joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d96c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x44da0b
cmp dword [ebx + 0x94], 0
jne 0x44da05
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d8f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44da05
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44d9cb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44da05
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418fb4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44d9da
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44dc24
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4d9c10]
cmp dword [eax + 0x30], 0
je 0x44dd81
test bl, bl
jne 0x44dcd2
cmp dword [esi + 0x9c], 0
jne 0x44dcc7
mov eax, esi
call fcn.00450264
push eax
push 0x44db50
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x44dc98
mov eax, dword [0x4d9c10]
call fcn.00450944
test al, al
je 0x44dc98
mov eax, dword [0x4d9c34]
call fcn.00406254
mov edi, eax
cmp edi, 0
jl 0x44dc98
push 0
mov eax, dword [0x4d9c34]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x44dc82
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x44dcc7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00418fb4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x44dca7
inc dword [esi + 0x9c]
jmp 0x44dd81
cmp dword [esi + 0x9c], 0
jle 0x44dd81
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x44dd81
cmp dword [esi + 0x44], 0
je 0x44dd2d
mov eax, dword [0x4d9c10]
call fcn.00450944
test al, al
je 0x44dd2d
mov eax, dword [0x4d9c34]
call fcn.00406254
mov edi, eax
cmp edi, 0
jl 0x44dd2d
push 5
mov eax, dword [0x4d9c34]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x44dd17
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x44dd5c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00418fb4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x44dd3c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4d9c34
mov ecx, 1
mov edx, dword [0x44db30]
call fcn.00406408
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x44e814
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x44e87e
mov eax, ebx
call fcn.00450944
test al, al
jne 0x44e87e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040502c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x44e86b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x44e88b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f90
jmp 0x44e88b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f90
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x44fa68
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44fad6
mov eax, esi
call fcn.00461998
test al, al
je 0x44fad6
mov eax, dword [ebx + 0x84]
call fcn.004615e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44fad6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x44faca
push 0
mov eax, dword [ebx + 0x84]
call fcn.004615e8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00459570
jmp 0x44fad6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0044f8a4
pop esi
pop ebx
ret
Function at 0x456df8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4d9c9c], 0
je 0x456f41
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4d4144]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x456f41
mov eax, dword [0x4d9ca0]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4d9c9c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x456f10
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4d9c9c]
call fcn.00418fb4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x456f08
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x456f08
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x456f08
mov eax, dword [ebp - 0x14]
call fcn.004615e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456f08
push ebp
call fcn.00456db4
pop ecx
test al, al
jne 0x456f08
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404284
test al, al
je 0x456f08
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404284
cmp byte [ebp - 1], 0
je 0x456f08
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x456f08
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4d9ca0]
call fcn.00456524
inc edi
dec ebx
jne 0x456e5d
mov eax, dword [0x4d9ca0]
cmp dword [eax + 8], 0
jle 0x456f28
mov eax, dword [0x4d9ca0]
call fcn.004565dc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x456f41
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00456c18
pop ecx
test al, al
jne 0x456f41
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e4e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407260
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00459180
test ebx, ebx
jne 0x45e537
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0045e420
mov ebx, eax
test ebx, ebx
je 0x45e622
cmp esi, ebx
je 0x45e560
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x45e575
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x45e5ad
add eax, 0xffffff5f
sub eax, 2
jb 0x45e5c5
dec eax
sub eax, 2
jb 0x45e5d9
dec eax
sub eax, 2
jb 0x45e5cf
jmp 0x45e5e3
add eax, 0xfffffdff
sub eax, 2
jb 0x45e5c5
dec eax
sub eax, 2
jb 0x45e5d9
dec eax
sub eax, 2
jb 0x45e5cf
jmp 0x45e5e3
mov byte [esp + 0x120], 0
jmp 0x45e5eb
mov byte [esp + 0x120], 2
jmp 0x45e5eb
mov byte [esp + 0x120], 1
jmp 0x45e5eb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004442c8
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0045a940
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x45e624
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4669c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4d4334]
cmp byte [eax + 0xc], 0
je 0x466b2d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x466b26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [fcn.004d9cac], 0
jne 0x466a14
push 0x466b34
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x466b3c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.004d9cac], eax
cmp dword [0x4cd80c], 0
jne 0x466b0f
push 0x466b4c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4cd80c], eax
cmp dword [0x4cd80c], 0
je 0x466b0f
push 0x466b58
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cb0], eax
push 0x466b68
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cb4], eax
push 0x466b7c
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cb8], eax
push 0x466b94
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cbc], eax
push 0x466bac
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cc0], eax
push 0x466bc0
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cc4], eax
push 0x466bd8
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cc8], eax
push 0x466bf0
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9ccc], eax
push 0x466c0c
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [fcn.004d9cd0], eax
push 0x466c18
mov eax, dword [0x4cd80c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4d9cd4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466b2d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x46834c
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053bc
mov eax, dword [ebp - 8]
call fcn.004053bc
xor eax, eax
push ebp
push 0x468558
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 1
push 0x468568
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46852b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x18], 0
je 0x468514
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004681fc
push 0
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebp - 0x10]
call fcn.004053cc
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x1c], eax
push 0
push 0x80000000
push 0
push 0
push 0x46859c
mov eax, dword [ebp - 0x14]
call fcn.004053cc
push eax
push 0x4685a8
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x468420
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 8]
call fcn.004053cc
push eax
push 0x2f
push 0x4685b0
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_HttpSendRequestA
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x400
mov eax, dword [ebp - 0x2c]
call fcn.00402ed8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
push 5
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x468514
xor eax, eax
push ebp
push 0x46850d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x400
lea eax, [ebp - 0x24]
push eax
push 0x400
lea eax, [ebp - 0x432]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x24], 0
je 0x4684d5
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x432], 0
lea eax, [ebp - 0x438]
lea edx, [ebp - 0x432]
mov ecx, 0x402
call fcn.004051ac
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0xc]
call fcn.00405208
jmp 0x46847e
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00404f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468514
cmp dword [ebp - 0x28], 0
je 0x4684fa
mov eax, dword [ebp - 0x28]
call fcn.00402ef4
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468532
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret

Function at 0x4685e0
Capabilities:
Create process on windows

Disassembly:
push 1
push 0x4685f0
call sub.kernel32.dll_WinExec
ret
Function at 0x468604
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x46861a
xor esi, esi
jmp 0x46862a
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4689e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4689f1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053bc
mov eax, dword [ebp - 8]
call fcn.004053bc
mov eax, dword [ebp - 0xc]
call fcn.004053bc
mov eax, dword [ebp + 0xc]
call fcn.004053bc
xor eax, eax
push ebp
push 0x468aa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004053cc
push eax
push 0x10000
lea eax, [ebp - 0x1000c]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004053cc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004053cc
push eax
mov eax, dword [ebp - 8]
call fcn.004053cc
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1000c]
mov ecx, 0x10000
call fcn.004051ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468aaa
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f60
lea eax, [ebp + 0xc]
call fcn.00404f3c
ret

Function at 0x468ee8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053bc
xor eax, eax
push ebp
push 0x468f9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409af8
neg al
sbb ebx, ebx
cmp esi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x468f84
cmp ebx, 1
sbb eax, eax
inc eax
test al, al
jne 0x468f84
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409d84
cmp dword [ebp - 8], 0
jne 0x468f53
push 0
mov eax, dword [ebp - 4]
call fcn.004053cc
push eax
call sub.kernel32.dll_CreateDirectoryA
jmp 0x468f84
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.004053cc
push eax
call sub.kernel32.dll_CreateFileA_1
test eax, eax
jle 0x468f82
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
jmp 0x468f84
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468fa6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f60
ret
Function at 0x477794
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4777c2
mov eax, ebx
call fcn.00478248
cmp dword [ebx + 0x40], 0
je 0x4777bb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x477833
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x477825
cmp dword [ebx + 8], 0
je 0x4777e4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4777f6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x477825
cmp dword [ebx + 8], 0
je 0x4777d7
cmp eax, 3
je 0x477809
dec eax
jne 0x4777d7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4777d7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4777d7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x477851
cmp dword [ebx + 0x14], 0xcc
je 0x477851
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047785c
pop ebx
ret
Function at 0x49fa94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49fcbf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x10]
call fcn.00468770
mov dword [ebx + 8], eax
mov dword [ebx + 4], esi
lea eax, [esi + 0x18]
call fcn.00468770
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
xor edx, edx
call fcn.004957d8
mov edi, eax
cmp edi, 0x400000
jle 0x49fb79
lea eax, [edi + 0x4fc]
call fcn.00468770
mov dword [ebx + 0x10], eax
lea eax, [edi + 0x500]
call fcn.00468770
mov dword [ebx + 0x14], eax
lea eax, [edi + 0x51c]
call fcn.00468770
mov dword [ebx + 0x18], eax
lea eax, [edi + 0x520]
call fcn.00468770
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
call fcn.00468694
mov dword [ebx + 0x20], eax
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
call fcn.00468694
mov dword [ebx + 0x24], eax
lea eax, [edi + 0x3c]
call fcn.00468808
fstp dword [ebx + 0x2c]
wait
lea eax, [esi + 0x3c]
add eax, 8
sub eax, 4
call fcn.00468808
fstp dword [ebx + 0x34]
wait
lea eax, [esi + 0x3c]
add eax, 4
sub eax, 4
call fcn.00468808
fstp dword [ebx + 0x30]
wait
lea eax, [edi + 0x778]
call fcn.004687c8
mov byte [ebx + 0x4c], al
jmp 0x49fbf5
mov byte [ebx + 0x4c], 0
lea eax, [esi + 0x20]
call fcn.00468770
mov dword [ebx + 0x10], eax
lea eax, [esi + 0x24]
call fcn.00468770
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x28]
call fcn.00468770
mov dword [ebx + 0x18], eax
lea eax, [esi + 0x2c]
call fcn.00468770
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
call fcn.00468694
mov dword [ebx + 0x20], eax
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
call fcn.00468694
mov dword [ebx + 0x24], eax
lea edi, [esi + 0x3c]
mov eax, edi
call fcn.00468808
fstp dword [ebx + 0x2c]
wait
mov eax, edi
add eax, 8
sub eax, 4
call fcn.00468808
fstp dword [ebx + 0x34]
wait
mov eax, edi
add eax, 4
sub eax, 4
call fcn.00468808
fstp dword [ebx + 0x30]
wait
lea eax, [ebx + 0x2c]
or ecx, 0xffffffff
mov edx, 0x4d9dd4
call fcn.0049a868
fstp dword [ebx + 0x38]
wait
lea eax, [esi + 0x34]
call fcn.00468770
mov dword [ebx + 0x28], eax
lea eax, [esi + 0x44]
call fcn.00468770
mov dword [ebx + 0x3c], eax
lea eax, [esi + 0x5c]
call fcn.00468770
mov dword [ebx + 0x44], eax
lea eax, [esi + 0x58]
call fcn.00468770
mov dword [ebx + 0x40], eax
lea eax, [esi + 0x74]
call fcn.00468770
mov edi, eax
cmp edi, 0x400000
jle 0x49fca9
lea eax, [esi + 0x78]
call fcn.00468770
mov esi, eax
cmp esi, 0x50
jg 0x49fca9
lea eax, [ebx + 0x48]
mov edx, 0x49fcd8
call fcn.00404f90
dec esi
test esi, esi
jl 0x49fca9
inc esi
mov dword [ebp - 4], 0
push dword [ebx + 0x48]
mov eax, dword [ebp - 4]
add eax, eax
add eax, eax
add eax, eax
add eax, edi
call fcn.004687e8
movzx eax, ax
lea edx, [ebp - 8]
call fcn.0040962c
push dword [ebp - 8]
push 0x49fcd8
lea eax, [ebx + 0x48]
mov edx, 3
call fcn.004052d0
inc dword [ebp - 4]
dec esi
jne 0x49fc70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fcc6
lea eax, [ebp - 8]
call fcn.00404f3c
ret
Function at 0x4c560c
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebx
push esi
or esi, 0xffffffff
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
cmp ebx, dword [0x4da9f8]
jne 0x4c5633
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4c56c6
push ebx
call sub.user32.dll_IsWindowEnabled
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4c56c8
push 0
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_EnableWindow
push 1
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_ShowWindow
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov ebx, eax
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push ebx
call sub.user32.dll_AttachThreadInput
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_SetActiveWindow
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_SetFocus
push 0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push ebx
call sub.user32.dll_AttachThreadInput
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [0x4da9f8]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x4c56c8
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4c5d54
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004053bc
xor eax, eax
push ebp
push 0x4c5e9d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_GetWindowDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c5e80
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c5e62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov ebx, eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dl, 1
mov eax, dword [0x421e8c]
call fcn.00427c5c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c5e44
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00428e44
push 0x40cc0020
mov eax, dword [ebp + 0x10]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x2c]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_BitBlt
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
call fcn.004c5c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5e4b
mov eax, dword [ebp - 0x10]
call fcn.00404088
ret
Function at 0x504702
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00504781
jae 0x50470e
xor ecx, ecx
call fcn.00504781
jae 0x504738
xor eax, eax
call fcn.00504781
jae 0x504749
mov al, 0x10
call fcn.00504781
adc al, al
jae 0x50472a
jne 0x504776
stosb byte es:[edi], al
jmp 0x50470f
call fcn.0050478d
dec ecx
loop 0x504755
mov eax, ebp
call fcn.0050478b
jmp 0x504777
lodsb al, byte [esi]
shr eax, 1
je 0x50479d
adc ecx, 2
mov ebp, eax
jmp 0x504777
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0050478b
cmp eax, 0x7d00
jae 0x504775
cmp eax, 0x500
jae 0x504776
cmp eax, 0x7f
ja 0x504777
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x50470f
pop ebp
ret 8