joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f450
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f483
push esi
call fcn.00442560
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f47c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f509
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f4f2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f4a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f4ee
cmp eax, 2
je 0x43f4f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f49a
cmp eax, 3
je 0x43f4cd
cmp eax, 1
jne 0x43f49a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f49a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f49a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f530
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f518
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f530
add esp, 4
pop esi
ret

Function at 0x44c400
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44c466
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44c466
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44c447
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44c7f0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44c828
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x44d500
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44d549
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x44d9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044d570
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044d5f0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044d5f0
lea ecx, [esi + 0xc]
call fcn.004686e7
lea ecx, [esi + 0x10]
call fcn.004686e7
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044eb80
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044eb80
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044eb80
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046875c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046875c
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46ab4c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46ab84
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00468c03
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00468bdb
jmp 0x46ab90
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46c23e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46c280
call fcn.004721e4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46c280
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46c277
xor eax, eax
jmp 0x46c288
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046c28e
pop edi
pop esi
pop ebx
ret 4

Function at 0x472714
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x472742
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x472760
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047267a
jmp 0x472760
mov eax, dword [esi + 0x14]
test eax, eax
je 0x472760
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047267a
test edi, edi
mov eax, edi
jne 0x47274a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10002220
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10017690
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x130]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0x18]
mov eax, ecx
mov edx, dword [esp + 0x12c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x128]
and ecx, 3
mov dword [esp + 0x120], 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push 0
push ecx
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10002356
mov eax, dword [esp + 0x130]
push 0x10042024
push eax
call fcn.100049f9
add esp, 8
test eax, eax
jne 0x100022f2
mov dword [esp + 8], 0x1c2
jmp 0x10002356
mov ecx, dword [esp + 0x130]
push str.MinAutoRecordVoice
push ecx
call fcn.100049f9
add esp, 8
test eax, eax
jne 0x10002315
mov dword [esp + 8], 0x1f4
jmp 0x10002356
push str.RECVCALLIDDELAY
lea ecx, [esp + 0x134]
call fcn.1000e35c
cmp eax, 0xffffffff
je 0x10002335
mov dword [esp + 8], 0xfa0
jmp 0x10002356
mov edx, dword [esp + 0x130]
push str.VOICEVOL
push edx
call fcn.100049f9
add esp, 8
test eax, eax
jne 0x10002356
mov dword [esp + 8], 8
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x12c]
mov byte [esp + 0x120], 0
call fcn.10012c61
lea ecx, [esp + 0x130]
mov dword [esp + 0x120], 0xffffffff
call fcn.10012c61
mov ecx, dword [esp + 0x118]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x10002490
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x20
xor eax, eax
push 0x1281
mov dword [esp + 4], eax
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
call sub.WSOCK32.dll_htons
push 0
push 2
push 2
mov word [esp + 0xe], ax
mov dword [esp + 0x10], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x1006ca6c], eax
je 0x100024fb
cmp eax, 0xffffffff
je 0x100024fb
lea ecx, [esp]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x10002501
mov edx, dword [0x1006ca6c]
push edx
call sub.WSOCK32.dll_closesocket
xor al, al
add esp, 0x20
ret
xor eax, eax
push 0xed2
mov dword [esp + 0x14], eax
mov word [esp + 0x14], 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call sub.WSOCK32.dll_htons
push 0
push 2
push 2
mov word [esp + 0x1e], ax
mov dword [esp + 0x20], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x1006ca68], eax
je 0x100024fb
cmp eax, 0xffffffff
je 0x100024fb
lea ecx, [esp + 0x10]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x1000256f
mov edx, dword [0x1006ca68]
push edx
call sub.WSOCK32.dll_closesocket
xor al, al
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x10002580
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
lea eax, [esi + esi*8]
lea eax, [eax + eax*8]
cmp dword [eax*4 + 0x1006e2a8], 1
je 0x100025b5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp eax, dword [esi*4 + 0x1006e2a4]
jbe 0x100025c7
call edi
sub eax, dword [esi*4 + 0x1006e2a4]
cmp eax, 0xa
jbe 0x100025c7
mov al, byte [esi + 0x1006e3ec]
mov byte [esi + 0x1006e3ec], 0
pop edi
pop esi
ret 4
pop edi
xor al, al
pop esi
ret 4

Function at 0x100025d0
Capabilities:
Send data
Send data on socket
Terminate thread

