
sub eax, ecx
push eax
push ecx
call fcn.0047c9e0
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
mov esi, eax
push 0x104
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x449af5
cmp word [esp + 4], 0
je 0x449af5
push esi
call fcn.004455d0
add esp, 4
cmp word [esp + 4], 0
lea eax, [esp + 4]
je 0x449ac9
jmp 0x449ac0
add eax, 2
cmp word [eax], 0
jne 0x449ac0
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x214]
push ecx
lea ecx, [esp + 8]
push edx
sub eax, ecx
sar eax, 1
push eax
mov edx, ecx
push edx
call fcn.0047bb60
add esp, 0x10
pop esi
add esp, 0x208
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push esi
mov edi, eax
call fcn.004455d0
add esp, 4
cmp edi, 3
pop edi
jne 0x449b1b
mov eax, dword [0x4b177c]
mov ecx, dword [eax + 0x1b8]
jmp 0x449b27
mov ecx, dword [0x4b177c]
mov ecx, dword [ecx + 0x1bc]
cmp byte [ecx], 0
mov eax, ecx
je 0x449b38
mov edi, edi
add eax, 1
cmp byte [eax], 0
jne 0x449b30
mov edx, dword [esp + 0x218]
push edx
mov edx, dword [esp + 0x218]
push edx
sub eax, ecx
push eax
push ecx
call fcn.0047aca0
add esp, 0x10
pop esi
add esp, 0x208
ret

Function at 0x449b60
Capabilities:
Get disk information

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx], 0
mov eax, ecx
je 0x449b78
jmp 0x449b70
add eax, 1
cmp byte [eax], 0
jne 0x449b70
push ebx
push ebp
push esi
push edi
push 0
push 1
sub eax, ecx
push eax
push ecx
call fcn.0047c9e0
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
add esp, 0x10
push 1
mov esi, eax
call edi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push 0
mov ebx, eax
mov eax, dword [esp + 0x28]
push eax
push ecx
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
mov ebp, eax
call fcn.004455d0
add esp, 4
push ebx
call edi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x449c50
Capabilities:
Get disk size

Disassembly:
mov ecx, dword [esp + 4]
cmp byte [ecx], 0
mov eax, ecx
je 0x449c68
jmp 0x449c60
add eax, 1
cmp byte [eax], 0
jne 0x449c60
push esi
push edi
push 0
push 1
sub eax, ecx
push eax
push ecx
call fcn.0047c9e0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0x10
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push esi
mov edi, eax
call fcn.004455d0
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x44a5c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
jle 0x44a5f3
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x18]
lea ebx, [ebx]
push 0
push esi
push edi
push ebx
call ebp
test eax, eax
jle 0x44a5fd
sub esi, eax
add edi, eax
test esi, esi
jg 0x44a5e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x44a610
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push edi
mov edi, dword [esp + 0x18]
push 2
add eax, 0xffffffff
push eax
push edi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x44a63c
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
test eax, eax
push esi
je 0x44a674
lea ecx, [eax + edi]
cmp edi, ecx
mov esi, edi
jae 0x44a674
lea ebx, [ebx]
lea eax, [esi + 1]
cmp eax, ecx
jae 0x44a665
cmp byte [esi], 0xd
jne 0x44a665
cmp byte [eax], 0xa
je 0x44a6fc
cmp byte [esi], 0xa
je 0x44a721
mov esi, eax
cmp esi, ecx
jb 0x44a650
mov eax, dword [esp + 0x20]
push 0
push 1
lea edx, [esp + 0x1b]
push edx
lea ecx, [edi + eax - 1]
push ebx
mov esi, edi
mov dword [esp + 0x30], ecx
call ebp
cmp eax, 0xffffffff
je 0x44a6f4
test eax, eax
je 0x44a746
mov al, byte [esp + 0x13]
cmp al, 0xd
jne 0x44a6d4
push 0
push 1
lea eax, [esp + 0x1b]
push eax
push ebx
call ebp
cmp eax, 0xffffffff
je 0x44a6f4
test eax, eax
je 0x44a746
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x44a74a
cmp esi, dword [esp + 0x20]
jae 0x44a6d4
mov byte [esi], 0xd
add esi, 1
cmp al, 0xa
je 0x44a74a
cmp esi, dword [esp + 0x20]
jae 0x44a6e3
mov byte [esi], al
add esi, 1
push 0
push 1
lea ecx, [esp + 0x1b]
push ecx
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x44a693
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, esi
sub ecx, edi
push 0
lea eax, [ecx + 2]
push eax
push edi
push ebx
mov dword [esp + 0x30], eax
call ebp
cmp eax, 0xffffffff
je 0x44a6f4
cmp eax, dword [esp + 0x20]
je 0x44a74a
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, esi
sub edx, edi
push 0
lea eax, [edx + 1]
push eax
push edi
push ebx
mov dword [esp + 0x30], eax
call ebp
cmp eax, 0xffffffff
je 0x44a6f4
cmp eax, dword [esp + 0x20]
je 0x44a74a
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp esi, edi
je 0x44a6f4
mov byte [esi], 0
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x44ac80
Capabilities:
Delete registry key

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 8]
call fcn.0047cbb0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp + 4]
mov esi, eax
call fcn.0047ca90
mov eax, esi
pop esi
add esp, 8
ret
jmp 0x448440

Function at 0x44bd70
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x498868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x44bdef
push ebp
push esi
push str.Everything
lea ecx, [esp + 0x14]
call fcn.0047cbb0
mov eax, dword [esp + 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x44bdea
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x44bde7
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
push str.create_service__d_n
call fcn.00433c50
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x44be30
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0xffffffffffffffff
push 0x498458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
push 2
push ebx
push ebx
mov byte [esp + 0x38], 2
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x44bf39
push ebp
push 0x8000
lea ecx, [esp + 0x14]
call fcn.0047be00
mov eax, dword [esp + 0x14]
mov byte [eax], 0x22
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add ecx, 0xffffffff
push ecx
add edx, 1
push edx
push ebx
call fcn.00447be0
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0xc
test eax, eax
jle 0x44bf35
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0x4a2554
push eax
push ecx
call fcn.0043c970
mov edx, dword [esp + 0x1c]
push str._svc
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.00434e70
mov ecx, dword [esp + 0x30]
add esp, 0x1c
push ecx
lea ecx, [esp + 0x24]
call fcn.0047cbb0
push str.Everything
lea ecx, [esp + 0x1c]
call fcn.0047cbb0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
push 2
push 0x110
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
je 0x44bf35
push eax
mov esi, 1
call ebp
push edi
call ebp
pop ebp
push esi
push str.create_service__d_n
call fcn.00433c50
add esp, 8
cmp esi, ebx
je 0x44bf5b
xor esi, esi
call fcn.0044bd70
test eax, eax
je 0x44bf5b
mov esi, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call fcn.0047ca90
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.0047ca90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x44bfa0
Capabilities:
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x4987c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
push 1
push ebx
push ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x44c02e
push ebp
push esi
push str.Everything
lea ecx, [esp + 0x14]
call fcn.0047cbb0
mov eax, dword [esp + 0x14]
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x44c029
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x44c021
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x44c026
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
push str.stop_service__d_n
call fcn.00433c50
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x44c060
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x498868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call fcn.0044bfa0
test eax, eax
je 0x44c0e8
push edi
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x44c0e7
push esi
push str.Everything
lea ecx, [esp + 0x14]
call fcn.0047cbb0
mov eax, dword [esp + 0x14]
push 0x10004
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x44c0e3
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x44c0e0
mov ebp, 1
push esi
call ebx
push edi
call ebx
pop esi
pop edi
push ebp
push str.delete_service__d_n
call fcn.00433c50
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x10]
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44cb80
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test al, al
jns 0x44cb97
mov edi, 4
push 0x11
call esi
test al, al
jns 0x44cba2
or edi, 1
push 0x12
call esi
test al, al
jns 0x44cbad
or edi, 2
push 0x5b
call esi
test al, al
jns 0x44cbb8
or edi, 8
push 0x5c
call esi
test al, al
jns 0x44cbc3
or edi, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x4534f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi], 0
je 0x45352a
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x4535a6
push 0
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0x18], eax
je 0x45359c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x4534b0
push 0
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
push 0
mov dword [esi + 0x1c], 0
call fcn.0048a41e
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x4535a6
mov edx, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x18]
push eax
call edi
pop edi
pop esi
ret
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x453a60
Capabilities:
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 0xa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.00458750
push eax
call fcn.0045b680
add esp, 0x30
ret
movzx eax, word [esp + 4]
add eax, 0xffff63bf
cmp eax, 6
ja case.default.0x453a6f
jmp dword [eax*4 + 0x453adc]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
ret
mov dword [esp + 4], 1
jmp 0x4539b0
mov dword [esp + 4], 0
jmp 0x4539b0
push 0
push 0
call fcn.00477580
add esp, 8
ret
cmp dword [0x4b047c], 0
je 0x453ab4
jmp fcn.0043fd20
jmp fcn.0043fe30
cmp dword [0x4b0398], 0
je 0x453ac7
jmp fcn.004385d0
jmp fcn.00439310
mov dword [esp + 4], 0
jmp fcn.0045f8f0

