joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb6d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x59de73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x5bc9d4
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x10], 1
test eax, eax
jne 0x4cb71a
mov eax, dword [esi + 0x44]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4cb71a
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x4cb71a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 0x44]
call fcn.005772b0
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0
call fcn.005772b0
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.004c8e20
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4cc280
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0x60]
test esi, esi
push edi
mov dword [esp + 8], ecx
je 0x4cc32f
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 0x34]
shr eax, 8
cmp al, 2
jne 0x4cc32f
test edi, edi
je 0x4cc32f
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ebx
lea ecx, [esi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4cc2db
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x4cc2db
mov eax, dword [edi + 0x2c]
jmp 0x4cc300
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x58]
test ecx, ecx
mov ecx, ebx
jne 0x4cc2e9
mov ecx, ebp
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x4cc2fe
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x4cc300
mov eax, ecx
mov esi, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.004cc1b0
mov eax, dword [esp + 0x18]
pop ebp
cmp eax, 0x202
pop ebx
je 0x4cc326
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4cc32f
push 0
mov ecx, esi
call fcn.004cc130
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x4d2510
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00490a40
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00491ae0
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 9
jne 0x4d25d8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [esi + 0xf8]
jl 0x4d258d
test eax, eax
je 0x4d2551
mov eax, dword [eax + 0x14]
inc eax
jmp 0x4d2553
xor eax, eax
mov edx, dword [esi + 0xd8]
mov ecx, dword [esi + 0x104]
cmp eax, edx
jl 0x4d257a
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, ecx
jne 0x4d2580
xor eax, eax
push eax
mov ecx, esi
call fcn.004d2490
pop edi
pop esi
ret 0xc
test eax, eax
je 0x4d2596
mov eax, dword [eax + 0x14]
jmp 0x4d259c
mov eax, dword [esi + 0xd8]
dec eax
test eax, eax
jge 0x4d25b9
mov eax, dword [esi + 0x104]
test eax, eax
je 0x4d25c4
dec eax
mov ecx, esi
push eax
call fcn.004d2490
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jne 0x4d25cb
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, 0x25
jne 0x4d262d
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x4d26f1
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4d26f1
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
test ecx, ecx
lea eax, [ecx - 1]
jg 0x4d260a
lea eax, [edi - 1]
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x4d2620
mov eax, ecx
push eax
mov ecx, esi
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, 0x27
jne 0x4d2684
mov edi, dword [esi + 0xec]
cmp edi, 1
jle 0x4d26f1
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4d26f1
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
dec edi
cmp ecx, edi
jge 0x4d265f
lea eax, [ecx + 1]
jmp 0x4d2661
xor eax, eax
mov ecx, dword [esi + 0xe8]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edx
cmp ecx, eax
jg 0x4d2677
mov eax, ecx
push eax
mov ecx, esi
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, 0x28
jne 0x4d26b8
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4d2699
mov eax, dword [eax + 0x14]
inc eax
jmp 0x4d269b
xor eax, eax
mov ecx, dword [esi + 0xd8]
xor edx, edx
cmp eax, ecx
mov ecx, esi
setge dl
dec edx
and edx, eax
push edx
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, 0x26
jne 0x4d26e3
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4d26cf
mov eax, dword [eax + 0x14]
dec eax
test eax, eax
jge 0x4d26d6
mov eax, dword [esi + 0xd8]
dec eax
push eax
mov ecx, esi
call fcn.004d2490
pop edi
pop esi
ret 0xc
cmp eax, 0x10
je 0x4d26f1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x74]
pop edi
pop esi
ret 0xc
Function at 0x4d4940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59e660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, vtable.CRgn.0
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call esi
push eax
lea ecx, [esp + 0x10]
call fcn.0057c68b
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
push 0xfffffffffffffffc
lea edx, [esp + 0x18]
push 0xfffffffffffffffc
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x14]
push eax
call esi
push eax
lea ecx, [esp + 8]
call fcn.0057c68b
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.0057c68b
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
neg eax
mov edx, dword [esp + 0x10]
push 3
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov esi, vtable.CGdiObject.0
mov dword [esp + 4], esi
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.0057c6e2
mov dword [esp + 0xc], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 3
call fcn.0057c6e2
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x4da240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59ea5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00576b13
xor edi, edi
mov eax, 0xa
mov dword [esp + 0x14], edi
mov dword [esi + 0x24], 0x5be9e0
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 0x5b6f3c
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0x5c]
xor ecx, ecx
mov dword [esi + 0x80], eax
mov dword [esi], method.COleControlContainer.virtual_0
mov dword [esi + 0x7c], 1
mov dword [edx], ecx
xor eax, eax
push esi
push 4
mov dword [edx + 4], ecx
mov byte [esp + 0x1c], 2
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea ecx, [esi + 0x6c]
mov dword [esi + 0x6c], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx]
call dword [edx + 0xc0]
mov ecx, dword [esi + 0x80]
mov dword [esi + 0x20], eax
push esi
push 2
mov eax, dword [ecx]
call dword [eax + 0xc0]
cmp eax, edi
je 0x4da30b
lea ecx, [eax - 0x1c]
jmp 0x4da30d
xor ecx, ecx
mov edx, dword [esi + 0x80]
mov dword [esi + 0x1c], ecx
mov eax, dword [edx + 0x7c]
mov edx, dword [esi + 0x20]
push eax
push 1
push edx
call fcn.004e6720
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4dc280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x59ec28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov ebx, 0x5b6f3c
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xa
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push edi
mov eax, dword [ecx]
mov dword [esp + 0x3c], edi
call dword [eax + 0xc]
cmp dword [esp + 0x1c], edi
jne 0x4dc301
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 1
cmp eax, edi
je 0x4dc404
mov eax, dword [eax]
cmp eax, edi
jne 0x4dc2f6
jmp 0x4dc404
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x4dc311
add eax, 0xffffffe4
jmp 0x4dc313
xor eax, eax
push eax
mov ecx, ebp
call fcn.004dc100
cmp eax, edi
mov dword [esp + 0x40], eax
je 0x4dc3ea
cmp dword [eax + 8], edi
je 0x4dc3ea
mov ecx, dword [esp + 0x3c]
mov esi, dword [ecx + 0x78]
cmp esi, edi
je 0x4dc381
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
cmp eax, edi
je 0x4dc34b
lea ebx, [eax - 0x3c]
jmp 0x4dc34d
xor ebx, ebx
lea ecx, [ebx + 0x3c]
call fcn.00535fb0
cmp eax, edi
je 0x4dc378
add eax, 0xffffffe4
cmp eax, edi
je 0x4dc378
push eax
mov ecx, ebp
call fcn.004dc100
cmp eax, edi
je 0x4dc378
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + 8]
je 0x4dc39d
cmp esi, edi
jne 0x4dc33b
mov ebx, 0x5b6f3c
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 4
cmp eax, edi
je 0x4dc404
mov eax, dword [eax]
cmp eax, edi
jne 0x4dc395
jmp 0x4dc404
lea ecx, [esp + 0x10]
push 2
push ecx
push ebx
mov ecx, ebp
call fcn.004dc210
mov dword [esp + 0x10], 0x5b6f3c
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
cmp eax, edi
je 0x4dc3ca
mov eax, dword [eax]
cmp eax, edi
jne 0x4dc3c4
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.00571ca9
mov eax, 1
jmp 0x4dc41f
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 2
cmp eax, edi
je 0x4dc404
mov eax, dword [eax]
cmp eax, edi
jne 0x4dc3fe
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call fcn.00571ca9
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x4de120
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4de1a7
lea edi, [esi + 0xcc]
push 0x11
mov ecx, edi
call fcn.00535ff0
test eax, eax
jne 0x4de1a7
mov ecx, edi
call fcn.004e2600
mov edi, dword [eax + 0xe8]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call fcn.004dd320
test eax, eax
je 0x4de173
add eax, 0x3c
jmp 0x4de175
xor eax, eax
mov ecx, dword [esp + 8]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov ecx, edi
call fcn.004d44b0
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x4eb3aa
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x59f638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x38]
push edi
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esi + 0xdc]
mov ecx, eax
mov eax, dword [esp + 0x4c]
test ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], eax
je 0x4eb3f0
mov eax, ebp
sub eax, edi
jmp 0x4eb3f2
sub eax, ebx
sub eax, edx
mov edx, dword [esi + 0x210]
dec eax
test ecx, ecx
je 0x4eb407
push 0
push eax
push 0
push edx
jmp 0x4eb40d
push eax
push 0
push edx
push 0
lea ecx, [esp + 0x28]
call fcn.00587327
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4eb433
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], 1
mov eax, dword [ecx + 0x144]
test eax, eax
jne 0x4eb43b
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4eb460
mov eax, dword [esp + 0x4c]
push 0xf
sub eax, ebx
mov ecx, esi
mov ebp, eax
call fcn.004e89e0
mov edx, dword [esp + 0x20]
push eax
add edx, 2
push ebp
push edx
jmp 0x4eb475
push 0xf
mov ecx, esi
sub ebp, edi
call fcn.004e89e0
push eax
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push ebp
push ebx
push edi
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.00587109
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4eb48f
lea ebx, [ecx + 0x3c]
jmp 0x4eb491
xor ebx, ebx
lea edx, [esp + 0x3c]
push edx
call fcn.004e38f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x3c], 0
sub esp, 0x10
mov eax, esp
push ebx
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 0xc], ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.005772b0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x18
Function at 0x4f3a30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
cmp ebx, 0x112
push edi
mov esi, ecx
ja 0x4f3b7f
cmp ebx, 0x112
je 0x4f3adb
mov eax, ebx
sub eax, 2
je 0x4f3aa4
sub eax, 3
je 0x4f3a67
sub eax, 0x42
jne 0x4f3a85
cmp ebp, dword [esi + 0x124]
jne 0x4f3a85
mov eax, dword [esi - 0x20]
push 0
push 0x2fbf
push 0x113
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push ebp
mov ecx, esi
call fcn.0047d660
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esi + 0x128]
test eax, eax
je 0x4f3a85
lea ecx, [esi - 0x3c]
call fcn.0047e360
test eax, eax
je 0x4f3abd
mov eax, dword [eax + 0x1c]
cmp ebp, eax
jne 0x4f3a85
mov ecx, dword [esi + 0x128]
push ecx
push ebp
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esi + 0x128], 0
jmp 0x4f3a85
lea edi, [esi - 0x3c]
mov ecx, edi
call fcn.004f62e0
test eax, eax
je 0x4f3a85
push 0x46cae0
mov ecx, 0x60ed24
call fcn.0058dac3
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x4f3a85
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4f3a85
mov ecx, edi
call fcn.0047e480
test eax, eax
jne 0x4f3a85
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x4f3a85
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
jne 0x4f3a85
mov edx, dword [edi]
push 0x12
mov ecx, edi
call dword [edx + 0x170]
test eax, eax
je 0x4f3b5e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
mov ecx, edi
call fcn.0047e450
test eax, eax
je 0x4f3b73
push 0
push edi
mov ecx, eax
call fcn.0047b1d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
cmp ebx, 0x220
jb 0x4f3a85
cmp ebx, 0x222
jbe 0x4f3a6f
cmp ebx, 0x230
jne 0x4f3a85
mov eax, dword [esi - 0x3c]
lea edi, [esi - 0x3c]
mov ecx, edi
call dword [eax + 0xdc]
test eax, eax
mov ecx, edi
je 0x4f3c43
call fcn.0047e480
test eax, eax
je 0x4f3bed
mov ecx, edi
call fcn.0047e360
mov ecx, dword [eax + 0x1c]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [edx], 0
mov eax, 1
pop ebx
ret 0x14
mov eax, dword [esi + 0x58]
mov ebx, dword [esp + 0x1c]
test ah, 4
jne 0x4f3c17
mov eax, dword [ebx]
test eax, eax
jne 0x4f3c0f
mov ecx, dword [esi + 0x128]
test ecx, ecx
je 0x4f3c17
test eax, eax
jne 0x4f3c0f
mov eax, ecx
push eax
mov ecx, edi
call fcn.004f39d0
mov ecx, edi
call fcn.0047e360
mov eax, dword [eax + 0x1c]
push 0
push eax
call dword [sym.imp.USER32.dll_SetMenu]
mov ecx, edi
call fcn.004f2b40
pop edi
pop esi
mov dword [ebx], 0
pop ebp
mov eax, 1
pop ebx
ret 0x14
call fcn.0047e360
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call fcn.00578d37
test eax, eax
jne 0x4f3a85
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov eax, 1
pop ebx
ret 0x14
Function at 0x4f4cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [ebx + 0xa4]
push edi
and esi, 0xffff
call fcn.004c1aa0
test esi, esi
jne 0x4f4cf8
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
call fcn.0058b5c7
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x4f4d0d
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
push 0xf1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4f4d25
pop edi
pop esi
pop ebx
pop ecx
ret 8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4f4d38
pop edi
pop esi
pop ebx
pop ecx
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4f4d4c
pop edi
pop esi
pop ebx
pop ecx
ret 8
xor eax, eax
push ebp
mov ax, word [esi + 6]
shl eax, 2
push eax
call fcn.0057284c
xor edi, edi
add esp, 4
cmp word [esi + 6], di
mov dword [esp + 0x10], eax
jbe 0x4f4d8f
mov ebp, eax
mov ecx, esi
call fcn.004f4e20
xor ecx, ecx
xor edx, edx
mov cx, word [eax + edi*2]
inc edi
mov dword [ebp], ecx
mov dx, word [esi + 6]
add ebp, 4
cmp edi, edx
jl 0x4f4d6d
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [esi + 6]
push ecx
push eax