Disassembly:
sub esp, 0xc
mov ecx, dword [0x1006ca5c]
push ebx
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push eax
push ecx
call edi
mov eax, dword [0x1006ca5c]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esp + 0x10]
push edx
push eax
call ebx
push 0x1006ea18
mov dword [esp + 0x10], 0xd
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1006cc0c], 1
jne 0x10002635
mov edx, dword [0x1006ca68]
push 0x10
push 0x1006cbfc
push 0
lea ecx, [esp + 0x18]
push 4
push ecx
push edx
call sub.WSOCK32.dll_sendto
mov esi, 0x1006ca7c
cmp dword [esi + 0x10], 1
jne 0x10002658
mov ecx, dword [0x1006ca68]
push 0x10
push esi
push 0
lea eax, [esp + 0x18]
push 4
push eax
push ecx
call sub.WSOCK32.dll_sendto
add esi, 0x20
cmp esi, 0x1006cbfc
jl 0x1000263a
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1006ca58]
lea edx, [esp + 0x14]
push edx
push eax
call edi
mov edx, dword [0x1006ca58]
mov ecx, dword [esp + 0x14]
push ecx
push edx
call ebx
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x1006ca68]
push eax
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10002c50
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
mov dword [eax*4 + 0x1006cc28], edi
xor ecx, ecx
shl eax, 4
mov esi, eax
push str.127.0.0.1
lea eax, [esi + 0x1006cc18]
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [eax], 2
call sub.WSOCK32.dll_inet_addr
push edi
mov dword [esi + 0x1006cc1c], eax
call sub.WSOCK32.dll_htons
mov word [esi + 0x1006cc1a], ax
pop edi
pop esi
ret 8

Function at 0x10002cb0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
lea eax, [edx + edx*8]
push edi
or ecx, 0xffffffff
mov dword [edx*4 + 0x1006e3f4], 1
lea eax, [eax + eax*8]
lea edi, [eax*4 + 0x1006e2bc]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x32
jle 0x10002ce5
mov ecx, 0x32
lea eax, [edx + edx*2]
mov byte [edx + 0x1006e3f0], cl
shl eax, 3
sub eax, edx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4]
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [eax + eax*4]
lea esi, [eax*4 + 0x1006cd00]
push esi
push 0x10003250
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebp, eax
push 0
push ebp
call ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
call ebp
lea eax, [esp + 0x10]
push eax
push 4
push esi
push 0x100032c0
push 0
push 0
call edi
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 4
push esi
push 0x100031e0
push 0
push 0
call edi
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 4
push esi
push 0x10002e80
push 0
push 0
call edi
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov edx, dword [esp + 0x18]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push 4
push esi
push 0x100031a0
push 0
push 0
call edi
push 0
mov dword [esp + 0x1c], eax
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 4
push esi
push 0x10002ef0
push 0
push 0
call edi
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 4
push esi
push 0x10002e10
push 0
push 0
call edi
mov esi, eax
push 0
push esi
call ebx
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100034d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov cl, byte [esp + 0xc]
xor eax, eax
mov dword [0x1006e9f0], eax
mov edx, dword [esp + 8]
mov dword [0x1006e9f4], eax
mov byte [0x1006e9f4], cl
lea ecx, [esp + 0xc]
push esi
push ecx
push 4
push 0
mov dword [0x1006e9f8], eax
mov eax, dword [esp + 0x14]
push 0x10003550
push 0
push 0
mov dword [0x1006e9f0], edx
mov dword [0x1006e9f8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000352d
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret
Function at 0x10003ac0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x1006ea34]
push 0
push eax
push 0x10003a30
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1006eb0c], eax
ret

Function at 0x10003b00
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x1006ea18
mov dword [esi], 0x11
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x1006ca68]
push 0x10
mov eax, dword [esp + 0x10]
shl eax, 5
add eax, 0x1006cbfc
push eax
push 0
push 0x8c
push esi
push ecx
call sub.WSOCK32.dll_sendto
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
ret 8

Function at 0x10003b60
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x210]
mov eax, dword [esp + 0x214]
push ecx
lea edx, [esp + 0x10]
push 0x10041f48
push edx
mov dword [esp + 0x10], 0x12
mov dword [esp + 0x14], eax
call fcn.10004aa8
add esp, 0xc
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1006cc0c]
pop edi
cmp eax, 1
jne 0x10003bde
mov ecx, dword [0x1006ca68]
push 0x10
push 0x1006cbfc
push 0
lea eax, [esp + 0xc]
push 0x208
push eax
push ecx
call sub.WSOCK32.dll_sendto
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 0x208
ret 8

Function at 0x10003cc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push 0x1006ea18
mov dword [esp + 4], 0x25
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1006cc0c], 1
jne 0x10003cf9
mov ecx, dword [0x1006ca68]
push 0x10
push 0x1006cbfc
push 0
lea eax, [esp + 0xc]
push 4
push eax
push ecx
call sub.WSOCK32.dll_sendto
push 0x1006ea18
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ecx
ret

Function at 0x10003d10
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [0x1006cc0c]
mov dword [esp], 0x26
cmp eax, 1
jne 0x10003d3f
mov ecx, dword [0x1006ca68]
push 0x10
push 0x1006cbfc
push 0
lea eax, [esp + 0xc]
push 4
push eax
push ecx
call sub.WSOCK32.dll_sendto
pop ecx
ret

Function at 0x10011a21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10011a63
call fcn.100162e3
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10011a63
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10011a5a
xor eax, eax
jmp 0x10011a6b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10011a71
pop edi
pop esi
pop ebx
ret 4
Function at 0x4017dc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4017ee
mov eax, dword [0x53c08b]
shl eax, 2
mov dword [0x53c08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0052bc14
pop edx
call fcn.0052bb78
call fcn.0052bc54
push 0
call fcn.0052d120
pop ecx
push 0x53c034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x53c093], eax
push 0
jmp fcn.005355b8
Function at 0x42b3ec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.USER32.DLL_GetWindowTextA
mov esi, eax
cmp esi, 0xf
jge 0x42b41b
xor eax, eax
jmp 0x42b509
xor ebx, ebx
jmp 0x42b445
mov ecx, ebx
jmp 0x42b436
mov eax, ecx
cdq
idiv esi
movsx eax, byte [ebp + edx - 0x108]
cmp eax, 0x2a
jne 0x42b43d
inc ecx
lea edx, [ebx + 3]
cmp ecx, edx
jl 0x42b423
lea eax, [ebx + 3]
cmp ecx, eax
je 0x42b44c
inc ebx
lea edx, [esi + 3]
cmp ebx, edx
jl 0x42b41f
mov dword [ebp - 4], ebx
lea ecx, [esi + 3]
cmp ebx, ecx
jne 0x42b45f
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x42b462
add ebx, 3
mov ecx, ebx
jmp 0x42b479
mov eax, ecx
cdq
idiv esi
movsx eax, byte [ebp + edx - 0x108]
cmp eax, 0x2e
je 0x42b480
inc ecx
lea edx, [ebx + 8]
cmp ecx, edx
jl 0x42b466
add ebx, 8
cmp ecx, ebx
jne 0x42b48b
xor eax, eax
jmp 0x42b509
lea ebx, [ecx + 1]
mov eax, ebx
cdq
idiv esi
movsx ecx, byte [ebp + edx - 0x108]
cmp ecx, 0x20
jne 0x42b4a1
inc ebx
cmp ebx, dword [ebp - 4]
jle 0x42b4a9
add dword [ebp - 4], esi
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edi, eax
cmp ebx, dword [ebp - 4]
jge 0x42b4cb
mov eax, ebx
inc ebx
cdq
idiv esi
inc ecx
mov al, byte [ebp + edx - 0x108]
mov byte [edi], al
inc edi
cmp ebx, dword [ebp - 4]
jl 0x42b4b5
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0052c1d8
pop ecx
mov esi, eax
dec esi
mov eax, dword [ebp + 0xc]
add eax, esi
jmp 0x42b4e8
dec esi
dec eax
test esi, esi
jl 0x42b4f4
movsx edx, byte [eax]
cmp edx, 0x2d
jne 0x42b4e6
test esi, esi
jg 0x42b4fc
xor eax, eax
jmp 0x42b509
mov edx, dword [ebp + 0xc]
mov eax, 1
mov byte [edx + esi - 1], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b68c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov byte [ebp - 8], dl
test dl, dl
jle 0x42b69f
call fcn.0053b2c4
mov ebx, ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x54c8c0
call fcn.0052c468
mov word [ebp - 0x18], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049d794
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
mov byte [edx + 0xf], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x42b6ef
call fcn.0053b2d1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43be4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
lea ebx, [ebp - 0x2c]
mov eax, 0x55314c
call fcn.0052c468
mov word [ebx + 0x10], 8
xor edx, edx
lea ecx, [ebp - 0x12c]
mov dword [ebp - 4], edx
inc dword [ebx + 0x1c]
mov word [ebx + 0x10], 0x14
push ecx
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov word [ebx + 0x10], 0x20
lea edx, [ebp - 0x12c]
lea eax, [ebp - 8]
call fcn.005399d4
inc dword [ebx + 0x1c]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00539be4
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00539bb4
mov word [ebx + 0x10], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00539be4
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebx + 0x10], 0x38
push eax
lea eax, [ebp - 4]
dec dword [ebx + 0x1c]
call fcn.00539bb4
pop eax
mov word [ebx + 0x10], 0x2c
inc dword [ebx + 0x1c]
mov edx, dword [ebx]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442634
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
test dl, dl
push ebx
push esi
mov byte [ebp - 8], dl
jle 0x442648
call fcn.0053b2c4
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, 0x5558b8
call fcn.0052c468
mov word [ebp - 0x18], 8
mov cl, byte [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049d794
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], esi
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xf], 1
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp - 4]
test bl, bl
je 0x442692
call fcn.0053b2d1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47f5e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x55bcd0
call fcn.0052c468
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.0052ba88
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x47f659
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x47f659
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.0052baa8
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x47f659
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x47f676
cmp dword [ebp - 0x34], 0
je 0x47f676
mov edx, dword [ebp - 0x34]
jmp 0x47f67b
mov edx, 0x55b944
lea eax, [ebp - 4]
call fcn.005399d4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.0052ba98
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00539be4
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00539bb4
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x47f6f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x486968
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
call fcn.004869bc
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x48698a
lea eax, [ebp - 1]
xor edx, edx
call fcn.004869f0
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4869a0
lea eax, [ebp - 1]
mov dl, 2
call fcn.004869f0
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4869b6
lea eax, [ebp - 1]
mov dl, 1
call fcn.004869f0
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret