joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cac70
Capabilities:
Packed with generic packer

Disassembly:
enter 4, 2
pushal
mov dword [ebp - 0xc], 0
mov eax, 0
mov esi, dword [ebp - 4]
mov eax, dword [esi - 8]
mov ebx, 0x800
mov ecx, str.Changing_p_SSLError_from
mov edx, 0
call fcn.00420884
mov edi, dword [ebp - 0xc]
inc edi
mov dword [ebp - 0xc], edi
call dword [0x544874]
add esp, 0
mov dword [esi - 0xc], eax
cmp dword [esi - 0xc], 0
je 0x4cadae
mov eax, dword [esi - 0x10]
mov ecx, dword [eax]
mov eax, dword [esi - 0x10]
mov ebx, dword [esi - 0xc]
and ebx, 0xff
mov dword [eax], ebx
cmp dword [0x5c290c], 0
je 0x4cad2b
mov eax, str.Changing_p_SSLError_from
mov ebx, 0x19
call fcn.00425f5c
mov eax, ecx
call fcn.00425c64
call fcn.00425618
mov eax, str._to_SSL_Our_GetErrorString
mov ebx, 4
call fcn.00425f5c
call fcn.00425618
mov eax, dword [esi - 0x10]
mov eax, dword [eax]
call fcn.00425c64
call fcn.00425618
mov eax, 0x5beea4
mov ebx, 0x16
call fcn.00425f5c
mov eax, 0
call fcn.004a7a20
cmp edi, 1
jle 0x4cad59
mov eax, dword [esi - 8]
call fcn.004260bc
mov eax, 0x5beebc
mov ebx, 3
call fcn.00425f5c
call fcn.00425618
mov eax, dword [esi - 8]
mov ebx, 0x800
call fcn.00426028
lea edi, [esi - 0x114]
mov eax, edi
mov ebx, 0x100
mov ecx, str.SSL_ERROR_NONE____No_Error_occurred._The_TLS_SSL_I_O_operation_completed.
mov edx, 0
call fcn.00420884
mov eax, edi
push eax
mov eax, dword [esi - 0xc]
push eax
call dword [0x544878]
add esp, 8
mov dword [esi - 0x14], eax
mov eax, dword [esi - 8]
call fcn.004260bc
mov eax, edi
call fcn.004260bc
call fcn.00425618
mov eax, dword [esi - 8]
mov ebx, 0x800
call fcn.00426028
jmp 0x4cac9b
popal
leave
ret
Function at 0x4f2778
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x40c
pushal
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov ebp, edx
push 0xf00021
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
push eax
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
push eax
mov eax, dword [ecx + 4]
push eax
mov eax, dword [ecx]
push eax
push ebx
call sub.GDI32.dll_PatBlt
push 0x400
lea esi, [esp + 0x30]
push esi
push dword [esp + 0x28]
call sub.USER32.dll_GetWindowTextA
cmp eax, 0
je 0x4f282f
mov eax, ebp
and eax, 0xf
cmp eax, 0xc
jne 0x4f27d5
mov eax, 0x140
mov dword [esp + 0x24], eax
jmp 0x4f27e3
mov eax, ebp
and eax, 0xf
or eax, 0x150
mov dword [esp + 0x24], eax
mov ecx, ebp
and ecx, 0x80
cmp ecx, 0
je 0x4f27f9
or eax, 0x800
mov dword [esp + 0x24], eax
and ebp, 0x8000000
cmp ebp, 0
je 0x4f2812
push dword [0x595a30]
push ebx
call sub.GDI32.dll_SetTextColor
mov edi, eax
push dword [esp + 0x24]
push dword [esp + 0x2c]
push 0xffffffffffffffff
push esi
push ebx
call sub.USER32.dll_DrawTextA
cmp ebp, 0
je 0x4f282f
push edi
push ebx
call sub.GDI32.dll_SetTextColor
popal
add esp, 0x40c
ret

Function at 0x4f4da4
Capabilities:
