joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
xor esi, esi
push esi
push str.Enabled
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b399
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x41b3b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41b3df
cmp eax, 2
jne 0x41b429
lea ecx, [esp + 8]
push ecx
push str.SYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41b429
push 4
lea edx, [esp + 8]
push edx
push 4
push eax
mov eax, dword [esp + 0x18]
push str.Enabled
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41b429
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret

Function at 0x41d200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5de5d3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
xor edi, edi
mov word [esi + 0xe], ax
mov dword [esp + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x400
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
cmp dword [esi + 0x10], edi
jne 0x41d293
push 0x14
call fcn.0048fcc0
add esp, 4
cmp eax, edi
je 0x41d28b
mov dword [eax], edi
mov dword [eax + 4], 0x10000
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x41d28d
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x41f800
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x5e1199
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, 1
push 0x637908
mov ecx, ebp
mov dword [esp + 0x44], esi
call fcn.00413e80
mov edx, dword [esp + 0x4c]
mov ecx, dword [edx - 8]
mov eax, esi
sub eax, dword [edx - 4]
mov dword [esp + 0x14], esi
or ecx, eax
jge 0x41f868
push ebx
lea ecx, [esp + 0x50]
call fcn.00403fe0
mov edx, dword [esp + 0x4c]
sub esp, 0x1c
mov ecx, esp
mov esi, edx
mov eax, esi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x34], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x41f885
sub eax, edi
push eax
push esi
call fcn.00414400
lea edi, [esp + 0x38]
call fcn.0041f6e0
add esp, 0x1c
mov edi, 0x10
mov byte [esp + 0x40], 2
cmp dword [eax + 0x18], edi
jb 0x41f8b5
mov edx, dword [eax + 4]
jmp 0x41f8b8
lea edx, [eax + 4]
cmp edx, ebx
jne 0x41f8c0
xor eax, eax
jmp 0x41f8ce
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f8c5
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x54]
call fcn.00413db0
mov byte [esp + 0x40], 1
cmp dword [esp + 0x34], edi
jb 0x41f8f1
mov eax, dword [esp + 0x20]
push eax
call fcn.0048fcfa
add esp, 4
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x41f932
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
jne 0x41f916
xor ecx, ecx
jmp 0x41f929
mov ecx, eax
lea esi, [ecx + 1]
jmp 0x41f920
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x41f920
sub ecx, esi
push ecx
push eax
mov ecx, ebp
call fcn.00413db0
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f956
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x41fc10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x194], eax
mov al, byte [0x66bd8b]
test al, al
jne 0x41fc7e
xor eax, eax
push 0x18e
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.004a0660
add esp, 0xc
lea edx, [esp]
push edx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41fc77
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, byte [0x66bd8b]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00499a1c
add esp, 0x19c
ret
mov al, 1
mov byte [0x66bd8b], al
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00499a1c
add esp, 0x19c
ret

Function at 0x41fca0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x5e1a78
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
call fcn.0041fc10
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x41fd2e
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp dword [esp + 0x44], 0x10
mov eax, dword [esp + 0x30]
jae 0x41fcff
lea eax, [esp + 0x30]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00413e80
call fcn.0041f970
add esp, 4
test al, al
jne 0x41fd2c
push 0xbb8
call ebp
call esi
sub eax, edi
cmp eax, 0x3e8
jb 0x41fcf0
jmp 0x41fd2e
mov bl, 1
cmp dword [esp + 0x44], 0x10
jb 0x41fd42
mov eax, dword [esp + 0x30]
push eax
call fcn.0048fcfa
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x420b10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.004a0660
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 6
jne 0x420b62
mov eax, 1
cmp dword [esp + 8], eax
je 0x420b64
xor al, al
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00499a1c
mov esp, ebp
pop ebp
ret
Function at 0x4245b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
xor bl, bl
cmp dword [esp + 0x28], 0x10
push esi
mov dword [edi], 0
jae 0x4245cc
lea eax, [esp + 0x18]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4245f1
mov dword [edi], 0x1000
jmp 0x42460c
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [esp + 8]
push esi
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x424620
mov edx, dword [esp + 0x18]
push edx
call fcn.0048fcfa
add esp, 4
pop esi
mov al, bl
pop ebx
add esp, 8
ret
Function at 0x426700
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x5e0609
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ebx
push ebx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
push 0x637908
mov ecx, ebp
mov dword [esp + 0x2c], ebp
mov byte [ebp + 4], bl
call fcn.00414400
mov dword [esp + 0x30], ebx
push 0x288
mov dword [esp + 0x24], 1
call fcn.0049b122
mov esi, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x288
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4267a2
push esi
call fcn.0049b045
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0049b122
add esp, 8
mov dword [esp + 0x18], eax
mov esi, eax
lea edx, [esp + 0x1c]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
jne 0x42684c
xor eax, eax
mov byte [esp + 0x14], bl
mov word [esp + 0x15], ax
mov byte [esp + 0x17], al
mov edi, esi
cmp esi, ebx
je 0x426859
mov edi, edi
lea eax, [edi + 0x10c]
push str.Virtual
push eax
call fcn.0049ba80
add esp, 8
test eax, eax
jne 0x426846
mov eax, dword [edi + 0x1a0]
cmp eax, 0x47
je 0x4267f8
cmp eax, 6
jne 0x426846
xor esi, esi
cmp dword [edi + 0x190], ebx
jbe 0x426842
movzx ecx, byte [edi + esi + 0x194]
push ecx
push str._02X
lea edx, [esp + 0x1c]
call fcn.004281f0
lea eax, [esp + 0x1c]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x426823
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
mov eax, ebp
call fcn.00412fa0
inc esi
cmp esi, dword [edi + 0x190]
jb 0x426802
mov esi, dword [esp + 0x18]
mov edi, dword [edi]
cmp edi, ebx
jne 0x4267d0
cmp esi, ebx
je 0x426859
push esi
call fcn.0049b045
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4283c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5e1720
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], eax
mov al, 0x6c
push ecx
xor ebx, ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x24], 0x4c
mov byte [esp + 0x25], 0x62
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0x70
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], bl
call fcn.00413e80
mov ebp, eax
lea esi, [esp + 0x14]
mov dword [esp + 0x4c], ebx
call fcn.00428230
push ebp
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x58], 1
call fcn.00420f10
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428497
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4c], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4284bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4284e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
cmp eax, ebx
jne 0x4284fc
mov ecx, dword [esp + 0x10]
push ebx
push 0x637908
call fcn.00414400
xor al, al
jmp 0x42855b
mov cl, 0x61
mov byte [esp + 0x35], cl
mov byte [esp + 0x37], cl
lea ecx, [esp + 0x30]
push ecx
push eax
mov byte [esp + 0x38], 0x53
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x64
mov byte [esp + 0x3c], 0x44
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x40], 0x52
mov byte [esp + 0x41], 0x65
mov byte [esp + 0x42], 0x70
mov byte [esp + 0x43], 0x6f
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], 0x74
mov byte [esp + 0x46], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 4], eax
cmp eax, ebx
je 0x4284e9
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00499a1c
add esp, 0x40
ret 4
Function at 0x429920
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x429938
mov esi, 8
push 1
call edi
test ax, ax
jge 0x429944
or esi, 1
push 2
call edi
test ax, ax
jge 0x429950
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x42995c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x429968
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x42b3e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x344], esi
jle 0x42b434
jmp 0x42b400
mov eax, dword [edi + 0x340]
mov byte [esp + 0x3c], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push eax
push ebx
push ebp
call edx
cmp byte [esp + 0x3c], 0
jne 0x42b4b1
inc esi
cmp esi, dword [edi + 0x344]
jl 0x42b400
sub ebp, 0x100
je 0x42b545
sub ebp, 4
je 0x42b4c3
sub ebp, 2
jne 0x42b618
push ebx
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 0
call fcn.004afec1
mov edi, dword [edi + 0xd0]
add esp, 4
mov byte [esp + 0x3c], al
mov edx, dword [edi]
mov edx, dword [edx + 0x134]
push reloc.WS2_32.dll_select
lea eax, [esp + 0x40]
push eax
push 0x431250
mov ecx, edi
call edx
mov esi, eax
test esi, esi
je 0x42b618
mov eax, dword [esi]
mov edx, dword [eax + 0x128]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
mov ecx, dword [esp + 0x44]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp dword [edi + 0xd4], 0
je 0x42b618
mov ecx, dword [edi + 0xf0]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0xec]
mov dword [esp + 0x10], 6
mov byte [esp + 0x24], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.00429920
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [edi + 0xd4]
mov dword [esp + 0x18], eax
mov edx, dword [edi]
mov edx, dword [edx + 0x140]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp ebx, 9
jne 0x42b618
cmp dword [edi + 0xd4], 0
je 0x42b601
mov ecx, dword [edi + 0xd4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x100]
call edx
test al, al
je 0x42b5b1
mov ecx, dword [edi + 0xd4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10c]
call edx
test al, al
je 0x42b5b1
mov ecx, dword [edi + 0xd4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
push str.RichEditUI
push eax
call fcn.0049ab43
add esp, 8
test eax, eax
je 0x42b5b1
mov eax, dword [edi + 0xd4]
cmp byte [eax + 0x421], 0
jne 0x42b618
cmp dword [edi + 0xd4], 0
je 0x42b601
mov ecx, dword [edi + 0xd4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x100]
call eax
test al, al
je 0x42b601
mov ecx, dword [edi + 0xd4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10c]
call eax
test al, al
je 0x42b601
mov ecx, dword [edi + 0xd4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
push str.WkeWebkitUI
push eax
call fcn.0049ab43
add esp, 8
test eax, eax
jne 0x42b618
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
movzx edx, cl
push edx
call fcn.0042f2f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x24
ret 0x10
Function at 0x42edc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0x74]
cmp eax, ecx
je 0x42ede9
cmp esi, dword [edi + 0xd4]
je 0x42ede9
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xd4]
cmp esi, eax
je 0x42ef00
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x42ee66
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0xd4]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x140]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [edi + 0xd4]
push 0
push 0
push 0
push str.killfocus
call fcn.0042f650
mov dword [edi + 0xd4], 0
test esi, esi
je 0x42ef00
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp eax, edi
jne 0x42ef00
mov edx, dword [esi]
mov eax, dword [edx + 0x100]
mov ecx, esi
call eax
test al, al
je 0x42ef00
mov edx, dword [esi]
mov eax, dword [edx + 0x10c]
mov ecx, esi
call eax
test al, al
je 0x42ef00
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0xd4], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0xd4]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x140]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [edi + 0xd4]
push 0
push 0
push 0
push str.setfocus
call fcn.0042f650
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5df35b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [edi], vtable.DuiLib::CMenuWnd.0
mov dword [edi + 0x10], vtable.DuiLib::CMenuWnd.1.0
mov dword [edi + 0x18], vtable.DuiLib::CMenuWnd.2.0
mov dword [edi + 0x1c], vtable.DuiLib::CMenuWnd.3.0
lea eax, [edi + 0x30]
push eax
mov dword [esp + 0x18], 0
call fcn.0042ac10
mov esi, dword [edi + 0x14]
mov dword [edi + 0x10], vtable.DuiLib::MenuReceiverImpl.0
test esi, esi
je 0x4368ec
call fcn.0048bf70
mov dword [edi + 0x14], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x436a40
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0xc]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x10]
push edi
mov dword [esi + 0x584], eax
mov dword [esi + 0x588], 0
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x58c], edx
test eax, eax
jne 0x436a88
call fcn.00439d10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push ebx
call eax
lea edi, [esi + 0x10]
call fcn.00439d10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push edi
call eax
mov ecx, dword [esi + 0x584]
test ecx, ecx
jne 0x436aa8
mov eax, dword [ebx + 0x74]
jmp 0x436ab2
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov eax, dword [eax + 0x74]
push 0
push 0
push 0
push 0
push 0x88
push closesocket
push 0
push eax
mov eax, esi
call fcn.00433850
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push edi
call ebx
test eax, eax
je 0x436aec
mov edi, edi
push edi
call ebx
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x436ae0
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop ebx
ret 0x14
Function at 0x439670
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x440
jmp method.DuiLib::CMenuUI.virtual_324
Function at 0x43e1d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x658aa8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
push esi
push edi
je 0x43e25c
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
inc esi
mov eax, esi
call fcn.0049e050
mov edi, esp
test edi, edi
je 0x43e25c
mov ecx, dword [ebx + 4]
push esi
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [ebx + 0x10]
push 0xffffffffffffffff
add esi, 0x14c
push edi
call fcn.00428e20
mov esi, dword [ebx + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0
push 0
push str.textchanged
mov ecx, esi
call eax
mov ecx, esi
mov edi, eax
call fcn.0042f650
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
cmp byte [eax + 0x13d], 0
je 0x43e25c
mov eax, dword [ebx + 0x10]
call fcn.0043b730
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a1c
mov esp, ebp
pop ebp
ret 4
Function at 0x447690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
test ecx, ecx
jne 0x44769b
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x447774
mov esi, edx
shr esi, 3
push edi
lea ecx, [ecx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x639478]
inc ecx
sub edx, 8
sub esi, 1
jne 0x4476b0
pop edi
test edx, edx
je 0x44779b
jmp 0x447780
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x639478]
inc ecx
sub edx, 1
jne 0x447780
not eax
pop esi
ret

Function at 0x4477a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x639478]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x639478]
mov dword [edx + 8], ecx
ret

Function at 0x4477f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x639478]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x639478]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret