joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d87f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8884
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 5
call fcn.004d84b8
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004057d8
jne 0x4d8841
push 0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d8894
mov edx, 0x4d88ac
mov eax, 0x80000001
call fcn.004d822c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404f18
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040fb50
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d888b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.0040544c
ret

Function at 0x4d9008
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret

Function at 0x4d910c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x4d91c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040585c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404f18
mov eax, dword [ebp - 8]
mov edx, 0x4d91d8
call fcn.00409b40
test eax, eax
je 0x4d9178
push dword [ebp - 4]
push 0x4d91e4
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405790
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0x4d91f4
mov eax, dword [0x5c66a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d91c9
lea eax, [ebp - 0xc]
call fcn.0040544c
lea eax, [ebp - 8]
call fcn.00404c80
lea eax, [ebp - 4]
call fcn.0040544c
ret

Function at 0x4d9ecc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, ebx
mov edx, 2
call fcn.00405a24
push 0
mov eax, dword [ebx]
call fcn.004056ac
push eax
lea eax, [esp + 8]
push eax
push 0
movzx edi, si
push edi
call sub.user32.dll_MapVirtualKeyA
push eax
push edi
call sub.user32.dll_ToAscii
sub eax, 1
jb 0x4d9f18
je 0x4d9f21
dec eax
je 0x4d9f36
jmp 0x4d9f2f
mov eax, ebx
call fcn.0040544c
jmp 0x4d9f36
mov eax, ebx
mov edx, 1
call fcn.00405a24
jmp 0x4d9f36
mov eax, ebx
call fcn.0040544c
add esp, 0x100
pop edi
pop esi
pop ebx
ret
Function at 0x4e12a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e1508
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4e130b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004e0d70
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040f818
cmp al, 1
jne 0x4e130b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004e1088
test al, al
je 0x4e1497
cmp dword [ebp - 8], 0
jge 0x4e1329
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004e0d70
mov eax, dword [ebp - 0x210]
call fcn.00404f50
cmp ebx, eax
jge 0x4e1373
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004e0d70
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5c68b4]
and eax, 0xff
bt dword [edx], eax
jae 0x4e1373
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4e1387
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004e1284
cmp ebx, dword [ebp - 8]
je 0x4e1489
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4e13b3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040401c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c17ec]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4e1476
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040401c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c17ec]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00478eb4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040401c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c17ec]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00478eb4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e147d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4e14ea
cmp dword [ebp - 8], 0
jge 0x4e14a2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004e0d70
mov eax, dword [ebp - 0x218]
call fcn.00404f50
cmp eax, dword [ebp - 8]
jg 0x4e14dc
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004e0d70
mov eax, dword [ebp - 0x21c]
call fcn.00404f50
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e1284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e150f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404ca4
ret
Function at 0x502bbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x502c20
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404f00
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040a59c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x502c27
lea eax, [ebp - 0xc]
call fcn.00404c80
ret
Function at 0x504090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5042a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x330]
call fcn.004ae8d8
mov edx, dword [esi + 0x10]
mov eax, dword [ebx + 0x30c]
call fcn.004ac9e0
mov edx, dword [esi + 0x14]
mov eax, dword [ebx + 0x334]
call fcn.004ae8d8
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x18]
call fcn.0040a340
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00405630
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x310]
call fcn.004ac9e0
mov edx, dword [esi + 0x1c]
mov eax, dword [ebx + 0x320]
call fcn.004ac9e0
mov edx, 0x5042b4
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
setg dl
mov eax, dword [ebx + 0x354]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov edx, 0x5042d4
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
setg dl
mov eax, dword [ebx + 0x358]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov edx, 0x5042f0
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
setg dl
mov eax, dword [ebx + 0x37c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebx + 0x34c]
mov edi, dword [eax + 0x21c]
dec edi
test edi, edi
jl 0x50419e
inc edi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34c]
call fcn.004f6b54
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
inc dword [ebp - 4]
dec edi
jne 0x504183
push 0x504314
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 0x34c]
call fcn.004f6a00
push 0x504328
xor ecx, ecx
mov edx, 1
mov eax, dword [ebx + 0x34c]
call fcn.004f6a00
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x300]
call fcn.004ae8c4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404f18
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi + 8]
call fcn.00404f18
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00409b40
test eax, eax
je 0x504212
cmp dword [esi + 0x2c], 1
jne 0x504212
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x300]
call fcn.004ae8d8
lea edx, [ebp - 0x1c]
mov eax, dword [ebx + 0x30c]
call fcn.004ac9cc
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004057d8
jne 0x504251
cmp byte [ebx + 0x57], 0
je 0x504242
mov eax, dword [ebx + 0x30c]
mov edx, dword [eax]
call dword [edx + 0xc4]
jmp 0x50425e
mov edx, dword [ebx + 0x30c]
mov eax, ebx
call fcn.0048f1b4
jmp 0x50425e
mov edx, dword [ebx + 0x330]
mov eax, ebx
call fcn.0048f1b4
mov eax, ebx
call fcn.00504bdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5042a7
lea eax, [ebp - 0x1c]
call fcn.0040544c
lea eax, [ebp - 0x18]
call fcn.00404c80
lea eax, [ebp - 0x14]
call fcn.0040544c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 8]
call fcn.0040544c
ret
Function at 0x504ae8
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x3b0], 0
je 0x504b15
push 0
mov eax, dword [ebx + 0x39c]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebx + 0x398]
call fcn.00403e14
xor eax, eax
mov dword [ebx + 0x398], eax
mov eax, dword [ebx + 0x3bc]
test eax, eax
je 0x504b2e
push eax
call sub.libmysqlx.dll_myx_mysql_close
pop ecx
xor eax, eax
mov dword [ebx + 0x3bc], eax
cmp byte [ebx + 0x3b0], 0
je 0x504b71
xor edx, edx
mov eax, dword [ebx + 0x35c]
call fcn.0045dcd8
xor edx, edx
mov eax, dword [ebx + 0x35c]
call fcn.004723d4
mov dl, 1
mov eax, ebx
call fcn.00504a1c
mov eax, dword [ebx + 0x30c]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov byte [ebx + 0x3b0], 0
pop ebx
ret
cmp byte [ebx + 0x3b2], 0
je 0x504b86
mov dword [ebx + 0x24c], 3
jmp 0x504b90
mov dword [ebx + 0x24c], 2
pop ebx
ret

Function at 0x507094
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0041db38
mov esi, eax
xor edx, edx
push ebp
push 0x507141
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [esi + 8]
dec ebx
test ebx, ebx
jl 0x5070df
inc ebx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0041d3c8
call fcn.00426a38
inc dword [ebp - 8]
dec ebx
jne 0x5070ca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x507128
call fcn.00426a38
push 0x7d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x50711d
push 0x3e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 4]
add eax, 0x3c
call fcn.00410e34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507148
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0041db9c
ret
Function at 0x507dfc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0x14]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x507fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, 0x67
ja 0x507e35
bt dword [eax + 0x48], edx
setb al
xor al, 1
test al, al
jne 0x507e48
cmp byte [ebp + 0xc], 0
je 0x507fab
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, 0x67
ja 0x507e57
bt dword [edx + 0x48], ecx
setb dl
test al, al
je 0x507e88
mov eax, dword [ebp - 4]
push esi
lea esi, [eax + 0x48]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [ebp - 8]
cmp eax, 0x67
ja 0x507e79
bts dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push esi
lea esi, [ebp - 0x1c]
lea edi, [eax + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
push ebp
push 0x507f76
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
mov eax, dword [ebp + 0x14]
push eax
mov al, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x506ee8]
call fcn.00508d24
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 0xc]
call fcn.0041dab0
xor eax, eax
push ebp
push 0x507f47
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x507ee8
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 0xc]
call fcn.00426a10
test ebx, ebx
je 0x507f3d
xor esi, esi
jmp 0x507f0c
push 0x64
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov esi, eax
test esi, esi
je 0x507f12
cmp byte [ebx + 0xd], 0
je 0x507ef8
cmp esi, 0x102
jne 0x507f35
push 0x3e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00507fd4
mov eax, dword [ebp - 0xc]
call fcn.00403e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x507f6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x507fab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507fc8
lea eax, [ebp + 0x14]
call fcn.0040544c
ret

Function at 0x51c1ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x51c1e4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51c1c2
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51c1d1
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x51c1e0
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x52b01c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x52b080
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404f00
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040a59c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b087
lea eax, [ebp - 0xc]
call fcn.00404c80
ret
Function at 0x54c29c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x54c2af
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x54c32c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403de4
mov ecx, edi
mov dl, 1
mov eax, dword [0x54b5b4]
call fcn.0054b910
mov esi, eax
mov dword [edi + 0xc], esi
xor edx, edx
mov eax, esi
call fcn.004723d4
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
lea eax, [edi + 0x3c]
mov edx, dword [ebp - 4]
call fcn.00405488
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c333
lea eax, [ebp - 4]
call fcn.0040544c
ret

Function at 0x54c354
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x54c367
add esp, 0xfffffff0
call fcn.0040418c
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x54c3e4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403de4
mov ecx, edi
mov dl, 1
mov eax, dword [0x54b5b4]
call fcn.0054b910
mov esi, eax
mov dword [edi + 0xc], esi
xor edx, edx
mov eax, esi
call fcn.004723d4
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
lea eax, [edi + 0x3c]
mov edx, dword [ebp - 4]
call fcn.00405488
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c3eb
lea eax, [ebp - 4]
call fcn.0040544c
ret

Function at 0x54d818
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x54d82b
add esp, 0xfffffff0
call fcn.0040418c
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp + 8]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x54d8a3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403de4
mov ecx, ebx
mov dl, 1
mov eax, dword [0x54c900]
call fcn.0054cc38
mov esi, eax
mov dword [ebx + 0xc], esi
xor edx, edx
mov eax, esi
call fcn.004723d4
mov dl, 1
mov eax, esi
call fcn.00466208
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov dword [ebx + 0x30], edi
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.00405488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d8aa
lea eax, [ebp + 8]
call fcn.0040544c
ret
Function at 0x55ca04
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x55cb1f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0055bafc
mov eax, dword [ebp - 0xc]
call fcn.004056bc
mov ebx, eax
test ebx, ebx
jle 0x55cb09
call fcn.00443798
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x55cb02
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov esi, ebx
add esi, esi
add esi, 2
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55caea
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55cae3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x55cacc
mov eax, dword [ebp - 0xc]
call fcn.004056ac
mov ecx, esi
mov edx, dword [ebp - 8]
call fcn.00402ddc
mov eax, dword [ebp - 4]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x55cacc
mov ecx, 0x55cb34
mov dl, 1
mov eax, dword [0x408c9c]
call fcn.0040ee0c
call fcn.004045f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55caea
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cb09
call fcn.00443798
mov edx, dword [eax]
call dword [edx + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cb26
lea eax, [ebp - 0xc]
call fcn.0040544c
ret
Function at 0x55ed3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
push edi
mov eax, dword [ebp + 8]
push eax
mov cl, byte [ebp - 2]
mov dl, byte [ebp - 1]
mov eax, ebx
call fcn.00473ac4
cmp byte [ebp - 1], 0
jne 0x55ef0e
mov eax, ebx
mov si, 0xffb5
call fcn.0040401c
test al, al
jne 0x55eda6
mov eax, ebx
mov si, 0xffb8
call fcn.0040401c
test al, al
je 0x55ed97
mov eax, ebx
call fcn.00478eb4
push eax
call sub.user32.dll_SetFocus
mov eax, ebx
call fcn.0055bb20
test al, al
jne 0x55ef1b
lea eax, [ebp - 0xa]
push eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, ebx
call fcn.005644e4
lea ecx, [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.0041bce4
push dword [ebp - 0x10]
push dword [ebp - 0x14]
lea eax, [ebx + 0x2e4]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x55edf7
push edi
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 6]
push eax
mov cl, byte [ebp - 2]
mov dl, byte [ebp - 1]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xd0]
jmp 0x55ef1b
test byte [ebp - 2], 0x40
je 0x55ee34
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x318], eax
mov eax, dword [ebx + 0x2c8]
cmp dword [eax + 0xc], 0
jle 0x55ee28
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055ba78
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055c900
mov byte [ebx + 0x32d], 1
jmp 0x55ef1b
test byte [ebx + 0x38a], 2
je 0x55ee77
mov al, byte [0x55ef24]
cmp al, byte [ebp - 2]
jne 0x55ee77
cmp dword [ebx + 0x318], 0
jbe 0x55ee77
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x318]
cmp eax, dword [ebx + 0x2d0]
jae 0x55ee6f
mov eax, ebx
call fcn.00561974
jmp 0x55ef1b
xor eax, eax
mov dword [ebx + 0x318], eax
mov eax, ebx
call fcn.00478eb4
push eax
call sub.user32.dll_SetCapture
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055ba78
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x310], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x314], eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, ebx
call fcn.0055d51c
mov al, byte [0x55ef28]
not eax
and al, byte [ebp - 2]
mov dl, byte [0x55ef24]
cmp dl, al
jne 0x55eedc
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0056143c
test al, al
je 0x55eedc
or ecx, 0xffffffff
xor edx, edx
mov eax, ebx
call fcn.00472ba4
jmp 0x55ef1b
test byte [ebp - 2], 1
je 0x55eef8
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055ba78
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055bd28
jmp 0x55ef1b
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055ba78
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0055bc34
jmp 0x55ef1b
xor edx, edx
mov eax, dword [ebx + 0x39c]
call fcn.00441a34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x568414
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x568442
mov eax, ebx
call fcn.00568ec8
cmp dword [ebx + 0x40], 0
je 0x56843b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5684b3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5684a5
cmp dword [ebx + 8], 0
je 0x568464
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x568476
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5684a5
cmp dword [ebx + 8], 0
je 0x568457
cmp eax, 3
je 0x568489
dec eax
jne 0x568457
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x568457
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x568457
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5684d1
cmp dword [ebx + 0x14], 0xcc
je 0x5684d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005684dc
pop ebx
ret