Check for software breakpoints

Disassembly:
pushal
mov esi, eax
mov ecx, 0
mov ebx, ecx
mov eax, dword [esi + 0x20]
cmp ebx, eax
jae 0x4f4e69
mov eax, ecx
movzx eax, byte [esi + eax*4 + 0x2a]
mov ebx, ecx
movzx ebx, byte [esi + ebx*4 + 0x28]
add eax, ebx
mov ebx, ecx
movzx ebx, byte [esi + ebx*4 + 0x29]
add eax, ebx
mov ebx, 3
cdq
idiv ebx
cmp eax, 0x33
jge 0x4f4df6
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0
jmp 0x4f4e63
cmp eax, 0x66
jge 0x4f4e12
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0x40
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0x40
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0x40
jmp 0x4f4e63
cmp eax, 0x99
jge 0x4f4e30
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], pe_nt_image_headers32
mov eax, ecx
mov byte [esi + eax*4 + 0x29], pe_nt_image_headers32
mov eax, ecx
mov byte [esi + eax*4 + 0x28], pe_nt_image_headers32
jmp 0x4f4e63
cmp eax, 0xcc
jge 0x4f4e4e
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0xc0
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0xc0
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0xc0
jmp 0x4f4e63
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0xff
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0xff
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0xff
inc ecx
jmp 0x4f4dac
popal
ret
Function at 0x4f6aa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x38
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov dword [esp + 0x1e], ebx
mov ebx, eax
mov eax, dword [esp + 0x1e]
mov dword [esp + 0x22], eax
mov ebp, 0
mov dword [esp + 0x1a], ebp
mov dword [esp + 0x26], 1
mov ecx, eax
cmp ecx, 0x3e4
jne 0x4f6adc
mov eax, 1
jmp 0x4f6bf5
cmp ecx, 0x3e6
jne 0x4f6aef
mov ebp, 0x3e5
mov dword [esp + 0x1a], ebp
jmp 0x4f6b05
cmp ecx, 0x3e1
jne 0x4f6b05
mov ebp, eax
mov dword [esp + 0x1a], ebp
mov dword [esp + 0x26], 0
mov esi, 0
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
mov ecx, dword [0x595fcb]
cmp eax, ecx
jb 0x4f6bbe
jmp 0x4f6bd8
push 1
lea eax, [esp + 0x38]
mov ecx, 0x3e4
mov edx, 0x3e4
call fcn.004f6c78
cmp eax, 0
jne 0x4f6b4d
jmp 0x4f6bc9
lea eax, [esp + 0x2a]
push eax
lea eax, [esp + 0x32]
push eax
push dword [esp + 0x48]
push dword [esp + 0x44]
call sub.USER32.dll_UnpackDDElParam
push dword [esp + 0x40]
push dword [esp + 0x3c]
call sub.USER32.dll_FreeDDElParam
mov ax, word [esp + 0x2e]
mov word [esp + 0x32], ax
mov ax, word [esp + 0x32]
and ax, 0x8000
shr ax, 0xf
movzx esi, ax
cmp dword [esp + 0x22], 0x3e8
je 0x4f6bd8
mov ax, word [esp + 0x2a]
call fcn.004f6c64
jmp 0x4f6bd8
push 0
lea eax, [esp + 0x38]
mov ecx, ebp
mov edx, ebp
mov ecx, dword [esp + 0x1e]
call fcn.004f6c78
cmp eax, 0
jne 0x4f6bd3
jmp 0x4f6b17
cmp dword [esp + 0x26], 0
jne 0x4f6b31
cmp ebp, 0
jne 0x4f6ba1
jmp 0x4f6b17
mov esi, 1
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
mov ebx, dword [0x595fcb]
cmp eax, ebx
jb 0x4f6bf3
mov eax, 0x25d
call fcn.00413d90
mov eax, esi
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x38
ret

Function at 0x4f6e54
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x114
pushal
mov eax, 0x595cc8
lea eax, [eax]
push eax
call sub.KERNEL32.dll_EnterCriticalSection
cmp byte [0x595ce8], 0
jne 0x4f6e78
mov byte [0x595ce8], 1
cmp dword [0x5d2d6c], 0
jne 0x4f6f63
inc dword [0x5d2d6c]
mov byte [esp + 0x133], 0
lea ecx, [esp + 0x13c]
cmp dword [esp + 0x138], 0
je 0x4f6eb8
lea esi, [esp + 0x34]
mov eax, esi
mov ebx, dword [esp + 0x138]
call fcn.004dbf90
jmp 0x4f6ebe
lea eax, [ecx + 4]
mov esi, dword [eax - 4]
cmp byte [esp + 0x133], 0
je 0x4f6edc
mov eax, str.Error:_Output_corrupted_stack
mov ebx, str.wsldebug.cpp
mov ecx, 0xa4
call fcn.004f6f6c
cmp dword [0x5d2d68], 0
jne 0x4f6f11
push 0x14
lea eax, [esp + 0x24]
push eax
push 0x5d1cf8
push str.auxtrace
push str.Clarion_5_Tracing
call sub.KERNEL32.dll_GetProfileStringA
cmp byte [esp + 0x20], 0
je 0x4f6f11
mov dword [0x5d2d70], 1
mov eax, esi
call dword [0x5d2e74]
cmp dword [0x5d2d70], 0
je 0x4f6f50
cmp dword [0x595cec], 0
jne 0x4f6f3c
push 1
push 0x5d1d1c
call sub.KERNEL32.dll__lopen
mov dword [0x595cec], eax
mov eax, esi
call fcn.00420750
push eax
push esi
push dword [0x595cec]
call sub.KERNEL32.dll__lwrite
dec dword [0x5d2d6c]
mov eax, 0x595cc8
lea eax, [eax]
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
popal
add esp, 0x114
ret
Function at 0x4f7490
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 4
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov edi, eax
mov esi, ebx
jmp 0x4f7548
cmp dword [esi + 8], 9
je 0x4f74ad
jmp 0x4f7555
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x4f7555
mov ecx, 0
mov ebp, 0
cmp edi, 0
pushfd
mov edx, edi
add edx, 0x1f4
popfd
jne 0x4f74db
mov ebx, edi
jmp 0x4f74dd
mov ebx, edx
mov eax, ebp
call fcn.004f3300
cmp eax, 0
je 0x4f7526
cmp edi, 0
jne 0x4f74f2
mov edx, edi
jmp 0x4f74f2
mov eax, ebp
mov ebx, dword [edx]
mov ecx, dword [ebx + eax*4]
cmp ecx, 0
jne 0x4f7516
jmp 0x4f7519
mov eax, ecx
mov ebx, dword [ecx + 4]
mov eax, dword [esp + 0x18]
call dword [ebx + 0xb4]
cmp eax, 0
jne 0x4f7526
jmp 0x4f7523
sub ecx, 0x17
mov dword [esp + 0x18], ecx
cmp byte [ecx + 0x10], 0x25
je 0x4f7500
inc ebp
jmp 0x4f74c8
cmp ecx, 0
je 0x4f7555
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
push 0x100
mov eax, dword [ecx + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4f755a
cmp dword [esi + 4], 0x100
je 0x4f74a2
mov eax, 0
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 4
ret

Function at 0x4f7a58
Capabilities:
Hide graphical window

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
cmp ebx, 0
je 0x4f7bb7
mov ecx, 0
mov edi, 0
mov eax, dword [ebx + 0x18e]
cmp dword [esi + 0x1f4], eax
je 0x4f7afc
mov eax, dword [ebx + 0x18e]
mov dword [esi + 0x1f4], eax
cmp dword [esi + 0x1f4], 0
je 0x4f7ac5
mov eax, dword [esi + 0x1f4]
call fcn.005066d8
mov ecx, eax
mov eax, dword [esi + 0x1f4]
call fcn.005066d4
push eax
push ecx
push 0x230
mov eax, dword [esi + 0xf7]
push eax
call sub.USER32.dll_SendMessageA
jmp 0x4f7ada
push 0
push 0
push 0x230
mov eax, dword [esi + 0xf7]
push eax
call sub.USER32.dll_SendMessageA
cmp dword [esi + 0x1f4], 0
jne 0x4f7aee
push 0
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_SetMenu
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_DrawMenuBar
mov ecx, 1
mov edx, dword [esi + 0x1fc]
mov eax, esi
call fcn.004f79e8
mov eax, dword [esi + 0x1fc]
cmp edx, eax
je 0x4f7b24
mov ecx, 1
jmp 0x4f7b38
cmp edi, 0
jne 0x4f7b9c
jmp 0x4f7bad
cmp dword [esi + 0x1fc], 0
je 0x4f7b38
mov eax, dword [esi + 0x1fc]
mov eax, dword [eax + 0xc]
or ecx, eax
mov eax, dword [esi + 0x1f8]
cmp dword [ebx + 0x18a], eax
je 0x4f7b80
cmp dword [esi + 0x1f8], 0
je 0x4f7b6a
mov dword [0x59c35c], 1
push 0
mov eax, dword [esi + 0x1f8]
mov eax, dword [eax + 0x45]
push eax
call sub.USER32.dll_ShowWindow
mov eax, dword [ebx + 0x18a]
mov dword [esi + 0x1f8], eax
mov ecx, 1
mov edi, 1
cmp ecx, 0
je 0x4f7b91
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x20]
call dword [ebx + 0x70]
cmp dword [esi + 0x1f8], 0
jne 0x4f7b1a
jmp 0x4f7bad
push 1
mov eax, dword [esi + 0x1f8]
mov eax, dword [eax + 0x45]
push eax
call sub.USER32.dll_ShowWindow
mov dword [0x59c35c], 0
popal
add esp, 4
ret
Function at 0x4fd0b8
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
pushal
mov esi, eax
mov dword [esp + 0x24], esi
mov eax, dword [0x5d5bec]
cmp dword [esi + 0x7f], eax
jne 0x4fd0d6
mov dword [0x5d5bec], 0
mov eax, dword [0x5d5bf0]
cmp esi, eax
jne 0x4fd0e9
mov dword [0x5d5bf0], 0
cmp dword [esi + 0x7f], 0
je 0x4fd2c6
lea ebx, [esi + 0x1e3]
call fcn.004f33c0
jmp 0x4fd10f
mov eax, dword [0x5d5bd4]
cmp dword [esi + 0xf7], eax
je 0x4fd119
jmp 0x4fd13b
mov eax, dword [0x5d5bd4]
cmp dword [esi + 0x7f], eax
jne 0x4fd100
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x24]
call dword [ebx + 0x60]
cmp eax, 0
je 0x4fd131
mov eax, 0
jmp 0x4fd136
mov eax, dword [0x5d5bd0]
mov dword [0x5d5bd4], eax
mov eax, 0
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x4fd261
mov ebx, dword [esi + 0x1ae]
mov dword [esp + 0x20], ebx
jmp 0x4fd178
mov eax, dword [ebx + 0x7f]
push eax
call sub.USER32.dll_IsWindowVisible
cmp eax, 0
je 0x4fd16e
jmp 0x4fd17d
mov ebx, dword [ebx + 0x1ae]
mov dword [esp + 0x20], ebx
cmp ebx, 0
jne 0x4fd15e
cmp ebx, 0
jne 0x4fd18c
mov ebx, dword [esi + 0x1aa]
mov dword [esp + 0x20], ebx
cmp ebx, 0
jne 0x4fd19b
mov ebx, dword [0x5d5bdc]
mov dword [esp + 0x20], ebx
cmp ebx, 0
je 0x4fd1d0
mov eax, ebx
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x20]
call dword [ecx + 0x5c]
cmp eax, 0
je 0x4fd1c7
push dword [0x5d5bd0]
call sub.USER32.dll_SetActiveWindow
mov eax, dword [ebx + 0x7f]
push eax
call sub.USER32.dll_SetFocus
jmp 0x4fd1d0
mov eax, dword [ebx + 0x7f]
push eax
call sub.USER32.dll_SetActiveWindow
push 0
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_SetMenu
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x24]
call dword [ebx + 0x5c]
cmp eax, 0
je 0x4fd23b
push 0
mov eax, dword [esi + 0x7f]
push eax
push 0x221
push dword [0x5d5bcc]
call sub.USER32.dll_SendMessageA
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x4fd224
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_DestroyWindow
dec dword [0x5d5c08]
call fcn.0044c8a8
mov eax, dword [0x5d5bdc]
call fcn.004f78b8
jmp 0x4fd244
mov eax, dword [esi + 0x7f]
push eax
call sub.USER32.dll_DestroyWindow
mov eax, dword [esi + 0xf7]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x4fd261
mov eax, dword [esi + 0xf7]
push eax
call sub.USER32.dll_DestroyWindow
mov dword [esi + 0xf7], 0
mov dword [esi + 0x7f], 0
cmp dword [esi + 0x118], 0
je 0x4fd2c6
mov eax, esi
call fcn.004fd090
lea ebx, [esp + 0x28]
push ebx
push eax
push dword [0x59605c]
call sub.USER32.dll_GetClassInfoA
mov eax, esi
call fcn.004fd090
push dword [0x59605c]
push eax
call sub.USER32.dll_UnregisterClassA
cmp dword [esp + 0x3c], 0
je 0x4fd2b6
push dword [esp + 0x3c]
call sub.USER32.dll_DestroyIcon
cmp dword [esp + 0x40], 0
je 0x4fd2c6
push dword [esp + 0x40]
call sub.USER32.dll_DestroyCursor
popal
add esp, 0x30
ret
Function at 0x502de4
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
pushal
mov esi, eax
mov edx, ebx
mov bx, cx
mov eax, esi
call fcn.00503160
mov dword [esi + 4], 0x5d94ac
mov dword [esi + 0x1e], edx
movzx eax, bx
and eax, 0x800
cmp eax, 0
je 0x502e44
push 0x32
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 0xc], eax
push 0x31
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 8], eax
push 0x4001
push 0x160
lea eax, [esp + 0x28]
push eax
push 0
push 0x5d3808
call sub.SHELL32.dll_SHGetFileInfoA
mov dword [esi + 0x22], eax
jmp 0x502e76
push 0xc
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 0xc], eax
push 0xb
call sub.USER32.dll_GetSystemMetrics
mov dword [esi + 8], eax
push 0x4000
push 0x160
lea eax, [esp + 0x28]
push eax
push 0
push 0x5d380c
call sub.SHELL32.dll_SHGetFileInfoA
mov dword [esi + 0x22], eax
popal
add esp, 0x160
ret

Function at 0x502e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x1c
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov dword [esp + 0x24], eax
mov eax, ebx
mov dword [esp + 0x2c], eax
mov word [esp + 0x22], dx
mov ebp, 0
mov dword [esp + 0x30], 0
cmp ecx, 0
pushfd
movzx edi, dx
and edi, 0x100
popfd
je 0x502f21
mov ebx, str.IMAGE
call fcn.005171e0
mov ebx, eax
cmp ebx, 0
je 0x502f21
push ebx
push dword [0x596060]
call sub.KERNEL32.dll_LoadResource
