joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a2f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40a30d
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x40e
xor ebx, ebx
lea ecx, [ebp - 0x562]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x564], ax
call fcn.004c9b50
push 0x40
xor eax, eax
lea edx, [ebp - 0x50]
push ebx
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x44
call fcn.004c9b50
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x7ffe
push eax
add esi, 0x1c50
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x564]
push str.__s___DEBUGPID_u__BW80__BH25__BZ_u
push eax
call esi
add esp, 0x14
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push ebx
push ebx
push 0x30
push ebx
push ebx
push ebx
lea eax, [ebp - 0x564]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a3cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x154]
push str.Cant_create_debugger_console__ErrCode0x_08X
push ecx
call esi
push 1
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x154]
push 0x40
push edx
call fcn.004262f0
add esp, 0x20
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x52fe40], 1
cmp eax, ebx
je 0x40a3ef
cmp eax, 0xffffffff
je 0x40a3ef
push eax
mov dword [ebp - 0x10], ebx
call esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x40a401
cmp eax, 0xffffffff
je 0x40a401
push eax
mov dword [ebp - 0xc], ebx
call esi
mov bl, 1
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40aad0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x52fe30]
test byte [eax + 0x11629], 1
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
jne 0x40ab2d
mov ecx, dword [0x52fe34]
cmp byte [ecx + 0x125fa], 1
jbe 0x40ac66
test ebx, ebx
je 0x40ac66
mov ecx, dword [ebx + 0x40b0]
test ecx, ecx
je 0x40ac66
push 1
push 0
push 1
push str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_isMonitorConsoleLang0
call fcn.004c77f0
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push 0x50
lea edx, [ebp - 0x54]
push 0
push edx
call fcn.004c9b50
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0x14
xor esi, esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, dword [ebp + 8]
xor ecx, ecx
cmp ecx, eax
jae 0x40ab66
cmp dword [ebp + ecx*4 - 0x54], edi
jne 0x40ab61
mov esi, 1
inc ecx
test esi, esi
je 0x40ab52
xor edx, edx
test esi, esi
jne 0x40aba7
lea esp, [esp]
cmp edx, eax
jae 0x40ab95
mov ecx, dword [ebp + edx*4 - 0x54]
mov ebx, ecx
xor ebx, edi
test ebx, 0xffff
jne 0x40ab8b
mov esi, 1
mov edi, ecx
mov ebx, dword [ebp - 4]
inc edx
test esi, esi
je 0x40ab70
jmp 0x40aba7
test esi, esi
jne 0x40aba7
movzx ecx, di
cmp edi, ecx
jne 0x40aba7
mov edx, edi
shl edx, 0x10
or edi, edx
mov eax, dword [ebx + 0x78b8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp edi, eax
je 0x40ac24
mov ecx, dword [0x52fe34]
cmp byte [ecx + 0x125fa], 1
jbe 0x40abf9
push edi
lea edx, [ebp - 0x254]
push str.CConEmuMain::SwitchKeyboardLayout__posting_WM_INPUTLANGCHANGEREQUEST__WM_INPUTLANGCHANGE_for_0x_08X
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebx + 0x40b0]
add esp, 0xc
test ecx, ecx
je 0x40abf9
push 1
push 0
push 1
lea eax, [ebp - 0x254]
push eax
call fcn.004c77f0
mov ecx, dword [0x52fe14]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push edi
push 0
push 0x50
push ecx
call esi
mov edx, dword [0x52fe14]
push edi
push 0
push 0x51
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 1
jbe 0x40ac64
push edi
lea ecx, [ebp - 0x254]
push str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_GetActiveKeyboardLayout__0x_08X
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebx + 0x40b0]
add esp, 0xc
test ecx, ecx
je 0x40ac64
push 1
push 0
push 1
lea edx, [ebp - 0x254]
push edx
call fcn.004c77f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b370
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52fe14]
sub esp, 0x2c
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
push eax
mov esi, ecx
call edi
test eax, eax
jne 0x40b394
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x52fe14]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x40b38c
mov edx, dword [0x52fe30]
cmp byte [edx + 0x1220], al
je 0x40b3c0
cmp byte [esi + 0x40ee], al
jne 0x40b38c
cmp byte [esi + 0x4090], 0
jne 0x40b3d5
mov eax, dword [0x52fe14]
push eax
call edi
test eax, eax
je 0x40b38c
mov edx, dword [0x52fe14]
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
push edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x40b38c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push ebx
mov edi, eax
mov ebx, edx
sub ebx, esi
sub edi, ecx
imul edi, ebx
xor ebx, ebx
cmp edi, ebx
jg 0x40b429
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push eax
push edx
push ecx
push esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 2
call dword [sym.imp.GDI32.dll_CreateRectRgn]
lea ecx, [ebp - 0x2c]
push ecx
push 0x40b240
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x18], 1
mov esi, 0x64
jne 0x40b47b
mov eax, dword [ebp - 0x1c]
push eax
xor esi, esi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1c]
push ebx
push ebx
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
mov ebx, eax
cmp ebx, 4
jbe 0x40b4fd
push 1
push ebx
call fcn.0044c490
add esp, 8
mov esi, eax
push esi
mov dword [esi], 0x20
mov eax, dword [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
test eax, eax
je 0x40b4df
cmp dword [esi + 4], 1
jne 0x40b4df
cmp dword [esi + 8], 0
jbe 0x40b4df
mov ecx, dword [esi + 8]
lea eax, [esi + 0x24]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
sub edx, dword [eax - 4]
sub ebx, dword [eax]
add eax, 0x10
imul edx, ebx
add dword [ebp - 4], edx
sub ecx, 1
jne 0x40b4c6
push esi
call fcn.0044c4f0
mov eax, dword [ebp - 4]
imul eax, eax, 0x64
cdq
idiv edi
add esp, 4
mov esi, eax
cmp esi, 0x64
jbe 0x40b4fd
mov esi, 0x64
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bcb0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d8bc8
push eax
mov dword fs:[0], esp
mov eax, dword [0x52fe34]
sub esp, 0x224
cmp byte [eax + 0x125fa], 1
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
jbe 0x40bd31
cmp dword [ebp + 8], 0x51
mov eax, str.WM_INPUTLANGCHANGE
je 0x40bcf4
mov eax, str.WM_INPUTLANGCHANGEREQUEST
mov ecx, dword [ebp + 0xc]
push 0
push ebx
push ecx
push eax
lea edx, [ebp - 0x230]
push str.CConEmuMain::OnLangChange:__s_CP:_i__HKL:0x_08I64X_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test edi, edi
je 0x40bd31
mov ecx, dword [edi + 0x40b0]
test ecx, ecx
je 0x40bd31
push 1
push 0
push 1
lea eax, [ebp - 0x230]
push eax
call fcn.004c77f0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [0x52fe14]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x24]
xor ecx, ecx
push edx
mov word [ebp - 0x24], cx
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x10
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
push edx
mov dword [ebp + 0x10], eax
call fcn.004c9edf
add esp, 0xc
or esi, 0xffffffff
xor ecx, ecx
lea edx, [edi + 0x556c]
lea ebx, [ebx]
cmp dword [edx - 4], 0
jne 0x40bd9f
cmp esi, 0xffffffff
jne 0x40bda3
mov esi, ecx
jmp 0x40bda3
cmp dword [edx], eax
je 0x40bdbb
inc ecx
add edx, 0xc
cmp ecx, 0x14
jl 0x40bd90
cmp esi, 0xffffffff
je 0x40bdbb
push ebx
push eax
push esi
mov ecx, edi
call fcn.0040bbc0
mov esi, dword [ebp + 8]
cmp esi, 0x50
je 0x40bdc8
cmp esi, 0x51
jne 0x40be42
lea ecx, [ebp - 0x30]
call fcn.004bc8c0
lea eax, [ebp - 0x30]
push 0
push eax
mov dword [ebp - 4], 0
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x40be27
lea ecx, [ebp - 0x30]
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc80
test eax, eax
je 0x40be27
cmp dword [0x52fd9c], 0x50
jne 0x40be12
cmp esi, 0x51
jne 0x40be12
cmp dword [0x52fd98], ebx
je 0x40be27
xor ecx, ecx
cmp esi, 0x50
setne cl
push ebx
dec ecx
and ecx, dword [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0048be10
lea ecx, [ebp - 0x30]
mov dword [0x52fd9c], esi
mov dword [0x52fd98], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
mov ecx, dword [edi + 0x40a8]
mov dword [edi + 0x5564], ebx
call fcn.004a42a0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x410dde
cmp word [esi], 0x40
jne 0x410dde
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea ebx, [esi + 2]
push 0x100000
push ebx
mov dword [ebp - 8], edi
mov dword [ebp + 8], edi
call fcn.004c6fc0
add esp, 0x18
cmp eax, 0xffffffff
jne 0x410d2e
lea ecx, [ebp - 0x418]
push ecx
xor eax, eax
push 0x208
mov word [ebp - 0x418], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410c93
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x418]
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410cb0
sub eax, esi
sar eax, 1
lea edi, [eax + edx + 0x64]
push 2
push edi
call fcn.0044c490
add esp, 8
push str.Cant_open_console_batch_file:_n
mov esi, eax
push edi
push esi
call fcn.00401730
push ebx
push edi
push esi
call fcn.004017b0
push 0x4e777c
push edi
push esi
call fcn.004017b0
lea edx, [ebp - 0x418]
push edx
push edi
push esi
call fcn.004017b0
push 0x4e7778
push edi
push esi
call fcn.004017b0
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push eax
push esi
call fcn.004263e0
push esi
call fcn.0044c4f0
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xfffffffe
jne 0x410d89
mov eax, esi
lea edx, [eax + 2]
jmp 0x410d40
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410d40
sub eax, edx
sar eax, 1
add eax, 0x64
push 2
push eax
call fcn.0044c490
add esp, 8
mov esi, eax
push str.Console_batch_file_is_too_large_or_empty:_n
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push esi
call edi
push 0x4e7778
push esi
call edi
mov ecx, dword [ebp + 8]
push 0
push 0
push 0
push ecx
jmp 0x410d14
cmp eax, edi
jge 0x410dde
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410d92
sub eax, edx
sar eax, 1
add eax, 0x64
push 2
push eax
call fcn.0044c490
add esp, 8
mov esi, eax
push str.Reading_console_batch_file_failed:_n
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push esi
call edi
push 0x4e7778
push esi
call edi
mov edx, dword [ebp + 8]
push 0
push 0
push 0
push edx
jmp 0x410d14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4115a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x20]
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x24]
mov eax, 0xc3ee
and word [esi + 0x4148], ax
mov eax, dword [ebp + 0x1c]
push edx
push eax
mov byte [esi + 0x414b], 0
mov dword [esi + 0x4152], ecx
call fcn.00425040
mov ebx, dword [ebp + 8]
add esp, 8
mov ecx, ebx
mov dword [esi + 0x414e], eax
call fcn.004bcc80
test eax, eax
jne 0x4115f2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x24]
push edi
push ecx
mov ecx, esi
call fcn.0040c9a0
mov edi, eax
test edi, edi
je 0x4116c4
cmp edi, 1
jne 0x41161b
mov edx, 0x400
or word [esi + 0x4148], dx
jmp 0x41163f
cmp edi, 2
jne 0x41162e
mov eax, 0x800
or word [esi + 0x4148], ax
jmp 0x41163f
cmp edi, 3
jne 0x41163f
mov ecx, 0x1000
or word [esi + 0x4148], cx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
jne 0x41167f
mov edx, 0x2000
or word [esi + 0x4148], dx
cmp edi, 2
jne 0x41166e
push str.__If___APanel.Left__Tab__End
jmp 0x411678
cmp edi, 3
jne 0x41167f
push str.__If__APanel.Left__Tab__End
mov ecx, esi
call fcn.0040f840
mov ecx, dword [esi + 0x4152]
mov eax, 2
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [ebp - 0x18], eax
push eax
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
push edx
mov ecx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 1
call fcn.004bcc80
mov ecx, eax
call fcn.0048d7e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.004b6da0
test al, al
jne 0x4117a8
push 0
call fcn.004b6f20
add esp, 4
test al, al
je 0x4117a8
test ebx, ebx
je 0x4117a8
mov eax, dword [esi + 0x4152]
push 0
push eax
mov ecx, ebx
call fcn.004bcc80
mov ecx, eax
call fcn.0048ca40
test eax, eax
je 0x4117a8
mov edi, dword [ebp + 0x18]
movsx ecx, di
mov edx, edi
mov dword [esi + 0x47f8], ecx
shr edx, 0x10
movsx eax, dx
push 0
lea ecx, [ebp - 8]
push ecx
mov ecx, ebx
mov dword [esi + 0x47fc], eax
call fcn.004bcc80
mov ecx, eax
call fcn.00489180
cmp dword [ebp - 4], 0
je 0x41176f
cmp dword [ebp - 8], 0
jbe 0x41176f
mov ecx, dword [0x52fe30]
test byte [ecx + 0x11289], 1
je 0x41176f
push 1
push 0x7db
call fcn.00453860
test al, al
je 0x41176f
mov edx, 1
mov word [esi + 0x4148], dx
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
push 0
push 0
push ecx
push edx
push eax
mov dword [esi + 0x417c], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, ebx
mov dword [esi + 0x4180], edi
call fcn.004bcc80
mov ecx, eax
call fcn.00492af0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x20
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x412e90
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
xor bl, bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
push 0
push str.Shell_TrayWnd
push 0
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_FindWindowExW]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ecx
cmp edi, ecx
je 0x412f15
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x412f12
mov eax, dword [ebp - 4]
test eax, eax
je 0x412f12
cmp byte [esi + 0x5c], bl
sete cl
movzx edx, cl
push edx
push 0
push eax
push edi
mov ecx, esi
call fcn.00412ab0
mov bl, al
test bl, bl
jne 0x412f92
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x412f53
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x412f53
mov eax, dword [ebp - 8]
test eax, eax
je 0x412f53
cmp eax, dword [ebp - 4]
je 0x412f53
cmp byte [esi + 0x5c], 0
sete dl
movzx ecx, dl
mov edx, dword [ebp - 0x10]
push ecx
push 0
push eax
push edx
mov ecx, esi
call fcn.00412ab0
mov bl, al
test bl, bl
jne 0x412f92
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x412f92
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x412f92
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x412f92
cmp eax, dword [ebp - 8]
je 0x412f92
cmp eax, dword [ebp - 4]
je 0x412f92
cmp byte [esi + 0x5c], 0
sete cl
movzx edx, cl
push edx
push 0
push eax
push edi
mov ecx, esi
call fcn.00412ab0
mov bl, al
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x412fd1
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x412fd1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x412fd1
cmp ecx, dword [ebp - 4]
je 0x412fd1
cmp ecx, dword [ebp - 0xc]
je 0x412fd1
cmp ecx, dword [ebp - 8]
je 0x412fd1
push 1
push 0
push ecx
push edi
mov ecx, esi
call fcn.00412ab0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412fe0
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x824
push esi
push edi
mov edi, ecx
test eax, eax
je 0x413021
movzx ecx, word [eax]
cmp cx, 0x3a
je 0x413021
test cx, cx
je 0x41318d
push eax
lea esi, [edi + 0x7d2]
push esi
call fcn.004128d0
push esi
call fcn.004259c0
add esp, 0xc
jmp 0x41318d
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004c9b50
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41306d
cmp eax, 0x104
ja 0x41306d
lea eax, [ebp - 0x20c]
push eax
call fcn.004259c0
add esp, 4
jmp 0x413076
xor ecx, ecx
mov word [ebp - 0x20c], cx
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.004c9b50
add esp, 0xc
push 0xfa
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4130b9
lea edx, [ebp - 0x414]
push edx
call fcn.004259c0
add esp, 4
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call fcn.00405470
add esp, 8
push str._system32
push 0x104
lea edx, [ebp - 0x61c]
push edx
call fcn.004017b0
cmp word [ebp - 0x20c], 0
je 0x413131
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call esi
test eax, eax
je 0x413131
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x413131
lea ecx, [edi + 0x3be]
push ecx
lea edx, [ebp - 0x20c]
push edx
call esi
test eax, eax
jne 0x413177
push 0
push 0x28
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x413157
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004259c0
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x413177
lea edx, [edi + 0x3be]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004128d0
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [edi + 0x7d2]
push edx
call fcn.004128d0
add esp, 8
push 0x104
lea eax, [ebp - 0x824]
push eax
add edi, 0x7d2
push edi
call fcn.00406cf0
add esp, 0xc
push eax
push str.ConEmuWorkDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x415c80
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x52fe14]
push esi
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
setne al
test al, al
jne 0x415cc8
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1220], al
je 0x415cae
cmp byte [esi + 0x40ee], al
jne 0x415cc8
cmp byte [esi + 0x4090], 0
jne 0x415d18
mov edx, dword [0x52fe14]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x415d18
push 0
mov ecx, esi
call fcn.00409f20
mov eax, dword [esi + 0x7884]
test eax, eax
je 0x415d16
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x7884], 0
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 0
je 0x415d16
mov ecx, dword [esi + 0x40b0]
test ecx, ecx
je 0x415d16
push 0
push 1
push 0
push 1
push str.CConEmuMain::UnRegisterHooks___done
call fcn.004c87c0
pop esi
ret
push 1
mov ecx, esi
call fcn.00409f20
cmp dword [esi + 0x7884], 0
jne 0x415d16
mov ecx, esi
pop esi
jmp fcn.0040f9c0

Function at 0x416260
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9408
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x78b8]
je 0x4162b3
mov eax, dword [edi + 0x78e0]
mov ecx, dword [0x52fe14]
push 0
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
cmp word [edi + 0x53e8], si
lea eax, [edi + 0x53e8]
je 0x4162ed
push 0x4c0
lea esi, [edi + 0x4a68]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4162e3
cmp eax, 0x4c0
jb 0x4162e9
lea esi, [edi + 0x154]
test esi, esi
jne 0x416358
lea ecx, [ebp - 0x18]
call fcn.004bc8c0
lea edx, [ebp - 0x18]
push 0
push edx
mov dword [ebp - 4], 0
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x41633b
lea ecx, [ebp - 0x18]
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc80
test eax, eax
je 0x41633b
push 0
lea ecx, [ebp - 0x18]
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc80
mov ecx, eax
call fcn.0048ec50
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
test esi, esi
jne 0x416358
lea esi, [edi + 0x154]
test esi, esi
je 0x41637d
push ebx
lea ebx, [edi + 0x4a68]
cmp esi, ebx
je 0x41637c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41637c
push 0x4c0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop ebx
mov ecx, edi
call fcn.004106d0
mov ecx, 0x532a10
call fcn.004ae0e0
call fcn.004b8600
mov ecx, dword [ebp - 0xc]
pop esi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret