joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afb08
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff90
push esi
push edi
mov byte [ebp - 0x1051], cl
mov dword [ebp - 0x1050], edx
mov dword [ebp - 0x104c], eax
mov esi, 0x51f6dc
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov esi, 0x51f724
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
push ebp
mov eax, dword [ebp + 0x14]
call fcn.00408674
push eax
mov eax, dword [ebp + 0x14]
call fcn.00408afc
pop edx
call fcn.004af9c0
pop ecx
mov eax, dword [ebp - 0x104c]
mov dword [ebp - 0x105c], eax
cmp byte [ebp - 0x1051], 0
je 0x4afb8d
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1060], eax
mov dword [ebp - 0x1064], 1
jmp 0x4afba0
lea eax, [ebp - 4]
mov dword [ebp - 0x1060], eax
mov dword [ebp - 0x1064], 0xffffffff
mov eax, dword [ebp - 0x1050]
shr eax, 3
dec eax
test eax, eax
jl 0x4afd4a
inc eax
mov dword [ebp - 0x1070], eax
mov dword [ebp - 0x1058], 0
cmp dword [ebp + 0x10], 0
jne 0x4afbcd
cmp dword [ebp + 0xc], 0
je 0x4afc8c
mov dword [ebp - 0x1068], 7
lea eax, [ebp + 0xc]
add eax, dword [ebp - 0x1068]
mov al, byte [eax]
inc eax
and al, 0xff
lea edx, [ebp + 0xc]
add edx, dword [ebp - 0x1068]
mov byte [edx], al
lea eax, [ebp + 0xc]
add eax, dword [ebp - 0x1068]
cmp byte [eax], 0
jne 0x4afc13
dec dword [ebp - 0x1068]
cmp dword [ebp - 0x1068], 0xffffffff
jne 0x4afbdd
push ebp
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.004af440
pop ecx
mov dword [ebp - 0x1068], eax
push ebp
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.004af440
pop ecx
mov dword [ebp - 0x106c], eax
push ebp
mov eax, dword [ebp - 0x1064]
push eax
lea edx, [ebp - 0x106c]
lea eax, [ebp - 0x1068]
mov ecx, dword [ebp - 0x1060]
call fcn.004af484
pop ecx
push ebp
mov eax, dword [ebp - 0x1068]
call fcn.004af440
pop ecx
mov edx, dword [ebp - 0x105c]
xor dword [edx], eax
push ebp
mov eax, dword [ebp - 0x106c]
call fcn.004af440
pop ecx
mov edx, dword [ebp - 0x105c]
add edx, 4
xor dword [edx], eax
jmp 0x4afd31
cmp byte [ebp + 8], 0
jne 0x4afd0e
push ebp
mov eax, dword [ebp - 0x105c]
mov eax, dword [eax]
call fcn.004af440
pop ecx
mov dword [ebp - 0x1068], eax
push ebp
mov eax, dword [ebp - 0x105c]
add eax, 4
mov eax, dword [eax]
call fcn.004af440
pop ecx
mov dword [ebp - 0x106c], eax
push ebp
mov eax, dword [ebp - 0x1064]
push eax
lea edx, [ebp - 0x106c]
lea eax, [ebp - 0x1068]
mov ecx, dword [ebp - 0x1060]
call fcn.004af484
pop ecx
push ebp
mov eax, dword [ebp - 0x1068]
call fcn.004af440
pop ecx
mov edx, dword [ebp - 0x105c]
mov dword [edx], eax
push ebp
mov eax, dword [ebp - 0x106c]
call fcn.004af440
pop ecx
mov edx, dword [ebp - 0x105c]
add edx, 4
mov dword [edx], eax
jmp 0x4afd31
push ebp
mov eax, dword [ebp - 0x1064]
push eax
mov edx, dword [ebp - 0x105c]
mov eax, dword [ebp - 0x105c]
add eax, 4
mov ecx, dword [ebp - 0x1060]
call fcn.004af484
pop ecx
add dword [ebp - 0x105c], 8
inc dword [ebp - 0x1058]
dec dword [ebp - 0x1070]
jne 0x4afbc3
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b392c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edx, 0xffffffec
mov eax, dword [ebp - 4]
call fcn.0040f628
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 0
je 0x4b3957
test byte [ebp - 0xa], 4
je 0x4b3974
cmp byte [ebp - 5], 0
jne 0x4b3a0b
mov eax, dword [ebp - 0xc]
and eax, 0x40000
cmp eax, 0x40000
jne 0x4b3a0b
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
or al, byte [ebp - 0xe]
je 0x4b39ab
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 5], 0
je 0x4b39c9
mov ecx, dword [ebp - 0xc]
or ecx, 0x40000
mov edx, 0xffffffec
mov eax, dword [ebp - 4]
call fcn.0040f7bc
jmp 0x4b39df
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffbffff
mov edx, 0xffffffec
mov eax, dword [ebp - 4]
call fcn.0040f7bc
mov al, byte [ebp - 6]
and al, byte [ebp - 0xd]
jne 0x4b39ed
cmp byte [ebp - 0xe], 0
je 0x4b3a0b
cmp byte [ebp - 0xe], 0
je 0x4b3a00
push 6
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4b3a0b
push 5
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret

Function at 0x4b3e7c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x4b3e8e
add esp, 0xfffffff0
call fcn.00406a5c
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004064d0
mov eax, dword [ebp - 4]
call fcn.004b4184
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov dl, 1
mov eax, dword [0x46d260]
call fcn.004064d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov dl, 1
mov eax, dword [0x46d260]
call fcn.004064d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov dl, 1
mov eax, dword [0x46d260]
call fcn.004064d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0xc], eax
push 0x5a
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
mov eax, 0x4b3e34
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4b3f3d
call fcn.00406ab4
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b42c8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc58
push ebx
