joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10023f28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push 0
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10002480
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0
test eax, eax
je 0x1000146f
lea ecx, [esp]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10002500
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x14]
push esi
push edx
mov dword [eax], 0
push eax
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.10011490
add esp, 0x10
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.10002500
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x100014c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10023f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push 0
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10001fd0
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], 0
test eax, eax
je 0x1000151f
lea ecx, [esp]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10002090
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x10]
push esi
push edx
mov dword [eax], 0
push eax
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.10013340
add esp, 0x10
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.10002090
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x10009980
Capabilities:
Access peb ldr_data

Disassembly:
lds esp, [esp + edx*2]
call fcn.100077dd
bound esi, qword [esi]
lodsb al, byte [esi]
cdq
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x100099a1
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.100077dd
sbb ecx, ebx
je 0x100099b8
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100077dd
in eax, 0x53
ret

Function at 0x1000a150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002410b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1000a810
xor ebx, ebx
lea edi, [esi + 0x30]
push ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.1000ad00
mov dword [edi], 0x100252d0
mov dword [edi + 0x38], ebx
mov eax, dword [esi + 0xb0]
lea ecx, [esi + 0xa8]
and al, 0xfd
mov dword [esp + 0x10], ecx
or al, 1
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], ebx
mov dword [ecx + 0x10], ebx
push 1
push ebx
mov byte [esp + 0x24], 2
mov dword [ecx], 0x100252b0
mov dword [ecx + 0x14], ebx
call fcn.1000a380
mov eax, dword [esi + 0x1c4]
mov ecx, 0xf
and al, 0xf0
lea edi, [esi + 0x6c]
mov dword [esi + 0x1c4], eax
xor eax, eax
mov dword [esi], 0x100253b0
mov dword [esi + 0xc0], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x68], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1000d2f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
test ecx, ecx
jne 0x1000d30c
or eax, 0xffffffff
mov dword [edi + 0x17c], eax
pop edi
not eax
pop esi
ret
mov esi, dword [esp + 0x14]
mov eax, dword [edi + 0x17c]
test esi, esi
je 0x1000d33a
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1002a274]
xor eax, edx
inc ecx
dec esi
jne 0x1000d31b
pop ebx
mov dword [edi + 0x17c], eax
pop edi
not eax
pop esi
ret

Function at 0x10014870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100242a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x14]
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebx, [esi + 4]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [ebx], edi
mov dword [esp + 0xc], esi
mov byte [esi + 0x24], al
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov cl, byte [esp + 0x20]
mov dword [esp + 0x18], edi
mov byte [esi + 0x34], cl
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dl, byte [esp + 0x20]
mov dword [esi + 0x44], edi
mov word [esi + 0x48], 1
mov word [esi + 0x4a], 1
mov word [esi + 0x4c], di
mov word [esi + 0x4e], di
mov byte [esi + 0xa8], dl
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov byte [esp + 0x18], 2
mov dword [esi + 0xcc], edi
mov word [esi + 0x16], di
call fcn.10016550
xor ecx, ecx
cmp eax, 4
setl cl
dec ecx
mov edx, dword [esp + 0x20]
and ecx, 0x400030
push ebx
add ecx, 0x10
push edi
mov eax, ecx
push edi
push eax
push edi
push edx
call dword [sym.imp.ole32.dll_StgOpenStorage]
cmp eax, edi
jge 0x10014947
push eax
push str.Error___d__opening_docfile_n
push 0x1002aa90
call fcn.100183a8
add esp, 0xc
jmp 0x1001494e
mov dword [esi + 0xc], 1
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10016550
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
mov edi, eax
test edi, edi
jne 0x1001659f
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
jne 0x1001659f
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xa0
ret
mov eax, dword [esp + 0x1c]
dec eax
je 0x100165ed
dec eax
jne 0x10016627
mov eax, dword [esp + 0x10]
cmp eax, 4
ja 0x100165c0
pop edi
mov eax, 4
pop esi
add esp, 0xa0
ret
cmp eax, 5
jne 0x100165db
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100165db
pop edi
mov eax, 5
pop esi
add esp, 0xa0
ret
test edi, edi
je 0x10016627
pop edi
mov eax, 6
pop esi
add esp, 0xa0
ret
cmp dword [esp + 0x10], 4
jne 0x10016627
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1001660a
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
cmp eax, 0xa
jne 0x1001661d
pop edi
mov eax, 2
pop esi
add esp, 0xa0
ret
cmp eax, 0x5a
mov eax, 3
je 0x1001662b
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xa0
ret

Function at 0x1001774e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001776e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001bee5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1001778f
test byte [esp + 8], 2
je 0x1001778f
mov dword [0x1002c144], 0xd
mov dword [0x1002c148], 5
jmp 0x1001776a
xor eax, eax
ret
Function at 0x1001ba29
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1002ad10
cmp edx, dword [eax]
je 0x1001ba4b
add eax, 8
inc ecx
cmp eax, 0x1002ada0
jl 0x1001ba3c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1002ad10]
jne 0x1001bb79
mov eax, dword [0x1002c134]
cmp eax, 1
je 0x1001bb53
test eax, eax
jne 0x1001ba7c
cmp dword [0x1002c138], 1
je 0x1001bb53
cmp edx, 0xfc
je 0x1001bb79
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001bab3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1001d6b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1001d260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1001baf6
lea eax, [ebp - 0x1a4]
push eax
call fcn.1001d260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1002584c
push edi
call fcn.10017650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1001d6b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1001d6c0
lea eax, [ebp - 0xa0]
push 0x1002582c
push eax
call fcn.1001d6c0
push dword [esi + 0x1002ad14]
lea eax, [ebp - 0xa0]
push eax
call fcn.1001d6c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1001db80
add esp, 0x2c
pop edi
jmp 0x1001bb79
lea eax, [ebp + 8]
lea esi, [esi + 0x1002ad14]
push 0
push eax
push dword [esi]
call fcn.1001d260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5071b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00507140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00507140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00507140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00507140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x507bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x507c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x51987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x507c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x507c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x32c9141b
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6a5371fe
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402cf0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6e30d0]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6f321c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push 0x5ba964
push edx
call fcn.0058a079
push 0x5ba97c
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0058a032
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x402d76
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.00589ee5
mov edx, dword [esp + 0x18]
push edx
call fcn.00589d1a
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00589b64
add esp, 0x48
ret

Function at 0x402d90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6e30d0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6f321c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.0058a079
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.005899a0
push 0x5ba998
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.0058a032
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e68
push eax
push 1
push 0x1c64
push edi
call fcn.0058a499
mov edx, dword [esp + 0x18]
push edx
call fcn.00589d1a
add esp, 0x14
call fcn.00401240
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x402e2b
fadd dword [0x5ba9e4]
fstp dword [esi + 0xe0]
call fcn.00401240
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x402e51
fadd dword [0x5ba9e4]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e80
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret
Function at 0x402da3
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6e30d0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6f321c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.0058a079
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.005899a0
push 0x5ba998
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.0058a032
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e68
push eax
push 1
push 0x1c64
push edi
call fcn.0058a499
mov edx, dword [esp + 0x18]
push edx
call fcn.00589d1a
add esp, 0x14
call fcn.00401240
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x402e2b
fadd dword [0x5ba9e4]
fstp dword [esi + 0xe0]
call fcn.00401240
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x402e51
fadd dword [0x5ba9e4]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e80
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret
Function at 0x402e80
Capabilities:
Create directory
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
mov esi, 0x1d4
lea ebx, [edi + 1]
call fcn.00401240
mov dword [eax + esi + 0xbc], ebx
call fcn.00401240
mov dword [eax + esi], edi
cmp ebp, 5
jge 0x402ecf
call fcn.00401240
mov dword [eax + esi - 0x88], edi
call fcn.00401240
mov dword [eax + esi - 0x34], edi
call fcn.00401240
mov dword [eax + esi + 0x88], ebx
cmp ebp, 4
jge 0x402ef6
call fcn.00401240
mov dword [eax + esi - 0x74], edi
call fcn.00401240
mov dword [eax + esi - 0x20], edi
call fcn.00401240
mov dword [eax + esi + 0x9c], 5
cmp ebp, 2
jge 0x402f3f
call fcn.00401240
mov dword [eax + esi - 0x64], edi
call fcn.00401240
mov dword [eax + esi - 0x5c], edi
call fcn.00401240
mov dword [eax + esi - 0x10], edi
call fcn.00401240
mov dword [eax + esi + 0xac], 5
call fcn.00401240
mov dword [eax + esi - 8], edi
call fcn.00401240
mov dword [eax + esi + 0xb4], 5
add esi, 4
add ebp, ebx
cmp esi, 0x1ec
jl 0x402e95
call fcn.00401240
mov dword [eax + 0x240], 0x1e
call fcn.00401240
mov dword [eax + 0x180], ebx
call fcn.00401240
mov dword [eax + 0x184], ebx
call fcn.00401240
mov esi, 0xfa
mov dword [eax + 0x228], esi
call fcn.00401240
mov dword [eax + 0x22c], esi
call fcn.00401240
mov dword [eax + 0x188], ebx
call fcn.00401240
mov dword [eax + 0x18c], ebx
call fcn.00401240
mov dword [eax + 0x250], ebx
call fcn.00401240
mov ebp, 3
mov dword [eax + 0x254], ebp
call fcn.00401240
mov dword [eax + 0x190], ebx
call fcn.00401240
mov dword [eax + 0x12c], ebx
call fcn.00401240
mov dword [eax + 0xf0], edi
call fcn.00401240
mov dword [eax + 0xf4], edi
call fcn.00401240
mov dword [eax + 0xf8], edi
call fcn.00401240
mov dword [eax + 0x194], edi
call fcn.00401240
mov dword [eax + 0x198], edi
call fcn.00401240
mov esi, 5
mov dword [eax + 0x218], esi
call fcn.00401240
mov dword [eax + 0x220], esi
call fcn.00401240
mov dword [eax + 0x21c], esi
call fcn.00401240
mov dword [eax + 0x258], ebp
call fcn.00401240
mov dword [eax + 0x204], esi
call fcn.00401240
mov dword [eax + 0x19c], edi
call fcn.00401240
mov dword [eax + 0xfc], edi
call fcn.00401240
mov dword [eax + 0x10c], ebx
call fcn.00401240
mov dword [eax + 0x110], ebx
call fcn.00401240
mov dword [eax + 0x118], ebx
call fcn.00401240
mov dword [eax + 0x120], ebx
call fcn.00401240
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x2a8], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.00402cf0
Function at 0x407b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6e30d0]
xor eax, esp
mov dword [esp + 0x48], eax
movzx eax, word [esp + 0x54]
push ebp
push edi
mov edi, ecx
push eax
mov ecx, 0x6f31a8
mov dword [esp + 0x10], eax
call fcn.00494880
mov ebp, eax
mov dword [esp + 8], ebp
test ebp, ebp
je 0x407d3c
push ebx
xor ebx, ebx
push esi
jmp 0x407b90
mov ecx, dword [edi + 0x218]
movzx esi, bx
push esi
call fcn.00408970
test eax, eax
je 0x407bdc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
cmp word [esp + 0x14], ax
jne 0x407bdc
mov ecx, dword [edi + 0x218]
push esi
call fcn.00408970
mov esi, eax
test esi, esi
je 0x407bdc
mov ecx, dword [edi + 0x218]
push esi
call fcn.00430010
push esi
mov ecx, 0x6f2910
call fcn.00444070
inc ebx
cmp ebx, 5
jl 0x407b90
mov ebx, dword [ebp + 0x538]
test ebx, ebx
je 0x407d08
mov ebp, dword [esp + 0x60]
mov ecx, dword [edi + 0x218]
push ebp
call fcn.00408970
mov esi, eax
test esi, esi
je 0x407c1d
mov ecx, dword [edi + 0x218]
push esi
call fcn.00430010
push esi
mov ecx, 0x6f2910
call fcn.00444070
push 0x53c
call fcn.00589a56
add esp, 4
test eax, eax
je 0x407c39
mov ecx, eax
call fcn.00494100
mov esi, eax
jmp 0x407c3b
xor esi, esi
lea ecx, [esp + 0x38]
call fcn.00430110
lea ecx, [esp + 0x18]
call fcn.00430110
mov edx, dword [ebx + 0x33]
push 2
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x6f27a0
call fcn.00435810
mov ecx, dword [ebx + 0x37]
push 2
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x6f27a0
call fcn.00435810
mov edx, dword [esi]
mov edx, dword [edx + 0xb4]
lea eax, [ebp + 0x109a0]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x40]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x220]
add eax, 0x4b8
mov dword [esi + 0x220], ecx
push eax
mov ecx, esi
call fcn.004941c0
mov edx, 0x8e
mov dword [esi + 0x538], ebx
mov word [esi + 0xc], dx
mov ecx, dword [0x6f2928]
push esi
call fcn.00583630
mov ecx, dword [edi + 0x218]
push esi
push ebp
call fcn.0042fd80
lea ecx, [esp + 0x18]
call fcn.00430120
lea ecx, [esp + 0x38]
call fcn.00430120
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x6f5218
call fcn.004d7240
push eax
push 0x1d
push 0x6f5218
call fcn.004d8470
add esp, 0xc
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x6f5218
call fcn.004d7240
push eax
push 0x1d
push 0x6f5218
call fcn.004d8470
mov ecx, dword [esp + 0x5c]
add esp, 0xc
pop edi
pop ebp
xor ecx, esp
call fcn.00589b64
add esp, 0x4c
ret 8

Function at 0x40ac40
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x40abc0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6e4d94], eax
ret 4