mov dword [esp + 0x28], eax
push eax
call sub.KERNEL32.dll_LockResource
mov ebp, eax
push ebx
push dword [0x596060]
call sub.KERNEL32.dll_SizeofResource
mov esi, eax
mov eax, dword [esp + 0x24]
mov ebx, ebp
mov ecx, esi
mov dx, word [esp + 0x22]
call dword [esp + 0x38]
mov ebp, eax
cmp ebp, 0
jne 0x502f0f
push dword [esp + 0x28]
call sub.KERNEL32.dll_FreeResource
jmp 0x502f21
cmp edi, 0
jne 0x502f04
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x10], eax
or word [ebp + 0x1c], 0x400
cmp ebp, 0
jne 0x502fbd
push 0
push dword [esp + 0x30]
call sub.KERNEL32.dll__lopen
mov dword [esp + 0x1e], eax
cmp eax, 0xffffffff
je 0x502fbd
mov ebp, dword [esp + 0x1e]
mov eax, ebp
lea ebx, [esp + 0x30]
call fcn.0051a368
push 2
push 0
push ebp
call sub.KERNEL32.dll__llseek
mov esi, eax
push esi
push 2
call sub.KERNEL32.dll_GlobalAlloc
mov dword [esp + 0x1a], eax
push eax
call sub.KERNEL32.dll_GlobalLock
mov ebx, eax
push 0
push 0
push ebp
call sub.KERNEL32.dll__llseek
mov eax, esi
push eax
push ebx
push ebp
call sub.KERNEL32.dll__hread
push ebp
call sub.KERNEL32.dll__lclose
mov eax, dword [esp + 0x24]
mov ecx, esi
mov dx, word [esp + 0x22]
call dword [esp + 0x38]
mov ebp, eax
mov ebx, dword [esp + 0x1a]
push ebx
call sub.KERNEL32.dll_GlobalUnlock
cmp ebp, 0
jne 0x502faf
push ebx
call sub.KERNEL32.dll_GlobalFree
jmp 0x502fbd
cmp edi, 0
jne 0x502fa7
mov dword [ebp + 0x10], ebx
and word [ebp + 0x1c], 0xfbff
cmp ebp, 0
je 0x502fcf
mov eax, ebp
mov ebx, esi
mov ecx, dword [esp + 0x30]
call fcn.00503148
mov eax, ebp
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x1c
ret 4
Function at 0x5045ec
Capabilities:
Log keystrokes

Disassembly:
sub esp, 4
push ebx
push ecx
push edx
push esi
mov eax, 0
cmp byte [0x595db0], 0
jne 0x504608
mov byte [0x595db0], 1
cmp byte [0x595db4], 0
jne 0x504618
mov byte [0x595db4], 1
mov ebx, 0x595d8c
lea esi, [esp + 0x10]
mov eax, esi
mov dword [eax], ebx
mov eax, dword [eax]
lea eax, [eax]
push eax
call sub.KERNEL32.dll_EnterCriticalSection
cmp dword [0x5d3854], 0
je 0x504660
mov dword [0x5d3858], 0
mov dword [0x5d385c], 0
call fcn.005047cc
mov dword [0x5d3860], eax
mov dword [0x5d3854], 0
call fcn.00504c58
and eax, 0x700
mov ecx, eax
mov ebx, dword [0x5d3860]
and ebx, 0x700
xor ecx, ebx
cmp ecx, 0
je 0x504706
mov edx, ecx
neg ecx
and edx, ecx
mov ebx, eax
and ebx, edx
cmp ebx, 0
sete bl
movzx ebx, bl
cmp edx, 0x400
jne 0x5046c9
mov dword [0x5d3864], 0x12
jmp 0x5046b6
and eax, 0x200
cmp eax, 0
je 0x5046bd
jmp 0x5046fe
cmp ebx, 0
jne 0x5046aa
jmp 0x5046fe
mov dword [0x5d385c], 1
jmp 0x5046fe
cmp edx, 0x200
jne 0x5046ec
mov dword [0x5d3864], 0x11
cmp ebx, 0
je 0x5046fe
mov dword [0x5d385c], 0
jmp 0x5046fe
cmp edx, 0x100
jne 0x5046fe
mov dword [0x5d3864], 0x10
mov dword [0x5d3868], ebx
jmp 0x50477d
cmp dword [0x5d3850], 0
jne 0x504723
mov ebx, 0
