joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7250
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [0x6f5e06], al
je 0x4a73d9
cmp dword [0x6f2544], eax
je 0x4a73d9
push ebx
push esi
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + 0x5c]
lea ebx, [esi + 0x5c]
push edi
cmp ecx, eax
jbe 0x4a72b7
lea edi, [esi + 0x60]
jmp 0x4a7290
mov edx, dword [edi]
mov si, word [ebp + 0x10]
cmp word [edx + 0xa], si
je 0x4a72a9
inc eax
add edi, 4
cmp eax, ecx
jb 0x4a7290
mov esi, dword [ebp + 8]
jmp 0x4a72b7
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x60]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4a72c0
cmp byte [ebx], 4
je 0x4a73d6
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.WS2_32.dll_htons]
push eax
mov byte [ebp - 0x14], 5
call edi
mov ecx, dword [ebp + 0x10]
push ecx
mov word [ebp - 0xb], ax
call edi
mov word [ebp - 9], ax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4a73c1
lea edx, [ebp - 4]
push edx
push eax
call fcn.004a5530
mov esi, eax
push esi
call fcn.004a4ef0
push esi
push ebx
call fcn.004a4010
mov cx, word [ebp + 0x10]
mov dx, word [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov esi, eax
mov ax, word [ebp - 4]
mov word [esi + 6], ax
mov word [esi + 8], bx
mov word [esi + 0xa], cx
mov byte [esi + 0x14], 1
mov word [esi + 0xc], dx
mov ecx, dword [0x6f671c]
add esp, 0x14
mov eax, 2
push ecx
mov word [ebp - 0x24], ax
call dword [sym.imp.WS2_32.dll_htonl]
push ebx
mov dword [ebp - 0x20], eax
call edi
mov word [ebp - 0x22], ax
movzx edx, word [esi + 6]
push 1
push edx
call edi
movzx ecx, word [esi + 0xa]
movzx eax, ax
push eax
push ecx
call edi
mov edi, dword [ebp + 8]
movzx edx, ax
mov eax, dword [edi + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push eax
call fcn.004a5660
mov edx, dword [esi]
add esp, 0x10
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
push 0xd
test eax, eax
jns 0x4a73a9
lea eax, [ebp - 0x14]
push eax
mov byte [esi + 0x14], 0
push edi
mov byte [ebp - 0x14], 9
call fcn.004a71f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
push ecx
push edi
mov byte [esi + 0x14], 2
call fcn.004a71f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 0x14], 2
jne 0x4a73d6
push 0xd
lea edx, [ebp - 0x14]
push edx
push esi
call fcn.004a71f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7790
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [0x69fb48]
push esi
push edi
jne 0x4a77ab
mov ebx, dword [0x69fb44]
mov edi, dword [sym.imp.WS2_32.dll_recvfrom]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x800
push 0x6f5e20
push ebx
mov dword [ebp - 4], 0x10
call edi
mov esi, eax
test esi, esi
jle 0x4a7806
mov ecx, dword [ebp - 0x14]
cmp cx, 2
jne 0x4a7804
mov edx, dword [ebp - 0x10]
push esi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
push eax
call fcn.004a75b0
add esp, 0x18
test esi, esi
jns 0x4a77b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7b60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [0x69fb4c]
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
push edx
mov dword [ebp - 8], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4a7d19
cmp esi, 0xffffffff
je 0x4a7d19
cmp word [ebp - 0x24], 2
jne 0x4a7d19
push ebx
push esi
call fcn.004a4ef0
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
add esp, 4
push eax
call ebx
cmp eax, dword [0x6f671c]
je 0x4a7bcf
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x22]
push edi
mov edi, dword [sym.imp.WS2_32.dll_ntohs]
push ecx
call edi
movzx edx, ax
mov dword [ebp - 0x14], edx
call fcn.004a5610
movzx eax, byte [0x6f223c]
xor esi, esi
test eax, eax
je 0x4a7c0f
mov ecx, dword [ebp - 0x22]
jmp 0x4a7c00
cmp cx, word [esi*8 + 0x6f2042]
je 0x4a7c54
inc esi
cmp esi, eax
jb 0x4a7c00
mov ebx, dword [ebp - 0xc]
movzx eax, byte [0x6f223c]
mov ecx, dword [ebp - 4]
cmp esi, eax
je 0x4a7cb6
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x24]
push eax
push ecx
mov dword [ebp - 8], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4a7c73
cmp word [ebp - 0x24], 2
jne 0x4a7c73
mov edx, dword [ebp - 0x22]
push edx
call edi
movzx eax, ax
mov dword [ebp - 0xc], eax
jmp 0x4a7c7a
mov eax, dword [esi*8 + 0x6f203c]
push eax
call ebx
movzx ecx, word [esi*8 + 0x6f2040]
push ecx
mov ebx, eax
call edi
movzx edx, ax
mov dword [ebp - 0x10], edx
jmp 0x4a7c12
mov dword [ebp - 0xc], 0
mov edx, dword [0x6f25f4]
xor ecx, ecx
test edx, edx
je 0x4a7cac
mov edi, dword [0x6f25c0]
mov eax, 0x6f25f8
mov esi, eax
cmp eax, edi
je 0x4a7ca2
cmp byte [eax + 0x26], 0
je 0x4a7ca2
cmp dword [eax + 0x10], ebx
je 0x4a7caf
inc ecx
add eax, 0x70
cmp ecx, edx
jb 0x4a7c91
jmp 0x4a7caf
mov esi, dword [ebp - 0x14]
cmp ecx, edx
jne 0x4a7cc4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0x5c], 4
lea eax, [esi + 0x5c]
jne 0x4a7cde
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
push eax
call fcn.004a4010
movzx edx, word [ebp - 0xc]
mov cx, word [ebp - 0x10]
mov word [eax + 6], dx
movzx edx, word [ebp - 0x14]
push eax
push esi
mov byte [eax + 4], 1
mov word [eax + 0xa], cx
mov word [eax + 8], dx
mov byte [eax + 0x14], 1
call fcn.004a7420
add esp, 0x10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a8750
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
push 0
push 0x5aa
push 0x6f5e20
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
test eax, eax
jg 0x4a87c6
cmp byte [edi + 4], 0
jne 0x4a87ad
movzx ecx, word [edi + 0xa]
mov esi, dword [ebp + 8]
push ecx
push 0
push esi
call fcn.004a73e0
movzx edx, word [edi + 0xa]
push edx
push 0
push esi
call fcn.004a73e0
push edi
add esi, 0x5c
push esi
call fcn.004a5ae0
add esp, 0x20
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
push eax
mov byte [edi + 0x14], 3
call fcn.004a74d0
add esp, 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004574b0
movzx ecx, word [edi + 0x18]
mov ebx, eax
movzx eax, word [edi + 0x16]
sub eax, ecx
cmp eax, 0x8000
jle 0x4a87e6
add eax, 0xffff0000
jmp 0x4a87f2
cmp eax, 0xffff8000
jge 0x4a87f2
add eax, 0x10000
mov ecx, dword [ebp - 4]
imul eax, eax, 0x5b8
lea esi, [eax + edi + 0x1c]
mov byte [esi], 1
mov dword [esi + 4], ebx
mov edx, dword [edi + 0xb728]
add edx, ebx
push ecx
mov dword [esi + 8], edx
lea edx, [esi + 0xe]
or eax, 0xffffffff
push 0x6f5e20
push edx
mov word [esi + 0xc], ax
call fcn.004a46d0
mov word [esi + 2], ax
movzx eax, ax
cmp eax, dword [ebp - 4]
push ebx
setne cl
mov byte [esi + 1], cl
inc word [edi + 0x16]
call fcn.004a7ae0
add esp, 0x10
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a9610
Capabilities:
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
push 0
push 0
push 0
push 0x4a95f0
call sub.MFC42.dll_AfxBeginThread
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x6f2030
mov esi, eax
call edi
push eax
mov eax, dword [esi + 0x2c]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
ret

Function at 0x4a961a
Capabilities:
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
push 0
push 0
push 0
push 0x4a95f0
call sub.MFC42.dll_AfxBeginThread
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x6f2030
mov esi, eax
call edi
push eax
mov eax, dword [esi + 0x2c]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
ret

Function at 0x4aaca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [esi + 0x10c]
mov edx, edi
sub edx, eax
jmp 0x4aacc0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4aacc0
add esi, 8
push esi
lea eax, [ebp - 0x800]
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
push 1
push 0
lea edx, [ebp - 0x800]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aad23
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push edi
push 0
push 0
push str.Name
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b9590
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x168], 0
je 0x4b95f9
push ebx
push edi
call fcn.004574b0
mov ecx, dword [esi + 0x120]
push 0x3e8
push 0x24
mov edi, eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esi + 0x168]
push eax
push edx
call sub.ICMP.dll_IcmpSendEcho
mov ebx, eax
call fcn.004574b0
sub eax, edi
pop edi
test ebx, ebx
pop ebx
jne 0x4b95ea
mov eax, 0x270f
cmp byte [esi + 4], 0
mov word [esi + 0x160], ax
jne 0x4b9626
jmp 0x4b9605
mov ecx, 0x270f
mov word [esi + 0x160], cx
mov eax, dword [0x717ef8]
test eax, eax
je 0x4b9626
cmp dword [eax + 0x20], 0
je 0x4b9626
mov edx, dword [eax + 0x20]
push esi
push 0
push 0x8003
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bf520
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e39a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
cmp byte [ebx + 0x58], 0
push edi
mov dword [ebp - 0x10], esp
je 0x4bf68c
mov eax, dword [ebx + 4]
movzx esi, word [eax + 0xc14]
mov dword [ebp - 4], 0
call sym.GameRanger.exe_public:_static_class_CFileDB____cdecl_CModule::GetFile_void_
push esi
push 0x44617461
push 0x53727672
mov ecx, eax
call sym.GameRanger.exe_public:_class_CFileRec____thiscall_CFileDB::WriteRec_unsigned_int__unsigned_int__unsigned_int_
mov edi, eax
push 1
mov ecx, edi
call fcn.0044b5e0
movzx edx, word [ebx + 0x30]
push edx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
mov eax, dword [ebx + 0x34]
push eax
mov ecx, edi
call fcn.0044b5e0
lea ecx, [ebx + 0x7c]
push edi
call fcn.0044db00
mov eax, dword [ebx + 0x40]
push eax
mov ecx, edi
call fcn.0044b5e0
xor eax, eax
mov dword [ebp - 0x14], eax
cmp eax, dword [ebx + 0x40]
jae 0x4bf667
mov ecx, dword [ebx + 0x4c]
mov esi, dword [ecx + eax*4]
mov edx, dword [esi]
push edx
mov ecx, edi
call fcn.0044b5e0
movzx eax, word [esi + 4]
push eax
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
movzx ecx, word [esi + 6]
push ecx
mov ecx, edi
call fcn.0044b5b0
movzx edx, byte [esi + 8]
push edx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_ubyte_unsigned_char_
movzx eax, byte [esi + 9]
push eax
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_ubyte_unsigned_char_
movzx ecx, byte [esi + 0xa]
push ecx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_ubyte_unsigned_char_
movzx edx, byte [esi + 0xb]
push edx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_ubyte_unsigned_char_
movzx eax, word [esi + 0xc]
push eax
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
movzx ecx, word [esi + 0xe]
push ecx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
mov edx, dword [esi + 0x10]
push edx
mov ecx, edi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_string_char_const__
mov eax, dword [esi + 0x14]
push eax
lea ecx, [ebx + 0x7c]
call fcn.0044dac0
push eax
mov ecx, edi
call fcn.0044b5e0
mov ecx, dword [esi + 0x18]
push ecx
lea ecx, [ebx + 0x7c]
call fcn.0044dac0
push eax
mov ecx, edi
call fcn.0044b5e0
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
jmp 0x4bf5b0
mov edx, dword [ebx + 4]
movzx esi, word [edx + 0xc14]
call sym.GameRanger.exe_public:_static_class_CFileDB____cdecl_CModule::GetFile_void_
push esi
push 0x44617461
push 0x53727672
mov ecx, eax
call sym.GameRanger.exe_public:_void___thiscall_CFileDB::UpdateRec_unsigned_int__unsigned_int__unsigned_int_
mov byte [ebx + 0x58], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3aac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
mov esi, ecx
push 5
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CServerGameBase.0
call fcn.004bc1e0
xor ebx, ebx
push 0x1f4
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.004bc210
push 5
lea ecx, [esi + 0x5c]
call fcn.004bc240
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.0044de50
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 3
mov dword [esi + 4], ecx
call fcn.004887b0
lea edx, [ebp - 0x110]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c19b4
lea eax, [ebp - 0x110]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4c19c5
mov ecx, dword [str._Servers]
mov edx, dword [0x6139b8]
mov dword [eax], ecx
mov cl, byte [0x6139bc]
mov dword [eax + 4], edx
lea edx, [ebp - 0x110]
push edx
mov byte [eax + 8], cl
call sym.GameRanger.exe_char____cdecl_new_string_char_const__
mov dword [esi + 8], eax
mov eax, 7
add esp, 4
mov ecx, esi
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov word [esi + 0x58], bx
mov dword [esi + 0x38], ebx
mov word [esi + 0x30], ax
mov dword [esi + 0x34], ebx
call fcn.004c12a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c62c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004c7c70
mov edi, eax
test edi, edi
je 0x4c633c
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c633c
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c62e8
sub eax, edx
push ebx
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub eax, edi
lea esp, [esp]
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
test cl, cl
jne 0x4c6310
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.0040107c
add esp, 4
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebx
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
ret

Function at 0x4c6340
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c6382
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4c637a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [edi + 0xcc]
push eax
call fcn.004c1c00
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
pop edi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
ret
Function at 0x4c6e70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 4]
lea ecx, [esi + 0x40]
lea edx, [ebp - 4]
push edx
call eax
test al, al
je 0x4c6f10
mov ecx, dword [esi + 0xe0]
mov edx, dword [ebp - 4]
lea eax, [ecx + edx*4]
mov eax, dword [eax]
push edi
push eax
mov ecx, esi
call fcn.004c7480
mov edi, eax
test edi, edi
je 0x4c6f0f
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c6f0f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c6ec4
sub eax, edx
push ebx
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub eax, edi
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
test cl, cl
jne 0x4c6ee5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call fcn.0040107c
add esp, 4
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ce520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e42d8
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 0xc
push esi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp + 0x14], 0
je 0x4ce5a6
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42.dll_CDialogTemplate::CDialogTemplate
push 8
push str.MS_Shell_Dlg_2
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call sub.MFC42.dll_CDialogTemplate::SetFont
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
push 0
push ecx
push edx
push eax
mov ecx, esi
call sym.GameRanger.exe_protected:_int___thiscall_CDialogEx::CreateIndirect_void___class_CWnd___struct_HINSTANCE_____int_
lea ecx, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00520c0e
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push 0
push edx
push eax
mov ecx, esi
call sub.MFC42.dll_CDialog::CreateIndirect
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ce5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e42f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
mov ebx, dword [esi + 0x4c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
call sub.MFC42.dll_AfxGetModuleState
mov edi, dword [eax + 0xc]
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4ce632
push 5
push eax
call sub.MFC42.dll_AfxFindResourceHandle
mov ecx, dword [esi + 0x44]
push 5
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
jmp 0x4ce635
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4ce642
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4ce65a
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call sub.MFC42.dll_CDialog::PreModal
call sub.MFC42.dll_AfxUnhookWindowCreate
lea ecx, [ebp - 0x24]
mov dword [esi + 0x58], 0
call sub.MFC42.dll_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
mov dword [ebp - 4], 0
push esi
mov byte [ebp - 4], 1
call sub.MFC42.dll_AfxHookWindowCreate
push 0
call sub.MFC42.dll_CWnd::FromHandle
push edi
push eax
push ebx
mov ecx, esi
call sub.MFC42.dll_CWnd::CreateDlgIndirect
test eax, eax
je 0x4ce6fd
test byte [esi + 0x28], 0x10
je 0x4ce6c1
mov ecx, esi
mov edi, 4
call sub.MFC42.dll_CWnd::GetStyle
test eax, 0x100
je 0x4ce6b9
mov edi, 5
push edi
mov ecx, esi
call sub.MFC42.dll_CWnd::RunModalLoop
cmp dword [esi + 0x20], 0
je 0x4ce6fd
push 0x97
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call sub.MFC42.dll_CWnd::SetWindowPos
jmp 0x4ce6fd
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.dll_AfxTryCleanup
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
call edx
mov ecx, esi
call sub.MFC42.dll_CDialog::PostModal
cmp dword [esi + 0x44], 0
je 0x4ce729
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d0810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
mov ebx, ecx
cmp eax, 0x102
je 0x4d085f
cmp eax, 0x20a
jne 0x4d0898
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
test eax, eax
je 0x4d0898
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
cmp dword [esi + 8], 9
jne 0x4d0898
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
js 0x4d0898
push 0x10
call edi
xor edx, edx
test ax, ax
mov eax, dword [esi]
setns dl
push edx
push eax
call fcn.004cfcb0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
push esi
mov ecx, ebx
call sub.MFC42.dll_CFrameWnd::PreTranslateMessage
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4d0fe0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
lea esp, [esp]
test edi, edi
je 0x4d105e
push 2
push edi
mov esi, edi
call dword [sym.imp.USER32.dll_GetWindow]
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4d1000
push 0xfffffffffffffff0
push esi
call ebx
test eax, 0x40000000
jne 0x4d1000
test eax, 0xc00000
je 0x4d1000
push 0xffffffffffffffec
push esi
call ebx
test al, 8
jne 0x4d1000
push 0x40
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4d1000
push esi
call fcn.004d01d0
add esp, 4
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d1b80
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 8]
test eax, eax
je 0x4d1c00
cmp dword [eax + 0x20], 0
je 0x4d1c00
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebx + 8]
cmp eax, dword [ecx + 0x20]
je 0x4d1c00
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call edi
mov edx, dword [ebx + 8]
mov esi, eax
mov eax, dword [edx + 0x20]
push 0
push eax
call edi
mov edi, eax
cmp esi, edi
je 0x4d1be9
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.004d1850
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.004d1850
pop ebx
ret