joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9690
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ecx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 6
call fcn.004e9a60
mov eax, dword [esi + 0x100]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.IMM32.dll_ImmGetContext
push 0
mov ebp, eax
push 0
push 8
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
push 0
push 0
push 0x800
push ebp
mov edi, eax
call sub.IMM32.dll_ImmGetCompositionStringW
test eax, eax
je 0x4e96e5
test edi, edi
je 0x4e96e5
push ebp
mov ecx, esi
call fcn.004e98a0
push ebp
mov ecx, esi
call fcn.004e97f0
mov al, byte [esi + 0xd0]
test al, al
je 0x4e97d5
cmp edi, 2
jne 0x4e97d5
lea edx, [esp + 0xc]
push edi
push edx
push 8
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
mov eax, dword [esp + 0xc]
cmp ax, 0x20
jae 0x4e972a
cmp ax, 0xa
je 0x4e972a
cmp ax, 0xd
je 0x4e972a
cmp ax, 9
jne 0x4e97d5
cmp ax, 0xff60
ja 0x4e973a
cmp ax, 0xff00
jae 0x4e97d5
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x20]
cmp ecx, edx
jge 0x4e9775
push ecx
lea ecx, [esi + 0x18]
call fcn.0043cde0
test eax, eax
je 0x4e9758
mov eax, dword [eax]
jmp 0x4e975a
xor eax, eax
mov ecx, dword [esi + 0x88]
mov edx, dword [esp + 0xc]
push 1
add ecx, eax
push 0
push ecx
push edx
mov ecx, esi
call fcn.004e7620
jmp 0x4e977f
push 0
push eax
mov ecx, esi
call fcn.004e7540
mov ecx, dword [esi + 0x88]
push 0
push 4
inc ecx
push 0x15
push ebp
mov dword [esi + 0x88], ecx
call sub.IMM32.dll_ImmNotifyIME
mov edi, dword [esi + 0x84]
mov eax, dword [esi + 0x20]
inc edi
cmp edi, eax
jge 0x4e97c0
push ebx
lea ebx, [esi + 0x18]
push edi
mov ecx, ebx
call fcn.0043cde0
mov edx, dword [eax]
inc edx
inc edi
mov dword [eax], edx
mov eax, dword [esi + 0x20]
cmp edi, eax
jl 0x4e97aa
pop ebx
mov eax, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.004e76b0
mov ecx, esi
call fcn.004e8730
mov ecx, dword [esi + 0x100]
push ebp
mov edx, dword [ecx + 0x1c]
push edx
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4e98a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 4], eax
jne 0x4e98c5
mov eax, dword [esi + 0x100]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
push 0
push 0
push 0x800
push ebx
call sub.IMM32.dll_ImmGetCompositionStringW
push 0
push 0
push 0x800
push ebx
mov edi, eax
call sub.IMM32.dll_ImmGetCompositionStringA
mov ebx, eax
test ebx, ebx
jle 0x4e9917
push ebx
call fcn.0057110b
mov edx, dword [esp + 0x14]
add esp, 4
mov ebp, eax
push ebx
push ebp
push 0x800
push edx
call sub.IMM32.dll_ImmGetCompositionStringA
push ebp
call fcn.00571134
add esp, 4
test edi, edi
jle 0x4e9a33
push 0xffffffffffffffff
mov ecx, esi
call fcn.004ea0a0
test eax, eax
jne 0x4e9a33
push edi
mov dword [esi + 0xe0], edi
call fcn.0057110b
add esp, 4
mov ebp, eax
mov eax, dword [esp + 0x10]
push edi
push ebp
push 0x800
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov eax, edi
mov dword [esp + 0x14], 0
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x4e99ea
mov ebx, ebp
mov dword [esp + 0x18], eax
mov al, byte [esi + 0x11d]
test al, al
jne 0x4e99b2
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jge 0x4e99b2
push eax
lea ecx, [esi + 0x18]
call fcn.0043cde0
mov eax, dword [eax]
mov edx, dword [esi + 0x88]
mov cx, word [ebx]
mov edi, dword [esi + 0xc]
add eax, edx
push 1
push 0
push eax
push ecx
mov ecx, esi
call fcn.004e7620
cmp edi, eax
je 0x4e99dc
jmp 0x4e99c6
mov dx, word [ebx]
mov edi, dword [esi + 0xc]
push 0
push edx
mov ecx, esi
call fcn.004e7540
cmp edi, eax
je 0x4e99dc
mov ecx, dword [esi + 0x88]
mov eax, dword [esp + 0x14]
inc ecx
inc eax
mov dword [esi + 0x88], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
add ebx, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x4e996f
push ebp
call fcn.00571134
mov edi, dword [esi + 0x84]
mov eax, dword [esi + 0x20]
add esp, 4
inc edi
cmp edi, eax
jge 0x4e9a1e
lea ebx, [esi + 0x18]
push edi
mov ecx, ebx
call fcn.0043cde0
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add edx, ecx
inc edi
mov dword [eax], edx
mov eax, dword [esi + 0x20]
cmp edi, eax
jl 0x4e9a04
mov edx, dword [esi + 0x84]
mov ecx, esi
push edx
call fcn.004e76b0
mov ecx, esi
call fcn.004e8730
mov eax, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
test eax, eax
jne 0x4e9a52
mov ecx, dword [esi + 0x100]
mov eax, dword [esp + 4]
push eax
mov edx, dword [ecx + 0x1c]
push edx
call sub.IMM32.dll_ImmReleaseContext
pop esi
add esp, 0xc
ret 4
Function at 0x4e9d40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push 0xffffffffffffffff
call fcn.004ea0a0
test eax, eax
jne 0x4e9e16
mov ecx, esi
call fcn.004e86a0
mov ecx, esi
call fcn.004e74e0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.004e8310
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 0xe8]
cmp eax, 0x32
jbe 0x4e9e0f
mov edx, dword [esi + 0xec]
push edi
push edx
mov ecx, esi
call fcn.004e76b0
mov ecx, esi
call fcn.004e74e0
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x20]
lea edi, [eax - 1]
mov al, byte [esi + 0x11c]
test al, al
jne 0x4e9dd5
push edi
lea ecx, [esi + 0x18]
mov dword [esi + 0x84], edi
call fcn.0043cde0
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
sub ecx, edx
mov dword [esi + 0x88], ecx
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov al, byte [esi + 0x11c]
test al, al
jne 0x4e9dec
mov ecx, esi
call fcn.004e8730
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [esi + 0xec], edi
call ebx
mov dword [esi + 0xe8], eax
mov byte [esi + 0xf0], 0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov byte [esi + 0xf0], 1
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4eb500
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
jg 0x4eb511
mov eax, 6
pop esi
ret
mov eax, dword [esi + 0x24]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 6
push eax
mov dword [esi + 0x28], 0xfffffffe
call edi
mov ecx, dword [esi + 0x24]
push 4
push ecx
call edi
mov edx, dword [esi + 0x24]
push 0xf
push edx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 0x24]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [esi + 0x28]
mov edi, 0x1e
test eax, eax
je 0x4eb587
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
test edi, edi
jle 0x4eb56a
push 0x64
call ebx
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x4eb55a
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4eb587
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xfffffffffffffffe
push ecx
call edi
mov edx, dword [esi + 0x30]
push 0xfffffffffffffffe
push edx
call edi
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esi + 0x28], 0xffffffff
call edi
mov ecx, dword [esi + 0x805c]
push ecx
call edi
mov edx, dword [esi + 0x8070]
push edx
call edi
mov eax, dword [esi + 0x2c]
push eax
call edi
mov ecx, dword [esi + 0x30]
push ecx
call edi
pop edi
pop ebx
xor eax, eax
pop esi
ret

Function at 0x4eb670
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x4eb6e3
mov edx, dword [esp + 0x20]
lea edi, [esi + 0x8060]
lea ecx, [esp + 0x24]
push edi
push ecx
push eax
mov eax, dword [esi + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4eb6e3
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
jne 0x4eb715
mov edx, dword [esi + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ecx, [esp + 0x24]
push 1
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x4eb6e3
call ebp
cmp eax, 0x3e4
jne 0x4eb6f2
mov ecx, dword [esi + 0x24]
lea eax, [esp + 0x24]
push 1
push eax
push edi
push ecx
call ebx
test eax, eax
je 0x4eb6c8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x4ee140
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5af613
push eax
mov eax, 0x2724
mov dword fs:[0], esp
call fcn.00557520
mov eax, dword [esp + 0x2740]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], ebx
call fcn.00575b56
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2740], ebx
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee1c7
push 0x2f
lea ecx, [esp + 0x14]
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee1c7
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push 0x681408
push edx
call fcn.00575d17
mov ebx, 1
mov dword [esp + 0x18], ebx
mov byte [esp + 0x273c], bl
jmp 0x4ee1cb
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.0057585d
test bl, 1
mov dword [esp + 0x273c], 3
je 0x4ee1ee
lea ecx, [esp + 0x1c]
call fcn.00575ae8
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x2748]
mov ebp, dword [esp + 0x2744]
push eax
lea ecx, [esp + 0x24]
push 0x2710
push ecx
push str.default_default
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [esp + 0x274c]
lea esi, [esp + 0x20]
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4ee249
test cl, cl
je 0x4ee245
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4ee249
add eax, 2
add esi, 2
test cl, cl
jne 0x4ee225
xor eax, eax
jmp 0x4ee24e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4ee27d
lea ecx, [esp + 0x14]
mov byte [esp + 0x273c], al
call fcn.00575ae8
lea ecx, [esp + 0x10]
mov dword [esp + 0x273c], 0xffffffff
call fcn.00575ae8
mov eax, 1
jmp 0x4ee2b4
mov eax, dword [esp + 0x14]
push eax
push edx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x273c], 0
call fcn.00575ae8
lea ecx, [esp + 0x10]
mov dword [esp + 0x273c], 0xffffffff
call fcn.00575ae8
mov eax, esi
mov ecx, dword [esp + 0x2734]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2730
ret
Function at 0x4ee830
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5af647
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0xc], ebx
call fcn.00575b56
push 0x5c
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], ebx
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee8a4
push 0x2f
lea ecx, [esp + 0x38]
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee8a4
lea ecx, [esp + 0x34]
lea edx, [esp + 0xc]
push ecx
push 0x681408
push edx
call fcn.00575d17
mov ebx, 1
mov dword [esp + 8], ebx
mov byte [esp + 0x18], bl
jmp 0x4ee8a8
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 8]
call fcn.0057585d
test bl, 1
mov dword [esp + 0x18], 3
pop ebx
je 0x4ee8c9
lea ecx, [esp + 8]
call fcn.00575ae8
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 4]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.00575ae8
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4ee930
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5af687
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x28]
push ebx
xor ebx, ebx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], ebx
call fcn.00575b56
push 0x5c
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebx
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee9a4
push 0x2f
lea ecx, [esp + 0x30]
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4ee9a4
lea ecx, [esp + 0x2c]
lea edx, [esp + 0xc]
push ecx
push 0x681408
push edx
call fcn.00575d17
mov ebx, 1
mov dword [esp + 8], ebx
mov byte [esp + 0x18], bl
jmp 0x4ee9a8
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 8]
call fcn.0057585d
test bl, 1
mov dword [esp + 0x18], 3
pop ebx
je 0x4ee9c9
lea ecx, [esp + 8]
call fcn.00575ae8
mov eax, dword [esp]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push esi
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 4]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.00575ae8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4eea20
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5af6e9
push eax
mov eax, 0x2804
mov dword fs:[0], esp
call fcn.00557520
push ebx
push ebp
mov ebp, dword [esp + 0x281c]
push esi
xor ebx, ebx
mov esi, ecx
cmp ebp, ebx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
jne 0x4eea68
call fcn.0058d5de
mov eax, dword [eax + 4]
mov ebp, dword [eax + 0x90]
mov eax, dword [0x614cb0]
mov edi, dword [esi + 8]
mov dword [esp + 0x14], eax
push edi
lea ecx, [esp + 0x18]
push 0x600838
push ecx
mov dword [esp + 0x2828], ebx
call fcn.0056d732
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], edx
push ebp
call fcn.00575b56
push 0x5c
lea ecx, [esp + 0x14]
mov byte [esp + 0x2820], 1
