joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55b3c0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x5c4626
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x7353f8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
lea ecx, [esp + 8]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xac], ebx
call fcn.005aee65
cmp dword [0x78efb4], ebx
je 0x55b430
lea ecx, [esp + 8]
mov dword [esp + 0xa8], 0xffffffff
call fcn.005ac995
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
add esp, 0xa4
ret
mov edx, dword [0x7353f8]
push ebp
push edi
mov edi, 1
mov dword [0x78efb4], edi
mov dword [esp + 0x40], edx
cmp esi, ebx
mov byte [esp + 0xb0], 1
jne 0x55b459
mov dword [esp + 0x20], ebx
jmp 0x55b460
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
call fcn.005b1014
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x88]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], 5
mov dword [esp + 0x34], edx
call fcn.005acace
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x94]
mov edx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x1c], edx
jne 0x55b4be
mov dword [esp + 0x14], ebx
jmp 0x55b4c5
mov ebp, dword [eax + 0x1c]
mov dword [esp + 0x14], ebp
cmp ecx, 0xd
jne 0x55b4df
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x55b4d9
cmp eax, 2
jne 0x55b4df
mov dword [esp + 0x18], edi
jmp 0x55b4e3
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x55b4f1
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005ae49b
mov edi, eax
cmp edi, ebx
jne 0x55b501
xor eax, eax
jmp 0x55b504
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x55b52c
mov ecx, esi
call fcn.005b1014
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov esi, dword [esp + 0x1c]
push esi
call ebx
test eax, eax
je 0x55b544
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x18]
mov dword [0x78efb4], 0
test eax, eax
je 0x55b56d
mov esi, dword [esp + 0x14]
push esi
call ebx
test eax, eax
je 0x55b56d
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x40]
mov byte [esp + 0xb0], 0
call fcn.005ac995
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.005ac995
mov ecx, dword [esp + 0xa8]
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x55d470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5c4818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.005b3776
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.0055d3b0
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x178]
add ecx, 0x64
add eax, 0x64
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.005b36a4
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x55d537
cmp dword [esp + 0x40], 1
jne 0x55d535
cmp ecx, eax
jge 0x55d537
mov eax, ecx
cmp eax, 0x12c
jge 0x55d543
mov eax, 0x12c
mov ecx, esi
mov dword [esi + 0x194], eax
mov dword [esi + 0x1dc], 1
call fcn.0055d590
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005b37e8
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x5617a0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x5c4d06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [0x7353f8]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov ecx, esi
mov dword [esp + 0xb0], ebx
call fcn.005aee65
mov edx, dword [0x7353f8]
mov dword [esp + 0x3c], edx
cmp esi, ebx
mov byte [esp + 0xac], 1
jne 0x5617fa
mov dword [esp + 0x1c], ebx
jmp 0x561801
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
push edi
mov ecx, esi
call fcn.005b1014
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov edi, 1
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], 0xffffff96
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edx
call fcn.005acace
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x1c]
cmp eax, ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x1c], ecx
jne 0x561852
mov dword [esp + 0x14], ebx
jmp 0x561859
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x14], edx
cmp dword [esi + 0x44], 0xd
jne 0x561874
mov eax, dword [eax + 0x3c4]
cmp eax, edi
je 0x56186e
cmp eax, 2
jne 0x561874
mov dword [esp + 0x18], edi
jmp 0x561878
mov dword [esp + 0x18], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x561886
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005ae49b
mov edi, eax
cmp edi, ebx
jne 0x561896
xor eax, eax
jmp 0x561899
mov eax, dword [edi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x5618c1
mov ecx, esi
call fcn.005b1014
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x4e
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebx
test eax, eax
pop edi
je 0x5618dd
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5618fc
mov esi, dword [esp + 0x10]
push esi
call ebx
test eax, eax
je 0x5618fc
push 1
push 0xd
push 0x100
push esi
call ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0
call fcn.005ac995
lea ecx, [esp + 0xc]
mov dword [esp + 0xac], 0xffffffff
call fcn.005ac995
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x56c540
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x56c576
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x574d00
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x574d10
mov esi, 1
push esi
call fcn.005972a7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x574d62
call fcn.00599b48
mov edi, eax
call fcn.00577840
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x574d46
mov edx, dword [0x68a438]
mov dword [0x68a434], edx
test al, 0x18
je 0x574d57
push esi
push 0x24
push 5
call fcn.00578090
add esp, 0xc
test edi, edi
je 0x574d7d
push 1
call fcn.005991a1
test byte [esp + 0x14], 0x20
je 0x574d7d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x575e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x575f74
cmp byte [edx], 0
je 0x575f67
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.00575e00
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00575e00
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00575d70
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x575f31
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.00575db0
fmul qword [0x658938]
push ecx
fstp qword [esp]
call fcn.00595b58
fadd qword [0x658930]
add esp, 8
call fcn.00595c28
mov byte [ebx], al
inc ebx
dec edi
jne 0x575f04
lea ecx, [esp + 0x20]
push ecx
call fcn.00575db0
fmul qword [0x658938]
push ecx
fstp qword [esp]
call fcn.00595b58
add esp, 8
call fcn.00595c28
cmp esi, ebx
je 0x575f5d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x575f56
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x576340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x576370
mov byte [edi + esi], 2
jmp 0x5763a7
test al, 4
je 0x57637a
mov byte [edi + esi], 0xd
jmp 0x5763a7
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x576393
mov byte [edi + esi], 2
jmp 0x5763a7
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x5763a3
mov byte [edi + esi], 0x19
jmp 0x5763a7
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x576357
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x57641b
cmp dl, 0xd
je 0x57641b
xor edx, edx
jmp 0x576420
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x57640b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x576440
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.00574d00
mov esi, eax
add esp, 8
test esi, esi
jne 0x576461
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.00577a80
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x576486
push esi
call fcn.00574d90
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.005a39e9
push ebx
push edi
mov ebp, eax
call fcn.00577af0
push 0x5764c0
push ebp
push esi
call fcn.00578e20
push esi
call fcn.00574d90
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x5777b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x79a180
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x79a0b0]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
jne 0x57782b
push 0x4c
push 1
call fcn.005997d9
mov esi, eax
add esp, 8
test esi, esi
jne 0x5777f3
push 0x79a180
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x79a0b0]
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [0x78f38c]
inc eax
lea edx, [esi + 0xc]
mov dword [0x78f38c], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0057b2e0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x79a180
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x577cb0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00599b48
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.005a39e9
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x577daa
call fcn.00599b48
cmp dword [eax], 0
je 0x577cf7
call fcn.00599b48
mov ebp, dword [eax]
jmp 0x577cfa
or ebp, 0xffffffff
call fcn.00577840
test esi, esi
mov dword [eax], ebp
jne 0x577d0f
call fcn.00599b48
cmp dword [eax], 4
je 0x577d5f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x577d42
cmp esi, 0xffffffff
je 0x577d84
test al, 6
je 0x577d42
call fcn.00577840
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0057b310
add esp, 4
push eax
push 0x24
push 9
call fcn.00578090
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x577da2
test al, 6
je 0x577d50
test ah, 2
je 0x577da2
test esi, esi
jbe 0x577dae
test ah, 2
je 0x577dae
add dword [esp + 0x18], esi
sub edi, esi
call fcn.00599b48
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.005a39e9
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x577daa
jmp 0x577ce4
call fcn.00577840
mov eax, dword [eax]
push eax
push ebx
call fcn.0057b310
add esp, 4
push eax
push 0x24
push 2
call fcn.00578090
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x577dbb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x577dc4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x599793
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5997b3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00599ad5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5997d6
test byte [esp + 8], 2
je 0x5997d6
call fcn.00599b48
mov dword [eax], 0xd
call fcn.00599b51
mov dword [eax], 5
jmp 0x5997af
xor eax, eax
ret
Function at 0x5a08fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65def0
push 0x598584
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.005a089c]
test eax, eax
je 0x5a0945
mov dword [ebp - 4], 1
call eax
jmp 0x5a0941
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x5a094e
jmp fcn.005a089c

Function at 0x5aee65
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5aee9d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005ace3c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005ace14
jmp 0x5aeea9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5b06dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5b071f
call fcn.005b734c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x5b071f
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x5b0716
xor eax, eax
jmp 0x5b0727
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005b072d
pop edi
pop esi
pop ebx
ret 4

Function at 0x5b787b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5b78a9
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x5b78c7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005b77e1
jmp 0x5b78c7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5b78c7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005b77e1
test edi, edi
mov eax, edi
jne 0x5b78b1
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5ba68b
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x5ba6b3
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x5ba6c4
push 2
call edi
test ax, ax
jge 0x5ba6c4
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.005ae49b
cmp dword [esi + 0x30], ebx
jne 0x5ba79e
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.005ae49b
cmp eax, dword [esp + 0x34]
jne 0x5ba79e
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x5ba73a
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x5ba77f
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x5ba79e
cmp eax, 0x205
je 0x5ba79e
cmp eax, 0x201
je 0x5ba79e
cmp eax, 0x204
je 0x5ba79e
cmp eax, ebx
jne 0x5ba765
cmp dword [esp + 0x1c], 0x1b
je 0x5ba79e
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x79989c]
jbe 0x5ba794
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x5ba6f7
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x1001e54
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1004004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x2c
lea eax, [ebp - 0x238]
push esi
push eax
mov dword [ebp - 0x23c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10011f8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01001c16
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x1004030], eax
cmp eax, esi
je 0x1001efd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001efd
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01001ab0
test eax, eax
jne 0x1001f10
push dword [0x1004030]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01002443
leave
ret 0x10
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x1001f28
lea eax, [ebp - 0x23c]
push eax
push edi
call fcn.01001a1d
jmp 0x1001f78
push ebx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push eax
call edi
mov ebx, eax
cmp ebx, esi
jne 0x1001f4b
push 0x7f05
push esi
call edi
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call fcn.01001cc6
test eax, eax
jne 0x1001f6c
cmp dword [section..data], 8
jne 0x1001f6c
push esi
push esi
call fcn.01002de7
cmp ebx, esi
je 0x1001f77
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
pop ebx
push dword [0x1004030]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1001f00
Function at 0x1002411
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1003048
call fcn.010025d4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10043b0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10021c8
cmp eax, esi
jne 0x10021bb
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10021cb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10021a2
xor esi, esi
inc esi
mov eax, dword [0x10043ac]
cmp eax, esi
jne 0x10021de
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100220d
mov eax, dword [0x10043ac]
test eax, eax
jne 0x1002207
mov dword [0x10043ac], esi
push 0x100119c
push 0x1001190
call fcn.01002107
pop ecx
pop ecx
test eax, eax
je 0x100220d
jmp 0x1002335
mov dword [0x1004058], esi
mov eax, dword [0x10043ac]
cmp eax, esi
jne 0x1002231
push 0x100118c
push 0x1001184
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043ac], 2
test ebx, ebx
jne 0x100223d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10043b4], 0
je 0x1002261
push 0x10043b4
call fcn.01002549
pop ecx
test eax, eax
je 0x1002261
push 0
push 2
push 0
call dword [0x10043b4]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10022bd
test al, al
je 0x100227b
cmp dword [ebp - 0x1c], 0
jne 0x10022bd
mov al, byte [esi]
test al, al
je 0x100228b
cmp al, 0x20
ja 0x100228b
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100227b
test byte [ebp - 0x3c], 1
je 0x1002297
movzx eax, word [ebp - 0x38]
jmp 0x100229a
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1004054], eax
cmp dword [0x1004048], 0
jne 0x1002311
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10022cc
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10022df
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1002268
cmp dword [0x1004058], 0
jne 0x1002320
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004054]
jmp 0x1002341
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002619
ret
call fcn.01002721
jmp 0x1002168