joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c19c4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 8]
call fcn.004056a4
mov ebx, 0x4d2e70
xor eax, eax
push ebp
push 0x4c1bc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.0040a044
add eax, dword [0x4d2ef4]
lea edx, [ebp - 0x1c]
call fcn.00409f08
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00405278
xor edx, edx
push ebp
push 0x4c1b90
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x419ef8]
call fcn.0041ec54
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0040a408
test al, al
je 0x4c1a56
mov eax, dword [ebp - 8]
call fcn.004056b4
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004056b4
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419ef8]
call fcn.0041ec54
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c1b7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041e9cc
mov eax, dword [ebx]
call fcn.0040a044
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 8
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx]
call fcn.0040a044
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041ea3c
mov eax, dword [ebx]
call fcn.0040a044
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041e9cc
mov eax, dword [ebx]
call fcn.0040a044
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041ea3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1b86
mov eax, dword [ebp - 0x10]
call fcn.00404324
mov eax, dword [ebp - 0xc]
call fcn.00404324
ret
Function at 0x4c1bd8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4c1d86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4c1d9c
call fcn.0046b150
test al, al
jne 0x4c1c0a
mov eax, 0x4c1d9c
call fcn.0040a8b8
mov eax, dword [0x4d2e78]
mov edx, 0x4c1db0
call fcn.0040564c
jne 0x4c1d6b
lea eax, [ebp - 4]
call fcn.004c20a0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [0x4cc080]
mov eax, dword [eax]
call fcn.004692d4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004c191c
push dword [ebp - 8]
push dword [0x4d2e80]
mov eax, 0x4d2ec0
mov edx, 3
call fcn.004055b8
mov edx, dword [0x4d2ec0]
mov eax, dword [0x4d2e98]
call fcn.004c19c4
mov eax, dword [0x4d2e78]
mov edx, 0x4c1db0
call fcn.0040564c
jne 0x4c1d6b
mov eax, dword [0x4d2ec0]
call fcn.0040a408
test al, al
je 0x4c1d6b
mov edx, 6
mov eax, dword [0x4d2ec0]
call fcn.0040a548
mov eax, dword [0x4cc080]
mov eax, dword [eax]
call fcn.0046899c
push 1
push 0
push 0
mov eax, dword [0x4d2ec0]
call fcn.004056b4
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4cc080]
mov eax, dword [eax]
call fcn.0046899c
push 0x3e8
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0x10]
mov eax, dword [0x4d2ec0]
call fcn.004c71b0
mov edx, dword [ebp - 0x10]
mov eax, 0x4d2eec
call fcn.00405278
mov eax, dword [0x4d2e4c]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.0043a634
mov eax, dword [0x4d2e4c]
mov eax, dword [eax + 0x37c]
mov dl, 1
call fcn.0043a634
mov eax, dword [0x4d2e4c]
mov eax, dword [eax + 0x38c]
mov dl, 1
call fcn.0043a634
mov eax, dword [0x4d2f00]
mov edx, 0x4c1dbc
call fcn.0040564c
jne 0x4c1d6b
xor eax, eax
push ebp
push 0x4c1d61
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043d12c
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c1d6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c1d8d
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405248
ret

Function at 0x4c20a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2171
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.0040ab14
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00437458
mov eax, dword [ebp - 0x108]
mov edx, 0x4c2188
call fcn.0040564c
je 0x4c2141
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00437458
mov eax, dword [ebp - 0x10c]
mov edx, 0x4c2194
call fcn.0040564c
je 0x4c2141
lea eax, [ebp - 4]
mov edx, 0x4c2194
call fcn.004054f0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2178
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00405248
lea eax, [ebp - 4]
call fcn.00405224
ret
Function at 0x4c2578
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056a4
mov eax, dword [ebp - 8]
call fcn.004056a4
xor eax, eax
push ebp
push 0x4c26b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x4d2ef8]
add ebx, 0x64
xor edx, edx
push ebp
push 0x4c2689
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x419ef8]
call fcn.0041ec54
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0040a408
test al, al
je 0x4c25ea
mov eax, dword [ebp - 8]
call fcn.004056b4
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004056b4
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419ef8]
call fcn.0041ec54
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c2678
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041ea3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c267f
mov eax, dword [ebp - 0x10]
call fcn.00404324
mov eax, dword [ebp - 0xc]
