joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403304
Capabilities:
Create directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.004503f1
push esi
mov ecx, edi
call fcn.004032ab
test eax, eax
je 0x40335f
push esi
mov ecx, edi
call fcn.00403efb
push str.autoupdate
mov ecx, esi
call fcn.00450842
push dword [esi]
mov ecx, edi
call fcn.00403ee4
test eax, eax
jne 0x40335f
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40335f
push dword [esi]
push str.AU:_Failed_to_create_dir___s_
push eax
call fcn.00431e0d
add esp, 0xc
mov eax, dword [esi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 4
Function at 0x403bf6
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x45a7d7
call fcn.0043baec
sub esp, 0xc30
push esi
push edi
push 0x1e
mov esi, ecx
push 0xa
push 0x4b
push 1
lea ecx, [ebp - 0xc3c]
call fcn.0042a620
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
push str.AU::DownloadUrl____s_____s
push edi
call fcn.00431e0d
add esp, 0x10
cmp dword [esi], edi
jne 0x403ca6
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc3c]
push str.User_Agent:_Gator_1.0_AutoUpdate_r_n
push dword [ebp + 8]
call fcn.0042a750
cmp dword [esi], edi
jne 0x403ca6
cmp eax, 0xc8
je 0x403ca3
push eax
lea eax, [ebp - 0x40c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.AU::DownloadUrl____s_____s:_ERROR__d
push eax
call fcn.0043c490
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.00431e0d
lea eax, [ebp - 0x40c]
push 0x476338
push eax
call fcn.0043c3b0
add esp, 0x24
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x403ca6
push 1
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc3c]
call fcn.0042a730
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x403cc7
Capabilities:
Delete file

Disassembly:
mov eax, 0x45a7ec
call fcn.0043baec
push ecx
push ecx
mov eax, dword [0x47f440]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edi
push ebx
push str.AU::DnldAndDecompress:__s
push edi
call fcn.00431e0d
add esp, 0xc
cmp dword [esi], edi
jne 0x403d6f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00403304
test eax, eax
je 0x403d6f
push 0x2f
push ebx
call fcn.0043c2a0
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x403d2e
push ebx
push str.AU::DnldAndDecompress:_Failed_to_find_file_name_in___s_
push eax
call fcn.00431e0d
add esp, 0xc
jmp 0x403d6f
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
inc edi
call fcn.00403efb
push edi
lea ecx, [ebp - 0x10]
call fcn.00450842
push dword [ebp - 0x10]
mov ecx, esi
push ebx
call fcn.00403bf6
test eax, eax
je 0x403d6f
cmp dword [esi], 0
jne 0x403d6f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.0040351f
test eax, eax
je 0x403d6f
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
cmp dword [ebp - 0x14], 0
jne 0x403d8e
mov edi, dword [ebp + 0xc]
push dword [edi]
call esi
mov ecx, edi
call fcn.004503f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00450466
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x403ee4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 4
Function at 0x403f1c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00403ee4
test eax, eax
je 0x403f36
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x403f3b
push 1
pop eax
jmp 0x403f54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.AU:_Failed_to_delete_file___s____lu_
push 0
call fcn.00431e0d
add esp, 0x10
xor eax, eax
pop esi
ret 4

Function at 0x407fea
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x45b2e4
call fcn.0043baec
sub esp, 0x1cc
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x48118c], esi
je 0x40800f
push 1
pop eax
jmp 0x408147
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
jne 0x408109
push 1
pop ebx
push esi
mov dword [0x48118c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x30
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.0043bed0
add esp, 0xc
lea eax, [ebp - 0x48]
mov esi, str.GatorAsyncWndClass
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
jne 0x4080c2
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x30
push eax
mov dword [ebp - 0x40], 0x408171
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x4080c2
mov eax, dword [0x47f440]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.CxSocket:_Couldnt_register_async_class:__d
push eax
call fcn.0044ad19
lea eax, [ebp - 0x10]
push eax
push 5
push 0x80
push str.D:Source_CodeLibrary_CodeeguardlibCxSocket.cpp
call fcn.0043304a
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0x408140
mov byte [0x48124c], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push str.GetHostByNameTimeout
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
call fcn.0042a020
add esp, 0x10
test eax, eax
je 0x4080f8
mov eax, dword [ebp - 0x18]
test eax, eax
mov dword [0x476d30], eax
jne 0x408102
mov dword [0x476d30], 0x14
mov eax, dword [0x48118c]
jmp 0x408147
mov ecx, dword [0x47f440]
mov dword [ebp - 0x14], ecx
push eax
lea eax, [ebp - 0x14]
push str.CxSocket:_WSAStartup_failed__lx
push eax
mov dword [ebp - 4], esi
call fcn.0044ad19
lea eax, [ebp - 0x14]
push eax
push 5
push 0x6f
push str.D:Source_CodeLibrary_CodeeguardlibCxSocket.cpp
call fcn.0043304a
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00450466
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408b91
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ecx
push ebp
push edi
call fcn.00409361
pop ecx
pop ecx
push str.send
push ebp
push 1
mov ecx, edi
call fcn.00409322
test eax, eax
je 0x408c72
cmp dword [esp + 0x1c], ebp
mov esi, dword [esp + 0x18]
jge 0x408bcf
push esi
call fcn.0043c6e0
pop ecx
mov dword [esp + 0x1c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebp
call ebx
mov esi, eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x3e8
add esi, eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [edi]
call sub.WSOCK32.dll_send
mov ebp, eax
cmp ebp, 0xffffffff
je 0x408c24
add dword [esp + 0x10], ebp
test ebp, ebp
jle 0x408c1a
call ebx
mov esi, eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x3e8
add esi, eax
add dword [esp + 0x18], ebp
sub dword [esp + 0x1c], ebp
jmp 0x408c3a
mov ecx, edi
call fcn.00409315
cmp eax, 0x2733
jne 0x408c54
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 0
je 0x408c76
call ebx
cmp eax, esi
ja 0x408c65
cmp byte [0x48124c], 0
jne 0x408c76
xor ebp, ebp
jmp 0x408bec
push eax
push str.Send_failed___d_.
push edi
call fcn.00409361
add esp, 0xc
jmp 0x408c72
push str.Send_timed_out.
push edi
call fcn.00409361
pop ecx
pop ecx
xor eax, eax
jmp 0x408c84
mov al, byte [0x48124c]
neg al
sbb al, al
inc al
movzx eax, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x40908c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push esi
call fcn.00409361
cmp dword [esi + 8], edi
pop ecx
pop ecx
jne 0x4090be
push str.retrieve_file_headers
push 1
push 1
mov ecx, esi
call fcn.00409322
test eax, eax
je 0x4091c2
cmp dword [esi + 8], edi
push ebx
jne 0x4091be
push 0x2000
call fcn.004087cf
mov dword [esi + 8], eax
and byte [eax], 0
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [esi + 0x24]
imul eax, eax, 0x3e8
add ebx, eax
cmp dword [ebp - 4], 0
jne 0x4091b1
mov eax, 0x2000
cmp edi, eax
jae 0x409172
cmp dword [ebp - 8], 0
jne 0x409178
mov ecx, eax
mov eax, 0x80
sub ecx, edi
cmp ecx, eax
ja 0x40911a
mov eax, ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, edi
mov ecx, esi
add eax, dword [esi + 8]
push eax
call fcn.004091c6
add edi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
jne 0x409151
cmp dword [ebp - 0xc], 0
jne 0x409151
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
ja 0x40916b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._r_n_r_n
push dword [esi + 8]
call fcn.0043bb10
cmp dword [ebp - 4], 0
pop ecx
pop ecx
mov dword [ebp - 8], eax
je 0x4090fc
jmp 0x409172
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x4091b1
mov eax, dword [ebp - 8]
and byte [eax], 0
push dword [esi + 8]
call fcn.0043c6e0
sub edi, eax
pop ecx
lea eax, [edi - 4]
test eax, eax
mov dword [esi + 0x10], eax
je 0x4091be
push eax
call fcn.004087cf
mov ecx, dword [ebp - 8]
push dword [esi + 0x10]
add ecx, 4
mov dword [esi + 0xc], eax
push ecx
push eax
call fcn.0043bb90
add esp, 0x10
jmp 0x4091be
push str.Reply_contains_no_headers.
push esi
call fcn.00409361
pop ecx
pop ecx
mov eax, dword [esi + 8]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4091c6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00409361
pop ecx
pop ecx
push str.read_file
push 1
push 1
mov ecx, esi
call fcn.00409322
test eax, eax
je 0x40930e
mov edi, dword [ebp + 0x10]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x14]
and dword [ebx], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40927c
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40927c
mov ebx, dword [ebp + 0xc]
cmp ebx, ecx
jb 0x409239
push ecx
push eax
push dword [ebp + 8]
call fcn.0043bb90
mov eax, dword [esi + 0x10]
mov dword [edi], eax
push dword [esi + 0xc]
and dword [esi + 0x10], 0
call fcn.00450113
add esp, 0x10
and dword [esi + 0xc], 0
jmp 0x409274
push ebx
push eax
push dword [ebp + 8]
call fcn.0043bb90
mov dword [edi], ebx
mov edi, dword [esi + 0x10]
sub edi, ebx
push edi
call fcn.004087cf
mov ecx, dword [esi + 0xc]
push edi
add ecx, ebx
mov dword [ebp + 8], eax
push ecx
push eax
call fcn.0043bb90
push dword [esi + 0xc]
call fcn.00450113
mov eax, dword [ebp + 8]
add esp, 0x20
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
push 1
pop eax
jmp 0x40930e
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4092c6
mov ecx, esi
call fcn.00409315
cmp eax, 0x2733
je 0x4092b5
push eax
push str.Recv_failed___d_
push esi
mov dword [ebx], 1
call fcn.00409361
add esp, 0xc
jmp 0x4092e2
push 0xa
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4092f4
test eax, eax
jle 0x4092d5
mov dword [edi], eax
mov dword [ebp - 4], 1
jmp 0x4092f4
mov ecx, esi
mov dword [ebx], 1
call fcn.00409315
cmp dword [ebx], 0
jne 0x4092f4
push str.No_data_was_received
push esi
call fcn.00409361
pop ecx
pop ecx
cmp byte [0x48124c], 0
je 0x409301
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40930e
mov dword [ebx], 1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40c2a3
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x4812b8], 0
jne 0x40c2ce
and dword [0x4812bc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x40c2cf
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4812b8], eax
ret

Function at 0x40ea09
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.egIEClient
xor edi, edi
push 1
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [esi + 0x3514], eax
jne 0x40ea41
push str.Gator_is_already_running._r_n_mutex__0__r_n
push 0x341
push str.D:Source_CodeClient_Codeclientegclient.cpp
push edi
call fcn.00431d70
add esp, 0x10
jmp 0x40ea85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ea8a
push str.Gator_is_already_running._r_n_mutex_exists__r_n
push 0x347
push str.D:Source_CodeClient_Codeclientegclient.cpp
push edi
call fcn.00431d70
add esp, 0x10
cmp dword [esp + 0xc], edi
je 0x40ea85
push str.CEGClientDlg::ShowSiteHelper
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push edi
push edi
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
pop eax
jmp 0x40ea8c
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x413274
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
and dword [ebx], 0
test esi, esi
je 0x4132eb
cmp byte [esi], 0
je 0x4132eb
lea eax, [ebp + 8]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0xc], eax
je 0x4132eb
push eax
call fcn.004500ea
pop ecx
mov dword [ebp + 0x10], eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x476204
push dword [ebp + 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4132e2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebx], ecx
mov eax, dword [eax + 0xc]
mov dword [edi], eax
push dword [ebp + 0x10]
call fcn.00450113
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413729
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
cmp eax, esi
jne 0x413746
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x484cf8], eax
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4137b1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ResDll
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4137a4
lea eax, [ebp - 0x10c]
push eax
call fcn.00413361
pop ecx
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x4137c2
push str.GatorRes.dll
call fcn.00413361
mov edi, eax
pop ecx
cmp edi, esi
je 0x4137fe
mov eax, dword [0x484cf4]
mov esi, 0x478314
push 0x3f
push esi
push 0x2710
push eax
mov dword [0x484cfc], eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4137f1
push 0x47789c
push esi
call fcn.0043c3a0
pop ecx
pop ecx
push esi
push 0x478354
call fcn.0043c3a0
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x416ddd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp + 8]
mov esi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x416e91
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 8], eax
je 0x416e91
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x416e91
push ebx
push edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x416e76
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x416e76
cmp dword [ebp - 8], 4
jne 0x416e76
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
shl eax, 0x10
or ecx, eax
push ecx
push str._08lx
push esi
call fcn.0044ad19
add esp, 0xc
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 4], edi
je 0x416e91
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.004505ef
jmp 0x416ea3
mov eax, dword [esi + 8]
test eax, eax
je 0x416e9f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [esi + 8], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4171c1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dword [ebp - 4], ecx
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call fcn.0043c6e0
cmp byte [ebp + eax - 0x108], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
mov ebx, 0x476204
je 0x41720e
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x41729f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call fcn.0043c6e0
cmp byte [ebp + eax - 0x108], 0x5c
pop ecx
je 0x417263
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.004172a6
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417236
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x419b6d
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x48507c], 0
jne 0x419b9a
mov eax, dword [esp + 4]
mov dword [0x485080], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x419b9b
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x48507c], eax
ret
Function at 0x41bbd7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [ebx]
push dword [0x484890]
mov ecx, ebx
mov dword [ebp - 8], esi
call dword [eax + 0x30]
push 1
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.00453404
mov dword [ebp - 0x14], eax
mov eax, dword [0x484874]
test eax, eax
je 0x41bc1f
push 0
push eax
mov ecx, ebx
call fcn.004533b3
push dword [ebx + 4]
call dword [sym.imp.GDI32.dll_RealizePalette]
test esi, esi
jne 0x41bc27
xor eax, eax
jmp 0x41bc2a
mov eax, dword [esi + 0x1c]
push 5
push eax
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
mov dword [ebp + 8], eax
je 0x41bd33
push edi
mov edi, dword [ebp + 8]
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp ax, 0xffff
jne 0x41bd1c
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41bd1c
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
add dword [ebp - 0x1c], 0xa
add dword [ebp - 0x18], 0xa
test esi, esi
jne 0x41bc7f
xor eax, eax
jmp 0x41bc82
mov eax, dword [esi + 0x1c]
lea ecx, [ebp - 0x24]
push 2
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x68]
push 0x32
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41bd1c
mov eax, dword [ebx]
push 0x485088
mov ecx, ebx
call dword [eax + 0x28]
cmp dword [0x484898], 0
mov dword [ebp - 0xc], eax
je 0x41bcff
mov eax, dword [ebx]
push 0x404040
mov ecx, ebx
call dword [eax + 0x30]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
push 0
add eax, 2
push ecx
movsd dword es:[edi], dword [esi]
add dword [ebp - 0x34], 2
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx]
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call dword [eax + 0x68]
mov eax, dword [ebx]
push dword [ebp - 4]
mov ecx, ebx
call dword [eax + 0x30]
mov esi, dword [ebp - 8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x24]
push 0
push ecx
lea ecx, [ebp - 0x68]
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call dword [eax + 0x68]
mov eax, dword [ebx]
push dword [ebp - 0xc]
mov ecx, ebx
call dword [eax + 0x28]
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
mov dword [ebp + 8], eax
jne 0x41bc3f
pop edi
mov eax, dword [ebx]
push dword [ebp - 0x10]
mov ecx, ebx
call dword [eax + 0x30]
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.00453404
pop esi
pop ebx
leave
ret 4
Function at 0x41d563
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x45d2cd
call fcn.0043baec
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov word [esi + 8], di
lea ecx, [esi + 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call fcn.0040a332
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
call fcn.0040a332
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 1
call fcn.0040a332
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.0040a332
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x464a64
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41e638
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [ebx]
push dword [0x484890]
mov ecx, ebx
mov dword [ebp - 8], esi
call dword [eax + 0x30]
push 1
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.00453404
mov dword [ebp - 0x14], eax
mov eax, dword [0x484874]
test eax, eax
je 0x41e680
push 0
push eax
mov ecx, ebx
call fcn.004533b3
push dword [ebx + 4]
call dword [sym.imp.GDI32.dll_RealizePalette]
test esi, esi
jne 0x41e688
xor eax, eax
jmp 0x41e68b
mov eax, dword [esi + 0x1c]
push 5
push eax
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
mov dword [ebp + 8], eax
je 0x41e794
push edi
mov edi, dword [ebp + 8]
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp ax, 0xffff
jne 0x41e77d
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41e77d
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
add dword [ebp - 0x1c], 0xa
add dword [ebp - 0x18], 0xa
test esi, esi
jne 0x41e6e0
xor eax, eax
jmp 0x41e6e3
mov eax, dword [esi + 0x1c]
lea ecx, [ebp - 0x24]
push 2
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x68]
push 0x32
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41e77d
mov eax, dword [ebx]
push 0x4850e8
mov ecx, ebx
call dword [eax + 0x28]
cmp dword [0x484898], 0
mov dword [ebp - 0xc], eax
je 0x41e760
mov eax, dword [ebx]
push 0x404040
mov ecx, ebx
call dword [eax + 0x30]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x34]
push 0
add eax, 2
push ecx
movsd dword es:[edi], dword [esi]
add dword [ebp - 0x34], 2
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx]
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call dword [eax + 0x68]
mov eax, dword [ebx]
push dword [ebp - 4]
mov ecx, ebx
call dword [eax + 0x30]
mov esi, dword [ebp - 8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x24]
push 0
push ecx
lea ecx, [ebp - 0x68]
push 0xffffffffffffffff
push ecx
mov ecx, ebx
call dword [eax + 0x68]
mov eax, dword [ebx]
push dword [ebp - 0xc]
mov ecx, ebx
call dword [eax + 0x28]
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
mov dword [ebp + 8], eax
jne 0x41e6a0
pop edi
mov eax, dword [ebx]
push dword [ebp - 0x10]
mov ecx, ebx
call dword [eax + 0x30]
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.00453404
pop esi
pop ebx
leave
ret 4