joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7bfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x1c
call fcn.0049018f
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x435d0b
mov ecx, eax
call fcn.004472f0
mov esi, eax
mov eax, dword [esp + 0x2c]
push esi
push eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00447370
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
add esp, 8
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x1c]
add edi, 0x1044
push esi
mov dword [esi + 8], edi
push edx
mov edx, dword [ecx + 4]
push 0x500
push eax
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x435e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x1c
mov dword [esp + 0x18], 1
call fcn.0049018f
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x435e64
mov ecx, eax
call fcn.004472f0
mov esi, eax
jmp 0x435e66
xor esi, esi
add edi, 0x1044
push esi
mov dword [esi + 8], edi
or edi, 0xffffffff
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x1c], 1
call fcn.00447370
mov ecx, dword [esp + 0x34]
push esi
push ecx
call fcn.00447440
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 0x10
or ah, 1
push esi
push edx
mov edx, dword [ecx + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [esp + 0x28]
mov byte [esp + 0x14], 0
call fcn.0048fb71
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], edi
call fcn.0048fb71
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x4364e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a7d0b
push eax
mov dword fs:[0], esp
sub esp, 0x104
lea eax, [esp + 4]
push esi
push edi
push 0xff
mov edi, ecx
push eax
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0xc]
lea esi, [edi + 0x5c4]
push ecx
mov ecx, esi
call fcn.0048fcfa
mov esi, dword [esi]
mov eax, dword [esi - 8]
test eax, eax
je 0x436580
push esi
call sub.WSOCK32.dll_gethostbyname
mov edx, dword [0x4d93ac]
mov dword [esp + 8], edx
test eax, eax
mov dword [esp + 0x114], 0
je 0x43656c
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
add edi, 0x5c8
mov eax, dword [eax]
mov cl, byte [eax + 1]
mov dl, byte [eax]
push ecx
push edx
push 0x4d7868
push edi
call fcn.004883fa
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esp + 0x114], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x437630
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1ec]
test eax, eax
je 0x437681
dec eax
je 0x43766c
dec eax
je 0x437659
sub eax, 2
jne 0x437675
call fcn.0043be10
mov dword [esi + 0x1ec], 0
pop esi
ret
mov ecx, esi
call fcn.0043b9f0
mov dword [esi + 0x1ec], 0
pop esi
ret
push 0
mov ecx, esi
call fcn.004376d0
mov dword [esi + 0x1ec], 0
pop esi
ret
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [0x4ddea0], 1
call edi
push 0x10
mov ebx, eax
call edi
pop edi
test bx, bx
pop ebx
jl 0x4376b4
test ax, ax
jl 0x4376c2
push 0
mov ecx, esi
call fcn.004376d0
pop esi
ret
test ax, ax
jge 0x4376c2
mov ecx, esi
call fcn.0043be10
pop esi
ret
mov ecx, esi
call fcn.0043b9f0
pop esi
ret
Function at 0x437cb0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a7ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [ecx + 0x1c]
mov ecx, dword [0x4dd8ec]
push esi
add ecx, 0x80
push edi
mov dword [esp + 0xc], 0x58
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 7
call fcn.0049ebe0
mov eax, dword [eax + 8]
push 0xb2
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x4db730
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x403
call fcn.0048fbdf
mov edx, dword [0x4de004]
lea ecx, [esp + 8]
push edx
push 0x104
push 0x104
mov dword [esp + 0x78], 0
call fcn.0048ffa1
push eax
push 0x4d54d0
push str.BorwsCaption
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [esp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
lea ecx, [esp + 8]
mov dword [esp + 0x6c], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x438710
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
lea eax, [esp + 8]
push ebp
push eax
mov ebp, 0x104
push str.SoftwareMicrosoftInternet_ExplorerMain
push connect
xor ebx, ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x438747
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0xc]
push esi
lea ecx, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push str.Display_Inline_Images
push eax
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x4d6c7c
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x43879a
test cl, cl
je 0x438796
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x43879a
add eax, 2
add esi, 2
test cl, cl
jne 0x438776
xor eax, eax
jmp 0x43879f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4387a8
mov ebx, 0x10
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.Display_Inline_Videos
push edx
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x4d6c7c
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4387f3
test cl, cl
je 0x4387ef
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4387f3
add eax, 2
add esi, 2
test cl, cl
jne 0x4387cf
xor eax, eax
jmp 0x4387f8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4387ff
or ebx, 0x20
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.Play_Background_Sounds
push edx
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x4d6c7c
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x43884a
test cl, cl
je 0x438846
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x43884a
add eax, 2
add esi, 2
test cl, cl
jne 0x438826
xor eax, eax
jmp 0x43884f
sbb eax, eax
sbb eax, 0xffffffff
pop edi
pop esi
test eax, eax
jne 0x438858
or ebx, 0x40
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x4389c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x4dbcb4]
push ebx
push esi
push edi
mov ebx, 1
xor edi, edi
test bl, al
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], edi
jne 0x438a19
or al, bl
push 0x4db730
mov ecx, 0x4dbcb0
mov byte [0x4dbcb4], al
call fcn.0048fbdf
push 0x438b10
call fcn.00479794
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], edi
push eax
call fcn.00488c1b
mov ecx, dword [eax]
mov edx, dword [esi + 0x60c]
push ecx
mov dword [ebp - 0x14], ecx
mov eax, esp
mov dword [ebp - 0x18], esp
lea ecx, [ebp - 0x14]
mov dword [eax], edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00438af0
cmp dword [eax], 5
jge 0x438a54
mov ecx, dword [0x4dbcb0]
cmp dword [ecx - 8], ebx
jge 0x438ab6
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x60c], edx
mov eax, dword [esi + 0x11c0]
cmp eax, edi
je 0x438a88
mov eax, dword [0x4dde98]
cmp eax, edi
je 0x438a88
push edi
call eax
push eax
push str._d__
push 0x4dbcb0
call fcn.004883fa
add esp, 0xc
jmp 0x438abd
push 0x4dbcb8
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [0x4dbcc4]
shr eax, 0x14
push eax
push 0x4d7908
push 0x4dbcb0
call fcn.004883fa
add esp, 0xc
jmp 0x438abd
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
push 0x4dbcb0
mov ecx, esi
call fcn.0048f8e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438b20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x4dbcac]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
test al, 1
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
jne 0x438b77
or al, 1
push 0x4db730
mov ecx, 0x4dbca8
mov byte [0x4dbcac], al
call fcn.0048fbdf
push 0x438cf0
call fcn.00479794
add esp, 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.00488c1b
mov ecx, dword [eax]
mov edx, dword [esi + 0x610]
push ecx
mov dword [ebp - 0x18], ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
lea ecx, [ebp - 0x18]
mov dword [eax], edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00438af0
mov edi, dword [eax]
mov edx, 5
cmp edi, edx
jle 0x438bef
mov eax, dword [0x4dbca8]
mov esi, str.127.0.0.1
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x438bdb
test cl, cl
je 0x438bd7
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x438bdb
add eax, 2
add esi, 2
test cl, cl
jne 0x438bb7
xor eax, eax
jmp 0x438be0
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, ebx
je 0x438beb
mov edx, 0x14
cmp edi, edx
jg 0x438bff
mov ecx, dword [0x4dbca8]
cmp dword [ecx - 8], 1
jge 0x438cbf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0x4ddcf8
mov byte [ebp - 4], 1
mov dword [eax + 0x610], edx
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
cmp edi, ebx
je 0x438cbf
mov ecx, dword [edi + 0xc]
cmp dword [ecx], ebx
je 0x438cbf
mov edx, dword [edi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x438cc6
mov ecx, 0x4dbca8
call fcn.0048fafc
push 0x4db730
lea ecx, [ebp - 0x14]
call fcn.0048fbdf
mov byte [ebp - 4], 2
xor esi, esi
movsx eax, word [edi + 0xa]
cmp esi, eax
jge 0x438ca1
test esi, esi
jle 0x438c73
push 0x4d5710
mov ecx, 0x4dbca8
call fcn.0048ff4d
mov ecx, dword [edi + 0xc]
xor eax, eax
mov edx, dword [ecx + ebx*4]
lea ecx, [ebp - 0x14]
mov al, byte [edx + esi]
push eax
push 0x4d6198
push ecx
call fcn.004883fa
add esp, 0xc
lea edx, [ebp - 0x14]
mov ecx, 0x4dbca8
push edx
call fcn.0048ff89
inc esi
jmp 0x438c58
lea ecx, [ebp - 0x14]
inc ebx
mov byte [ebp - 4], 1
call fcn.0048fb71
jmp 0x438c2e
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
push 0x4dbca8
mov ecx, esi
call fcn.0048f8e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x439300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a8100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0049ebe0
mov eax, dword [eax + 4]
add edi, 0x4d8
push edi
lea esi, [eax + 0xf0]
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0048fda0
push 0x4d5558
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.0048fe06
mov edi, dword [esp + 0x30]
lea edx, [esp + 8]
push edi
push eax
push edx
mov byte [esp + 0x34], 1
call fcn.0048fe06
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.0048fb71
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.0048fb71
push ecx
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0048f8e6
call fcn.0040feb0
add esp, 4
test eax, eax
jne 0x439458
push str.default
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.0048fe06
push 0x4d5558
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x34], 5
call fcn.0048fe06
push edi
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x30], 6
push eax
call fcn.0048fe06
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 7
call fcn.0048fcaa
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 6
call fcn.0048fb71
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 5
call fcn.0048fb71
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 3
call fcn.0048fb71
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0048f8e6
call fcn.0040feb0
add esp, 4
test eax, eax
jne 0x439458
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.0048fb71
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov eax, dword [esp + 8]
push 0x2050
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret 4

Function at 0x4395f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a8138
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0xbd4]
push 0
push 0x431
push eax
call ebx
push eax
call fcn.004895d1
test eax, eax
je 0x439636
mov ecx, eax
call fcn.004895bb
lea ecx, [esp + 0xc]
call fcn.0048953f
push 1
push 1
push 0xff
push 0x10
push 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00489604
push str.Go.bmp
mov ecx, esi
call fcn.00439300
mov edx, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0xff00ff
neg eax
sbb eax, eax
push edi
and eax, edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0xbd4]
push ecx
push 0
push 0x430
push edx
call ebx
lea ecx, [esp + 0xc]
call fcn.00489591
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00489568
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4398d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a8178
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0xf0c]
push 0x431
push eax
call ebx
push eax
call fcn.004895d1
test eax, eax
je 0x439915
mov ecx, eax
call fcn.004895bb
mov eax, dword [0x4ddec0]
test eax, eax
je 0x439947
mov ecx, dword [esi + 0xf0c]
push 0
push 0
push 0x430
push ecx
call ebx
push eax
call fcn.004895d1
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
lea ecx, [esp + 0xc]
call fcn.0048953f
push 1
push 2
push 0xff
push 0x10
push 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00489604
push str.FavBar.bmp
mov ecx, esi
call fcn.00439300
mov edx, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0xff00ff
neg eax
sbb eax, eax
push edi
and eax, edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esi + 0xf0c]
push eax
push 0
push 0x430
push edx
call ebx
push eax
call fcn.004895d1
lea ecx, [esp + 0xc]
call fcn.00489591
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00489568
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4399f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a8198
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push 0
push 0
mov eax, dword [esi + 0x10a4]
push 0x431
push eax
call ebx
push eax
call fcn.004895d1
test eax, eax
je 0x439a35
mov ecx, eax
call fcn.004895bb
mov eax, dword [0x4ddec0]
test eax, eax
je 0x439a67
mov ecx, dword [esi + 0x10a4]
push 0
push 0
push 0x430
push ecx
call ebx
push eax
call fcn.004895d1
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
lea ecx, [esp + 0xc]
call fcn.0048953f
push 1
push 2
push 0xff
push 0x10
push 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00489604
push str.FavBar.bmp
mov ecx, esi
call fcn.00439300
mov edx, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0xff00ff
neg eax
sbb eax, eax
push edi
and eax, edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esi + 0x10a4]
push eax
push 0
push 0x430
push edx
call ebx
push eax
call fcn.004895d1
lea ecx, [esp + 0xc]
call fcn.00489591
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00489568
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x43d5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0
mov byte [ebp - 4], 1
call fcn.0049ca17
mov edi, eax
test edi, edi
je 0x43d65c
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x43d65c
mov eax, dword [0x4d93ac]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
lea edx, [ebp + 8]
push ecx
push edx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043d3f0
test eax, eax
je 0x43d650
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
test ax, ax
jge 0x43d6d7
push 0x10
call ebx
test ax, ax
jge 0x43d6d7
mov eax, dword [esi + 0x858]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1304
push eax
call ebx
test eax, eax
jg 0x43d67e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0048fb71
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.0048fb71
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x38], 8
lea edi, [eax - 1]
test edi, edi
jl 0x43d650
mov edx, dword [esi + 0x858]
lea ecx, [ebp - 0x38]
push ecx
push edi
push 0x1305
push edx
call ebx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x43d6d4
push eax
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0048f8e6
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
mov byte [ebp - 4], 3
call fcn.0048f8e6
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043d7c0
dec edi
jmp 0x43d688
push edi
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0048f8e6
push ecx
lea edx, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
mov byte [ebp - 4], 4
call fcn.0048f8e6
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043d7c0
jmp 0x43d650
Function at 0x43e340
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4a8898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push 0x11
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x43e409
push 0x2e
lea ecx, [esp + 0x20]
call fcn.00488097
test eax, eax
jl 0x43e409
mov ecx, dword [0x4d93ac]
mov dword [esp + 4], ecx
lea edx, [esp + 8]
push eax
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.00487eea
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call fcn.0048fcaa
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call fcn.0048fb71
lea ecx, [esp + 4]
call fcn.00490093
mov eax, dword [esp + 4]
add esi, 0x240
push eax
mov ecx, esi
call fcn.004880b9
test eax, eax
jl 0x43e3fb
mov ecx, dword [esp + 4]
mov edx, dword [esi]
mov ecx, dword [ecx - 8]
add edx, ecx
mov al, byte [edx + eax]
cmp al, 0x20
je 0x43e42e
cmp al, 0x3b
je 0x43e42e
test al, al
je 0x43e42e
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0048fb71
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048fb71
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0048fb71
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048fb71
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x43ee60
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0
call fcn.0049ca17
test eax, eax
je 0x43ef3e
mov ecx, dword [eax + 0xf8]
test ecx, ecx
je 0x43ef3e
mov ecx, dword [esi + 0x204]
mov edx, dword [esi + 0x208]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov edx, dword [eax + 0xf8]
lea ecx, [esp + 4]
push edi
push ecx
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call fcn.0048c2a9
mov esi, eax
lea eax, [esp + 8]
push eax
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x1c]
and edx, 0xffff
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
and eax, 0xffff
shl edx, 0x10
or edx, eax
push edx
push 0
push 0x204
push ecx
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x1c]
and edx, 0xffff
shl edx, 0x10
and eax, 0xffff
or edx, eax
push edx
push 0
push 0x205
push ecx
call edi
push 0
push 0
push 0
push 0x48
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 0x48
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
add esp, 8
ret

Function at 0x43f490
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x4dd888]
push 1
push 0x4db730
push eax
push str.IEXPLORE.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret