joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437800
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4c3e88]
push eax
mov eax, dword [esp + 0x18]
call fcn.00443b70
mov ebp, eax
test ebp, ebp
je 0x437826
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
jmp 0x43782b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.004742b0
cmp eax, 1
je 0x437849
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x43795e
cmp byte [edi + 0x17], 0
jne 0x43785c
mov esi, dword [edi + 0xc]
jmp 0x43785e
mov esi, edi
test byte [esi + 0x15], 8
je 0x43786b
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x437884
test byte [esi + 0x15], 4
je 0x43787f
mov eax, esi
call fcn.0042f790
mov eax, dword [esi + 8]
jmp 0x437894
cmp al, 2
jne 0x43788f
call fcn.00401000
jmp 0x437894
mov eax, 0x4c5ff0
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x4378aa
mov esi, dword [edi + 0xc]
jmp 0x4378ac
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x4378c4
test byte [esi + 0x15], 8
je 0x4378bf
mov eax, esi
call fcn.00401160
lea eax, [esi + 0xc]
jmp 0x4378c9
mov eax, 0x4c6ecc
lea edx, [ebx + ebx]
mov dword [eax], edx
cmp byte [edi + 0x17], 0
jne 0x4378d9
mov esi, dword [edi + 0xc]
jmp 0x4378db
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x4378f3
test byte [esi + 0x15], 8
je 0x4378ee
mov eax, esi
call fcn.00401160
lea eax, [esi + 0xc]
jmp 0x4378f8
mov eax, 0x4c6ecc
test dword [eax], 0xfffffffe
jne 0x4379d5
cmp byte [edi + 0x17], 0
jne 0x43790f
mov esi, dword [edi + 0xc]
jmp 0x437911
mov esi, edi
test byte [esi + 0x15], 8
je 0x43791e
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43793f
test byte [esi + 0x15], 4
je 0x437932
mov eax, esi
call fcn.0042f790
mov eax, dword [esi + 8]
xor ecx, ecx
mov word [eax], cx
jmp 0x4379d5
cmp al, 2
jne 0x437952
call fcn.00401000
xor ecx, ecx
mov word [eax], cx
jmp 0x4379d5
mov eax, 0x4c5ff0
xor ecx, ecx
mov word [eax], cx
jmp 0x4379d5
cmp byte [edi + 0x17], 0
jne 0x437969
mov esi, dword [edi + 0xc]
jmp 0x43796b
mov esi, edi
test byte [esi + 0x15], 8
je 0x437978
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x437991
test byte [esi + 0x15], 4
je 0x43798c
mov eax, esi
call fcn.0042f790
mov eax, dword [esi + 8]
jmp 0x4379a1
cmp al, 2
jne 0x43799c
call fcn.00401000
jmp 0x4379a1
mov eax, 0x4c5ff0
xor edx, edx
mov word [eax], dx
cmp byte [edi + 0x17], dl
jne 0x4379b0
mov esi, dword [edi + 0xc]
jmp 0x4379b2
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x4379ca
test byte [esi + 0x15], 8
je 0x4379c5
mov eax, esi
call fcn.00401160
lea eax, [esi + 0xc]
jmp 0x4379cf
mov eax, 0x4c6ecc
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x4379de
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x4379fe
cmp dword [0x4c6b54], 0
je 0x4379fe
mov ecx, 0x4c6b48
call fcn.00403d90
pop edi
pop esi
pop ebp
pop ebx
ret 4
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x438830
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.00495db0
push 0x7fff
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esp]
test eax, eax
jne 0x438857
mov ecx, 0x49e828
mov edx, dword [0x4c3e88]
push 1
push 0
push eax
push ecx
push edx
call fcn.004742b0
add esp, 0x10000
ret
Function at 0x43b090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x43b0d0
xor edx, edx
mov word [esp + 0x18], dx
xor eax, eax
jmp 0x43b135
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.InstallDir
push edx
mov dword [esp + 0x28], 0x208
call ebp
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43b163
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43b163
shr eax, 1
dec eax
mov dword [esp + 0x10], eax
cmp word [esp + eax*2 + 0x18], si
jne 0x43b143
test eax, eax
je 0x43b135
lea ecx, [esp + eax*2 + 0x16]
cmp word [ecx], 0
jne 0x43b12d
sub ecx, 2
dec eax
jne 0x43b121
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43b16c
test edi, edi
jne 0x43b16c
mov edi, 0x100
jmp 0x43b0a8
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x43b15a
xor ecx, ecx
mov word [esp + 0x18], cx
xor eax, eax
jmp 0x43b135
xor edx, edx
mov word [esp + eax*2 + 0x18], dx
jmp 0x43b131
xor eax, eax
mov word [esp + 0x18], ax
jmp 0x43b135
mov esi, dword [esp + 0x224]
test esi, esi
je 0x43b18f
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
nop
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x43b180
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x43e6a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [0x4c3e88]
push esi
push edi
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [edi]
test cx, cx
je 0x43e785
cmp word [edi + 2], 0
jne 0x43e705
cmp ecx, 0xa
jne 0x43e6d9
mov al, 0xd
jmp 0x43e77f
push eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
jne 0x43e6f9
cmp cl, 0xff
jne 0x43e6f9
xor al, al
jmp 0x43e77f
and al, 0x38
neg al
sbb al, al
not al
and al, cl
jmp 0x43e77f
mov esi, ecx
test esi, 0xffffff80
jne 0x43e721
push 2
push esi
call fcn.0048b9ce
add esp, 8
test eax, eax
je 0x43e721
and esi, 0xffffffdf
cmp si, 0x56
jne 0x43e748
mov ax, word [edi + 2]
call fcn.00409130
cmp ax, 0x4b
jne 0x43e748
push 0x10
lea ecx, [edi + 4]
push 0
push ecx
call fcn.0048bdab
add esp, 0xc
jmp 0x43e77f
xor esi, esi
lea ebx, [ebx]
mov edx, dword [esi*8 + 0x4c11f0]
push edi
push edx
call fcn.0048a789
add esp, 8
test eax, eax
je 0x43e7b8
inc esi
cmp esi, 0x6d
jl 0x43e750
mov eax, edi
call fcn.00411b40
movzx ecx, ax
test cx, cx
je 0x43e785
call fcn.004122c0
mov bl, al
test bl, bl
jne 0x43e7fe
push 0
lea ebx, [esp + 0x18]
mov eax, edi
call fcn.0044f010
mov edi, eax
add esp, 4
test edi, edi
jne 0x43e7c1
push 1
push eax
push 0xffffffffffffffff
push 0x49e828
push ebp
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov bl, byte [esi*8 + 0x4c11f4]
jmp 0x43e781
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x18], eax
push 0
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
call fcn.0044f2c0
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov edi, ebp
call fcn.00473ce0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov edx, dword [esp + 0x22c]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x43e822
push 2
push esi
call fcn.0048b9ce
add esp, 8
test eax, eax
je 0x43e822
and esi, 0xffffffdf
movzx eax, si
cmp eax, 0x50
je 0x43e83a
xor ecx, ecx
cmp eax, 0x54
setne cl
lea eax, [ecx - 1]
and eax, 2
jmp 0x43e83f
mov eax, 1
push eax
call fcn.0044f210
add esp, 4
test al, al
mov eax, 0x4a7b94
jne 0x43e856
mov eax, 0x4a7b98
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
Function at 0x43e870
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
push esi
mov esi, ecx
mov ecx, dword [0x4c3e88]
push edi
call fcn.00412a60
test esi, esi
je 0x43e9f1
cmp word [esi], 0
je 0x43e9f1
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.0048d334
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e8c1
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x43e8f8
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x43e9f1
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4c7798], 1
jne 0x43e92e
or dword [0x4c7798], 1
push str.GetDiskFreeSpaceExW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c7794], eax
jmp 0x43e933
mov eax, dword [0x4c7794]
test eax, eax
je 0x43e97f
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
call eax
test eax, eax
je 0x43e9f1
test bl, bl
je 0x43e96c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e9bf
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e9bf
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x43e9f1
mov eax, dword [esp + 0x14]
test bl, bl
jne 0x43e9ae
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov edx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x49e8dc
push edx
call fcn.004742b0
mov eax, dword [0x4c3e88]
push 0x18
push edi
push esi
call fcn.004010e0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4c040c]
cmp byte [eax + 0x104], 0
jne 0x43ea1e
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push ecx
call fcn.004742b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0x49e828
push 0
push 0x4a12cc
call fcn.0042ec70
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4408b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x218
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call ebp
test eax, eax
jne 0x4408dd
cmp byte [0x4c6ae8], al
je 0x440989
call fcn.004091f0
pop ebp
add esp, 0x218
ret
cmp byte [0x4c6ae8], 0
push ebx
push esi
mov esi, 0x4c46f0
jne 0x4408f1
lea esi, [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push 0x104
call ebx
test eax, eax
je 0x44094f
cmp word [edi], 0
je 0x440967
cmp word [edi + 2], 0x3a
jne 0x440967
cmp word [edi + 4], 0
jne 0x440967
push esi
push edi
call fcn.0048a789
add esp, 8
test eax, eax
je 0x440967
push edi
lea ecx, [esp + 0x10]
push 0x4a8028
push ecx
call fcn.0048ab93
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call ebp
test eax, eax
je 0x440967
push esi
push 0x104
call ebx
test eax, eax
jne 0x440967
push 0x103
push edi
push esi
call fcn.0048d334
add esp, 0xc
xor eax, eax
mov word [esi + 0x206], ax
cmp byte [0x4c6ae8], 0
pop esi
pop ebx
je 0x440989
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x49e8dc
push ecx
call fcn.004742b0
pop ebp
add esp, 0x218
ret
Function at 0x441020
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
mov ebp, ecx
test edi, edi
je 0x4411c8
cmp word [edi], 0
je 0x4411c8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44107c
mov ecx, dword [0x4c040c]
shr eax, 4
not al
and al, 1
movzx edx, al
push edx
push ebp
mov dword [ecx + 0x30], 0xb7
call fcn.0042ed60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
push 0x5c
push edi
call fcn.0048c244
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x44118f
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441096
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x441103
mov eax, dword [0x4c040c]
mov dword [eax + 0x30], 0x6f
cmp byte [eax + 0x104], cl
jne 0x4410e3
mov eax, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push eax
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
mov ecx, ebp
push 0x49e828
push 0
push 0x4a12cc
call fcn.0042ec70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
mov esi, ebx
sub esi, edi
sar esi, 1
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0048d334
add esp, 0xc
lea eax, [esp + 0x18]
xor edx, edx
push eax
mov ecx, ebp
mov word [esp + esi*2 + 0x1c], dx
call fcn.00441020
cmp word [ebx + 2], 0
je 0x44117d
mov esi, dword [0x4c46ec]
cmp byte [esi + 0x17], 0
jne 0x441141
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x44114e
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x441167
test byte [esi + 0x15], 4
je 0x441162
mov eax, esi
call fcn.0042f790
mov eax, dword [esi + 8]
jmp 0x441177
cmp al, 2
jne 0x441172
call fcn.00401000
jmp 0x441177
mov eax, 0x4c5ff0
cmp word [eax], 0x31
jne 0x44118f
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete cl
mov byte [esp + 0x14], cl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x4c040c]
mov dword [edx + 0x30], eax
mov eax, dword [esp + 0x14]
push eax
push ebp
call fcn.0042ed60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
mov eax, dword [0x4c040c]
cmp byte [eax + 0x104], 0
mov dword [eax + 0x30], 0x57
jne 0x4410e5
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push ecx
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x4427f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
mov ebx, edx
call fcn.0040cc10
test al, al
je 0x442818
push 0x10
push 0
push edi
call fcn.0048bdab
add esp, 0xc
jmp 0x442821
push edi
call fcn.0048ba16
add esp, 4
cmp eax, 1
je 0x442886
call fcn.00453be0
test al, al
je 0x442886
mov eax, dword [0x4c040c]
cmp byte [eax + 0x104], 0
jne 0x442861
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push ecx
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
mov ecx, dword [esp + 0x224]
push 0x49e828
push 0
push 0x4a12cc
call fcn.0042ec70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4428d4
mov edx, dword [0x4c040c]
cmp byte [edx + 0x104], 0
jne 0x442861
push 1
push 0
push eax
mov eax, dword [0x4c46ec]
push 0x4a12cc
push eax
call fcn.004742b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4428e0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x4428fb
mov eax, 0x103
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
call fcn.00492940
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.0048c961
add esp, 4
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x44296a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44296a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x44296a
push 0
lea edx, [esp + 0x18]
push edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x44296c
xor bl, bl
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x224]
test bl, bl
sete al
movzx ecx, al
push ecx
push edx
call fcn.0042ed60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x4429a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x4c3e88]
sub esp, 0x100
push esi
mov esi, eax
call fcn.00412a60
test esi, esi
je 0x442a56
cmp word [esi], 0
je 0x442a56
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x442a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c040c]
cmp byte [ecx + 0x104], 0
mov dword [ecx + 0x30], eax
jne 0x442a8a
mov eax, dword [0x4c46ec]
push 1
push 0
push esi
push 0x4a12cc
push eax
call fcn.004742b0
pop esi
add esp, 0x100
ret
mov edx, dword [0x4c46ec]
mov ecx, dword [0x4c040c]
push 1
push 0
push 0xffffffffffffffff
push 0x49e8dc
push edx
mov dword [ecx + 0x30], 0
call fcn.004742b0
mov edx, esi
lea eax, [esp + 4]
call fcn.00472740
push 1
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [0x4c3e88]
push eax
call fcn.004742b0
pop esi
add esp, 0x100
ret
mov eax, dword [0x4c040c]
cmp byte [eax + 0x104], 0
mov dword [eax + 0x30], 0x57
jne 0x442a8a
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push ecx
call fcn.004742b0
pop esi
add esp, 0x100
ret
push 0x49e828
push 0
push 0x4a12cc
mov ecx, edi
call fcn.0042ec70
pop esi
add esp, 0x100
ret
Function at 0x44f210
Capabilities:
Log keystrokes via polling

Disassembly:
test bl, bl
jne 0x44f217
xor al, al
ret
mov eax, dword [esp + 4]
dec eax
je 0x44f23f
dec eax
je 0x44f231
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
ret
lea edx, [ebx - 1]
cmp dl, 5
ja 0x44f24c
cmp bl, 3
jne 0x44f253
lea eax, [ebx + 0x66]
cmp al, 5
ja 0x44f279
cmp dword [0x4c401c], 0
je 0x44f269
movzx ecx, bl
mov al, byte [ecx + 0x4c3f08]
shr al, 7
ret
movzx edx, bl
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
cmp dword [0x4c4018], 0
je 0x44f2a8
xor ecx, ecx
xor edx, edx
mov al, bl
call fcn.00411590
test al, al
je 0x44f29b
push 1
call fcn.004113c0
add esp, 4
movzx eax, bl
mov al, byte [eax + 0x4c3f08]
shr al, 7
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
Function at 0x44f840
Capabilities:
Get disk information

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
xor eax, eax
push esi
push eax
push 0x410
mov word [edi], ax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44f882
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x44f882
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
cmp byte [esp + 0x224], 0
push 0x104
push edi
push 0
push ebp
je 0x44f89d
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
jmp 0x44f8a3
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test byte [0x4c774c], 1
mov ebx, eax
jne 0x44f8d3
or dword [0x4c774c], 1
push str.GetProcessImageFileNameW
push str.psapi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c7748], eax
jmp 0x44f8d8
mov eax, dword [0x4c7748]
test ebx, ebx
jne 0x44f9ef
test eax, eax
je 0x44f9ef
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x44f9ef
cmp byte [esp + 0x224], 0
je 0x44f953
push 0x5c
push edi
call fcn.0048c244
add esp, 8
test eax, eax
je 0x44f9ef
mov ecx, eax
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x44f920
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
add eax, 2
push eax
push edi
call fcn.0048b1f0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
mov ecx, 0x41
mov dword [esp + 0x12], 0x3a
mov word [esp + 0x10], cx
push 0x104
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, eax
cmp esi, 2
jbe 0x44f99e
sub esi, 2
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.0048c272
add esp, 0xc
test eax, eax
jne 0x44f99e
cmp word [edi + esi*2], 0x5c
je 0x44f9c4
mov ax, word [esp + 0x10]
inc ax
mov word [esp + 0x10], ax
cmp ax, 0x5a
jbe 0x44f965
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
mov dx, word [esp + 0x10]
mov ax, word [esp + 0x12]
sub ebx, esi
mov word [edi], dx
lea ecx, [ebx + ebx + 2]
push ecx
lea edx, [edi + esi*2]
mov word [edi + 2], ax
push edx
add edi, 4
push edi
call fcn.0048b1f0
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x210
ret
Function at 0x452a30
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push 0
mov esi, ecx
mov byte [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x49c738
push 1
push 0
push 0x49c748
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x452bda
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
cmp word [esi], 0
je 0x452a8b
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push esi
push eax
call edx
cmp word [edi], 0
je 0x452a9e
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
cmp word [ebx], 0
je 0x452ab1
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
push eax
call edx
mov esi, dword [esp + 0x1c]
cmp word [esi], 0
je 0x452af9
cmp word [ebp], 0
je 0x452ae9
mov eax, ebp
call fcn.0040cc10
test al, al
je 0x452add
push 0x10
push 0
push ebp
call fcn.0048bdab
add esp, 0xc
dec eax
jmp 0x452aeb
push ebp
call fcn.0048ba16
add esp, 4
dec eax
jmp 0x452aeb
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x44]
push esi
push ecx
call eax
mov esi, dword [esp + 0x20]
cmp word [esi], 0
je 0x452b3c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 1
mov ecx, eax
push 0
xor edx, edx
mov eax, esi
call fcn.00411be0
add esp, 8
test al, al
je 0x452b3c
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
movzx eax, al
mov esi, 0x600
or ax, si
movzx eax, ax
push eax
push ecx
mov ecx, dword [edx + 0x34]
call ecx
mov esi, dword [esp + 0x28]
cmp word [esi], 0
je 0x452b76
mov eax, esi
call fcn.0040cc10
test al, al
je 0x452b60
push 0x10
push 0
push esi
call fcn.0048bdab
add esp, 0xc
jmp 0x452b69
push esi
call fcn.0048ba16
add esp, 4
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
push ecx
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x49c758
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x452bce
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x452bc2
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x49e8dc
push ecx
call fcn.004742b0
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [esp + 0x24], 0
pop esi
pop ebp
je 0x452bf2
mov eax, 1
pop ecx
ret 0x1c
mov eax, dword [0x4c040c]
cmp byte [eax + 0x104], 0
jne 0x452c1b
mov ecx, dword [0x4c46ec]
push 1
push 0
push 0xffffffffffffffff
push 0x4a12cc
push ecx
call fcn.004742b0
pop ecx
ret 0x1c
mov ecx, dword [esp + 8]
push 0x49e828
push 0
push 0x4a12cc
call fcn.0042ec70
pop ecx
ret 0x1c