joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x68
mov eax, dword [0x4b3220]
mov ecx, dword [0x4b3224]
mov edx, dword [0x4b3228]
mov dword [edi], eax
mov eax, dword [0x4b322c]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
push ebx
xor ebx, ebx
mov eax, 2
push ebp
mov ebp, dword [esp + 0x78]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
or eax, 0xffffffff
push esi
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [esp + 0x10], ebx
mov esi, ebp
call fcn.00432200
cmp ebp, ebx
jne 0x434d5a
mov eax, dword [eax]
cmp eax, ebx
je 0x434d9f
mov esi, eax
mov ecx, dword [esp + 0x78]
push 0xa
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x434d9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x434d9f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esp + 0x14]
push edx
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x10], eax
mov eax, ebp
cmp ebp, ebx
jne 0x434de7
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x10]
push ebp
push eax
call fcn.00432200
mov esi, dword [esp + 0x80]
mov ecx, 0x4bbce8
mov edx, esi
call fcn.0043a2c0
cmp eax, ebx
jne 0x434de7
lea ecx, [esp + 0x10]
push ebp
push ecx
call fcn.00432200
mov ecx, str.RC_PNG
mov edx, esi
call fcn.0043a2c0
cmp eax, ebx
jne 0x434de7
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 8
mov ecx, dword [0x4cad54]
cmp ecx, ebx
je 0x434ddc
mov esi, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push esi
push eax
lea eax, [esp + 0x30]
push eax
call edx
cmp eax, ebx
je 0x434ddc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
call fcn.00435de0
cmp dword [eax], ebx
je 0x434e1c
xor ecx, ecx
jmp 0x434e1f
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi], ebx
mov dword [edi + 4], ecx
mov dword [edi + 8], eax
or eax, 0xffffffff
lea esi, [edi + 0x24]
mov dword [edi + 0x3c], ebx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x28], ebx
mov dword [esi], ebx
cmp ecx, ebx
je 0x434e58
call fcn.00436cc0
mov eax, dword [esi]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x1c], eax
mov eax, 2
pop esi
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov al, 1
pop ebp
mov byte [edi + 0x40], bl
mov dword [edi + 0x20], ecx
mov byte [edi + 0x41], al
pop ebx
add esp, 0x68
ret 8
Function at 0x438140
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c5280]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push edi
push 0x3c
call fcn.00475202
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
jne 0x43817f
pop edi
mov dword [0x4cad6c], 0x6d
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00474db0
add esp, 0xc
ret
push esi
push 0x3c
push ebx
push edi
call fcn.00479770
push 0x6148
call fcn.00475202
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x4381c3
push edi
mov dword [0x4cad6c], 0x6d
call fcn.00475125
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00474db0
add esp, 0xc
ret
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x38], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi], 8
mov dword [esi + 0x3c], 0x437c60
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x4381f9
push 6
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x43820e
mov edx, dword [ecx + 0x38]
push edx
push 6
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0047b475
add esp, 0x10
cmp eax, 6
je 0x43821f
mov dword [0x4cad6c], 0x66
jmp 0x438245
push 3
lea ecx, [esp + 0x10]
push ecx
push str.GIFVER
mov byte [esp + 0x1e], bl
call fcn.0047bc2e
add esp, 0xc
test eax, eax
je 0x438268
mov dword [0x4cad6c], 0x67
push esi
call fcn.00475125
push edi
call fcn.00475125
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00474db0
add esp, 0xc
ret
call fcn.00438290
test eax, eax
je 0x438245
mov ecx, dword [esp + 0x14]
pop esi
mov eax, edi
pop edi
mov dword [0x4cad6c], ebx
pop ebx
xor ecx, esp
call fcn.00474db0
add esp, 0xc
ret
Function at 0x438290
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edi + 0x38]
test byte [eax], 8
jne 0x4382a7
mov dword [0x4cad6c], 0x6f
xor eax, eax
pop ecx
ret
push edi
mov edx, edi
call fcn.00438980
add esp, 4
test eax, eax
je 0x4382a3
lea ecx, [edi + 4]
push ecx
mov edx, edi
call fcn.00438980
add esp, 4
test eax, eax
je 0x4382a3
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4382e1
push 3
lea edx, [esp + 4]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x4382f6
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 8]
push 1
push ecx
call fcn.0047b475
add esp, 0x10
cmp eax, 3
je 0x438309
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ecx
ret
mov dl, byte [esp]
movzx eax, dl
mov ecx, eax
shr ecx, 4
and ecx, 7
inc ecx
mov dword [edi + 8], ecx
movzx ecx, byte [esp + 1]
and eax, 7
push ebx
inc eax
push esi
mov dword [edi + 0xc], ecx
test dl, dl
jns 0x4383f7
mov ecx, eax
mov esi, 1
shl esi, cl
push 0
call fcn.00438f70
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x438359
pop esi
mov dword [0x4cad6c], 0x6d
pop ebx
pop ecx
ret
xor ebx, ebx
cmp dword [eax], ebx
jle 0x4383fe
xor esi, esi
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x43837e
push 3
lea edx, [esp + 0xc]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x438393
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.0047b475
add esp, 0x10
cmp eax, 3
jne 0x4383d8
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 8]
mov byte [esi + eax], cl
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 9]
mov byte [eax + esi + 1], cl
mov edx, dword [edi + 0x10]
movzx ecx, byte [esp + 0xa]
mov eax, dword [edx + 8]
mov byte [eax + esi + 2], cl
mov edx, dword [edi + 0x10]
inc ebx
add esi, 3
cmp ebx, dword [edx]
jl 0x438365
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [edi + 0x10]
call fcn.00438ff0
pop esi
mov dword [edi + 0x10], 0
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ebx
pop ecx
ret
mov dword [edi + 0x10], 0
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x438410
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
test byte [eax], 8
jne 0x438427
mov dword [0x4cad6c], 0x6f
xor eax, eax
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x43843d
push 1
lea eax, [esp + 7]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x438452
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xb]
push 1
push edx
call fcn.0047b475
add esp, 0x10
cmp eax, 1
je 0x438465
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ecx
ret
mov al, byte [esp + 3]
cmp al, 0x21
je 0x4384a3
cmp al, 0x2c
je 0x438496
cmp al, 0x3b
je 0x438489
mov dword [esi], 0
mov dword [0x4cad6c], 0x6b
xor eax, eax
pop ecx
ret
mov dword [esi], 4
mov eax, 1
pop ecx
ret
mov dword [esi], 2
mov eax, 1
pop ecx
ret
mov dword [esi], 3
mov eax, 1
pop ecx
ret
Function at 0x4387b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x4387cb
mov dword [0x4cad6c], 0x6f
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4387e1
push 1
lea eax, [esp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4387f6
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.0047b475
add esp, 0x10
cmp eax, 1
je 0x43880a
mov dword [0x4cad6c], 0x66
xor eax, eax
pop esi
pop ecx
ret
movzx eax, byte [esp + 7]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
call fcn.00438820
pop esi
pop ecx
ret

Function at 0x438820
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x43883f
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xb]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x438854
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.0047b475
add esp, 0x10
cmp eax, 1
jne 0x4388a0
mov cl, byte [esp + 7]
test cl, cl
jbe 0x4388af
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x438882
movzx ecx, byte [esp + 7]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x438897
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 7]
push edx
push ecx
push 1
push eax
call fcn.0047b475
add esp, 0x10
movzx edx, byte [esp + 7]
cmp eax, edx
je 0x4388b5
mov dword [0x4cad6c], 0x66
xor eax, eax
pop edi
pop ecx
ret
mov dword [ebx], 0
mov eax, 1
pop edi
pop ecx
ret

Function at 0x438980
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x43899a
push 2
lea eax, [esp + 4]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x4389af
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [esp + 8]
push 1
push edx
call fcn.0047b475
add esp, 0x10
cmp eax, 2
je 0x4389c2
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ecx
ret
mov ax, word [esp]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 8]
shl ecx, 8
add ecx, edx
mov dword [eax], ecx
mov eax, 1
pop ecx
ret
Function at 0x4389e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x438a04
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xf]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x438a19
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0x13]
push 1
push edx
call fcn.0047b475
add esp, 0x10
cmp eax, 1
jne 0x438a66
mov cl, byte [esp + 0xb]
test cl, cl
jbe 0x438a76
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebp], eax
inc eax
test edx, edx
je 0x438a48
movzx ecx, byte [esp + 0xb]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x438a5d
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xb]
push edx
push ecx
push 1
push eax
call fcn.0047b475
add esp, 0x10
movzx edx, byte [esp + 0xb]
cmp eax, edx
je 0x438a88
pop edi
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x438aa0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [eax + 0x38]
xor ebx, ebx
push edi
mov ecx, esi
cmp dword [esi + 0x3c], ebx
je 0x438ac2
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
add esp, 0xc
jmp 0x438ad7
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.0047b475
add esp, 0x10
movzx ecx, byte [esp + 0xf]
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x438e80
Capabilities:
Read file on windows

Disassembly:
mov cl, byte [esi]
push ebp
mov ebp, dword [esp + 8]
push edi
test cl, cl
jne 0x438f29
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x438ea5
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x438eb6
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.0047b475
add esp, 0x10
cmp eax, 1
je 0x438eca
pop edi
mov dword [0x4cad6c], 0x66
xor eax, eax
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x438edf
pop edi
mov dword [0x4cad6c], 0x70
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x438ef9
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x438f0c
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.0047b475
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x438ebb
mov al, byte [edi]
mov byte [edi], 2
mov byte [ebp], al
dec cl
pop edi
mov byte [esi], cl
mov eax, 1
pop ebp
ret
mov al, byte [esi + 1]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
pop edi
mov byte [ebp], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop ebp
ret
Function at 0x439bf0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4989bb
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x4c5280]
xor eax, esp
mov dword [esp + 0x35c], eax
push ebp
push esi
push edi
mov eax, dword [0x4c5280]
xor eax, esp
push eax
lea eax, [esp + 0x374]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x384]
lea esi, [esp + 0x14]
mov edi, ecx
call fcn.00418900
xor esi, esi
push esi
push ebx
mov eax, edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x384], esi
call fcn.00415eb0
test al, al
je 0x439cb1
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], esi
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x439c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x439c7f
xor esi, esi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x36c], esi
mov dword [esp + 0x18], 0
call edi
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x439cf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x439cf7
xor eax, eax
jmp 0x439cf9
mov eax, ebx
call fcn.0040f780
push 0x4b91e0
push 0x4b8ff4
mov edx, eax
call fcn.00410f90
mov dword [esp + 0x384], 0xffffffff
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00415df0
xor al, al
jmp 0x439d64
mov eax, esi
push eax
mov dword [ebp + 8], eax
call fcn.00475202
mov ecx, dword [ebp + 8]
add esp, 4
push ecx
push eax
push ebx
lea ecx, [esp + 0x36c]
mov dword [ebp + 4], eax
call fcn.00418a20
test al, al
jne 0x439d3f
mov eax, ebx
call fcn.0040f780
push 0x4b91e0
push 0x4b8ff4
mov edx, eax
call fcn.00410f90
mov dword [esp + 0x384], edi
jmp 0x439cd4
mov dword [esp + 0x37c], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00415df0
mov al, 1
mov ecx, dword [esp + 0x374]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x35c]
xor ecx, esp
call fcn.00474db0
add esp, 0x370
ret 4

Function at 0x43a2c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x43a2d5
mov esi, dword [eax]
test esi, esi
jne 0x43a2d5
xor eax, eax
pop esi
ret 8
push edi
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x43a2f1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x43a2f8
pop edi
xor eax, eax
pop esi
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
ret 8
Function at 0x47447c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4c9820], 0
push esi
jne 0x4743ef
call fcn.00474315
test eax, eax
je 0x474432
mov eax, dword [0x4c9820]
cmp eax, 1
jne 0x474410
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x474432
pop esi
ret
push eax
call dword [0x4c9828]
test eax, eax
jne 0x47447a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x474436
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4c9820]
call dword [0x4c9828]
mov edi, eax
test edi, edi
je 0x47445b
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x474477
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4c9820]
call dword [0x4c9824]
add edi, 0x10
cmp edi, esi
jb 0x474463
mov eax, edi
pop edi
pop esi
ret
jmp 0x4743dc

Function at 0x474db0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c5280]
jne 0x474dba
repz ret
jmp fcn.0047ca3b

Function at 0x48691a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00478bd8
and dword [ebp - 4], 0
cmp dword [0x4ca41c], 0
mov ebx, eax
jne 0x4869cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x486a7c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x486a7c
push eax
call fcn.00478b66
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ca41c], eax
call esi
push eax
call fcn.00478b66
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ca420], eax
call esi
push eax
call fcn.00478b66
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ca424], eax
call esi
push eax
call fcn.00478b66
pop ecx
mov dword [0x4ca42c], eax
test eax, eax
je 0x4869cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00478b66
pop ecx
mov dword [0x4ca428], eax
mov eax, dword [0x4ca428]
cmp eax, ebx
je 0x486a23
cmp dword [0x4ca42c], ebx
je 0x486a23
push eax
call fcn.00478be1
push dword [0x4ca42c]
mov esi, eax
call fcn.00478be1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x486a23
test edi, edi
je 0x486a23
call esi
test eax, eax
je 0x486a1a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x486a1a
test byte [ebp - 0xc], 1
jne 0x486a23
or dword [ebp + 0x10], 0x200000
jmp 0x486a5c
mov eax, dword [0x4ca420]
cmp eax, ebx
je 0x486a5c
push eax
call fcn.00478be1
pop ecx
test eax, eax
je 0x486a5c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x486a5c
mov eax, dword [0x4ca424]
cmp eax, ebx
je 0x486a5c
push eax
call fcn.00478be1
pop ecx
test eax, eax
je 0x486a5c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ca41c]
call fcn.00478be1
pop ecx
test eax, eax
je 0x486a7c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x486a7e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x490430
Capabilities:
Hide graphical window

Disassembly:
test byte [esi + 0x27a8], 1
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x49048f
mov eax, dword [esi + 0x2098]
push 0
push eax
call edi
mov ecx, dword [esi + 0x21e4]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2330]
push 0
push edx
call edi
mov eax, dword [esi + 0x247c]
push 0
push eax
call edi
mov ecx, dword [esi + 0x2660]
push 5
push ecx
call edi
mov edx, dword [esi + 0x2638]
push 5
push edx
call edi
mov eax, dword [esi + 0x2630]
push 0
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0x2098]
push 5
push ecx
call edi
mov edx, dword [esi + 0x21e4]
push 5
push edx
call edi
mov eax, dword [esi + 0x2330]
push 5
push eax
call edi
mov ecx, dword [esi + 0x247c]
push 5
push ecx
call edi
mov edx, dword [esi + 0x2660]
push 0
push edx
call edi
mov eax, dword [esi + 0x2638]
push 0
push eax
call edi
mov ecx, dword [esi + 0x2630]
push 0
push ecx
call edi
pop edi
ret

Function at 0x4907d0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esi + 0x208c]
push str.ck_W
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 4
call fcn.00475fdd
push eax
push 0
push 0x490220
mov dword [eax], esi
call fcn.0047548e
mov ecx, dword [esi + 4]
add esp, 0x10
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
ret
Function at 0x490e70
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4c5280]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, ebx
and eax, 0xff
push esi
mov esi, ecx
jne 0x490ea8
xor al, al
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00474db0
add esp, 0x12c
ret
push edi
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx edi, ax
test di, di
jne 0x490ed3
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00474db0
add esp, 0x12c
ret
mov byte [esp + 0xb], 1
test ebx, 0x100
je 0x490ef1
push 0x4b694c
lea eax, [esp + 0xf]
call fcn.00490b20
add esp, 4
test ebx, 0x400
je 0x490f0a
push str.Shift
lea eax, [esp + 0xf]
call fcn.00490b20
add esp, 4
test ebx, 0x200
je 0x490f23
push 0x4b6964
lea eax, [esp + 0xf]
call fcn.00490b20
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00410770
movzx eax, di
cmp di, 0x20
jae 0x490f3a
mov eax, 0x3f
movzx eax, ax
push eax
push 0x4b9a6c
lea edx, [esp + 0x14]
call fcn.00410f90
add esp, 8
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x490f61
mov eax, dword [esp + 0x14]
add eax, 4
push eax
lea eax, [esp + 0xf]
call fcn.00490b20
add esp, 4
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x490f98
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x490f98
push eax
call fcn.00475125
add esp, 4
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00474db0
add esp, 0x12c
ret
Function at 0x491e50
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, eax
mov eax, dword [esi + 0x208c]
push str.ck_W_vN
push eax
call edi
mov ecx, dword [esi + 0x2630]
push 0x4b6914
xor ebx, ebx
push ecx
mov dword [esi + 0x2fe0], ebx
mov dword [esi + 0x2658], ebx
call edi
push ebx
call fcn.004760f0
add esp, 4
push ebx
push 0x64
mov dword [esi + 0x2fec], edx
mov edx, dword [esi + 4]
push 0x10a
push edx
mov dword [esi + 0x2fe8], eax
mov dword [esi + 0x2ff0], ebx
mov dword [esi + 0x2ff4], ebx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 4
call fcn.00475fdd
add esp, 4
push eax
push ebx
push 0x491820
mov dword [eax], esi
call fcn.0047548e
or dword [esi + 0x27a8], 1
add esp, 0xc
call fcn.00490430
call fcn.004905d0
mov edx, dword [esi + 4]
push 1
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
pop ecx
ret 0xc