joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468db0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x468dbb
xor al, al
pop ebx
ret
sub edx, 1
je 0x468de0
movzx eax, bl
push eax
sub edx, 1
je 0x468dd6
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x468ded
cmp bl, 3
jne 0x468df5
mov al, bl
add al, 0x66
cmp al, 5
ja 0x468e0c
cmp dword [0x4eb758], 0
movzx eax, bl
je 0x468e3d
mov al, byte [eax + 0x4ec0a8]
shr al, 7
pop ebx
ret
cmp dword [0x4eb75c], 0
je 0x468e3a
push 0
xor edx, edx
call fcn.00415630
add esp, 4
test al, al
je 0x468e2c
mov cl, 1
call fcn.00415420
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4ec0a8]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret

Function at 0x4694c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
push 0
push 0x410
mov byte [edi], 0
call ebx
mov ebp, eax
test ebp, ebp
jne 0x469501
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x469501
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
cmp byte [esp + 0x120], 0
push 0x104
push edi
push 0
push ebp
je 0x46951c
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
jmp 0x469522
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov ebx, eax
test ebx, ebx
jne 0x469632
mov eax, dword [0x4df74c]
test eax, eax
je 0x469632
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x469632
cmp byte [esp + 0x120], 0
je 0x46959b
push 0x5c
push edi
call fcn.004be03b
mov edx, eax
add esp, 8
test edx, edx
je 0x469632
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x469570
sub ecx, esi
lea eax, [edx + 1]
push ecx
push eax
push edi
call fcn.004b4620
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov word [esp + 0x11], 0x3a
mov byte [esp + 0x10], 0x41
nop word [eax + eax]
push 0x104
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov esi, eax
cmp esi, 2
jbe 0x4695eb
sub esi, 2
lea eax, [esp + 0x14]
push esi
push edi
push eax
call fcn.004bdf03
add esp, 0xc
test eax, eax
jne 0x4695eb
cmp byte [esi + edi], 0x5c
lea ecx, [esi + edi]
je 0x46960d
mov al, byte [esp + 0x10]
inc al
mov byte [esp + 0x10], al
cmp al, 0x5a
jle 0x4695b0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
movzx eax, byte [esp + 0x10]
sub ebx, esi
mov byte [edi], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 1], al
lea eax, [ebx + 1]
push eax
push ecx
lea eax, [edi + 2]
push eax
call fcn.004b4620
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
Function at 0x46cdc0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x12c
push esi
mov esi, ecx
test eax, eax
je 0x46cecf
cmp byte [eax], 0
je 0x46cecf
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46ce00
sub ecx, edx
je 0x46ce16
cmp byte [esp + ecx + 0x27], 0x5c
jne 0x46ce16
mov byte [esp + ecx + 0x27], al
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46ce20
sub ecx, edx
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x16], 0
mov dword [esp + 4], 0
mov byte [esp + ecx + 0x29], al
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, 0x4054
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x46ce9d
mov ecx, dword [0x4eb720]
push 1
push eax
push 0xffffffffffffffff
push 0x4d5290
call fcn.004a2730
pop esi
add esp, 0x12c
ret 4
mov eax, dword [0x4e88cc]
test byte [eax + 0xe0], 1
jne 0x46cecb
mov ecx, dword [0x4eb720]
push 1
push 0
push 0xffffffffffffffff
push 0x4d9c00
call fcn.004a2730
pop esi
add esp, 0x12c
ret 4
mov ecx, esi
jmp 0x46cedd
mov eax, dword [0x4e88cc]
test byte [eax + 0xe0], 1
je 0x46ceab
push 0x4d5231
push 0
push 0x4d9c00
call fcn.0043e650
pop esi
add esp, 0x12c
ret 4
Function at 0x46cf80
Capabilities:
Get file version info

Disassembly:
sub esp, 0x8c
push ebx
push esi
push 1
push 0
push 0xffffffffffffffff
mov ebx, ecx
mov ecx, dword [0x4eceb0]
push 0
call fcn.004a2730
mov esi, dword [esp + 0x98]
test esi, esi
je 0x46d13e
cmp byte [esi], 0
je 0x46d13e
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebp, eax
test ebp, ebp
jne 0x46d020
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4e88cc]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x46d001
mov ecx, dword [0x4eb720]
push 1
push ebp
push 0xffffffffffffffff
push 0x4d9c00
call fcn.004a2730
pop ebp
pop esi
pop ebx
add esp, 0x8c
ret 4
push 0x4d5231
push 0
push 0x4d9c00
mov ecx, ebx
call fcn.0043e650
pop ebp
pop esi
pop ebx
add esp, 0x8c
ret 4
push edi
push ebp
call fcn.004b6720
add esp, 4
mov edi, eax
push edi
push ebp
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x46d0d5
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0x4db614
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x46d0d5
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [esp + 0x28]
push edx
push str._u._u._u._u
push 0x80
push eax
call fcn.0049e100
push edi
call fcn.004b6427
mov eax, dword [0x4e88cc]
add esp, 0x20
mov ecx, dword [0x4eb720]
push 1
push 0
push 0xffffffffffffffff
push 0x4d5290
mov dword [eax + 0x30], 0
call fcn.004a2730
mov ecx, dword [0x4eceb0]
lea eax, [esp + 0x1c]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004a2730
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x8c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4e88cc]
push edi
mov dword [ecx + 0x30], eax
call fcn.004b6427
mov eax, dword [0x4e88cc]
add esp, 4
test byte [eax + 0xe0], 1
jne 0x46d11e
mov ecx, dword [0x4eb720]
push 1
push 0
push 0xffffffffffffffff
push 0x4d9c00
call fcn.004a2730
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x8c
ret 4
push 0x4d5231
push 0
push 0x4d9c00
mov ecx, ebx
call fcn.0043e650
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x8c
ret 4
mov eax, dword [0x4e88cc]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x46d174
mov ecx, dword [0x4eb720]
push 1
push 0
push 0xffffffffffffffff
push 0x4d9c00
call fcn.004a2730
pop esi
pop ebx
add esp, 0x8c
ret 4
push 0x4d5231
push 0
push 0x4d9c00
mov ecx, ebx
call fcn.0043e650
pop esi
pop ebx
add esp, 0x8c
ret 4
Function at 0x46d1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x238
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
mov esi, edx
cmp ebp, 1
je 0x46d1c1
mov byte [esp + 0xf], 0
cmp ebp, 2
jne 0x46d1c6
mov byte [esp + 0xf], 1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x34]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d1e3
sub ecx, edx
je 0x46d1f9
cmp byte [esp + ecx + 0x33], 0x5c
jne 0x46d1f9
mov byte [esp + ecx + 0x33], al
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x140]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x13c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d220
sub ecx, edx
je 0x46d23c
cmp byte [esp + ecx + 0x13b], 0x5c
jne 0x46d23c
mov byte [esp + ecx + 0x13b], al
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x34]
push eax
call esi
cmp eax, 0xffffffff
je 0x46d3fa
test al, 0x10
je 0x46d3fa
mov bl, byte [esp + 0x24c]
test bl, bl
je 0x46d2fb
movzx ebx, byte [esp + 0x34]
test ebx, 0xffffff80
jne 0x46d288
push 1
push ebx
call fcn.004b8e5e
add esp, 8
test eax, eax
je 0x46d288
or ebx, 0x20
movzx eax, byte [esp + 0x13c]
mov dword [esp + 0x10], eax
test eax, 0xffffff80
jne 0x46d2b1
push 1
push eax
call fcn.004b8e5e
add esp, 8
test eax, eax
mov eax, dword [esp + 0x10]
je 0x46d2b1
or eax, 0x20
cmp bl, al
jne 0x46d2bc
cmp byte [esp + 0x35], 0x3a
je 0x46d2f4
movzx eax, byte [esp + 0xf]
lea edx, [esp + 0x13c]
push 0
push eax
lea ecx, [esp + 0x3c]
call fcn.0046d1a0
add esp, 8
test al, al
je 0x46d3fa
mov dl, 1
lea ecx, [esp + 0x34]
call fcn.0046d410
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
mov bl, byte [esp + 0x24c]
lea eax, [esp + 0x13c]
push eax
call esi
cmp eax, 0xffffffff
je 0x46d324
test al, 0x10
je 0x46d3fa
mov al, byte [esp + 0xf]
test al, al
je 0x46d3fa
test bl, bl
jne 0x46d35c
jmp 0x46d33e
test bl, bl
jne 0x46d35c
xor edx, edx
lea ecx, [esp + 0x13c]
call fcn.00453970
test al, al
je 0x46d3fa
lea ecx, [esp + 0x34]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x46d343
mov eax, dword [0x4dfcf0]
mov dword [ecx], eax
mov al, byte [0x4dfcf4]
mov byte [ecx + 4], al
lea ecx, [esp + 0x34]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d363
sub ecx, edx
mov byte [esp + ecx + 0x35], al
lea ecx, [esp + 0x13c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d380
sub ecx, edx
mov dword [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x2e], 0
movlpd qword [esp + 0x26], xmm0
mov byte [esp + ecx + 0x13d], al
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x13c]
mov dword [esp + 0x20], eax
movzx eax, bl
xor eax, 1
inc eax
mov dword [esp + 0x18], eax
mov eax, 0x614
mov word [esp + 0x24], ax
cmp ebp, 2
jne 0x46d3e0
mov eax, 0x615
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
pop esi
test eax, eax
pop ebp
sete al
pop ebx
add esp, 0x238
ret
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x238
ret
Function at 0x46d410
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub esp, 0x12c
test dl, dl
jne 0x46d432
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x46d4e6
mov al, 1
add esp, 0x12c
ret
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x24]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d450
sub ecx, edx
je 0x46d466
cmp byte [esp + ecx + 0x23], 0x5c
jne 0x46d466
mov byte [esp + ecx + 0x23], al
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46d4e6
test al, 0x10
je 0x46d4e6
lea ecx, [esp + 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d481
sub ecx, edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x12], 0
mov byte [esp + ecx + 0x25], al
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x10], ax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
sete al
add esp, 0x12c
ret
xor al, al
add esp, 0x12c
ret
Function at 0x46d980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x148
push esi
mov esi, ecx
push 0x2a
push esi
call fcn.004b87b6
add esp, 8
test eax, eax
jne 0x46d9bd
push 0x3f
push esi
call fcn.004b87b6
add esp, 8
test eax, eax
jne 0x46d9bd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46d9ce
mov al, 1
pop esi
add esp, 0x148
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x46d9d8
xor al, al
pop esi
add esp, 0x148
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
add esp, 0x148
ret

Function at 0x46d9f0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x46da63
lea eax, [esp + 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0
push dword [esp + 0x18]
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46da63
push eax
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x46da63
mov al, 1
pop esi
add esp, 0x14
ret
xor al, al
pop esi
add esp, 0x14
ret
Function at 0x46da70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x554
push ebx
push ebp
push esi
push edi
push 0
mov ebx, ecx
mov dword [esp + 0x1c], 0x128
push 2
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32First]
push 0
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.0049df30
add esp, 0xc
test eax, eax
je 0x46db16
mov ecx, ebx
mov al, byte [ecx]
cmp al, 0x20
je 0x46dac2
cmp al, 9
jne 0x46dac5
inc ecx
jmp 0x46dab8
test al, al
je 0x46db09
cmp al, 0x2d
je 0x46dad1
cmp al, 0x2b
jne 0x46dad8
lea eax, [ecx + 1]
mov ecx, eax
mov al, byte [eax]
cmp al, 0x30
jne 0x46db09
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x46dae7
cmp al, 0x58
jne 0x46db09
movsx eax, byte [ecx + 2]
push eax
call fcn.004b99b0
add esp, 4
test eax, eax
je 0x46db09
push 0x10
push 0
push ebx
call fcn.004b9a3b
add esp, 0xc
mov ebx, eax
jmp 0x46db18
push ebx
call fcn.004b94ac
add esp, 4
mov ebx, eax
jmp 0x46db18
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x46dbc7
nop dword [eax]
test ebx, ebx
je 0x46db3e
cmp ebx, dword [esp + 0x20]
je 0x46dbdb
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0x144]
push eax
lea eax, [esp + 0x358]
push eax
lea eax, [esp + 0x464]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004bf710
lea eax, [esp + 0x25c]
add esp, 0x14
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46db74
lea edi, [esp + 0x140]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x46db85
push dword [esp + 0x14]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x144]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004b626e
add esp, 8
test eax, eax
je 0x46dbef
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x46db30
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
Function at 0x4836d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x4838bf
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
je 0x483755
xor ebx, ebx
mov eax, dword [esi + 0x18]
add eax, ebx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x483715
cmp byte [eax + 4], 6
je 0x483715
push str.Submit
push eax
push ecx
mov ecx, esi
call fcn.00483970
jmp 0x48374a
cmp dword [eax + 0x3c], 0
je 0x48374a
cmp byte [eax + 4], 6
je 0x48374a
mov ecx, dword [esi + 0xd4]
push 0x4d5231
test ecx, ecx
jne 0x483741
push str.No_object_to_invoke.
mov ecx, 0x4ed830
call fcn.0043ed90
jmp 0x48374a
push eax
push ecx
mov ecx, esi
call fcn.00484460
mov eax, dword [esi + 0x10]
inc edi
add ebx, 0x40
cmp edi, eax
jb 0x4836f3
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ebx
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov ebx, ecx
mov dword [esp + 0x1c], ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
je 0x483794
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0x18]
push 0xfffffffffffffff0
push dword [eax + ecx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x4837e7
mov edx, dword [esp + 0x10]
cmp edi, 1
jne 0x4837c8
cmp edx, edi
jle 0x4837c8
push 0xa
lea eax, [esp + 0x2c]
push eax
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
push eax
call fcn.004b6198
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x34]
add esp, 0xc
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.004a2730
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0x10]
je 0x4838ae
xor edi, edi
mov dword [esp + 0x14], 0
xor ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x4837eb
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add edx, dword [esi + 0x18]
cmp byte [edx + 4], 6
jne 0x48388d
mov ebx, dword [edx + 8]
inc ecx
test ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, ebx
cmove eax, dword [esp + 0xc]
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
lea eax, [edi + 1]
push 0
cmove eax, edi
push 0xf0
push dword [edx]
mov edi, eax
mov dword [esp + 0x30], edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x483863
cmp dword [esp + 0x14], 0
mov ecx, 0xffffffff
mov eax, dword [esp + 0x10]
cmovne eax, ecx
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x48388d
push 1
push 0
push ecx
push 0x4d9c00
mov ecx, ebx
call fcn.004a2730
jmp 0x48388d
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x48388d
push 1
push 0
push 0xffffffffffffffff
push 0x4d5290
mov ecx, ebx
call fcn.004a2730
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x1c]
add dword [esp + 0x18], 0x40
inc ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jbe 0x483775
cmp byte [ebp + 8], 0
je 0x4838bf
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x487a60
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
mov al, byte [esi]
test al, al
je 0x487a8f
nop dword [eax]
cmp al, 0x21
je 0x487a84
cmp al, 0x2b
je 0x487a80
cmp al, 0x5e
jne 0x487a8f
mov al, 2
jmp 0x487a86
mov al, 1
jmp 0x487a86
mov al, 4
inc esi
or bl, al
mov al, byte [esi]
test al, al
jne 0x487a70
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00415c70
mov bh, al
add esp, 0xc
test bh, bh
jne 0x487ab2
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
mov ecx, esi
call fcn.00415b80
movzx edx, ax
test dx, dx
jne 0x487acf
xor dl, dl
mov cl, bh
call fcn.00416230
movzx edx, ax
mov al, bl
or al, 8
and edx, 0x100
movzx ecx, al
movzx eax, bl
cmove ecx, eax
movzx eax, cl
movzx ecx, bh
shl ax, 8
pop esi
or ax, cx
pop ebx
ret
Function at 0x489110
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 8], CreateStatusWindowA
movzx eax, byte [esi + 4]
add eax, 0xfffffff7
cmp eax, 8
ja case.0x489136.12
jmp dword [eax*4 + 0x48922c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push dword [esi]
call edi
cmp eax, 0xffffffff
je case.0x489136.12
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push dword [esi]
call edi
jmp case.0x489136.12
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
cmp eax, 0xffffffff
je case.0x489136.12
lea ecx, [esp + 8]
mov dword [esp + 8], 2
push ecx
push eax
push 0x100e
push dword [esi]
call edi
jmp case.0x489136.12
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push dword [esi]
call edi
test eax, eax
je case.0x489136.12
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 1
push 0x1104
push dword [esi]
call edi
jmp case.0x489136.12
lea eax, [esp + 8]
push eax
push 0
push 0x419
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 8], 0x80000000
lea ecx, [esp + 8]
mov eax, dword [esi]
jne 0x4891f6
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x489202
push 2
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
pop edi
mov dword [esi], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
cdq
sub eax, edx
sar eax, 1
add eax, 2
add eax, dword [esp + 8]
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x489730
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], edx
mov esi, ecx
nop dword [eax]
mov al, byte [esi]
cmp al, 0x20
je 0x48974a
cmp al, 9
jne 0x48974d
inc esi
jmp 0x489740
test al, al
je 0x4898a5
cmp byte [esi + 1], 0
lea ecx, [esi + 1]
jne 0x489772
pop edi
pop esi
movzx eax, al
pop ebp
mov word [edx + 2], ax
mov al, 1
mov byte [edx], 0
pop ebx
add esp, 8
ret
push 0x2b
xor bl, bl
mov byte [edx], 1
push ecx
mov byte [esp + 0x1b], bl
call fcn.004b87b6
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x48982d
lea edi, [ebp - 1]
cmp edi, esi
jbe 0x4897a6
mov al, byte [edi]
cmp al, 0x20
je 0x4897a1
cmp al, 9
jne 0x4897a6
dec edi
cmp edi, esi
ja 0x489797
sub edi, esi
inc edi
push edi
push str.Ctrl
push esi
call fcn.004b653e
add esp, 0xc
test eax, eax
jne 0x4897c1
or bl, 1
jmp 0x4897f3
push edi
push 0x4d63c0
push esi
call fcn.004b653e
add esp, 0xc
test eax, eax
jne 0x4897d9
or bl, 4
jmp 0x4897f3
push edi
push str.Shift
push esi
call fcn.004b653e
add esp, 0xc
test eax, eax
jne 0x4898a5
or bl, 0x10
mov byte [esp + 0x13], bl
lea esi, [ebp + 1]
nop word [eax + eax]
mov al, byte [esi]
cmp al, 0x20
je 0x48980a
cmp al, 9
jne 0x48980d
inc esi
jmp 0x489800
test al, al
je 0x4898a5
lea eax, [esi + 1]
push 0x2b
push eax
call fcn.004b87b6
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x489790
cmp byte [esi + 1], 0
push 0
jne 0x48985e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, byte [esi]
mov edi, eax
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
push 1
push edi
lea edx, [esp + 0x1b]
mov cl, al
call fcn.00415d80
mov bl, byte [esp + 0x1b]
add esp, 8
jmp 0x489874
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00415c70
add esp, 0xc
movzx ecx, al
mov eax, dword [esp + 0x14]
mov word [eax + 2], cx
test bl, 1
je 0x489887
or byte [eax], 8
test bl, 4
je 0x48988f
or byte [eax], 0x10
test bl, 0x10
je 0x489897
or byte [eax], 4
pop edi
pop esi
test cx, cx
pop ebp
setne al
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret