joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fdd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x432
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x61
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x1036
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x14], 0xc8
mov dword [ebp - 0x10], 0x3c
mov dword [ebp - 0xc], 0x28
mov byte [ebp - 0x20], 0x4e
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0x41
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x74
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x27], 0x6b
mov byte [ebp - 0x26], 0
mov byte [ebp - 8], 0x42
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x73
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x38], ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x34], edx
lea eax, [ebp - 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], 0
jmp 0x42fe83
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 3
jae 0x42feca
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x58], 0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp + edx*4 - 0x14]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp + ecx*4 - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
push 0x101b
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x42fe7a
mov esp, ebp
pop ebp
ret
Function at 0x431120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0x12345678
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax], 0
setne cl
push ecx
push 0x3f1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0x3f2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax], 0
sete cl
push ecx
push 0x3f2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x3f3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x14], 0x4e
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1f], 0
mov byte [ebp - 8], 0x47
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x69
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x143
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x24]
push eax
push 0
push 0x143
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [ebp - 8]
push edx
push 0
push 0x143
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0x143
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
push 0x14e
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax], 0
sete cl
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0xff
push 0xc5
push 0x3f4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
push ecx
push 0x3f4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax], 0
sete cl
push ecx
push 0x3f4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4318f0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0x12345678
push 0
mov eax, dword [ebp - 4]
push eax
push 0x8007
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x596b0]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x15fb3c], 0
je 0x4319f4
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0x8004667e
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_ioctlsocket
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0
mov ecx, dword [ebp - 4]
add ecx, 0x15fc58
push ecx
mov edx, dword [ebp - 4]
add edx, 0x15fb58
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x15fb54]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x15fb50]
push ecx
call sub.WS2_32.dll_htons
movzx edx, ax
push edx
mov eax, dword [ebp - 4]
add eax, 0x15fb40
push eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 2]
push edx
call sub.WS2_32.dll_ntohs
movzx eax, ax
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call sub.WS2_32.dll_inet_ntoa
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00431a10
add esp, 0x24
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
lea ecx, [ebp - 8]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_ioctlsocket
xor eax, eax
cmp dword [ebp - 0x10], 0
setne al
dec eax
jmp 0x431a05
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_connect
mov esp, ebp
pop ebp
ret
Function at 0x432660
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0x12345678
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x23], 0x25
mov byte [ebp - 0x22], 0x30
mov byte [ebp - 0x21], 0x38
mov byte [ebp - 0x20], 0x58
mov byte [ebp - 0x1f], 0xd
mov byte [ebp - 0x1e], 0xa
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 9
mov byte [ebp - 0x17], 0x25
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0x38
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0x13], 0xd
mov byte [ebp - 0x12], 0xa
mov byte [ebp - 0x11], 0
mov byte [ebp - 4], 0xd
mov byte [ebp - 3], 0xa
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], 0x2d
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0
cmp dword [ebp + 0x10], 0
je 0x4326f7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
jmp 0x4326fd
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 8]
add eax, 0x596c8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x2c], 0
jmp 0x432731
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jge 0x4327e6
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2c]
mov dl, byte [ecx]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x596c8
push ecx
call fcn.00432800
add esp, 0xc
mov edx, dword [ebp + 0xc]
sub edx, 1
cmp dword [ebp - 0x2c], edx
jge 0x43277b
mov eax, dword [ebp - 0x2c]
and eax, reloc.WS2_32.dll_ntohs
jns 0x432776
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xf
jne 0x432796
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 8]
add eax, 0x596c8
push eax
call fcn.004328a0
add esp, 0xc
jmp 0x4327e1
mov ecx, dword [ebp - 0x2c]
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x4327a6
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 7
jne 0x4327c7
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x596c8
push ecx
call fcn.004328a0
add esp, 0xc
jmp 0x4327e1
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x596c8
push ecx
call fcn.004328a0
add esp, 0xc
jmp 0x432728
mov eax, dword [ebp - 8]
add eax, 0x596c8
mov esp, ebp
pop ebp
ret
Function at 0x435510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x4d
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x14], 0x59
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0xfe
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0xfd
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x6d
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x50], 0x56
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x63
mov byte [ebp - 0x4d], 0x63
mov byte [ebp - 0x4c], 0x68
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x65
mov byte [ebp - 0x49], 0x74
mov byte [ebp - 0x48], 0x74
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x2c], 0x56
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x69
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x48
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x6d
mov byte [ebp - 0x23], 0x6d
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0
mov byte [ebp - 8], 0x41
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x61
mov byte [ebp - 3], 0x6e
mov byte [ebp - 2], 0x6f
mov byte [ebp - 1], 0
mov byte [ebp - 0x58], 0xd1
mov byte [ebp - 0x57], 0xf2
mov byte [ebp - 0x56], 0xe0
mov byte [ebp - 0x55], 0xf0
mov byte [ebp - 0x54], 0xe5
mov byte [ebp - 0x53], 0xf6
mov byte [ebp - 0x52], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x40], ecx
lea edx, [ebp - 0x50]
mov dword [ebp - 0x3c], edx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0x58]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x5c], 0
jmp 0x43563c
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 6
jae 0x435662
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp + ecx*4 - 0x44]
push edx
call fcn.0042c500
add esp, 4
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x435660
mov eax, dword [ebp - 0x60]
jmp 0x435664
jmp 0x435633
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x437020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov byte [ebp - 0x30], 0x4c
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x67
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x76
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x70
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x68], 0x41
mov byte [ebp - 0x67], 0x6d
mov byte [ebp - 0x66], 0x6d
mov byte [ebp - 0x65], 0x69
mov byte [ebp - 0x64], 0x6e
mov byte [ebp - 0x63], 0x2e
mov byte [ebp - 0x62], 0x20
mov byte [ebp - 0x61], 0x4d
mov byte [ebp - 0x60], 0x61
mov byte [ebp - 0x5f], 0x67
mov byte [ebp - 0x5e], 0x61
mov byte [ebp - 0x5d], 0x7a
mov byte [ebp - 0x5c], 0x7a
mov byte [ebp - 0x5b], 0x69
mov byte [ebp - 0x5a], 0x6e
mov byte [ebp - 0x59], 0x69
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x3c], 0x4d
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], 0x67
mov byte [ebp - 0x39], 0x61
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], 0x69
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x69
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0xe9
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0
mov byte [ebp - 0x74], 0xca
mov byte [ebp - 0x73], 0xeb
mov byte [ebp - 0x72], 0xe0
mov byte [ebp - 0x71], 0xe4
mov byte [ebp - 0x70], 0xee
mov byte [ebp - 0x6f], 0xe2
mov byte [ebp - 0x6e], 0xf9
mov byte [ebp - 0x6d], 0xe8
mov byte [ebp - 0x6c], 0xea
mov byte [ebp - 0x6b], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x50], ecx
lea edx, [ebp - 0x68]
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x44], ecx
lea edx, [ebp - 0x74]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x78], 0
jmp 0x4371a4
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 6
jae 0x4371ca
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp + ecx*4 - 0x54]
push edx
call fcn.0042c500
add esp, 4
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4371c8
mov eax, dword [ebp - 0x7c]
jmp 0x4371cc
jmp 0x43719b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4371d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov byte [ebp - 0x114], 0x2f
mov byte [ebp - 0x113], 0x73
mov byte [ebp - 0x112], 0x61
mov byte [ebp - 0x111], 0x66
mov byte [ebp - 0x110], 0x65
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6f
mov byte [ebp - 0x10d], 0x78
mov byte [ebp - 0x10c], 0x5f
mov byte [ebp - 0x10b], 0x70
mov byte [ebp - 0x10a], 0x61
mov byte [ebp - 0x109], 0x73
mov byte [ebp - 0x108], 0x73
mov byte [ebp - 0x107], 0x77
mov byte [ebp - 0x106], 0x6f
mov byte [ebp - 0x105], 0x72
mov byte [ebp - 0x104], 0x64
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0
mov byte [ebp - 0x100], 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x17
mov word [ebp - 0xff], ax
mov byte [ebp - 0xfd], 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xfc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movzx edx, word [ebp - 0xff]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.00433df0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4372f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x13
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x78
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0
push 0x13
lea eax, [ebp - 0x14]
push eax
call fcn.00433df0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x437ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x5f
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x5f
mov byte [ebp - 5], 0x31
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.00437b10
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x437bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x5f
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x5f
mov byte [ebp - 5], 0x32
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.00437b10
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x439510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x12
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x72
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
push 0x12
lea eax, [ebp - 0x14]
push eax
call fcn.00433df0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x439570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x12
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x77
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0
push 0x12
lea eax, [ebp - 0x14]
push eax
call fcn.00433df0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x439a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x76
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.00437b10
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x439c10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x12345678
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x439c62
push 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
or eax, 1
push eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
push edx
push 0x102
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x596b4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x439c1b
mov esp, ebp
pop ebp
ret
Function at 0x439d90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], 0x12345678
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
xor ecx, ecx
test eax, eax
setl cl
mov dword [ebp - 0x24], ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
xor eax, eax
test edx, edx
setl al
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0xc]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x1c], edx
jne 0x439e08
cmp dword [ebp - 0x24], 0
jne 0x439e08
cmp dword [ebp - 0x18], 0
jne 0x439e08
cmp dword [ebp - 0x28], 0
jne 0x439e08
mov dword [ebp - 0x2c], 1
jmp 0x439e0f
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 0
jne 0x439e36
cmp dword [ebp - 0x24], 0
jne 0x439e36
cmp dword [ebp - 0x18], 0
jne 0x439e36
cmp dword [ebp - 0x28], 0
je 0x439e36
mov dword [ebp - 0x30], 1
jmp 0x439e3d
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x1c], 0
jne 0x439e64
cmp dword [ebp - 0x24], 0
je 0x439e64
cmp dword [ebp - 0x18], 0
jne 0x439e64
cmp dword [ebp - 0x28], 0
je 0x439e64
mov dword [ebp - 0x34], 1
jmp 0x439e6b
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x1599cc], 0
je 0x439ec3
cmp dword [ebp - 0x10], 0x24
jne 0x439eac
cmp dword [ebp - 0x14], 0
je 0x439eaa
cmp dword [ebp - 0x20], 0
je 0x439eaa
call fcn.00439f40
jmp 0x439ec3
cmp dword [ebp - 0x10], 0x4b
jne 0x439ec3
cmp dword [ebp - 8], 0
je 0x439ec3
cmp dword [ebp - 0x20], 0
je 0x439ec3
call fcn.00439ef0
cmp dword [ebp - 0x10], 0x2d
jne 0x439eda
cmp dword [ebp - 4], 0
je 0x439eda
cmp dword [ebp - 0x20], 0
je 0x439eda
call fcn.0043a630
mov eax, 1
mov esp, ebp
pop ebp
ret