joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a28a8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, ecx
mov edx, dword [ebp - 8]
cmp byte [edx], 0
jne 0x4a28fb
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, esi
mov ebx, 8
test cl, 1
je 0x4a28de
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4a28e0
shr ecx, 1
dec ebx
jne 0x4a28cf
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
inc esi
add dword [ebp - 0xc], 4
cmp esi, 0x100
jne 0x4a28c8
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4a2940
inc edx
xor esi, esi
cmp esi, 0x7ffffffe
jbe 0x4a2913
call fcn.00403edc
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + esi]
xor ecx, eax
and ecx, 0xff
cmp ecx, 0xff
jbe 0x4a292f
call fcn.00403edc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4a2906
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a941c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
test ebx, ebx
je 0x4a952b
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
call fcn.0044702c
mov byte [ebp - 9], al
xor eax, eax
call fcn.00447098
xor eax, eax
push ebp
push 0x4a9524
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.004a7c3c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a9506
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9814
dec eax
test eax, eax
jl 0x4a94f0
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aa86c
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 8]
je 0x4a94e8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aa86c
call fcn.004aa54c
cmp al, 1
je 0x4a94e8
xor eax, eax
push ebp
push 0x4a94de
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aa86c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a94e8
inc dword [ebp - 4]
dec dword [ebp - 0x14]
jne 0x4a9489
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a950d
lea eax, [ebp - 0x10]
call fcn.0040f80c
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a958c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
test esi, esi
je 0x4a977f
test edi, edi
je 0x4a9623
call fcn.004a70dc
xor eax, eax
push ebp
push 0x4a961c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9814
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a9609
mov edx, ebx
mov eax, esi
call fcn.004a9824
cmp edi, dword [eax + 4]
jne 0x4a9603
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.004a9824
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a95f8
cmp dword [ebp - 8], 0x103
je 0x4a9603
mov edx, ebx
mov eax, esi
call fcn.004a9370
jmp 0x4a9609
dec ebx
cmp ebx, 0xffffffff
jne 0x4a95c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a977f
call fcn.004a70f4
ret
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi + 0xc]
cmp eax, edx
jbe 0x4a964f
sub eax, edx
cmp eax, 0x3e8
jae 0x4a964f
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004a958c
jmp 0x4a977f
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0xc], eax
xor eax, eax
call fcn.004a7c3c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a9778
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004aa864
mov edi, eax
dec edi
test edi, edi
jl 0x4a96ef
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
cmp dword [eax + 0xc], 0
je 0x4a96eb
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 4]
je 0x4a96eb
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a96d9
cmp dword [ebp - 8], 0x103
je 0x4a96eb
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov byte [eax + 0x58], 1
mov byte [ebp - 0xd], 1
inc ebx
dec edi
jne 0x4a9685
cmp byte [ebp - 0xd], 0
jne 0x4a96ff
call fcn.00404a30
jmp 0x4a977f
call fcn.004a70dc
xor eax, eax
push ebp
push 0x4a975b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9814
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a9748
mov edx, ebx
mov eax, esi
call fcn.004a9824
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
call fcn.004a9534
test al, al
je 0x4a9742
mov edx, ebx
mov eax, esi
call fcn.004a9370
dec ebx
cmp ebx, 0xffffffff
jne 0x4a9721
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9762
call fcn.004a70f4
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aee74
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004b0944
mov esi, ebx
test esi, esi
jne 0x4aeeb2
push 0x4aefe0
push 0x4aefec
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4aeeb2
mov edx, dword [ebp - 4]
push edx
call eax
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.004038b8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4aefd4
xor eax, eax
push ebp
push 0x4aefcd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0x4aeeec
mov ebx, dword [ebp + 8]
jmp 0x4aeefb
lea edx, [ebp - 8]
mov eax, 0xcc
call fcn.0040f828
mov ebx, eax
xor eax, eax
push ebp
push 0x4aefaf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x4aef15
mov dword [ebx], 0x10007
cmp dword [ebp + 8], 0
jne 0x4aef29
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x4aef93
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x90]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadSelectorEntry
test eax, eax
je 0x4aef93
cmp dword [ebp + 0x1c], 0
je 0x4aef4f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4aef58
mov eax, dword [ebx + 0xb8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004aee18
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
movzx eax, byte [ebp + 0x18]
push eax
push esi
push 1
movzx eax, byte [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push ebx
mov ecx, dword [ebx + 0xb4]
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.004aed74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aefb6
cmp dword [ebp + 8], 0
jne 0x4aefae
mov eax, dword [ebp - 8]
call fcn.004030b8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4b0bfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov byte [ebp - 0x7d], cl
mov edi, edx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov edx, dword [0x473fdc]
call fcn.00405c60
xor eax, eax
push ebp
push 0x4b0c82
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4b0c66
mov eax, edi
call fcn.004b0ecc
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b0c66
inc ebx
xor esi, esi
lea ecx, [ebp - 0x78]
mov edx, esi
mov eax, edi
call fcn.004b0f44
movzx eax, byte [ebp - 0x7d]
xor al, 1
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
call fcn.004b0cdc
inc esi
dec ebx
jne 0x4b0c3e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0c89
lea eax, [ebp - 0x78]
mov edx, dword [0x473fdc]
call fcn.00405d30
ret
Function at 0x4bb804
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bb825
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bb812
pop edi
pop esi
pop ebx
ret

Function at 0x4bb860
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bb82c
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bb82c
mov esi, eax
xor eax, eax
mov edx, dword [0x66b85c]
mov dword [ebp - 8], edx
mov edx, dword [0x66b860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x66b864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x66b868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bb8ae
mov eax, ebx
call fcn.004bb82c
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bb82c
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb90c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bb82c
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bb82c
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [0x66b85c]
mov dword [ebp - 8], edx
mov edx, dword [0x66b860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x66b864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x66b868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bb95d
mov eax, ebx
call fcn.004bb82c
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bb82c
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c77d8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 4], 0x12345678
mov dword [ebx + 8], 0x23456789
mov dword [ebx + 0xc], 0x34567890
mov eax, dword [ebp - 4]
call fcn.00405308
mov esi, eax
test esi, esi
jle 0x4c784a
mov edi, 1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + edi - 1]
mov eax, dword [ebx + 4]
call fcn.00449ffc
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449ffc
mov dword [ebx + 0xc], eax
inc edi
dec esi
jne 0x4c780c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c7850
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x4c787b
mov ecx, 0x321
mov edx, 0x4c7a5c
mov eax, 0x4c7a84
call fcn.00404f58
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c77d8
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00403608
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.00449ffc
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449ffc
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4c788f
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c77d8
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [edi]
mov eax, dword [ebx + 4]
call fcn.00449ffc
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449ffc
mov dword [ebx + 0xc], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4c7911
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.00449ffc
mov edi, eax
mov dword [ebx + 4], edi
and edi, 0xff
add dword [ebx + 8], edi
imul edi, dword [ebx + 8], 0x8088405
inc edi
mov dword [ebx + 8], edi
mov edx, edi
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449ffc
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.00449ffc
mov edi, eax
mov dword [ebx + 4], edi
and edi, 0xff
add dword [ebx + 8], edi
imul edi, dword [ebx + 8], 0x8088405
inc edi
mov dword [ebx + 8], edi
mov edx, edi
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449ffc
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7ac0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov esi, edx
mov edi, ecx
dec edi
test edi, edi
jl 0x4c7b52
inc edi
movzx eax, word [ebp - 0xc]
and ax, 0xffff
or ax, 2
movzx ebx, byte [esi]
movzx edx, ax
xor ax, 1
movzx eax, ax
imul edx, eax
shr edx, 8
xor dl, bl
mov byte [ebp - 5], dl
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00449ffc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0xff
add dword [ebp - 0x10], eax
imul ebx, dword [ebp - 0x10], 0x8088405
inc ebx
mov dword [ebp - 0x10], ebx
mov edx, ebx
shr edx, 0x18
mov eax, dword [ebp - 0xc]
call fcn.00449ffc
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 5]
mov byte [esi], al
inc esi
dec edi
jne 0x4c7af1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca4a8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004bb020
mov ebx, eax
mov eax, ebx
call fcn.00488df8
mov byte [ebp - 0x11], al
mov eax, ebx
call fcn.00488dc8
mov byte [ebp - 0x12], al
mov eax, ebx
call fcn.00488d98
mov byte [ebp - 0x13], al
cmp byte [ebp - 0x11], 0
jne 0x4ca4f8
cmp byte [ebp - 0x12], 0
jne 0x4ca4f8
cmp byte [ebp - 0x13], 0
jne 0x4ca4f8
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4ca601
mov eax, ebx
call fcn.00488d2c
mov byte [ebp - 0x14], al
mov eax, ebx
call fcn.00488cf4
mov ebx, eax
mov dl, 1
mov eax, dword [0x438c74]
call fcn.00403fdc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ca5fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.004a7c3c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ca5c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004aa864
mov esi, eax
dec esi
test esi, esi
jl 0x4ca5ab
inc esi
xor edi, edi
push ebp
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
push ebx
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.004ca410
pop ecx
test al, al
je 0x4ca5a7
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4ca5a7
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aa86c
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0043b40c
inc edi
dec esi
jne 0x4ca552
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca5c8
lea eax, [ebp - 0xc]
call fcn.0040f80c
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ca60c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test eax, eax
je 0x4ca666
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca65f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4ca649
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0043b56c
push eax
call sub.kernel32.dll_ResumeThread
inc esi
dec ebx
jne 0x4ca635
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca666
lea eax, [ebp - 4]
call fcn.0040f80c
ret
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d37e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0
push 0
push 0xe
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
inc edi
mov eax, esi
mov edx, edi
call fcn.00405794
mov eax, esi
call fcn.00405564
mov edx, 1
dec edx
test eax, eax
je 0x4d3831
cmp edx, dword [eax - 4]
jb 0x4d3836
call fcn.00403edc
inc edx
lea eax, [eax + edx - 1]
push eax
push edi
push 0xd
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
mov eax, esi
call fcn.00405794
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4d3e0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
movzx eax, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4ddbc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x4ddbde
mov byte [ebp - 5], 1
jmp 0x4ddcb6
mov byte [ebp - 5], 0
mov esi, dword [ebp - 4]
cmp esi, 0x10000
jb 0x4ddcb6
cmp esi, ebx
jb 0x4ddcb6
mov eax, esi
sub eax, ebx
cmp eax, 0x7ffffffe
jge 0x4ddcb6
mov edx, esi
sub edx, ebx
inc edx
mov eax, ebx
call fcn.0040ea20
test al, al
je 0x4ddcb6
xor eax, eax
push ebp
push 0x4ddcac
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4ddc96
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, ebx
call fcn.00414188
cmp byte [ebp - 0x4f], 0
je 0x4ddc43
cmp ebx, dword [ebp - 0x54]
jne 0x4ddc4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
mov ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x48]
cmp esi, 0xcc
je 0x4ddc8c
cmp esi, 0xc2
je 0x4ddc8c
cmp esi, 0xc3
je 0x4ddc8c
cmp byte [ebp - 0x35], 0
je 0x4ddc96
mov edi, dword [ebp - 0x48]
cmp edi, 0xe9
je 0x4ddc8c
cmp edi, 0xe8
je 0x4ddc8c
cmp edi, 0xff
jne 0x4ddc96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
mov eax, dword [ebp - 4]
dec eax
cmp eax, ebx
ja 0x4ddc2c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f1334
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x4f1469
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4f143c
xor edx, edx
push ebp
push 0x4f1435
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x4f1381
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f140a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x4f13f9
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4f13c0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040550c
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00403348
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1400
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x565c48]
mov dl, 1
mov eax, dword [0x426e1c]
call fcn.0042c74c
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1470
lea eax, [ebp - 4]
call fcn.0040502c
ret