joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9fe0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x4c9ffa
mov eax, dword [ebp + 8]
sub eax, 8
mov dword [ebp - 0x1c], eax
jmp 0x4ca001
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x4ca029
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x4ca087
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c8a0
push str.cityitem_itemdel
lea ecx, [ebp - 0x10]
call fcn.00453fe0
test eax, eax
jne 0x4ca07d
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x180]
call eax
lea ecx, [ebp - 0x10]
call fcn.0040f740
jmp 0x4ca020
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4ca090
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x4ca0aa
mov eax, dword [ebp + 8]
sub eax, 8
mov dword [ebp - 0x1c], eax
jmp 0x4ca0b1
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x4ca0d9
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x4ca137
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c8a0
push str.cityitem_itemdel
lea ecx, [ebp - 0x10]
call fcn.00453fe0
test eax, eax
jne 0x4ca12d
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x180]
call eax
lea ecx, [ebp - 0x10]
call fcn.0040f740
jmp 0x4ca0d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x4ca3ec
mov eax, dword [ebp - 0xc]
sub eax, 0x3e0
mov dword [ebp - 0x10], eax
jmp 0x4ca3f3
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1f4
je 0x4ca422
cmp dword [ebp - 0x14], 0x200
je 0x4ca449
jmp 0x4ca45c
push 0x1f4
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x4dda20
call fcn.00547a7d
add esp, 0xc
jmp 0x4ca45c
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0x4ca980
call fcn.00547a7d
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4cf890
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570480
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x434
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x444], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push str.GetWeb
lea ecx, [ebp - 0x30]
call fcn.004cfa60
push 0x400000
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x30]
call fcn.004cfa40
push eax
lea ecx, [ebp - 0x1c]
call fcn.004cfc20
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x13
lea ecx, [ebp - 0x1c]
call fcn.004cfc70
lea ecx, [ebp - 0x20]
call fcn.0040ee90
cmp dword [ebp - 0x24], 0xc8
jne 0x4cf975
mov byte [ebp - 0x440], 0
push 0x400
push 0
lea ecx, [ebp - 0x43f]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x400
lea edx, [ebp - 0x440]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004cfbe0
test eax, eax
jbe 0x4cf975
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x20]
call fcn.004a5650
jmp 0x4cf94c
lea ecx, [ebp - 0x1c]
call fcn.004cfa10
lea ecx, [ebp - 0x30]
call fcn.004cfa10
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x20]
call fcn.0040f740
lea ecx, [ebp - 0x1c]
call fcn.004cfd30
lea ecx, [ebp - 0x30]
call fcn.004cfbc0
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x4cf9ea
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8