mov ecx, ebx
call fcn.004f4a80
mov ebp, eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4f4e00
mov ecx, ebx
call fcn.0047eea0
xor edi, edi
xor edx, edx
mov di, word [esi + 4]
mov dx, word [esi + 2]
mov ecx, dword [esp + 0x10]
push 0
push edi
push edx
xor edx, edx
mov dx, word [esi + 6]
push edx
mov edx, dword [esp + 0x28]
push ecx
push edx
mov ecx, eax
call fcn.004a77c0
test eax, eax
jne 0x4f4ddd
xor ebp, ebp
mov ax, word [esi + 2]
cmp ax, 0x10
je 0x4f4e00
and eax, 0xffff
mov ecx, eax
xor eax, eax
mov ax, word [esi + 4]
mov dword [ebx + 0xb4], ecx
mov dword [ebx + 0xb8], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00572875
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x4f7250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a00cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x20], 0x5b7490
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esp + 0x14], edi
call fcn.004a8ba0
mov edx, dword [eax]
push 0x2393
mov ecx, eax
call dword [edx + 0x18]
mov dword [esi + 0x38], eax
call fcn.004a8ba0
mov edx, dword [eax]
push 0x2392
mov ecx, eax
call dword [edx + 0x18]
mov dword [esi + 0x3c], eax
call fcn.004a8ba0
mov edx, dword [eax]
push 0x2391
mov ecx, eax
call dword [edx + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x14], edi
mov dword [esi + 0x34], eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4f7ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a0170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5f2384]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x24], esi
call fcn.004a8ba0
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push 0x23cb
push ecx
mov ecx, eax
call dword [edx + 8]
mov edx, dword [0x5f2384]
mov ebp, 1
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x30], 1
call fcn.0056fdd7
mov edx, dword [edi + 0x68]
add esp, 0xc
mov eax, dword [edx + 0x80]
cmp eax, esi
mov dword [esp + 0x18], eax
jle 0x4f7c78
push ebx
mov ecx, dword [edi + 0x68]
push esi
call fcn.00479eb0
test eax, eax
je 0x4f7c70
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.004788b0
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
push eax
push edx
call fcn.004512c1
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.005772b0
test bl, bl
je 0x4f7c70
mov eax, ebp
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
inc ebp
call fcn.0056fdd7
add esp, 0xc
xor esi, esi
jmp 0x4f7c71
inc esi
cmp esi, dword [esp + 0x1c]
jl 0x4f7c1b
pop ebx
lea edx, [esp + 0xc]
lea ecx, [edi + 0x60]
push edx
call fcn.005773e9
push 0
mov ecx, edi
call fcn.00575bd6
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005772b0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.005772b0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4f81e0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
test eax, eax
mov eax, dword [esi + 4]
je 0x4f8218
test eax, eax
jne 0x4f822a
push edi
call fcn.0058b5c7
mov edi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x4f8520
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 4], eax
pop edi
pop esi
ret 4
test eax, eax
je 0x4f822a
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 4], 0
pop esi
ret 4

Function at 0x50bab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a1100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, 0xaa
mov ecx, 0x55
xor esi, esi
mov word [esp + 0x20], cx
mov word [esp + 0x22], ax
mov word [esp + 0x24], cx
mov word [esp + 0x26], ax
mov word [esp + 0x28], cx
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], vtable.CBitmap.0
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
push 1
push 1
push 8
push 8
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.0057c68b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], vtable.CBrush.0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
mov byte [esp + 0x38], 1
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.0057c68b
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0057bcfb
mov ebp, dword [esi]
push 0xf
mov ecx, edi
mov ebx, eax
call fcn.00481e50
push eax
mov ecx, esi
call dword [ebp + 0x2c]
mov edx, dword [esi]
push 0x14
mov ecx, edi
mov ebp, eax
mov dword [esp + 0x44], edx
call fcn.00481e50
mov edx, dword [esp + 0x40]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
push 0xf00021
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edx
sub eax, edi
push ecx
push eax
mov eax, dword [esi + 4]
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call fcn.0057bcfb
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0x10]
call fcn.0057c6e2
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.0057c6e2
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 3
call fcn.0057c6e2
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8