call fcn.00404324
ret

Function at 0x4c7058
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004056a4
xor eax, eax
push ebp
push 0x4c7193
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4c7163
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004056b4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a408
test al, al
jne 0x4c70d3
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.004036b0
lea eax, [ebp - 0x1d0]
call fcn.0040344c
call fcn.00403088
push dword [0x4d2e50]
push 0x4c71ac
push dword [0x4d2e54]
push 0x4c71ac
push dword [0x4d2e58]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004055b8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004c1774
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.004059d4
call fcn.00403d6c
call fcn.00403088
lea eax, [ebp - 0x1d0]
call fcn.00403778
call fcn.00403088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c716d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c719a
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405248
lea eax, [ebp - 4]
call fcn.00405224
ret
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee141
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54c000]
add byte [ebx], dh
lds edx, [eax - 0x73]
inc ebp
hlt
mov dword fs:[0], eax
mov dword [0], eax
mov esi, dword [ebp + 8]

Function at 0x401200
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x18]
push esi
mov esi, dword [ecx + 0x44]
add eax, 0xc
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xc], eax
pop esi
test eax, eax
je 0x401250
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401250
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4018c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ebe6e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x54c000]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0
cmp byte [esi + 0x38], 0
mov al, 1
jne 0x40190c
cmp dword [esi + 0x2c], 4
jge 0x401ac6
mov ebx, 4
call fcn.00401320
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push ebx
mov ecx, esi
shr eax, 0xf
and al, 1
mov byte [esp + 0x20], al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x40ce50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e738a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x54c000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
cmp dword [edi + 0x18], esi
je 0x40cf18
push 0x1fe
call fcn.004c7080
add esp, 4
mov esi, eax
mov eax, dword [edi + 0x18]
push 0xff
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
cmp edi, 0xff
jle 0x40cf01
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
xor ecx, ecx
lea ebx, [edi + 1]
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c7080
add esp, 8
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ebx
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [ebp + 8]
test edi, edi
jle 0x40cf0e
push esi
mov ecx, ebx
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_unsigned_short_int_const__]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eafbd
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54c000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.ScCore.dll_const_ScCore::Listener::vftable]
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ScCore.dll_protected:_void___thiscall_ScCore::Refcountable::constructor_void_]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], 1
lea ecx, [esi + 0x20]
mov dword [esi], vtable.SAF::Widget.1.0
mov dword [esi + 4], vtable.SAF::Widget.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 2
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
mov word [esi + 0x2c], bx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
cmp eax, ebx
je 0x40efb9
mov ebx, dword [eax + 0x18]
mov ecx, dword [0x54f600]
mov edi, dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Broadcaster::addListener_class_ScCore::Listener___int_]
push 0xcf
push esi
add ecx, 0x14
mov dword [esi + 0x1c], ebx
call edi
mov ecx, dword [0x54f600]
push 0xd5
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd6
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd3
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd4
push esi
add ecx, 0x14
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f060
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eba5d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x54c000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.ScCore.dll_const_ScCore::Listener::vftable]
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ScCore.dll_protected:_void___thiscall_ScCore::Refcountable::constructor_void_]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 1
mov dword [esi + 0x18], ecx
lea ecx, [esi + 0x20]
mov dword [esi], vtable.SAF::Widget.1.0
mov dword [esi + 4], vtable.SAF::Widget.0
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov byte [ebp - 4], 2
mov dword [esi + 0x28], eax
mov eax, 0x4105b0
push ebx
push eax
mov ecx, esi
mov dword [esi + 0x24], edx
mov word [esi + 0x2c], bx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.00410250
mov ecx, dword [0x54f600]
mov edi, dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Broadcaster::addListener_class_ScCore::Listener___int_]
push 0xcf
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd5
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd6
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd3
push esi
add ecx, 0x14
call edi
mov ecx, dword [0x54f600]
push 0xd4
push esi
add ecx, 0x14
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41d2c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea959
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x54c000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x34]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::DialogModality::constructor_void_]
push 2
push 0x1fe
xor esi, esi
push 0x29c
push esi
mov dword [ebp - 4], esi
mov eax, dword [edi + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push esi
push esi
push eax
mov dword [edi], 1
mov dword [edi + 0xc], esi
mov word [edi + 0x10], si
call ebx
mov ecx, dword [edi + 0x24]
push 2
push 0x1e0
push 0x280
push esi
push esi
push esi
push ecx
call ebx
mov edx, dword [0x54f600]
mov eax, dword [edx + 0x20]
mov esi, dword [edi + 0x18]
push eax
call fcn.00414a00
mov ecx, dword [edi + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x30]
push eax
push ecx
call esi
mov eax, dword [edi + 0x24]
lea edx, [ebp - 0x20]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
push 1
push ecx
mov ecx, dword [ebp - 0x30]
push edx
mov edx, dword [edi + 0x24]
add eax, 5
push eax
add ecx, 0xe
push ecx
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [edi + 0x18]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
mov ecx, dword [edi + 0x24]
push 5
push ecx
call esi
call fcn.0041de10
mov edx, dword [0x54f600]
mov esi, dword [edx + 0x20]
push 0
push 0
call fcn.004112e0
mov eax, dword [edi + 0x24]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 3
push 0
push 0
mov ecx, dword [edi + 0x18]
push 0
push 0
push 0
push ecx
call ebx
mov edx, dword [edi + 0x24]
push 3
push 0
push 0
push 0
push 0
push 0
push edx
call ebx
mov eax, dword [edi + 0x24]
push 0
push 0x4b
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
cmp byte [edi + 0x11], 0
jne 0x41d436
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea esp, [esp]
push 0
push 0
push 0
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x41d436
lea edx, [ebp - 0x50]
push edx
call esi
lea eax, [ebp - 0x50]
push eax
call ebx
cmp byte [edi + 0x11], 0
je 0x41d410
mov ecx, dword [edi + 0x24]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [0x54f600]
mov esi, dword [edx + 0x20]
push 0
push 1
call fcn.004112e0
mov eax, dword [edi + 0x18]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [edi + 0x24]
push 0
push ecx
call esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::DialogModality::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c708b
mov esp, ebp
pop ebp
ret
Function at 0x421440
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7452
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x54c000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x54f6e5], 0
jne 0x421524
cmp byte [0x54f6dc], 0
mov byte [0x54f6e5], 1
jne 0x4214a7
push 0x10
mov byte [0x54f6dc], 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
or byte [esi + 0x35], al
jne 0x4214a7
mov eax, dword [esi + 0x28]
push eax
call fcn.0041bd10
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::FileSpec::constructor_void_]
mov dword [ebp - 4], 0
mov edx, dword [esi]
mov edx, dword [edx + 0x5c]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call edx
test eax, eax
jne 0x421514
push str.defs.xml
lea ecx, [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const__]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::changePath_class_ScCore::String_const__]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::FileSpec::exists_void_const]
test al, al
je 0x421514
mov ecx, dword [0x54f600]
mov eax, dword [ecx + 0x28]
lea edx, [ebp - 0x10]
push edx
push eax
call fcn.0041b910
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::FileSpec::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4215f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x50de14
mov esi, eax
push 0x5de
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call sub.MSVCR100.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
xor eax, eax
push eax
mov eax, dword [edx + 0x18]
push esi
push ecx
call eax
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
cmp esi, ebx
je 0x4216b2
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 8], ebx
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
xor esi, esi
call edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret