joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0500
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
push esi
push edi
mov esi, eax
je 0x4f0584
push 0x26
call fcn.004c6130
lea edi, [esi + 0x24]
push 0
mov ecx, 0xc8
mov eax, edi
call fcn.004f3420
push 0
mov ecx, 0x321
mov eax, edi
call fcn.004f3420
push 0x5ae504
push 0xdbba0
push edi
mov ecx, str.0__32__260__0
call fcn.004f3220
mov eax, dword [esi + 0xf4c]
test eax, eax
je 0x4f05e9
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f05e9
mov esi, dword [esi + 0xf4c]
mov edi, esi
call fcn.004e40e0
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4
push 0x4a
call fcn.004c6130
lea edi, [esi + 0x24]
push 1
mov ecx, 0xc8
mov eax, edi
call fcn.004f3420
push 0x5ae504
push 0xdbba0
push edi
mov ecx, str.78__32__260__0
call fcn.004f3220
push 1
mov ecx, 0x321
mov eax, edi
call fcn.004f3420
mov eax, dword [esi + 0xf4c]
test eax, eax
je 0x4f05e9
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f05e9
mov eax, dword [esi + 0xf4c]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 4

Function at 0x4f0920
Capabilities:
Check internet connectivity via wininet
Resolve dns

Disassembly:
push ecx
push esi
push 0
push 1
push str.http:__cd001.www.duba.net
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x4f0959
mov esi, dword [sym.imp.WS2_32.dll_gethostbyname]
push str.www.baidu.com
call esi
test eax, eax
jne 0x4f0959
push str.www.qq.com
call esi
test eax, eax
jne 0x4f0959
or eax, 0xffffffff
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0xc]
sub esp, 0x20
mov esi, esp
mov dword [esp + 0x24], esp
mov eax, 0x5198b0
push ecx
push eax
call fcn.0050a2a0
lea ecx, [edi + 0x4b0]
call fcn.004c7640
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x4f09a7
push eax
push edi
call fcn.004ec9a0
cmp dword [edi + 0x3b74], 0
lea eax, [edi + 0x3b74]
je 0x4f09bf
call fcn.00546c70
xor eax, eax
pop esi
pop ecx
ret 4
lea ecx, [edi + 0x424]
call fcn.004cbe60
test eax, eax
jge 0x4f09bf
push 1
mov eax, edi
call fcn.004e9150
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x4f2310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x58a5c0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
mov edx, dword [eax + 4]
mov ecx, dword [edx + 4]
xor ebx, ebx
cmp byte [ecx + 0x39], bl
jne 0x4f2363
mov esi, dword [ebp]
nop
cmp dword [ecx + 0x10], esi
jae 0x4f235a
mov ecx, dword [ecx + 8]
jmp 0x4f235e
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0x39], bl
je 0x4f2350
cmp edx, dword [eax + 4]
mov edi, edx
mov esi, eax
je 0x4f2374
mov ecx, dword [ebp]
cmp ecx, dword [edx + 0x10]
jae 0x4f23f3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x70], ebx
mov edx, dword [ebp]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], ebx
push edi
push esi
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x80], 1
call fcn.004fb030
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov byte [esp + 0x70], bl
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x4f23ca
mov eax, dword [eax]
cmp eax, ebx
je 0x4f23c6
lea ecx, [esp + 0x4c]
push 1
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x44], ebx
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4f23f3
mov eax, dword [eax]
cmp eax, ebx
je 0x4f23ef
lea ecx, [esp + 0x24]
push 1
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x1c], ebx
cmp esi, ebx
jne 0x4f23fc
call fcn.00565fa7
cmp edi, dword [esi + 4]
jne 0x4f2406
call fcn.00565fa7
lea eax, [edi + 0x18]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8

Function at 0x4f3370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5940b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
push 0x5b9c28
lea edi, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.00479f80
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add esp, 8
push esi
push str.mempointer
push ecx
mov ecx, dword [esp + 0x30]
call fcn.004f3120
mov edi, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f3405
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4f3aa0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f3acf
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3ac3
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f3acf
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f3af4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f3af4
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f3af4
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fc4a0
mov ebp, eax
cmp ebp, ebx
jne 0x4f3b25
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f3b3c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f3bb4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f3b99
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f3bae
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f3bf8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f3bf8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f3bf8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3c08
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f3c30
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f3c5f
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3c53
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f3c5f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f3c84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f3c84
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f3c84
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fc640
mov ebp, eax
cmp ebp, ebx
jne 0x4f3cb5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f3ccc
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f3d44
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f3d29
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f3d3e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f3d88
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f3d88
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f3d88
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3d98
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f3e90
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f3ebf
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3eb3
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f3ebf
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f3ee4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f3ee4
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f3ee4
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fc7e0
mov ebp, eax
cmp ebp, ebx
jne 0x4f3f15
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f3f2c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f3fa4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f3f89
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f3f9e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f3fe8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f3fe8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f3fe8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f3ff8
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f4320
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f434f
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4343
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f434f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f4374
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f4374
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f4374
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fcb40
mov ebp, eax
cmp ebp, ebx
jne 0x4f43a5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f43bc
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f4434
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f4419
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f442e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f4478
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f4478
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f4478
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4488
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f4ca0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f4ccf
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4cc3
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f4ccf
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f4cf4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f4cf4
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f4cf4
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fd160
mov ebp, eax
cmp ebp, ebx
jne 0x4f4d25
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f4d3c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f4db4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f4d99
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f4dae
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f4df8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f4df8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f4df8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4e08
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f4e20
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f4e4f
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4e43
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f4e4f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f4e74
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f4e74
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f4e74
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fd300
mov ebp, eax
cmp ebp, ebx
jne 0x4f4ea5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f4ebc
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f4f34
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f4f19
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f4f2e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f4f78
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f4f78
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f4f78
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f4f88
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f5880
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f58af
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f58a3
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f58af
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f58d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f58d4
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f58d4
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fd6f0
mov ebp, eax
cmp ebp, ebx
jne 0x4f5905
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f591c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f5994
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f5979
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f598e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f59d8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f59d8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f59d8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f59e8
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4