Function at 0x454680
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4546ac
push eax
push 0
push 0xa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.00458750
push eax
call fcn.0045b680
add esp, 0x30
ret
push esi
lea eax, [esp + 8]
push eax
push 0x4539f0
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [esp + 8]
test esi, esi
je 0x4546f8
mov ecx, dword [esi + 0x50]
push ecx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4546e3
mov ecx, esi
pop esi
jmp 0x456c60
mov edx, dword [esi + 0x50]
push edx
call fcn.00448c00
add esp, 4
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
push 0
push 0
push 0xa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.00458750
push eax
call fcn.0045b680
add esp, 0x30
pop esi
ret
mov eax, dword [ecx + 0x50]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
ret
Function at 0x455370
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test al, al
jns 0x455387
mov edi, 4
push 0x11
call esi
test al, al
jns 0x455392
or edi, 8
push 0x12
call esi
test al, al
jns 0x45539d
or edi, 0x20
push 1
call esi
test al, al
jns 0x4553a8
or edi, 1
push 4
call esi
test al, al
jns 0x4553b3
or edi, 0x10
push 2
call esi
test al, al
jns 0x4553be
or edi, 2
mov eax, edi
pop edi
pop esi
ret

Function at 0x4553d0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x498868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov edi, dword [esp + 0x20]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
add esi, 1
push esi
lea ecx, [esp + 0xc]
call fcn.0047caa0
mov eax, dword [esp + 8]
cmp esi, eax
jle 0x45541c
mov esi, eax
mov eax, dword [esp + 0xc]
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push esi
push ecx
push edx
push eax
call fcn.0047ba60
add esp, 0x10
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x455470
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x498868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov ebp, dword [esp + 0x24]
push ebp
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
lea esi, [edi + 1]
push esi
lea ecx, [esp + 0x10]
call fcn.0047caa0
mov eax, dword [esp + 0x10]
push esi
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0x10]
push edi
push ecx
push 0
push 0
call fcn.0047ba60
mov ebp, dword [esp + 0x38]
add esp, 0x10
mov esi, eax
push 0
lea edx, [esi + 1]
push edx
mov ecx, ebp
call fcn.0047be40
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
push edi
push eax
push esi
push ecx
call fcn.0047ba60
mov edx, dword [ebp + 4]
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esi + edx], 0
mov dword [esp + 0x1c], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x458570
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x498868
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [0x4b05ec]
xor ecx, ecx
cmp esi, ecx
je 0x4585b2
mov eax, dword [esp + 0x1c]
lea esp, [esp]
cmp dword [esi + 0x94], eax
je 0x4585c6
mov esi, dword [esi + 0x9c]
cmp esi, ecx
jne 0x4585a0
mov eax, dword [esp + 0x28]
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp dword [esi + 0x50], ecx
je 0x4585b2
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
push 0x20000
lea ecx, [esp + 8]
call fcn.0047be00
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
lea eax, [esp + 0x2c]
push eax
push ecx
push edx
call fcn.004528d0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x50]
push ecx
push edx
push eax
call fcn.00448d30
add esp, 0x1c
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x459b80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x50]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x459c0f
push ebx
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, edi
call fcn.004588c0
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_SetClipboardData]
je 0x459baf
push eax
push 0xf
call ebx
push 4
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x459c07
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x459bdb
push esi
mov dword [eax], 2
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x459be4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x459c07
mov ax, word [0x4b05e4]
test ax, ax
jne 0x459c00
push str.Preferred_DropEffect
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x4b05e4], ax
movzx ecx, ax
push esi
push ecx
call ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
mov edx, dword [edi + 0x50]
push 2
push 0x10
push edx
call dword [sym.imp.SHELL32.dll_SHShellFolderView_Message]
pop edi
ret