mov eax, dword [esi]
lea eax, [eax]
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x5047c2
mov ebx, dword [0x5d3860]
and ebx, 0xff
mov dword [0x5d3864], ebx
cmp dword [0x5d3858], 0
je 0x504754
mov dword [0x5d3858], 0
call fcn.005047cc
mov dword [0x5d3860], eax
jmp 0x504773
mov dword [0x5d3858], 1
and eax, 0x600
cmp eax, 0x400
sete al
movzx eax, al
mov dword [0x5d385c], eax
mov eax, dword [0x5d3858]
mov dword [0x5d3868], eax
push 0
push dword [0x5d3864]
call sub.USER32.dll_MapVirtualKeyA
cmp dword [0x5d3868], 0
je 0x50479a
mov ebx, 0
jmp 0x50479f
mov ebx, 2
push 0
push ebx
movzx eax, al
push eax
movzx eax, byte [0x5d3864]
push eax
call sub.USER32.dll_keybd_event
mov ebx, 1
mov eax, dword [esi]
lea eax, [eax]
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, ebx
pop esi
pop edx
pop ecx
pop ebx
add esp, 4
ret
Function at 0x50da24
Capabilities:
Hide graphical window

Disassembly:
pushal
mov edx, eax
mov eax, edx
call fcn.00508d18
mov ebx, eax
lea esi, [edx + 0x45]
mov eax, esi
mov ecx, 1
call fcn.004804bc
mov eax, ebx
dec eax
mov ecx, esi
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax*4]
jmp 0x50da5d
mov ecx, ebx
mov eax, esi
mov eax, dword [eax + 4]
lea eax, [eax + ecx*4]
cmp dword [eax], 0
je 0x50da9a
jmp 0x50daa6
cmp dword [eax], 0
je 0x50da4c
jmp 0x50daa6
mov eax, edx
mov ebx, dword [eax]
call dword [ebx + 0xa8]
cmp eax, 0
je 0x50da75
jmp 0x50dab5
mov ecx, 0
mov ebx, 0x2000
mov eax, esi
mov eax, dword [eax + 4]
call fcn.0050a600
mov eax, 0
push eax
mov eax, dword [esi + 4]
push eax
call sub.USER32.dll_ShowWindow
jmp 0x50dac1
mov eax, esi
mov ecx, 1
call fcn.004804bc
mov eax, edx
call fcn.00508fcc
mov esi, eax
cmp dword [edx + 0x41], 0
jne 0x50da64
mov eax, esi
mov ebx, 1
call fcn.005097d8
popal
ret
Function at 0x514730
Capabilities:
Get graphical window text

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
mov edi, ebx
cmp edi, 0
je 0x51477b
push 0
push 0
push 0xe
push edi
call sub.USER32.dll_SendMessageA
mov ebp, eax
cmp ebp, 0
je 0x51477b
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, ebp
add ebx, eax
mov eax, dword [esp + 0x20]
call fcn.005149e4
mov eax, dword [esi]
add eax, dword [esi + 4]
push eax
mov eax, ebp
inc eax
push eax
push 0xd
push edi
call sub.USER32.dll_SendMessageA
add dword [esi + 4], ebp
popal
add esp, 4
ret

Function at 0x5150b0
Capabilities:
Get common file path

Disassembly:
pushal
mov esi, eax
mov eax, esi
mov ebx, 0
mov cl, 0
mov edx, 0
call fcn.00510adc
mov ebx, esi
add ebx, 0x17
mov eax, ebx
mov dword [eax], 0
mov dword [esi + 4], 0x5d95b8
lea eax, [esi + 0x2b]
mov dword [eax], 0
mov dword [esi + 0x1b], 0
mov dword [esi + 0x1f], 0
mov dword [esi + 0x37], 0
mov dword [esi + 0x23], 0
mov dword [esi + 0x27], 0
mov dword [esi + 0x2f], 0x1f4
mov dword [esi + 0x33], 0x1388
mov dword [esi + 0x3b], 0x1388
mov dword [esi + 0x3f], 0
