joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aac10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4aadd3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
jne 0x4aac55
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4aac82
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x6c], 0
je 0x4aac74
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x6c]
call fcn.0044c960
mov dword [ebp - 4], eax
jmp 0x4aac82
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
call fcn.0044c960
mov dword [ebp - 4], eax
mov eax, dword [0x5500e0]
cmp byte [eax], 0
je 0x4aadb8
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x4aadb8
cmp dword [ebp - 0xc], 0
je 0x4aadb8
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
and ax, word [0x4aade0]
mov dx, word [0x4aade4]
cmp dx, ax
jne 0x4aadb8
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x4aadb8
push ebp
call fcn.004aaa7c
pop ecx
test al, al
je 0x4aadb8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004aa808
mov eax, dword [ebp - 8]
call fcn.0044e4ac
test eax, eax
jne 0x4aad56
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x4aad56
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x4aad2f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x64], 0
jne 0x4aad2f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 4]
mov edx, dword [0x44b2d8]
call fcn.00403ea8
test al, al
jne 0x4aad56
push dword [ebp - 0x10]
push 0x4aadec
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x60]
call fcn.004a9dbc
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405748
push ebp
lea eax, [ebp - 0x18]
call fcn.004aaae0
pop ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00405790
je 0x4aadb8
push ebp
mov eax, dword [ebp - 0x10]
call fcn.004aab74
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x34]
je 0x4aad91
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x6c], 0
je 0x4aadb8
mov eax, dword [ebp - 0xc]
mov edx, dword [0x44b2d8]
call fcn.00403ea8
test al, al
je 0x4aadb8
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x4aadb8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aadda
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405498
ret
Function at 0x4ac2b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac44c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5500e0]
cmp byte [eax], 0
je 0x4ac30f
mov eax, dword [ebp - 4]
mov edx, dword [0x4532c4]
call fcn.00403ea8
test al, al
je 0x4ac32a
mov eax, dword [ebp - 4]
call fcn.0045f974
test al, al
je 0x4ac32a
mov eax, dword [ebp - 4]
call fcn.0045f5d4
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x4ac32a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00457a68
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040564c
jmp 0x4ac421
mov eax, dword [ebp - 4]
mov edx, dword [0x4532c4]
call fcn.00403ea8
test al, al
jne 0x4ac38b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ac18c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4ac36a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00457a68
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040564c
jmp 0x4ac421
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00457a68
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, 0x38
call fcn.00488b2c
jmp 0x4ac421
mov eax, dword [ebp - 4]
call fcn.0045f974
test al, al
jne 0x4ac3bd
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00457a68
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040564c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ac204
jmp 0x4ac421
mov eax, dword [ebp - 4]
call fcn.0045f5d4
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
add edx, 1
jno 0x4ac3d7
call fcn.00403bec
mov eax, dword [ebp - 8]
call fcn.004059dc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040566c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040565c
push eax
mov eax, dword [ebp - 4]
call fcn.0045f5d4
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040566c
mov edx, eax
sub edx, 1
jno 0x4ac419
call fcn.00403bec
mov eax, dword [ebp - 8]
call fcn.004059dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac453
lea eax, [ebp - 0x20]
call fcn.00404c58
lea eax, [ebp - 0x1c]
call fcn.00405480
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404c7c
ret
Function at 0x4b5980
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5ab1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5500e0]
cmp byte [eax], 0
jne 0x4b59bf
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 4]
call fcn.0042c44c
jmp 0x4b5a93
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0042c3e4
test al, al
je 0x4b5a93
mov eax, dword [ebp - 0x30]
add eax, 1
jno 0x4b59e7
call fcn.00403bec
imul edx, eax, 2
jno 0x4b59f1
call fcn.00403bec
lea eax, [ebp - 0x14]
call fcn.004059dc
mov eax, dword [ebp - 0x34]
sub eax, 1
jno 0x4b5a06
call fcn.00403bec
test eax, eax
jl 0x4b5a93
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x30]
add eax, 1
jno 0x4b5a26
call fcn.00403bec
imul eax, eax, 2
jno 0x4b5a30
call fcn.00403bec
test eax, eax
jns 0x4b5a39
call fcn.00403be4
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040565c
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jns 0x4b5a5d
call fcn.00403be4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4b5a8b
mov eax, dword [ebp - 0x14]
call fcn.0040565c
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.004055dc
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4b5a19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5ab8
lea eax, [ebp - 0x38]
call fcn.00405480
lea eax, [ebp - 0x14]
call fcn.00405480
ret
Function at 0x4b5abc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5c41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5500e0]
cmp byte [eax], 0
jne 0x4b5b1b
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404efc
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0042c5bc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0040564c
jmp 0x4b5c19
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040565c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4b5b52
mov eax, dword [ebp - 0xc]
call fcn.00405480
jmp 0x4b5c19
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x4b5b8c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xf
lea eax, [ebp - 0x24]
push eax
push 0
lea edx, [ebp - 0x28]
mov eax, dword [0x550230]
call fcn.004071a8
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x42be48]
call fcn.0040e804
call fcn.004045d0
cmp dword [ebp - 0x14], 1
jne 0x4b5b99
mov dword [ebp - 0x14], 2
mov edx, dword [ebp - 0x14]
shr edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004059dc
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040565c
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040565c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4b5c05
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xf
lea eax, [ebp - 0x24]
push eax
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [0x5505e0]
call fcn.004071a8
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x42be48]
call fcn.0040e804
call fcn.004045d0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0040565c
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004055dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5c48
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404c7c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404c7c
ret
Function at 0x4bfc84
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4bfcb2
mov eax, ebx
call fcn.004c0738
cmp dword [ebx + 0x40], 0
je 0x4bfcab
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4bfd23
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4bfd15
cmp dword [ebx + 8], 0
je 0x4bfcd4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4bfce6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4bfd15
cmp dword [ebx + 8], 0
je 0x4bfcc7
cmp eax, 3
je 0x4bfcf9
dec eax
jne 0x4bfcc7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4bfcc7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4bfcc7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4bfd41
cmp dword [ebx + 0x14], 0xcc
je 0x4bfd41
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004bfd4c
pop ebx
ret

Function at 0x4d0c8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4d0caf
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d0cc2
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4d0d38
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, 1
mov edx, dword [ebp - 8]
dec eax
test edx, edx
je 0x4d0cd9
cmp eax, dword [edx - 4]
jb 0x4d0cde
call fcn.00403be4
inc eax
lea eax, [edx + eax - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x4d0d1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
shl eax, 5
mov edx, dword [ebp - 0x18]
shr edx, 0x1b
xor eax, edx
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx]
xor eax, edx
mov dword [ebp - 0x18], eax
add dword [ebp - 0x1c], 1
inc dword [ebp - 0x10]
dec dword [ebp - 0x20]
jne 0x4d0cf7
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 0x18]
pop edx
mov ecx, edx
xor edx, edx
div ecx
test edx, edx
jns 0x4d0d35
call fcn.00403be4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4e455c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
add eax, 8
mov ecx, 1
mov edx, dword [0x4dc498]
call fcn.0040656c
add esp, 4
push 0
mov eax, dword [ebp - 8]
add eax, 0xc
mov ecx, 1
mov edx, dword [0x4dc4b8]
call fcn.0040656c
add esp, 4
push 0
mov eax, dword [ebp - 8]
add eax, 0x10
mov ecx, 1
mov edx, dword [0x4dc4d8]
call fcn.0040656c
add esp, 4
mov eax, dword [ebp - 8]
push eax
push 0x4e3c00
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
call fcn.004063b0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4e5900
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
push 0x4e3c00
call sub.user32.dll_EnumWindows
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
call fcn.004063b0
sub eax, 1
jno 0x4e5933
call fcn.00403bec
test eax, eax
jl 0x4e596f
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x18]
test edx, edx
je 0x4e5954
cmp eax, dword [edx - 4]
jb 0x4e5959
call fcn.00403be4
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 4]
jne 0x4e5967
mov byte [ebp - 5], 1
jmp 0x4e596f
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4e5942
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4e8ae4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x5504b0]
cmp byte [eax], 0
je 0x4e8b7c
cmp dword [ebp - 8], 0
je 0x4e8b4c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
push 4
push 0x1000
push 0x1000
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
call dword [eax + 0x73c]
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x4e8bd8
push 0x8000
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
call dword [eax + 0x740]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
jmp 0x4e8bd8
cmp dword [ebp - 8], 0
je 0x4e8bbb
push 0x4e8be0
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x4e8bd8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e8d48
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test byte [ebp + 9], 2
jne 0x4e8da7
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4e8da7
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetFocus
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_AttachThreadInput
mov esp, ebp
pop ebp
ret 4
Function at 0x4f0008
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x5504b0]
cmp byte [eax], 0
je 0x4f0069
lea eax, [ebp - 0x1c]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x28]
push eax
push 0x4f01d8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov byte [ebp - 0x11], 0
test byte [ebp - 8], 8
je 0x4f0077
mov byte [ebp - 0x11], 1
test byte [ebp - 7], 1
je 0x4f0091
cmp byte [ebp - 0x11], 1
cmc
sbb eax, eax
push eax
push 0
call sub.kernel32.dll_SetSystemPowerState
jmp 0x4f01d4
test byte [ebp - 7], 2
je 0x4f00ab
cmp byte [ebp - 0x11], 1
cmc
sbb eax, eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_SetSystemPowerState
jmp 0x4f01d4
test byte [ebp - 7], 4
je 0x4f00cc
push 1
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f01d4
test byte [ebp - 7], 8
je 0x4f00ed
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f01d4
test byte [ebp - 7], 0x10
je 0x4f0129
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
cmp dword [eax + 0x778], 0
je 0x4f01d4
push 2
mov eax, dword [ebp - 4]
call dword [eax + 0x778]
jmp 0x4f01d4
test byte [ebp - 7], 0x20
je 0x4f014a
push 0
push 0xf140
push 0x112
push 0xffff
call sub.user32.dll_PostMessageA
jmp 0x4f01d4
test byte [ebp - 7], 0x40
je 0x4f0176
cmp dword [ebp - 0xc], 0
je 0x4f015d
mov dword [ebp - 0xc], 1
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x80cc
mov eax, dword [ebp - 4]
call fcn.0045f5d4
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x4f0188
mov dword [ebp - 8], 0x10
cmp byte [ebp - 0x11], 0
je 0x4f0192
or dword [ebp - 0x10], 4
test byte [ebp - 8], 0x10
je 0x4f019c
or dword [ebp - 0x10], 9
test byte [ebp - 8], 0x20
je 0x4f01a6
or dword [ebp - 0x10], 1
test byte [ebp - 8], 0x40
je 0x4f01b0
or dword [ebp - 0x10], 2
test byte [ebp - 8], 0x80
je 0x4f01ba
or dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jle 0x4f01d4
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jns 0x4f01ce
call fcn.00403be4
push eax
call sub.user32.dll_ExitWindowsEx
mov esp, ebp
pop ebp
ret
Function at 0x4f2818
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x378], 0
je 0x4f2965
cmp byte [ebp - 5], 0
je 0x4f292b
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.00520b78
cmp dword [ebp - 0xc], 0
je 0x4f2871
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f2871
mov ecx, 0x1f40
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f2694
mov eax, dword [ebp - 4]
cmp dword [eax + 0x748], 0
je 0x4f2888
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0x748]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004e8bec
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetAsyncKeyState
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x100
jne 0x4f2897
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetAsyncKeyState
test ax, ax
je 0x4f290a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x748], 0
je 0x4f28db
push 0
mov eax, dword [ebp - 4]
call dword [eax + 0x748]
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004f296c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x748], 0
je 0x4f2901
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0x748]
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetAsyncKeyState
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x92
jne 0x4f28b6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jne 0x4f28b1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e8bec
jmp 0x4f2965
mov eax, dword [ebp - 4]
cmp dword [eax + 0x748], 0
je 0x4f2942
push 0
mov eax, dword [ebp - 4]
call dword [eax + 0x748]
cmp dword [ebp - 0xc], 0
je 0x4f2965
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f2965
mov ecx, 0x1f40
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004f2694
mov esp, ebp
pop ebp
ret
Function at 0x4f3490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 1
jne 0x4f34d7
mov eax, dword [ebp - 0x9c]
test eax, eax
jns 0x4f34cf
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
cmp dword [ebp - 8], 2
jne 0x4f34f4
mov eax, dword [ebp - 0x98]
test eax, eax
jns 0x4f34ec
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
cmp dword [ebp - 8], 3
jne 0x4f3511
mov eax, dword [ebp - 0x94]
test eax, eax
jns 0x4f3509
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
cmp dword [ebp - 8], 4
jne 0x4f352e
mov eax, dword [ebp - 0x90]
test eax, eax
jns 0x4f3526
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
mov eax, dword [0x5504b0]
cmp byte [eax], 0
je 0x4f361c
cmp dword [ebp - 0x9c], 6
jae 0x4f35b7
mov eax, dword [ebp - 0x9c]
add eax, 7
jae 0x4f3555
call fcn.00403bec
test eax, eax
jns 0x4f355e
call fcn.00403be4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc
jl 0x4f3650
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
xor eax, eax
mov dword [ebp - 0xa4], eax
fild qword [ebp - 0xa8]
call fcn.004033c0
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
jno 0x4f359e
call fcn.00403bec
add esp, 8
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4f35af
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa8], eax
xor eax, eax
mov dword [ebp - 0xa4], eax
fild qword [ebp - 0xa8]
call fcn.004033c0
push edx
push eax
mov eax, dword [ebp - 0x9c]
sub eax, 4
jae 0x4f35e8
call fcn.00403bec
mov edx, 0xa
mul edx
jae 0x4f35f6
call fcn.00403bec
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
jno 0x4f3606
call fcn.00403bec
add esp, 8
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4f3617
call fcn.00403be4
mov dword [ebp - 0xc], eax
jmp 0x4f3650
cmp dword [ebp - 0x9c], 4
jne 0x4f3650
cmp dword [ebp - 0x98], 0
jne 0x4f3637
mov dword [ebp - 0xc], 1
jmp 0x4f3650
cmp dword [ebp - 0x98], 0x14
jae 0x4f3649
mov dword [ebp - 0xc], 2
jmp 0x4f3650
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret