joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44aaa8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x45f8b0
mov edx, dword [esi]
mov eax, ebx
call fcn.0044b784
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00406d50
call fcn.00406d54
mov edx, dword [esi + 8]
call fcn.0044b784
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x44ab9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00403e10
xor eax, eax
push ebp
push 0x44ac65
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x44ac4f
mov eax, dword [ebp + 8]
call fcn.0044aaf0
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x44ac12
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.0044aa88
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.0044aaa8
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x44abe4
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x44ac3c
mov eax, dword [ebp + 0x10]
call fcn.00406d50
call fcn.00406d54
cmp bl, al
jne 0x44ac4f
mov byte [ebp - 2], 1
jmp 0x44ac4f
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x44ac4f
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ac6c
lea eax, [ebp + 8]
call fcn.004039dc
ret

Function at 0x44b350
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00403e20
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
test esi, esi
je 0x44b379
cmp ebx, 0xffffffff
je 0x44b374
and ebx, 0x10
cmp ebx, 0x10
je 0x44b379
xor eax, eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x44bc24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x44bc4e
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
movzx ebx, word [ebx*2 + 0x45e09c]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x44bc2a
pop esi
pop ebx
ret
Function at 0x44bf98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e10
xor eax, eax
push ebp
push 0x44c06a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44c045
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403c5c
test eax, eax
jle 0x44c02a
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x44c084
mov edx, dword [ebp - 4]
call fcn.00403ca8
mov eax, dword [ebp - 0x10]
call fcn.00403e20
push eax
call sub.kernel32.dll_GetVolumeInformationA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
jmp 0x44c02e
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c04c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x44c304
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403e10
xor eax, eax
push ebp
push 0x44c3e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x78], 4
jne 0x44c33d
mov byte [ebp - 5], 1
jmp 0x44c3c6
mov eax, ebx
xor ecx, ecx
mov edx, 0x18
call fcn.00402a6c
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44c3bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0044b17c
mov eax, dword [ebp - 0x10]
call fcn.00403e20
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 8]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 0xc]
mov dword [ebx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c3c6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c3eb
lea eax, [ebp - 0x10]
call fcn.004039dc
lea eax, [ebp - 4]
call fcn.004039dc
ret
Function at 0x44c4f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403e10
xor eax, eax
push ebp
push 0x44c55b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403c5c
test eax, eax
jle 0x44c53e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0044b17c
mov eax, dword [ebp - 8]
call fcn.00403e20
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x44c540
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c562
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a00
ret

Function at 0x44dce4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xf0]
mov edx, dword [ebp + 0xc]
call fcn.00408998
push eax
lea eax, [ebp - 0xa0]
mov edx, edi
call fcn.00408998
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00408998
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x450178
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
test dl, dl
je 0x4501ee
mov al, byte [ebx + 0x48]
add al, 0xf9
sub al, 2
jb 0x4501b8
sub al, 2
jb 0x45019b
sub al, 3
je 0x45019b
add al, 0xf4
sub al, 2
jae 0x4501ee
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x4501ee
call fcn.0044aa88
xor byte [esi], al
mov al, byte [esi]
call fcn.0044aaa8
inc esi
dec edi
jne 0x4501a4
jmp 0x4501ee
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x4501ee
movzx eax, word [ebx + 0x4a]
mov edx, dword [ebx + 0x38]
mov al, byte [edx + eax - 1]
xor byte [esi], al
mov eax, dword [ebx + 0x38]
call fcn.00403c5c
movzx edx, word [ebx + 0x4a]
cmp eax, edx
jne 0x4501e6
mov word [ebx + 0x4a], 1
jmp 0x4501ea
inc word [ebx + 0x4a]
inc esi
dec edi
jne 0x4501c1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x457b4c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e10
xor eax, eax
push ebp
push 0x457cca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x457c9f
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.00457b10
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 4]
call fcn.00403a74
lea eax, [ebp - 0x148]
xor ecx, ecx
mov edx, 0x140
call fcn.00402a6c
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x457ce0
mov edx, dword [ebp - 4]
call fcn.00403ca8
mov eax, dword [ebp - 0x150]
call fcn.00403e20
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x457c9f
lea edx, [ebp - 8]
lea eax, [ebp - 0x11c]
call fcn.00408b08
test byte [ebp - 0x148], 0x10
je 0x457c5e
test bl, bl
je 0x457c84
mov eax, dword [ebp - 8]
mov edx, 0x457cf0
call fcn.00403d6c
je 0x457c84
mov eax, dword [ebp - 8]
mov edx, 0x457cfc
call fcn.00403d6c
je 0x457c84
push dword [ebp - 4]
push 0x457d08
push dword [ebp - 8]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403d1c
mov eax, dword [ebp - 0x154]
call fcn.00457d0c
jmp 0x457c84
push dword [ebp - 4]
push 0x457d08
push dword [ebp - 8]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00403d1c
mov eax, dword [ebp - 0x158]
call fcn.00408438
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x457bfd
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457cd1
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.00403a00
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a00
ret
Function at 0x457d24
Capabilities:
Get disk information
Get disk size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x457e14
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x30]
mov dword [0x45e4b0], eax
mov eax, dword [ebp - 0x18]
mov dword [0x45e4b8], eax
xor eax, eax
mov dword [0x45e4b4], eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x457d76
bt edi, eax
jae 0x457def
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00403b84
lea eax, [ebp - 0x38]
mov edx, 0x457e2c
call fcn.00403c64
mov eax, dword [ebp - 0x38]
call fcn.00403e20
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x457def
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3c]
mov edx, ebx
call fcn.00403b84
lea eax, [ebp - 0x3c]
mov edx, 0x457e2c
call fcn.00403c64
mov eax, dword [ebp - 0x3c]
call fcn.00403e20
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [ebp - 4]
cmp eax, dword [0x45e4b4]
jbe 0x457def
mov eax, dword [ebp - 4]
mov dword [0x45e4b4], eax
inc esi
cmp esi, 0x1a
jne 0x457d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457e1b
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00403a00
ret

Function at 0x458fd4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, dword [esp]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esi + 0x14]
mov edx, edi
call fcn.00458184
mov ebx, eax
add ebx, dword [esi + 0x40]
lea edx, [edi + 1]
mov eax, dword [esi + 0x14]
call fcn.00458184
push eax
mov eax, dword [esi + 0x14]
mov edx, edi
call fcn.00458184
pop edx
xchg edx, eax
sub eax, edx
mov dl, byte [ebx]
mov cl, byte [esi + 0x45]
xor cl, 0x20
mov byte [ebx], cl
jmp 0x45901c
dec eax
mov cl, byte [ebx + eax - 1]
cmp cl, byte [esi + 0x45]
je 0x45901b
mov byte [ebx], dl
cmp eax, 1
jne 0x459032
cmp dl, byte [esi + 0x45]
jne 0x459032
dec eax
mov esi, 1
test eax, eax
jle 0x459089
mov dl, byte [ebx + eax - 1]
dec eax
cmp dl, 0x30
jb 0x459066
cmp dl, 0x39
ja 0x459066
and edx, 0xff
sub edx, 0x30
imul edx, esi
mov ecx, dword [esp]
add dword [ecx], edx
mov edx, esi
add edx, edx
lea edx, [edx + edx*4]
mov esi, edx
jmp 0x459085
cmp dl, 0x2e
jne 0x459079
mov edx, dword [esp]
xor ecx, ecx
mov dword [edx], ecx
mov esi, 1
jmp 0x459085
cmp dl, 0x2d
jne 0x459089
mov eax, dword [esp]
neg dword [eax]
jmp 0x459089
test eax, eax
jg 0x45903b
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x459a78
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
and edx, edx
je 0x459a95
jcxz 0x459a95
push ebx
movzx ebx, al
xor bl, byte [edx]
shr eax, 8
xor eax, dword cs:[ebx*4 + 0x459a96]
inc edx
dec ecx
jne 0x459a80
pop ebx
ret
Function at 0x420f1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x18]
push eax
mov eax, 3
call fcn.00459583
cmp dword [ebp - 0x2c], esp
je 0x420fa8
push 6
call fcn.0045957d
add esp, 4
rdtsc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x20]
push eax
mov eax, 4
call fcn.00459583
cmp dword [ebp - 0x2c], esp
je 0x420fd3
push 6
call fcn.0045957d
add esp, 4
fild qword [ebp - 0x20]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fild qword [ebp - 0x18]
fstp qword [ebp - 0x38]
fadd qword [ebp - 0x38]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
call fcn.0041cd88
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0x28]
push eax
mov eax, 4
call fcn.00459583
cmp dword [ebp - 0x2c], esp
je 0x421019
push 6
call fcn.0045957d
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [ebp - 0x24], edx
jg 0x42102e
jl 0x42102d
cmp dword [ebp - 0x28], eax
jae 0x42102e
inc ecx
mov eax, ecx
test eax, eax
jne 0x420ff6
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
fild qword [ebp - 0x10]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fild qword [ebp - 8]
fstp qword [ebp - 0x38]
fsub qword [ebp - 0x38]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x1426]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
call fcn.0041cd88
jmp 0x42106a
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x48c387]
shl eax, 2
mov dword [0x48c38b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0047f210
pop edx
call fcn.0047f174
call fcn.0047f250
push 0
call fcn.004805b8
pop ecx
push 0x48c330
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x48c38f], eax
push 0
jmp fcn.00486a0c

Function at 0x4017e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4017e9
mov eax, dword [ebp - 4]
add esp, 0xffffffb0
mov eax, 0x48dc80
call fcn.0047f9a4
mov dword [ebp - 0x40], 0xfd000
call sub.KERNEL32.DLL_GetCurrentProcess
mov dword [ebp - 0x30], eax
push 0
push 0x2000
lea edx, [ebp - 0x2040]
push edx
push dword [ebp - 0x40]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_ReadProcessMemory
xor ecx, ecx
mov dword [ebp - 0x38], ecx
xor eax, eax
mov dword [ebp - 0x3c], eax
xor edx, edx
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x38]
shl ecx, 9
add ecx, dword [ebp - 0x34]
movsx eax, byte [ebp + ecx*4 - 0x2040]
add dword [ebp - 0x3c], eax
add dword [ebp - 0x34], 4
cmp dword [ebp - 0x34], 0x200
jb 0x40183a
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [edx*4 + 0x528af4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jb 0x401830
xor eax, eax
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov ecx, dword [0x528af4]
xor dword [edx*4 + 0x48c4c0], ecx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 6
jb 0x401876
mov word [ebp - 0x1c], 8
mov edx, 0x48c4c0
lea eax, [ebp - 4]
call fcn.0048ac20
inc dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [sym.game.exe__Principal]
mov eax, dword [eax + 0x4ec]
call fcn.00448f88
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0048acf0
mov ecx, dword [0x528af4]
and ecx, 0xffff
push ecx
mov eax, dword [0x528af4]
and eax, 0xffff000
shr eax, 0x10
push eax
push str._04X__04X
lea edx, [ebp - 0x2054]
push edx
call fcn.0048224c
add esp, 0x10
mov word [ebp - 0x1c], 0x14
lea edx, [ebp - 0x2054]
lea eax, [ebp - 8]
call fcn.0048ac20
inc dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [sym.game.exe__Principal]
mov eax, dword [eax + 0x4f4]
call fcn.00448f88
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0048acf0
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403c14
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push esi
push edi
mov eax, 0x48df10
call fcn.0047f9a4
xor edx, edx
mov dword [ebp - 0x2c], edx
mov esi, 0x48c514
lea edi, [ebp - 0x160]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x403c60
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
jmp 0x403d3e
mov dword [ebp - 0x160], 0x128
mov edx, dword [sym.game.exe__Principal]
mov ecx, dword [edx + 0x338]
add ecx, 0x1f0
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x40]
lea ecx, [ebp - 0x160]
push ecx
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403d11
mov eax, dword [sym.game.exe__Principal]
mov edx, dword [eax + 0x338]
add edx, 0x1f0
mov dword [ebp - 0x38], edx
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x13c]
lea eax, [ebp - 4]
call fcn.0048ac20
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0048acf0
imul ecx, dword [ebp - 0x2c], 0x25
lea edi, [ecx*8 + 0x528b04]
lea esi, [ebp - 0x160]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
inc dword [ebp - 0x2c]
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403c9c
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [sym.game.exe__Principal]
mov eax, dword [edx + 0x338]
xor edx, edx
call fcn.0041e5b0
mov ecx, dword [ebp - 0x2c]
mov dword [0x552634], ecx
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a444
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [0x48c494]
mov dword [ebp - 4], edx
cmp byte [0x48c481], 0
je 0x40a482
cmp dword [ebp - 4], 0
je 0x40a482
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
push dword [ecx*4 + 0x528a60]
call sub.KERNEL32.DLL_SuspendThread
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x40a467
pop ecx
pop ecx
pop ebp
ret

Function at 0x40a488
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [0x48c494]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x40a4bd
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
push dword [ecx*4 + 0x528a60]
call sub.KERNEL32.DLL_ResumeThread
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x40a4a2
pop ecx
pop ecx
pop ebp
ret
Function at 0x40a594
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
push edi
mov esi, 0x48c63c
lea edi, [ebp - 0x24]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
push 0
push 4
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40a5c4
xor eax, eax
jmp 0x40a656
xor edx, edx
mov dword [0x48c494], edx
mov dword [ebp - 0x24], 0x1c
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 4]
call sub.KERNEL32.DLL_Thread32First
test eax, eax
je 0x40a63f
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 8]
jne 0x40a626
mov edx, dword [0x48c494]
mov ecx, edx
shl edx, 3
sub edx, ecx
lea edi, [edx*4 + 0x5286e0]
lea esi, [ebp - 0x24]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
inc dword [0x48c494]
mov eax, dword [0x48c494]
cmp eax, 0x20
jne 0x40a626
push str.Too_many_programs_executing._nClose_unused_applications_nand_try_again.
call fcn.00401bd8
pop ecx
jmp 0x40a636
lea edx, [ebp - 0x24]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_Thread32Next
test eax, eax
jne 0x40a5e3
mov dword [ebp - 8], 1
jmp 0x40a644
xor ecx, ecx
mov dword [ebp - 8], ecx
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 8], 0
setne al
and eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a6e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
mov eax, 0x48f034
call fcn.0047f9a4
xor edx, edx
mov dword [ebp - 0x34], edx
mov ecx, dword [sym.game.exe__Principal]
mov eax, dword [ecx + 0x33c]
add eax, 0x1f0
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov edx, dword [eax]
call dword [edx + 0x40]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
jmp 0x40a7eb
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x40a7d9
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx*4 + 0x551cd4]
imul eax, dword [ebp - 0x2c], 0x25
cmp ecx, dword [eax*8 + 0x528b0c]
jne 0x40a7d6
mov edx, dword [ebp - 0x30]
push dword [edx*4 + 0x551824]
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x40a7d6
push 0xff
lea ecx, [ebp - 0x13c]
push ecx
mov eax, dword [ebp - 0x30]
push dword [eax*4 + 0x551824]
call sub.USER32.DLL_GetWindowTextA
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx*4 + 0x551cd4]
mov eax, dword [ebp - 0x34]
mov dword [eax*4 + 0x552184], ecx
inc dword [ebp - 0x34]
mov edx, dword [sym.game.exe__Principal]
mov ecx, dword [edx + 0x33c]
add ecx, 0x1f0
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x13c]
lea eax, [ebp - 4]
call fcn.0048ac20
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0048acf0
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [0x48c4dc]
jb 0x40a72e
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [0x552634]
jl 0x40a724
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x4204f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0047c9c0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x42053f
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.0047cbf0
pop ebx
mov esp, ebp
pop ebp
ret