joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dba3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dbb1
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dc85
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6b5a98]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6b5a98]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6b5a98]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6b5a98]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6b5a98]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6b5a98]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6b5a98]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6b5a98]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbce
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dca5
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x6b5a98]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dc8b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x445b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
mov edx, dword [ebp + 0xc]
cmp ecx, edx
jbe 0x445b76
mov eax, ecx
mov ecx, edx
mov edx, eax
xor eax, eax
mov dword [ebp - 4], edx
push esi
mov dword [ebp - 8], ecx
lea edx, [ebp - 8]
lea esi, [eax + 8]
jmp 0x445b90
movzx ecx, byte [edx]
lea edx, [edx + 1]
imul eax, eax, 0x1000193
xor eax, ecx
dec esi
jne 0x445b90
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4898c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67c43a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x735300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x749624], edi
mov dword [edi], vtable.CPythonTextTail.0
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0048c460
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.0048c460
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.0048c460
mov dword [edi + 0x14], eax
push 0
push 0
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.00514ee0
mov dword [edi + 0x1c], eax
push 0
push 0
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.00514ee0
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], vtable.CDynamicPool_struct_CPythonTextTail::STextTail_.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0048a670
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48ca50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x58edadb9
xor ecx, ecx
cmp byte [ebp - 4], cl
jbe 0x48ca83
xor dword [ebp - 4], 0x80164043
add dword [ebp - 4], 0xd61f75bd
mov eax, dword [ebp - 4]
mov dword [ecx*4 + 0x7499c0], eax
inc ecx
movzx eax, byte [ebp - 4]
cmp ecx, eax
jb 0x48ca62
movdqu xmm0, xmmword [0x749a5d]
push esi
xor esi, esi
movdqu xmmword [0x74999c], xmm0
call fcn.004c4fe0
mov dword [esi + 0x74999c], eax
add esi, 4
cmp esi, 0x10
jb 0x48ca96
push 0x10
push 0x7499e5
push 0x74999c
push 0x7499ac
call fcn.004c8e60
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48fc80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call fcn.0048f6a0
push 0x69f994
push dword [ebp + 8]
call fcn.0056ae3a
add esp, 8
mov edi, eax
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movss xmm0, dword [ebp - 0x1c]
sub esp, 0x18
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [ebp - 0x20]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [ebp - 0x24]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x6a2570
push 0
push edi
call fcn.004dd450
movss xmm0, dword [ebp - 0xc]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [ebp - 8]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [ebp - 4]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
push edi
call fcn.004dd450
movss xmm0, dword [ebp - 0x10]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [ebp - 0x14]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [ebp - 0x18]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
push edi
call fcn.004dd450
cvttss2si eax, dword [ebp - 0x10]
push eax
cvttss2si eax, dword [ebp - 0x14]
push eax
cvttss2si eax, dword [ebp - 0x18]
push eax
cvttss2si eax, dword [ebp - 0xc]
push eax
cvttss2si eax, dword [ebp - 8]
push eax
cvttss2si eax, dword [ebp - 4]
push eax
cvttss2si eax, dword [ebp - 0x1c]
push eax
cvttss2si eax, dword [ebp - 0x20]
push eax
cvttss2si eax, dword [ebp - 0x24]
push eax
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
push edi
call fcn.004dd450
add esp, 0x54
push edi
call fcn.0056acff
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x493aa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 0xc

Function at 0x493da0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.004ee060

Function at 0x4959a0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x6a267c
push str.interface.cfg
mov edi, ecx
call fcn.0056ae3a
mov esi, eax
add esp, 8
test esi, esi
jne 0x4959c1
pop edi
xor al, al
pop esi
ret
push esi
push 0xc8
lea eax, [edi + 0x2628]
push 1
push eax
call fcn.0056c747
push esi
call fcn.0056acff
add esp, 0x14
mov al, 1
pop edi
pop esi
ret
Function at 0x495b60
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x2624], 0
je 0x495bcf
push edi
push 0x69a90c
call dword [sym.imp.python27.dll_Py_BuildValue]
push eax
push str.OnSaveInterfaceStatus
push dword [esi + 0x2624]
call fcn.00560000
push 0x6a3b7c
push str.interface.cfg
call fcn.0056ae3a
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x495bb1
push str.Cannot_open_interface.cfg
call fcn.004c4030
add esp, 4
pop edi
pop esi
ret
push edi
push 0xc8
lea eax, [esi + 0x2628]
push 1
push eax
call fcn.0056d103
push edi
call fcn.0056acff
add esp, 0x14
pop edi
pop esi
ret

Function at 0x497540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x735300]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20]
mov edi, ecx
push eax
push 3
call fcn.004e2c30
test al, al
jne 0x497573
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005688a8
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004e2b80
movzx ecx, word [ebp - 0x1f]
cmp ecx, eax
jg 0x497562
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push 7
call fcn.004e2e10
test al, al
jne 0x4975a2
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005688a8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2b]
mov ecx, dword [ebp - 0x29]
add eax, 0xfffffff9
push ebx
movzx ebx, ax
push esi
push ebx
mov dword [ebp - 0x24], ecx
call fcn.0056716c
add esp, 4
mov esi, eax
mov ecx, edi
push esi
push ebx
call fcn.004e2e10
test al, al
jne 0x4975e7
push esi
call fcn.0043dc50
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005688a8
mov esp, ebp
pop ebp
ret
cmp dword [0x71cca0], 0x10
mov eax, 0x71cc8c
cmovae eax, dword [0x71cc8c]
push eax
call fcn.004c4790
push dword [ebp - 0x24]
call fcn.004af640
add esp, 8
lea ecx, [ebp - 0x1c]
push eax
call fcn.0043c4e0
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0x6a3b7c
cmovae eax, dword [ebp - 0x1c]
push eax
call fcn.0056ae3a
mov edi, eax
add esp, 8
test edi, edi
jne 0x497640
push esi
call fcn.0043dc50
add esp, 4
xor bl, bl
jmp 0x49765b
push edi
push 1
push ebx
push esi
call fcn.0056d103
push edi
call fcn.0056acff
push esi
call fcn.0043dc50
add esp, 0x18
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0064a500
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.005688a8
mov esp, ebp
pop ebp
ret
Function at 0x497cb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
push dword [ebp - 4]
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
test al, al
jne 0x497d06
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [eax], 2
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [sym.imp.DevIL.dll_ilGetInteger]
push 0xde4
call esi
cmp eax, 0x40
je 0x497d2d
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 3
xor al, al
mov esp, ebp
pop ebp
ret 8
push 0xde5
call esi
cmp eax, 0x80
je 0x497d4f
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 4
xor al, al
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x6a267c
push edi
call fcn.0056ae3a
mov esi, eax
add esp, 8
test esi, esi
jne 0x497d7e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
push 2
push 0
push esi
call fcn.0056c882
push esi
call fcn.0056cc95
push 0
push 0
push esi
mov dword [ebx + 0x394], eax
call fcn.0056c882
push dword [ebx + 0x394]
call fcn.0056716c
push esi
push 1
push dword [ebx + 0x394]
mov dword [ebx + 0x39c], eax
push eax
call fcn.0056c747
push esi
call fcn.0056acff
push edi
call fcn.004c92b0
add esp, 0x38
mov dword [ebx + 0x398], eax
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x498840
Capabilities:
Access peb ldr_data
Create directory
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67ccaf
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x735300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [0x74995c], ebx
mov dword [ebx], vtable.CGuildMarkManager.0
lea ecx, [ebx + 4]
mov dword [ebp - 4], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.0048c460
mov dword [ebx + 4], eax
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 1
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
call fcn.0048c460
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 0x14]
mov byte [ebp - 4], 2
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
call fcn.00545900
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x30], 0xf
mov dword [ebx + 0x2c], 0
mov byte [ebx + 0x1c], 0
lea ecx, [ebx + 0x34]
mov byte [ebp - 4], 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
call fcn.00498fb0
mov dword [ebx + 0x34], eax
push str.mark
mov byte [ebp - 4], 5
call fcn.0056de85
add esp, 4
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x498920
movzx eax, byte [0x74b8be]
lea ecx, [ebx + 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00542990
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x1900
jb 0x498920
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4989b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67cd0f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x735300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.CGuildMarkManager.0
mov eax, dword [ecx + 4]
lea edi, [ecx + 4]
mov dword [ebp - 4], 5
mov esi, dword [eax]
cmp esi, eax
je 0x498a49
push dword [esi + 0x14]
call fcn.00499040
cmp byte [esi + 0xd], 0
jne 0x498a42
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x498a21
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x498a42
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x498a15
jmp 0x498a42
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x498a40
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x498a40
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x498a30
mov esi, eax
mov ecx, dword [ebp - 0x10]
cmp esi, dword [edi]
jne 0x4989f4
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov esi, ebx
cmp byte [ebx + 0xd], 0
jne 0x498a73
push dword [esi + 8]
mov ecx, edi
call fcn.0053cc90
mov esi, dword [esi]
push ebx
call fcn.00567fdc
add esp, 4
mov ebx, esi
cmp byte [esi + 0xd], 0
je 0x498a56
mov eax, dword [edi]
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov dword [eax + 4], eax
mov eax, dword [edi]
lea ecx, [ebx + 0x34]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
mov eax, dword [ebx + 0x34]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.004991e0
push dword [ebx + 0x34]
call fcn.00567fdc
add esp, 4
cmp dword [ebx + 0x30], 0x10
jb 0x498abd
push dword [ebx + 0x1c]
call fcn.00567fdc
add esp, 4
mov dword [ebx + 0x30], 0xf
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x2c], 0
mov byte [ebx + 0x1c], 0
mov eax, dword [ebx + 0x14]
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00505350
push dword [ebx + 0x14]
call fcn.00567fdc
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00505350
push dword [ebx + 0xc]
call fcn.00567fdc
mov eax, dword [edi]
add esp, 4
mov ecx, edi
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00505350
push dword [edi]
call fcn.00567fdc
mov dword [ebx], vtable.singleton_class_CGuildMarkManager_.0
add esp, 4
mov dword [0x74995c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049c580
Function at 0x49c580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x18]
movzx eax, byte [edi + 0x20]
mov byte [esi + 0x20], al
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
lea eax, [edi + 0x18]
push eax
call fcn.0043c3f0
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov ax, word [edi + 0x78]
mov word [esi + 0x78], ax
movzx eax, byte [edi + 0x7a]
mov byte [esi + 0x7a], al
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x7c], eax
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x84]
mov dword [esi + 0x84], eax
cmp esi, edi
je 0x49c658
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.00441970
pop edi
pop esi
pop ebp
ret 4
Function at 0x49cac0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d058
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x735300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x49cbc7
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.004c4490
push 0x224
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.00569490
add esp, 0x10
mov dword [ebp - 0x24c], 0x224
lea eax, [ebp - 0x24c]
push eax
push esi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x49cbaf
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0049cd70
add esp, 8
test eax, eax
jne 0x49cbe5
push 0x224
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00569490
add esp, 0xc
mov dword [ebp - 0x24c], 0x224
lea eax, [ebp - 0x24c]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x49cb60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
jb 0x49cbc7
push dword [ebp - 0x28]
call fcn.00567fdc
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005688a8
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x12c], 0
jne 0x49cbf2
xor ecx, ecx
jmp 0x49cc09
lea ecx, [ebp - 0x12c]
lea edx, [ecx + 1]
jmp 0x49cc00
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49cc00
sub ecx, edx
push ecx
lea eax, [ebp - 0x12c]
mov ecx, edi
push eax
call fcn.00441ae0
mov eax, dword [ebp - 0x238]
push esi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
jb 0x49cc38
push dword [ebp - 0x28]
call fcn.00567fdc
add esp, 4
mov al, 1
jmp 0x49cbc9

Function at 0x4aa510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67d62b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x735300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x34]
call fcn.0043c360
xor eax, eax
mov dword [ebp - 4], 0
lea ecx, [edi + 0x34]
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov word [edi + 0x20], ax
mov byte [edi + 0x28], al
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
call fcn.0043c370
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b0ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x735300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x38]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edx
push 0
push 0
mov dword [ebp - 0x3c], eax
mov eax, dword [ecx]
push edi
push ecx
mov dword [ebp - 0x38], 0
call dword [eax + 0x34]
mov ebx, eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
js 0x4b0c5f
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004afd40
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004afcb0
push 0
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.004afdf0
push 0
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004afdf0
mov ecx, dword [ebp - 0x3c]
push 1
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp - 0x38]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x4b0c34
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
lea esp, [esp]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.004afd40
mov eax, dword [esi + 0x20]
lea edx, [ebp - 0x14]
push 0
push 0x1000000
push 0
mov ecx, dword [eax]
push edi
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jns 0x4b0be8
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [edi]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x40]
push eax
push edi
call dword [ecx + 0x44]
test eax, eax
js 0x4b0bdd
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0xcc0020
push dword [esi + 0xc]
push dword [esi + 8]
push 0
push 0
push dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [ebp - 0x40]
mov eax, dword [edi]
push edi
call dword [eax + 0x68]
push dword [ebp - 0x44]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [ebp + 0x14], 0
je 0x4b0c18
push 1
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4b0c31
push 0x1b
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4b0c31
push 0x20
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x4b0c31
mov eax, dword [ebp - 0x38]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x4b0b60
mov ebx, dword [ebp - 0x48]
dec dword [ebp + 0x18]
jne 0x4b0c49
push dword [ebp + 0x1c]
mov ecx, esi
push 0x514
push edi
call fcn.004b0600
mov ecx, dword [ebp - 0x3c]
push 0
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005688a8
mov esp, ebp
pop ebp
ret 0x18