joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464b50
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x464baf
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x464b7c
mov eax, 1
jmp 0x464bcd
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x464bad
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x464bcd
jmp 0x464bc8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x464bc8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x464bcd
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x464d10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x464d19
cmp dword [ebp + 0xc], 0
je 0x464d2c
mov dword [ebp - 4], 1
jmp 0x464d33
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x464d46
mov eax, 0xd
jmp 0x464d75
xor edx, edx
jne 0x464d1d
mov eax, dword [ebp + 0xc]
push eax
call fcn.0060f66f
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4903f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65cd55
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x490426
jmp 0x490542
lea ecx, [ebp - 0x40]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054db90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x48]
call fcn.0054dbd0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4904a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x490535
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4904e4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x490535
push 3
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x44]
add ecx, 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x490542
push 0
push 0
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 8
Function at 0x492ff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d083
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
cmp dword [ebp + 8], 0
jne 0x493026
jmp 0x493158
push 0xffffffffffffffff
push 0x67f0f4
mov ecx, dword [ebp + 8]
call fcn.0048a330
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x493158
push 0
mov ecx, dword [ebp - 0x4c]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::GetWindow_int_const]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x493158
mov eax, dword [ebp - 0x44]
push eax
call fcn.00494400
add esp, 4
mov dword [ebp - 0x54], eax
push 0xffffffffffffffff
push 0x67f270
mov ecx, dword [ebp - 0x44]
call fcn.00493c30
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x54], 0
je 0x493145
cmp dword [ebp - 0x50], 0
je 0x493145
lea ecx, [ebp - 0x40]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0054db90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp - 0x50]
call dword [sym.imp.soui.dll_public:_unsigned_long_int___thiscall_SOUI::SWindow::GetUserData_void_]
push eax
lea ecx, [ebp - 0x58]
call fcn.0054e1c0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49311e
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x49311e
push 3
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x54]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x48]
add ecx, 4
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
push 3
mov ecx, dword [ebp - 0x44]
call dword [sym.imp.soui.dll_public:_class_SOUI::SWindow____thiscall_SOUI::SWindow::GetWindow_int_const]
mov dword [ebp - 0x44], eax
jmp 0x493050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 4
Function at 0x497960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d573
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x497996
jmp 0x497ab2
lea ecx, [ebp - 0x40]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054db90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x48]
call fcn.0054dbd0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x497a10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x497aa5
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x497a54
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x497aa5
push 3
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x44]
add ecx, 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x497ab2
push 0
push 0
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 8
Function at 0x499620
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d7e3
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x499656
jmp 0x499772
lea ecx, [ebp - 0x40]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054db90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x48]
call fcn.0054dbd0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4996d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x499765
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x499714
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x499765
push 3
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x44]
add ecx, 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x499772
push 0
push 0
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65df5b
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x4a1046
jmp 0x4a1162
lea ecx, [ebp - 0x40]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054db90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x48]
call fcn.0054dbd0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a10c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x4a1155
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4a1104
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x4a1155
push 3
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x44]
add ecx, 4
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
call edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.0054dbb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0043c8a0
jmp 0x4a1162
push 0
push 0
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 8
Function at 0x4a2980
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65e193
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 8], 0
jne 0x4a29b6
jmp 0x4a2a9b
lea ecx, [ebp - 0x28]
call fcn.00446de0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0054db90
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0054e2e0
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a2a11
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0054dbb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
jmp 0x4a2a8e
lea ecx, [ebp - 0x28]
call fcn.0043d500
push eax
call dword [sym.imp.soui.dll_public:_static_struct_SOUI::IBitmap____cdecl_SOUI::SResLoadFromFile::LoadImageW_wchar_t_const__]
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4a2a49
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0054dbb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
jmp 0x4a2a8e
push 3
mov edx, dword [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0x2c]
add ecx, 4
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0054dbb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c8a0
jmp 0x4a2a9b
push 0
push 0
mov ecx, dword [ebp + 8]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::SetImage_struct_SOUI::IBitmap___enum_SOUI::FilterLevel_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
jmp 0x4b021b
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jge 0x4b0321
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4b02e8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov cl, byte [eax + 0x7058c8]
mov byte [ebp - 1], cl
mov dword [ebp - 8], 0
jmp 0x4b0268
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jge 0x4b02b3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx*4 + 0x705e98]
mov eax, dword [ebp - 8]
movzx eax, byte [edx + eax]
movzx ecx, byte [ebp - 1]
add eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp - 2], dl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx + 1]
movzx ecx, byte [ebp - 2]
movzx edx, byte [ecx + 0x7057c8]
xor eax, edx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x4b025f
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
jmp 0x4b02c4
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx - 1]
cmp dword [ebp - 8], eax
jge 0x4b02e6
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx + 1]
mov byte [ecx], al
jmp 0x4b02bb
jmp 0x4b031c
mov dword [ebp - 8], 0
jmp 0x4b02fa
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx - 1]
cmp dword [ebp - 8], ecx
jge 0x4b031c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov cl, byte [eax + 1]
mov byte [edx], cl
jmp 0x4b02f1
jmp 0x4b0212
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c7ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65faf6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x7060c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x40]
call fcn.004c7df0
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x94]
call eax
movzx ecx, byte [ebp - 0x18]
test ecx, ecx
je 0x4c7b51
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x3a4]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SMsgHandleState::SetMsgHandled_int_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004c7ed0
jmp 0x4c7bf5
cmp dword [ebp + 8], 0xd
jne 0x4c7b9f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x370]
and edx, 0x1000
jne 0x4c7b9f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
jne 0x4c7b9f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3a4]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SMsgHandleState::SetMsgHandled_int_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004c7ed0
jmp 0x4c7bf5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x380]
call dword [sym.imp.soui.dll_public:_class_ITextServices____thiscall_SOUI::STextHost::GetTextService_void_]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.soui.dll_public:_struct_SOUI::SWNDMSG____thiscall_SOUI::SWindow::GetCurMsg_void_]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.soui.dll_public:_struct_SOUI::SWNDMSG____thiscall_SOUI::SWindow::GetCurMsg_void_]
mov edx, dword [eax + 4]
push edx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.soui.dll_public:_struct_SOUI::SWNDMSG____thiscall_SOUI::SWindow::GetCurMsg_void_]
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004c7ed0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d5b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7060c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404930
push 1
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.00409bd0
push eax
push 0x685c0c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
ja 0x4d5bc6
push 1
push 0
lea ecx, [ebp - 0x1c]
call fcn.00409bd0
push eax
push str.iexplore.exe
push 0x685c24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404bf0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c4766
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d6fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6603f7
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x7060c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SImageWnd::constructor_void_]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18c
call fcn.004c9350
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.SOUI::SMyGameImgWnd.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], vtable.SOUI::SMyGameImgWnd.1.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], vtable.SOUI::SMyGameImgWnd.2.0
mov eax, dword [ebp - 0x10]
mov dword [eax + method.SOUI::SMyGameImgWnd.3.virtual_0], vtable.SOUI::SMyGameImgWnd.3.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x190], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x194], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x198], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x19c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1a0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1a4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1a8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1ac], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1b4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1b8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1bc
call fcn.004c9330
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x184], 3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x138]
and ecx, 0xffffffef
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x138], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x190], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1a4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1a8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1ac], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1b0], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c8], 0
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov dword [ebp - 0x14], eax
call dword [sym.imp.soui.dll_public:_static_wchar_t_const____cdecl_SOUI::SLinearInterpolator::GetClassNameW_void_]
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0xc]
call edx
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1bc
call fcn.004c9400
call fcn.004d81c0
push eax
push 0x989686
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call dword [sym.imp.soui.dll_public:_void___thiscall_SOUI::SEventSet::addEvent_unsigned_long_int__wchar_t_const__]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret