joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a39a
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, ecx
mov ecx, 0x104
cmp eax, ecx
ja 0x48a4f4
je 0x48a51a
cmp eax, 0xa1
jb 0x48a546
cmp eax, 0xa2
jbe 0x48a51a
cmp eax, 0xa3
jbe 0x48a546
cmp eax, 0xa5
jbe 0x48a51a
cmp eax, 0xa6
jbe 0x48a546
cmp eax, 0xa8
jbe 0x48a51a
cmp eax, 0x100
jne 0x48a546
cmp dword [esi + 0x80], 0xffffffff
je 0x48a51a
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x48a51a
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x48a4c0
dec eax
jne 0x48a51a
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [eax + 1]
add ecx, eax
cmp edi, ecx
jge 0x48a4b8
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x48a479
mov eax, dword [esi + 0x7c]
add eax, dword [esi + 0x80]
inc edi
cmp edi, eax
jl 0x48a451
jmp 0x48a4b8
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x1e4], 1
call dword [eax + 0x1ec]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1e8]
mov ecx, eax
call fcn.00413c95
push dword [esi + 0x80]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x248]
and dword [esi + 0x1e4], 0
xor eax, eax
inc eax
jmp 0x48a54e
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [ecx + eax - 1]
cmp edi, eax
jle 0x48a4b8
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x48a479
dec edi
cmp edi, dword [esi + 0x80]
jg 0x48a4d1
jmp 0x48a4b8
cmp eax, 0x200
jb 0x48a546
cmp eax, 0x202
jbe 0x48a51a
cmp eax, 0x203
jbe 0x48a546
cmp eax, 0x205
jbe 0x48a51a
add eax, 0xfffffdf9
cmp eax, 1
ja 0x48a546
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x48a530
cmp dword [ecx + 0x20], 0
je 0x48a530
push edi
call fcn.0042e797
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x48a546
cmp dword [ecx + 0x20], 0
je 0x48a546
push edi
call fcn.0042e797
push edi
mov ecx, esi
call fcn.004a435e
pop edi
pop esi
pop ebp
ret 4
Function at 0x48ec76
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x190]
test al, al
jns 0x48ec98
or eax, 0xffffffff
jmp 0x48ec9d
mov eax, dword [0x57845c]
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x290]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x5797d0
call fcn.0041cd8c
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x48ed3a
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x48ed3a
cmp edi, ebx
je 0x48ecef
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x200]
push eax
push 0x579f3c
call fcn.0041cd8c
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 8], 2
jne 0x48ed43
test ebx, ebx
je 0x48ed26
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x198]
test al, 0x40
je 0x48ed3a
cmp dword [ebp - 4], 0
je 0x48ed26
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x224]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x48ed3c
mov eax, dword [esi]
push 5
push 0
push edi
mov ecx, esi
call dword [eax + 0x1d0]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], 3
jne 0x48ed3a
test edi, edi
je 0x48ed3a
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x15c]
test eax, eax
je 0x48ed3a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x164]
test eax, eax
je 0x48ed3a
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x218]
mov eax, dword [esi]
push 0
push 1
push 5
push edi
mov ecx, esi
call dword [eax + 0x328]
mov edx, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
jmp 0x48ed3c
Function at 0x49263d
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x582c84], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x49266c
or dword [0x582c84], 1
mov ecx, 0x582c80
call fcn.00407951
push 0x5313f8
call fcn.005096dc
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x492678
call fcn.0040babf
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x4926f1
cmp dword [eax + 0x20], 0
je 0x4926f1
test eax, eax
je 0x49268f
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4926f1
mov eax, dword [edi + 4]
dec eax
je 0x4926d0
dec eax
je 0x4926a6
dec eax
jne 0x4926f1
mov esi, 0x428e
jmp 0x4926d5
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4926d5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x4926d5
add esi, 3
jmp 0x4926d5
mov esi, 0x3ea0
push esi
mov ecx, 0x582c80
call fcn.00401375
test eax, eax
je 0x492673
mov eax, dword [0x582c80]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4926f3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4930c4
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
xor ecx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebx + 0x9c], ecx
cmp dword [ebx + 0x90], ecx
je 0x493144
cmp dword [ebp + 0xc], ecx
jne 0x493144
cmp dword [ebx + 0x94], ecx
jne 0x493144
mov eax, dword [ebx + 0x20]
cmp eax, ecx
je 0x49313a
cmp eax, 0xffffffff
je 0x49313a
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xc8]
push dword [ebp - 8]
call fcn.0040d7c4
mov dword [ebx + 0x9c], eax
test eax, eax
jne 0x493144
xor eax, eax
jmp 0x493284
mov dword [ebx + 0x9c], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test eax, eax
je 0x49317f
cmp dword [ebp + 0xc], 0
jne 0x49317f
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xd8]
push dword [ebp - 8]
call fcn.0040d7c4
test eax, eax
jne 0x493133
xor ecx, ecx
cmp dword [ebx + 0x9c], ecx
jne 0x4931a5
mov eax, dword [ebx + 0x20]
cmp eax, ecx
jbe 0x4931a5
cmp eax, 0xffffffff
je 0x4931a5
cmp dword [ebx + 0x90], ecx
jne 0x4931a5
cmp dword [ebx + 0xa8], ecx
je 0x493133
push dword [ebx + 0x6c]
push 0x579664
call fcn.0041cd8c
lea esi, [ebx + 0x8c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x4931de
mov dword [eax + 0xf8], edi
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
cmp ecx, edi
je 0x493244
push edi
jmp 0x49323f
push dword [ebx + 0x6c]
push 0x57921c
call fcn.0041cd8c
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
je 0x49320a
cmp eax, edi
je 0x49320a
cmp dword [0x5815a4], edi
jne 0x49320a
push 1
push ebx
mov ecx, eax
call fcn.0047857c
jmp 0x493237
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x493222
push edi
call fcn.0042dd97
cmp eax, edi
je 0x493222
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x58]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test eax, eax
je 0x493133
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x493244
push ebx
call fcn.004308e2
cmp dword [ebx + 0x6c], edi
je 0x493281
lea esi, [ebx + 0x54]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0042101f
mov eax, dword [eax + 0x94]
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 0x401
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x6c]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4a7467
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x52ad0b
call fcn.005094ab
xor edi, edi
cmp dword [0x579118], edi
je 0x4a7530
cmp dword [0x579de8], 0xfffffffe
jne 0x4a751d
cmp dword [ebp + 8], 0xffffffff
je 0x4a7530
test byte [0x583050], 1
mov esi, 0x583030
jne 0x4a74c6
or dword [0x583050], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043f676
push 0x531478
call fcn.005096dc
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.0043f6cd
cmp dword [0x58302c], edi
je 0x4a74da
call fcn.0040babf
push edi
push edi
push 0x4a740f
call fcn.0050f679
add esp, 0xc
mov dword [0x58302c], eax
cmp eax, edi
jbe 0x4a750a
cmp eax, 0xffffffff
je 0x4a750a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [0x579de8], eax
jmp 0x4a7510
mov dword [0x58302c], edi
push 0x583038
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4a7530
mov eax, dword [ebp + 8]
mov dword [0x579de8], eax
cmp eax, 0xffffffff
jne 0x4a7530
mov dword [0x58302c], edi
call fcn.00509583
ret
Function at 0x4e2317
Capabilities:
Get common file path

Disassembly:
push 0x120
mov eax, 0x52d347
call fcn.00509514
mov esi, ecx
mov dword [ebp - 0x128], esi
call fcn.004e7dfc
push 0x15c
call fcn.0040ab01
pop ecx
mov ecx, eax
mov dword [ebp - 0x124], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4e235b
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004e92c5
jmp 0x4e235d
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004e7dce
call fcn.004165c6
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov byte [ebp + esi - 0x114], 0x5c
inc esi
mov dword [ebp - 0x124], esi
mov byte [ebp + esi - 0x114], bl
mov dword [ebp - 0x120], ebx
cmp edi, ebx
je 0x4e24f7
cmp dword [edi + 4], ebx
jle 0x4e24f7
lea ecx, [ebp - 0x118]
call fcn.00407951
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x118]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4e24db
lea ecx, [ebp - 0x11c]
call fcn.00407951
mov eax, dword [ebp - 0x120]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4e242c
push dword [ebp - 0x118]
lea eax, [ebp - 0x11c]
push 0x54e9e8
push eax
call fcn.00407e1b
add esp, 0xc
jmp 0x4e245e
jge 0x4e244c
push dword [ebp - 0x118]
inc eax
push eax
lea eax, [ebp - 0x11c]
push str._d__s
push eax
call fcn.00407e1b
add esp, 0x10
jmp 0x4e245e
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00407db1
push 0x15c
call fcn.0040ab01
pop ecx
mov dword [ebp - 0x12c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4e2482
mov ecx, eax
call fcn.004bb10c
mov esi, eax
jmp 0x4e2484
xor esi, esi
push dword [ebp - 0x11c]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.00418ee8
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x128]
push esi
call fcn.004e7dce
mov ecx, dword [ebp - 0x11c]
inc dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.004010ac
mov esi, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x118]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004010ac
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4e23c5
call fcn.00509597
ret
Function at 0x4e6eb1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4e6ec9
mov edi, dword [esi + 0xc]
jmp 0x4e6f09
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4e6ee2
call fcn.0041b064
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4e6ef7
call fcn.0041b064
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e6f09
call fcn.0041b064
call fcn.004165c6
cmp dword [eax + 0x3c], 0
je 0x4e6f1e
push edi
mov ecx, ebx
call fcn.004e5d14
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004e6dd7
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4e6f3c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4e6f48
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4ee0fb
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4ee145
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4ee145
call fcn.004ed9b6
test eax, eax
je 0x4ee145
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00408fc5
xor eax, eax
inc eax
jmp 0x4ee35d
cmp dword [ebx + 4], 0x100
push edi
jne 0x4ee354
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4ee242
push 0x11
call edi
test ax, ax
jl 0x4ee242
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4ee242
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4ee1b5
cmp eax, 0x20
jbe 0x4ee242
cmp eax, 0x24
jbe 0x4ee1a8
cmp eax, 0x26
je 0x4ee1a8
cmp eax, 0x28
jne 0x4ee242
call fcn.004ed9b6
test eax, eax
je 0x4ee242
mov ecx, esi
call fcn.00413c95
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004ed9b6
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4ee1ea
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00408fc5
jmp 0x4ee34f
call fcn.00410e20
test eax, eax
je 0x4ee34f
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.00410e58
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4ee218
xor edi, edi
jmp 0x4ee21b
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.00410e20
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4ee34f
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4ee31e
sub eax, 0x12
je 0x4ee2f6
sub eax, 0xb
je 0x4ee264
dec eax
dec eax
jne 0x4ee354
push 0x12
call edi
test ax, ax
jl 0x4ee354
push 0x11
call edi
test ax, ax
jl 0x4ee354
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4ee354
call fcn.004ed9b6
test eax, eax
jne 0x4ee34f
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004ed930
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040fa5d
test eax, eax
je 0x4ee34f
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0040fa5d
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4ee34f
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4ee30a
push 0
call fcn.004ed930
mov ecx, esi
call fcn.004105a3
test eax, eax
je 0x4ee354
mov ecx, esi
call fcn.004105a3
jmp 0x4ee348
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0040fa5d
test eax, eax
je 0x4ee354
push dword [esi + 0x20]
call edi
push eax
call fcn.0040fa5d
push 0
push esi
mov ecx, eax
call fcn.0040c3ee
mov ecx, eax
call fcn.00413c95
xor eax, eax
inc eax
jmp 0x4ee35c
push ebx
mov ecx, esi
call fcn.0040d827
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4fb696
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x52f952
call fcn.005094ab
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x4fb76c
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x4fb76c
cmp ebx, 0x43
je 0x4fb6d8
cmp ebx, 0x2d
jne 0x4fb76c
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4fb76c
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00407951
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.00407e1b
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.004010ac
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.004772f8
call fcn.00509583
ret 4

Function at 0x503812
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp byte [ebp + 0xc], 0
jne 0x503852
test edi, edi
jl 0x503852
cmp al, 0x20
je 0x503847
cmp word [ebp + 8], 0x71
jne 0x503852
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x50949c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x57b830]
jne 0x5094a6
repz ret
jmp fcn.005139ec
Function at 0x51d1f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005133c5
and dword [ebp - 4], 0
cmp dword [0x584d84], 0
mov ebx, eax
jne 0x51d2a9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x51d35a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x55a780
push edi
call esi
test eax, eax
je 0x51d35a
push eax
call fcn.00513353
mov dword [esp], 0x55a770
push edi
mov dword [0x584d84], eax
call esi
push eax
call fcn.00513353
mov dword [esp], 0x55a75c
push edi
mov dword [0x584d88], eax
call esi
push eax
call fcn.00513353
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x584d8c], eax
call esi
push eax
call fcn.00513353
pop ecx
mov dword [0x584d94], eax
test eax, eax
je 0x51d2a9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00513353
pop ecx
mov dword [0x584d90], eax
mov eax, dword [0x584d90]
cmp eax, ebx
je 0x51d301
cmp dword [0x584d94], ebx
je 0x51d301
push eax
call fcn.005133ce
push dword [0x584d94]
mov esi, eax
call fcn.005133ce
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x51d301
test edi, edi
je 0x51d301
call esi
test eax, eax
je 0x51d2f8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x51d2f8
test byte [ebp - 0xc], 1
jne 0x51d301
or dword [ebp + 0x10], 0x200000
jmp 0x51d33a
mov eax, dword [0x584d88]
cmp eax, ebx
je 0x51d33a
push eax
call fcn.005133ce
pop ecx
test eax, eax
je 0x51d33a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x51d33a
mov eax, dword [0x584d8c]
cmp eax, ebx
je 0x51d33a
push eax
call fcn.005133ce
pop ecx
test eax, eax
je 0x51d33a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x584d84]
call fcn.005133ce
pop ecx
test eax, eax
je 0x51d35a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x51d35c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4035a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x43e3f8]
push esi
mov esi, dword [esp + 8]
push esi
push eax
call fcn.00405a30
test eax, eax
je 0x4035d0
mov ecx, dword [0x43e3f8]
push str.when_selecting_the_database
push ecx
call fcn.00401be0
add esp, 8
mov eax, 1
pop esi
ret
mov eax, dword [0x43e408]
test eax, eax
jne 0x403632
mov al, byte [0x43e3ee]
test al, al
jne 0x4035eb
mov al, byte [0x43e3ef]
test al, al
je 0x403632
mov edx, dword [0x446d0c]
push esi
push str._n___n___Current_Database:__s_n___n
push edx
call fcn.00413428
mov al, byte [0x43e3f0]
add esp, 0xc
test al, al
jne 0x40361d
mov eax, dword [0x446d0c]
push esi
push str._nCREATE_DATABASE___32312_IF_NOT_EXISTS___s__n
push eax
call fcn.00413428
add esp, 0xc
mov ecx, dword [0x446d0c]
push esi
push str._nUSE__s__n
push ecx
call fcn.00413428
add esp, 0xc
mov al, byte [0x43e3e1]
test al, al
je 0x403662
push 0x400
push 0x400
push 0x43e434
push 0x43b1d0
call fcn.004040b0
add esp, 0x10
test al, al
je 0x403662
push 4
call fcn.00413491
xor eax, eax
pop esi
ret

Function at 0x404300
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x40430f
mov edi, 1
push edi
call fcn.00413e4a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404363
push esi
call fcn.00413e38
mov esi, eax
call fcn.00409e30
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x404346
mov edx, dword [fcn.0040b230]
mov dword [fcn.0040b230], edx
test al, 0x18
je 0x404357
push edi
push 0x24
push 5
call fcn.00406d20
add esp, 0xc
test esi, esi
pop esi
je 0x40437e
push 1
call fcn.00413491
test byte [esp + 0x10], 0x20
je 0x40437e
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x404bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov al, byte [0x43e438]
test al, al
jne 0x404c71
mov byte [0x43e438], 1
call fcn.00406ee0
call fcn.00409e90
mov eax, dword [0x43e43c]
test eax, eax
jne 0x404c47
push 0x4256bc
push str.mysql
mov dword [0x43e43c], 0xcea
call sub.WSOCK32.dll_getservbyname
test eax, eax
je 0x404c28
movzx eax, word [eax + 8]
push eax
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
mov dword [0x43e43c], eax
push str.MYSQL_TCP_PORT
call fcn.0041412e
add esp, 4
test eax, eax
je 0x404c47
push eax
call fcn.0041360f
add esp, 4
mov dword [0x43e43c], eax
mov eax, dword [0x43e440]
test eax, eax
jne 0x404c70
push str.MYSQL_UNIX_PORT
mov dword [0x43e440], 0x423990
call fcn.0041412e
add esp, 4
test eax, eax
je 0x404c70
mov dword [0x43e440], eax
ret
jmp fcn.00409d70