xor edx, edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b447d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4b445b
mov dl, 1
mov eax, dword [0x470244]
call fcn.0048c874
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00408170
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4b4444
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
movzx eax, word [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 0x3a0], 0
lea ecx, [ebp - 0x3a4]
mov edx, 0x4b448c
lea eax, [ebp - 0x39c]
call fcn.00420454
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4b4438
xor eax, eax
push ebp
push 0x4b4431
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x200
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x4b44fc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4b441a
lea eax, [ebp - 0x3a8]
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408ee4
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x10]
jne 0x4b441a
mov eax, dword [ebp - 4]
add eax, 0xc
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408ee4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4438
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x4b433d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dl, 1
call fcn.0048c7c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4484
lea eax, [ebp - 0x3a8]
call fcn.00408170
ret

Function at 0x4b46bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.004b4654
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4b46dd
xor eax, eax
call fcn.004b468c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x4b46f7
mov al, 1
call fcn.004b468c
mov esp, ebp
pop ebp
ret
Function at 0x4b53fc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xe0], 0
je 0x4b54bd
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x4b54b7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe0]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x4b5348
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
cmp dword [eax + 8], 0
je 0x4b54b7
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
mov edx, 0xffffffec
mov eax, dword [ebp - 0x14]
call fcn.0040f628
test al, 8
je 0x4b5477
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4b54b7
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00489424
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b5489
mov eax, dword [ebp - 4]
inc dword [eax + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x4b576c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x527760]
cmp dword [eax + 0xe0], 0
je 0x4b58f1
cmp byte [ebp - 5], 0
jne 0x4b583a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4b582f
mov eax, dword [ebp - 4]
call fcn.004b77a0
push eax
push 0x4b566c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x4b57f8
mov eax, dword [0x527760]
cmp byte [eax + 0x62], 0
je 0x4b57f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.0040a138
cmp eax, 0
jl 0x4b57f8
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b57db
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4b582f
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00489424
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b580a
mov eax, dword [ebp - 4]
inc dword [eax + 0x34]
jmp 0x4b58f1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jle 0x4b58f1
mov eax, dword [ebp - 4]
dec dword [eax + 0x34]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4b58f1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x4b589e
mov eax, dword [0x527760]
cmp byte [eax + 0x62], 0
je 0x4b589e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.0040a138
cmp eax, 0
jl 0x4b589e
mov dword [ebp - 0xc], eax
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b5881
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4b58d5
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00489424
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4b58b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 4]
add eax, 0x68
mov edx, dword [0x4b22d0]
call fcn.0040a474
mov esp, ebp
pop ebp
ret
Function at 0x4b6504
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44], 0
je 0x4b656e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x62], 0
jne 0x4b656e
push pe_nt_image_headers32
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe0]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 8]
call fcn.004082f8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408668
test eax, eax
jne 0x4b65b2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
call fcn.00408550
jmp 0x4b65b2
push pe_nt_image_headers32
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 8]
call fcn.004082f8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408668
test eax, eax
jne 0x4b65b2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
call fcn.00408550
mov esp, ebp
pop ebp
ret

Function at 0x4c38d0
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4c3935
mov eax, dword [esp]
call fcn.004c3d7c
test al, al
je 0x4c3935
mov eax, dword [esp]
call fcn.004c3c04
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4c3918
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4c3935
cmp ax, 0x5a
ja 0x4c3935
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4c5994
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004c5194
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00408e40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004c5298
test al, al
jne 0x4c59fc
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x521bf0]
mov dl, 1
mov eax, dword [0x4c3f60]
call fcn.00425084
call fcn.0040786c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c5a08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00408e40
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004c5298
test al, al
jne 0x4c5a69
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x521f00]
mov dl, 1
mov eax, dword [0x4c3f60]
call fcn.00425084
call fcn.0040786c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c51c4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c6584
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c6677
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0xe
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.004082f8
cmp dword [ebp - 0x10], 0
je 0x4c665c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00408e40
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
sub dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4c660e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00408668
mov edx, eax
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00408fbc
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x4c665c
mov al, byte [0x4c6684]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x4c6694
call fcn.00426580
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00408550
cmp byte [ebp - 5], 0
je 0x4c665c
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor edx, edx
call fcn.004c5b70
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00408550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c667e
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004081d0
ret

Function at 0x4c66f8
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x4c6714
push 0x4c6718
call sub.user32.dll_FindWindowW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret
Function at 0x4c6858
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
call fcn.004c6314
test al, al
je 0x4c6894
mov eax, dword [ebp - 0x20]
call fcn.004c6348
test al, al
je 0x4c6b3e
xor edx, edx
mov eax, dword [ebp - 0x20]
call fcn.004c63e4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
call fcn.004c681c
test al, al
je 0x4c6b3e
mov eax, dword [ebp - 0x20]
call fcn.004c7684
test al, al
jne 0x4c6b3e
mov byte [ebp - 5], 1
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x20]
je 0x4c6b3e
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x4c68de
push 9
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x20]
je 0x4c6b3e
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x20]
je 0x4c6b3e
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x10], eax
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4c696c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x4c696c
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4c696c
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x20]
je 0x4c6b3e
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_BringWindowToTop
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
call sub.user32.dll_GetForegroundWindow
cmp eax, dword [ebp - 0x20]
je 0x4c6b3e
push 0x12
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4c7d78
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
cmp dword [0x5277d8], 0
jne 0x4c7de1
lea eax, [ebp - 0x118]
xor ecx, ecx
mov edx, 0x114
call fcn.00405bdc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4c7dd7
cmp dword [ebp - 0x114], 6
jb 0x4c7dcb
mov dword [0x5277d8], 1
jmp 0x4c7de1
mov dword [0x5277d8], 0xffffffff
jmp 0x4c7de1
mov dword [0x5277d8], 0xffffffff
cmp dword [0x5277d8], 0
setg byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4c8aec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00408fbc
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c8b6b
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00408fbc
jmp 0x4c8b73
mov eax, dword [ebp - 4]
call fcn.00408170
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c8c34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00408fbc
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c8cb3
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00408fbc
jmp 0x4c8cbb
mov eax, dword [ebp - 4]
call fcn.00408170
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c8ce8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00408fbc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c8d67
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408e40
push eax
call sub.kernel32.dll_GetLongPathNameW
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00408fbc
jmp 0x4c8d6f
mov eax, dword [ebp - 4]
call fcn.00408170
pop ecx
pop ecx
pop ebp
ret