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4eeaef
push 0x2f
lea ecx, [esp + 0x14]
call fcn.00575faf
cmp eax, 0xffffffff
jne 0x4eeaef
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x681408
push ecx
call fcn.00575d17
mov ebx, 1
mov dword [esp + 0x24], ebx
mov byte [esp + 0x281c], 2
jmp 0x4eeaf3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.0057585d
test bl, 1
mov dword [esp + 0x281c], 4
je 0x4eeb16
lea ecx, [esp + 0x1c]
call fcn.00575ae8
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x100]
push edx
push 0x2710
push eax
push str.default_default
push str.nItems
push str.Contests
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [esp + 0x28]
lea esi, [esp + 0x100]
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4eeb6e
test cl, cl
je 0x4eeb6a
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4eeb6e
add eax, 2
add esi, 2
test cl, cl
jne 0x4eeb4a
xor eax, eax
jmp 0x4eeb73
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4eeb8d
mov ecx, dword [esp + 0x18]
push ecx
push edx
push str.nItems
push str.Contests
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x18]
mov byte [esp + 0x281c], 1
call fcn.00575ae8
lea ecx, [esp + 0x10]
mov byte [esp + 0x281c], 0
call fcn.00575ae8
xor esi, esi
test edi, edi
jle 0x4eec03
mov bl, 5
push esi
lea edx, [esp + 0x18]
push str.Contest__i
push edx
call fcn.0056d732
mov ecx, dword [esp + 0x2c]
add esp, 0xc
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.004ef020
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x281c], bl
push ecx
push ebp
mov ecx, eax
call fcn.004ec570
lea ecx, [esp + 0x2c]
mov byte [esp + 0x281c], 0
call fcn.004ec1b0
inc esi
cmp esi, edi
jl 0x4eebb7
lea ecx, [esp + 0x14]
mov dword [esp + 0x281c], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x2814]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2810
ret 4
Function at 0x4f0e40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov eax, 0xffff
test esi, esi
jbe 0x4f0e7b
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [edx*4 + 0x5c96e8]
xor ax, bx
inc ecx
cmp ecx, esi
jb 0x4f0e56
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x4f42b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5aff5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push esi
push str..cwt
lea eax, [esp + 8]
push 0x681408
push eax
call fcn.00575d7d
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x158], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
setne al
test eax, eax
je 0x4f4334
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test dword [esp + 0xc], 0x1356
jne 0x4f4327
lea eax, [esp + 0x38]
push eax
call fcn.004f3c90
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
jne 0x4f4310
pop edi
push 0x5fe4b0
call fcn.004f3730
add esp, 4
test eax, eax
pop esi
jne 0x4f437e
push eax
push 0x30
push str.Cannot_load_ENG.cwt__MixW_will_now_exit.
call fcn.0057dfc5
lea ecx, [esp]
mov dword [esp + 0x14c], 0xffffffff
call fcn.00575ae8
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
add esp, 0x150
ret
lea ecx, [esp]
mov dword [esp + 0x14c], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x144]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x150
ret
Function at 0x4f8c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b0573
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 8]
sub esp, 0x18
mov esi, esp
lea eax, [esp + 0x38]
mov dword [esp + 0x24], esp
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], esi
call fcn.0057585d
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 1
push ecx
lea ecx, [esi + 4]
call fcn.0057585d
mov edx, dword [esp + 0x40]
mov byte [esp + 0x30], 2
mov dword [esi + 8], edx
mov al, byte [esp + 0x44]
mov byte [esi + 0xc], al
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x4c]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
call fcn.0057585d
push ebp
mov ecx, edi
mov byte [esp + 0x34], 0
call fcn.004f9860
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], 5
test ecx, ecx
je 0x4f8c9c
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea ecx, [esp + 0x34]
mov byte [esp + 0x18], 4
call fcn.00575ae8
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 3
call fcn.00575ae8
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00575ae8
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x10
ret 0x18
Function at 0x4fb960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebx, [esi + 0x12c]
mov eax, dword [esi + 0x1cc]
push 0
push edi
push 0x101d
push eax
call ebp
mov dword [ebx], eax
inc edi
add ebx, 0xc
cmp edi, 5
jl 0x4fb974
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ah, 0x80
jne 0x4fb9b2
push 0x10
call edi
test ah, 0x80
jne 0x4fb9b2
xor ebx, ebx
mov dword [esi + 0x310], ebx
jmp 0x4fb9b4
xor ebx, ebx
cmp dword [esi + 0x168], ebx
jne 0x4fb9c2
mov dword [esi + 0x310], ebx
cmp dword [esi + 0x310], ebx
je 0x4fb9e5
mov ecx, dword [0x64fe78]
mov edx, dword [ecx + 0x8dcc]
cmp dword [edx - 8], ebx
je 0x4fb9e5
push 0x379
call fcn.00489110
mov eax, dword [esi + 0x2e8]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4fba11
cmp dword [esi + 0x2ec], ebx
je 0x4fba08
push 2
push eax
call edi
mov eax, dword [esi + 0x2e8]
push eax
call ebp
mov eax, dword [esi + 0x2f0]
cmp eax, ebx
je 0x4fba31
cmp dword [esi + 0x2f4], ebx
je 0x4fba28
push 3
push eax
call edi
mov ecx, dword [esi + 0x2f0]
push ecx
call ebp
mov eax, dword [esi + 0x2e0]
cmp eax, ebx
je 0x4fba51
cmp dword [esi + 0x2e4], ebx
je 0x4fba48
push 4
push eax
call edi
mov edx, dword [esi + 0x2e0]
push edx
call ebp
mov ecx, esi
call fcn.005726e8
mov ecx, dword [esi + 0x32c]
cmp ecx, ebx
je 0x4fba7e
call fcn.005799d3
mov ecx, dword [esi + 0x32c]
cmp ecx, ebx
je 0x4fba78
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x32c], ebx
cmp esi, ebx
je 0x4fba8b
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 4]
pop edi
pop esi
mov dword [0x64fe74], ebx
pop ebp
pop ebx
ret
Function at 0x4fb968
Capabilities:
Log keystrokes via polling
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebx, [esi + 0x12c]
mov eax, dword [esi + 0x1cc]
push 0
push edi
push 0x101d
push eax
call ebp
mov dword [ebx], eax
inc edi
add ebx, 0xc
cmp edi, 5
jl 0x4fb974
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ah, 0x80
jne 0x4fb9b2
push 0x10
call edi
test ah, 0x80
jne 0x4fb9b2
xor ebx, ebx
mov dword [esi + 0x310], ebx
jmp 0x4fb9b4
xor ebx, ebx
cmp dword [esi + 0x168], ebx
jne 0x4fb9c2
mov dword [esi + 0x310], ebx
cmp dword [esi + 0x310], ebx
je 0x4fb9e5
mov ecx, dword [0x64fe78]
mov edx, dword [ecx + 0x8dcc]
cmp dword [edx - 8], ebx
je 0x4fb9e5
push 0x379
call fcn.00489110
mov eax, dword [esi + 0x2e8]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4fba11
cmp dword [esi + 0x2ec], ebx
je 0x4fba08
push 2
push eax
call edi
mov eax, dword [esi + 0x2e8]
push eax
call ebp
mov eax, dword [esi + 0x2f0]
cmp eax, ebx
je 0x4fba31
cmp dword [esi + 0x2f4], ebx
je 0x4fba28
push 3
push eax
call edi
mov ecx, dword [esi + 0x2f0]
push ecx
call ebp
mov eax, dword [esi + 0x2e0]
cmp eax, ebx
je 0x4fba51
cmp dword [esi + 0x2e4], ebx
je 0x4fba48
push 4
push eax
call edi
mov edx, dword [esi + 0x2e0]
push edx
call ebp
mov ecx, esi
call fcn.005726e8
mov ecx, dword [esi + 0x32c]
cmp ecx, ebx
je 0x4fba7e
call fcn.005799d3
mov ecx, dword [esi + 0x32c]
cmp ecx, ebx
je 0x4fba78
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x32c], ebx
cmp esi, ebx
je 0x4fba8b
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 4]
pop edi
pop esi
mov dword [0x64fe74], ebx
pop ebp
pop ebx
ret

Function at 0x4fbd90
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x2e0]
test eax, eax
jne 0x4fbde6
mov eax, dword [esi + 0x88]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4fbde6
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx - 8]
test eax, eax
je 0x4fbde6
lea edx, [esp + 4]
push edx
push 0
push esi
push 0x4fdb00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x2e0], eax
je 0x4fbde6
push 0
lea ecx, [esi + 0x1ec]
call fcn.00575233
pop esi
pop ecx
ret