Function at 0x4cfa60
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x214]
call fcn.004cfb10
mov eax, dword [ebp - 0x214]
mov dword [eax], vtable.CInternetSession.0
cmp dword [ebp + 8], 0
jne 0x4cfac7
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x218]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4cff50
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5704d0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x830
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x840], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push str.GetWeb
lea ecx, [ebp - 0x30]
call fcn.004cfa60
push 0x400000
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x30]
call fcn.004cfa40
push eax
lea ecx, [ebp - 0x1c]
call fcn.004cfc20
push 0x582b94
lea ecx, [ebp - 0x20]
call fcn.0041c8a0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x13
lea ecx, [ebp - 0x1c]
call fcn.004cfc70
cmp dword [ebp - 0x24], 0xc8
jne 0x4d00fc
mov byte [ebp - 0x828], 0
push 0x7e8
push 0
lea ecx, [ebp - 0x827]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x7e8
lea edx, [ebp - 0x828]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004cfbe0
test eax, eax
jbe 0x4d00fc
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x828]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x830], eax
xor ecx, ecx
mov eax, dword [ebp - 0x830]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f4318
add esp, 4
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jne 0x4d009f
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x838], ecx
mov edx, dword [ebp - 0x838]
push edx
call fcn.0053e96b
add esp, 4
mov eax, dword [ebp - 0x830]
push eax
mov ecx, dword [ebp - 0x82c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x828]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041c900
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x83c], ecx
mov edx, dword [ebp - 0x83c]
push edx
call fcn.0053e96b
add esp, 4
mov dword [ebp - 0x82c], 0
jmp 0x4d000e
lea ecx, [ebp - 0x1c]
call fcn.004cfa10
lea ecx, [ebp - 0x30]
call fcn.004cfa10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x20]
call fcn.0040f740
lea ecx, [ebp - 0x1c]
call fcn.004cfd30
lea ecx, [ebp - 0x30]
call fcn.004cfbc0
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x4d0171
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8
Function at 0x4db280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 0
je 0x4db29c
mov eax, dword [ebp - 0x50]
sub eax, 0x3e0
mov dword [ebp - 0x54], eax
jmp 0x4db2a3
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.0040ee90
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s__s__s
lea eax, [ebp - 8]
push eax
call fcn.004ea900
add esp, 0x18
push 0
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x88
call fcn.004a5a90
test eax, eax
jl 0x4db31c
lea ecx, [ebp - 8]
call fcn.0040f740
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
jmp 0x4db4c6
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x50]
add ecx, 0x88
call fcn.004a5630
mov ecx, dword [ebp - 0x50]
add ecx, 0x88
call fcn.0041cc40
movzx edx, al
test edx, edx
jne 0x4db378
mov eax, dword [ebp - 0x50]
add eax, 0x88
push ecx
mov ecx, esp
push eax
call fcn.0041c880
push ecx
mov ecx, esp
push str.List
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.OtherCity
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.00480e10
lea ecx, [ebp - 0x2c]
call fcn.004e2b10
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0041c8e0
lea edx, [ebp + 0x14]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c8e0
push 0x58b3a4
lea ecx, [ebp - 0x24]
call fcn.0041cec0
push 0x582b94
lea ecx, [ebp - 0x20]
call fcn.0041cec0
push 0x582b94
lea ecx, [ebp - 0x1c]
call fcn.0041cec0
push 0x582b94
lea ecx, [ebp - 0x18]
call fcn.0041cec0
push 0
push 0
push 0
push 1
push 1
push 0x7de
lea ecx, [ebp - 0x14]
call fcn.00463750
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x8c
call fcn.004e3da0
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x4dda80
call fcn.00547a7d
add esp, 0xc
push ecx
mov ecx, esp
lea edx, [ebp + 0x14]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
lea eax, [ebp + 0x10]
push eax
call fcn.0041c880
push ecx
mov ecx, esp
lea edx, [ebp + 0xc]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x50]
call fcn.004e4000
push str.weather_othercity_add_hor
mov ecx, dword [ebp - 4]
add ecx, 0x20
call fcn.00509af5
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4db46b
push 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0x180]
call eax
push str.weather_othercity_citylist
mov ecx, dword [ebp - 4]
add ecx, 0x20
call fcn.00509af5
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4db496
push 0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0x180]
call eax
lea ecx, [ebp - 0x2c]
call fcn.004e2b70
lea ecx, [ebp - 8]
call fcn.0040f740
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e3f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0xc], 0x50
lea ecx, [ebp - 8]
call fcn.0040ee90
mov eax, dword [ebp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones_s
lea ecx, [ebp - 8]
push ecx
call fcn.004ea900
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 1
push 0
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push 0x5979bc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xb
lea esi, [ebp - 0x3c]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp + 8]
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8
Function at 0x4e6b90
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570660
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x830
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x840], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push str.GetWeb
lea ecx, [ebp - 0x30]
call fcn.004cfa60
push 0x400000
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x30]
call fcn.004cfa40
push eax
lea ecx, [ebp - 0x1c]
call fcn.004cfc20
push 0x582b94
lea ecx, [ebp - 0x20]
call fcn.0041c8a0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x13
lea ecx, [ebp - 0x1c]
call fcn.004cfc70
cmp dword [ebp - 0x24], 0xc8
jne 0x4e6d3c
mov byte [ebp - 0x828], 0
push 0x7e8
push 0
lea ecx, [ebp - 0x827]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x7e8
lea edx, [ebp - 0x828]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004cfbe0
test eax, eax
jbe 0x4e6d3c
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x828]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x830], eax
xor ecx, ecx
mov eax, dword [ebp - 0x830]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f4318
add esp, 4
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jne 0x4e6cdf
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x838], ecx
mov edx, dword [ebp - 0x838]
push edx
call fcn.0053e96b
add esp, 4
mov eax, dword [ebp - 0x830]
push eax
mov ecx, dword [ebp - 0x82c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x828]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041c900
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x83c], ecx
mov edx, dword [ebp - 0x83c]
push edx
call fcn.0053e96b
add esp, 4
mov dword [ebp - 0x82c], 0
jmp 0x4e6c4e
lea ecx, [ebp - 0x1c]
call fcn.004cfa10
lea ecx, [ebp - 0x30]
call fcn.004cfa10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x20]
call fcn.0040f740
lea ecx, [ebp - 0x1c]
call fcn.004cfd30
lea ecx, [ebp - 0x30]
call fcn.004cfbc0
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x4e6db1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8
Function at 0x4f4170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x5c32dc], 0
push esi
push edi
jne 0x4f40e1
call fcn.004f403b
test eax, eax
je 0x4f4126
mov eax, dword [0x5c32dc]
cmp eax, 1
jne 0x4f4102
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4f4126
jmp 0x4f4168
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4f4168
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4f412a
xor eax, eax
jmp 0x4f4168
mov eax, dword [esi]
push dword [0x5c32dc]
call edi
mov edi, eax
test edi, edi
je 0x4f414c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4f4168
lea edi, [esi + 0xff0]
push esi
push dword [0x5c32dc]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4f4152
mov eax, esi
pop edi
pop esi
ret
jmp 0x4f40cd

Function at 0x4f6374
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 4
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
mov dword [ebp - 0xc], eax
call esi
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4f6469
xor eax, eax
cmp dword [ebp - 4], eax
je 0x4f63f2
jmp 0x4f63c4
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4f63f0
push dword [ebp - 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
inc dword [ebp - 8]
test eax, eax
jne 0x4f63ea
and dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f63c2
xor eax, eax
push eax
push eax
push eax
lea eax, [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x4f6469
test eax, eax
je 0x4f6476
cmp dword [edi + 0x28], 0x10
jne 0x4f6426
mov eax, dword [ebp + 8]
cmp dword [edi + 0x24], eax
jne 0x4f6426
push 1
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [edi]
lea eax, [edi + 0x24]
push eax
mov ecx, edi
call dword [edx]
test eax, eax
jne 0x4f644e
lea eax, [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [edi + 0x28], 0x12
je 0x4f6476
lea eax, [edi + 0x24]
push eax
call fcn.004f5977
add esp, 4
test eax, eax
je 0x4f6469
and dword [ebp - 8], 0
mov dword [ebp - 4], 1
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x4f63b9
push 1
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [edi + 0x28], 0x12
jne 0x4f6495
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [edi + 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4f9fa2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 8
call fcn.0053e4e7
pop ecx
test eax, eax
jne 0x4f9fb4
leave
ret
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x10]
push eax
push 0x4f9f82
push 0
push 0
call fcn.0054be74
add esp, 0x18
leave
ret

Function at 0x4fa00a
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x28], edi
jne 0x4fa08b
push ebx
lea eax, [esi + 8]
push eax
mov dword [esi + 0x28], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 0x30], edi
jle 0x4fa040
mov eax, dword [esi + 0x2c]
push dword [eax + ebx*4]
call fcn.0053df44
inc ebx
pop ecx
cmp ebx, dword [esi + 0x30]
jl 0x4fa02e
lea ecx, [esi + 0x2c]
call fcn.004f9bd3
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
cmp dword [esi + 0x24], edi
je 0x4fa07a
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x24], edi
cmp edi, edi
jne 0x4fa058
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x4fa08b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], edi
pop edi
pop esi
ret

Function at 0x4fa7cf
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x4fa7e5
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x4fa7f1
or edi, 1
push 1
call esi
test ax, ax
jns 0x4fa7fd
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x4fa809
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x4fa815
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x4fa81a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20319
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsDWM
push SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4fa854
xor eax, eax
jmp 0x4fa882
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.ColorizationColor
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4fa876
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x4fa94b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.0053ef70
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4fa9a6
cmp dword [ebp - 0x114], 6
jne 0x4fa9a6
cmp dword [ebp - 0x110], 2
jb 0x4fa9a6
xor eax, eax
inc eax
jmp 0x4fa9a8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
leave
ret

Function at 0x5097ff
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x509824
cmp ebx, dword [esi + 0x74]
je 0x509824
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x74]
cmp ebx, eax
je 0x5098ee
push edi
test eax, eax
je 0x50987b
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x1a
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x74]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x1d8]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x74]
mov ecx, esi
call fcn.0050969e
mov dword [esi + 0x74], edi
test ebx, ebx
je 0x5098ed
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
cmp eax, esi
jne 0x5098ed
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x17c]
test al, al
je 0x5098ed
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x188]
test al, al
je 0x5098ed
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov dword [esi + 0x74], ebx
mov dword [ebp - 0x20], 0x1b
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x74]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x1d8]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x74]
mov ecx, esi
call fcn.0050969e
pop edi
pop esi
pop ebx
leave
ret 4