mov dword [esi + 0x43], 1
mov dword [esi + 0x47], 0
mov word [esi + 0x57], 2
mov dword [esi + 0x4b], 0
mov dword [esi + 0x4f], 1
mov dword [esi + 0x53], 0
mov dword [esi + 0x99], 0
mov dword [esi + 0x9d], 0
mov dword [esi + 0xa1], 0
push 0
push 0
call sub.KERNEL32.dll_GetTempPathA
mov ebp, eax
inc ebp
mov edi, 0
cmp edi, 2
jge 0x51519e
mov eax, ebp
call fcn.00467104
mov ecx, edi
mov dword [esi + ecx*4 + 0x59], eax
mov eax, edi
mov eax, dword [esi + eax*4 + 0x59]
push eax
mov eax, ebp
push eax
call sub.KERNEL32.dll_GetTempPathA
inc edi
jmp 0x51517a
cmp esi, 0
jne 0x5151a7
mov eax, esi
jmp 0x5151a9
mov eax, ebx
push 0
movzx ebx, byte [0x5d3744]
push ebx
mov ebx, 0x5d4b68
mov ecx, 8
mov edx, 0
call fcn.00501134
push 0
call sub.USER32.dll_GetDC
mov edi, eax
push 0x5a
push edi
call sub.GDI32.dll_GetDeviceCaps
push 0x48
push eax
push 8
call sub.KERNEL32.dll_MulDiv
mov ebp, eax
neg ebp
push 0x17
call sub.USER32.dll_GetSysColor
mov edx, eax
push 0
push 1
push 0
mov eax, edi
mov ecx, ebp
mov ebx, 0x5d4b70
call fcn.00501698
mov dword [esi + 0xa5], eax
push 0
push 1
push 0
mov eax, edi
mov ecx, ebp
mov ebx, str.Helv
mov edx, 0xffffffff
call fcn.00501698
mov dword [esi + 0xa9], eax
push edi
push 0
call sub.USER32.dll_ReleaseDC
popal
ret
Function at 0x515bec
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov esi, ecx
mov ebp, 1
mov ecx, ebp
imul edi, ecx, 0x3e
cmp dword [edi + 0x5d4b80], 0
je 0x515c19
cmp ebp, 0x3f
jne 0x515c16
mov eax, 0xffffffff
jmp 0x515d32
inc ebp
jmp 0x515bf9
lea ecx, [edi + 0x5d4b80]
push ecx
push 4
mov ecx, ebp
push ecx
push 0x515d3c
push eax
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [edi + 0x5d4b84], eax
cmp dword [edi + 0x5d4b84], 0
jne 0x515c4b
mov eax, 0xffffffff
jmp 0x515d32
mov dword [edi + 0x5d4b88], ebx
mov dword [edi + 0x5d4b8c], esi
mov eax, dword [0x5d5b44]
mov eax, dword [eax + 0x18]
call fcn.004eb6f4
mov dword [edi + 0x5d4b98], eax
mov dword [edi + 0x5d4b94], 0
mov dword [edi + 0x5d4bb6], 0
mov dword [edi + 0x5d4b90], 0
mov dword [edi + 0x5d4ba2], 0
mov dword [edi + 0x5d4ba6], 0
mov dword [edi + 0x5d4baa], 0
mov dword [edi + 0x5d4bae], 0
mov dword [edi + 0x5d4b9c], 0
mov byte [edi + 0x5d4ba0], 0
mov byte [edi + 0x5d4ba1], 0
mov dword [edi + 0x5d4bb2], 0
push 0
push 1
push 0
push 0
call sub.KERNEL32.dll_CreateSemaphoreA
mov dword [edi + 0x5d4bba], eax
mov eax, ebp
mov ebx, 1
call fcn.005037f4
mov eax, dword [edi + 0x5d4b84]
push eax
call sub.KERNEL32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [edi + 0x5d4bba]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [edi + 0x5d4bba]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0
mov eax, ebp
push eax
push 0x2414
mov eax, dword [edi + 0x5d4b80]
push eax
call sub.USER32.dll_PostThreadMessageA
cmp eax, 0
mov eax, ebp
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret