joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485d2c
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x485d80
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x485d6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x485d7a
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x485d3f
jmp 0x485d7e
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc

Function at 0x485e97
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0xb42710]
call fcn.004aa9b6
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x485f97
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x485eed
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x485ee5
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x485f2d
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x485f6f
push 0x22
pop edx
cmp cx, dx
je 0x485f1f
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x485f0f
xor ecx, ecx
cmp word [eax], cx
je 0x485f6f
mov ecx, eax
add eax, 2
jmp 0x485f71
test dx, dx
je 0x485f77
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x485f1f
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x485f65
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x485f6f
cmp cx, dx
je 0x485f62
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x485f52
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x485f37
jmp 0x485f1f
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x485f79
xor edx, edx
cmp dword [ebp], ebx
jne 0x485f82
test edi, edi
jne 0x485f9f
test edx, edx
je 0x485f87
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x485edb
test edi, edi
jne 0x485fb0
mov eax, ebx
jmp 0x485fb4
test esi, esi
je 0x485fb0
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x485fb4
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x48601d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x4860dc
cmp dword [esp + 0x24], 2
je 0x4860dc
push 0x2000
push ebp
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x4860ab
cmp dword [esp + 0x18], 2
jne 0x4860c7
cmp dword [esp + 0x28], 0xffffffff
je 0x48606f
cmp ebp, dword [esp + 0x28]
jae 0x4860c7
add ebp, 2
test ebx, ebx
jne 0x486094
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x4860c7
cmp ax, 0xd
je 0x4860ab
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48605b
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.005325c0
jmp 0x48616e
push eax
push 0
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x4860fa
cmp ebp, dword [esp + 0x28]
jae 0x486152
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x486152
cmp dword [esp + 0x18], 1
jne 0x486152
inc ebp
test ebx, ebx
jne 0x48613f
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x486152
cmp al, 0xd
je 0x4860ed
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x4860ed
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x486169
call fcn.00532610
jmp 0x48616e
call fcn.00532560
push esi
push 0
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x487143
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
push ebp
xor ebp, ebp
push edi
cmp dword [eax + 8], 1
mov edi, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 8], ebp
jne 0x4872e2
push esi
mov esi, dword [esp + 0x48]
test esi, esi
je 0x4872e1
push ebx
push ebp
push pe_nt_image_headers32
push 3
push ebp
push 7
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4872e0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x200000
push ebp
push dword [0xb3fee4]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4872d9
call fcn.004c10c0
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x4872c6
lea eax, [esp + 0x20]
push eax
push esi
call sub.MSVCRT.dll__wstat
push 0x1a4
push edi
call fcn.004c1590
lea eax, [esp + 0x30]
push eax
push edi
call fcn.004c1710
mov esi, dword [esp + 0x60]
add esp, 0x18
mov eax, dword [esi + 0x20]
cmp dword [eax + 8], 1
je 0x487212
cmp dword [eax + 8], 3
je 0x487212
push dword [esp + 0x50]
push edi
call fcn.004c0e60
pop ecx
pop ecx
jmp 0x487230
push dword [esp + 0x50]
call fcn.005324d0
mov esi, eax
push esi
push edi
call fcn.004c1580
pop ecx
pop ecx
push esi
call fcn.005324c0
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
cdq
push edx
push eax
push edi
call fcn.004c15e0
push 0x8000
push edi
call fcn.004c1430
push edi
push dword [esi]
call fcn.004c1880
add esp, 0x1c
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jle 0x4872ad
mov edi, dword [esp + 0x10]
push eax
push ebp
push dword [esi]
call fcn.004c1840
add esp, 0xc
cmp eax, dword [esp + 0x4c]
jne 0x4872a5
add edi, dword [esp + 0x4c]
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jg 0x487273
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], eax
jne 0x4872bf
mov dword [esp + 0x18], 1
push edi
call fcn.004c0ff0
pop ecx
push ebp
push 0
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x34
ret 0xc

Function at 0x48739c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x4873fe
cmp word [esi], di
je 0x4873fe
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004c2290
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.004c24a0
add esp, 0x10
test eax, eax
jne 0x4873fd
push 0x24
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x489024
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push ebx
push edi
push dword [0xb4276c]
xor edi, edi
call fcn.004aa9b6
mov ebx, eax
cmp dword [esp + 0x10], edi
je 0x489118
push ebp
push esi
push 0x60
push 8
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x18]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call sub.MSVCRT.dll__wcsdup
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov ebx, dword [esp + 0x20]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x489106
test ebx, ebx
je 0x4890d0
push ebx
push edi
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x48], eax
test eax, eax
je 0x4890cb
push ebx
push dword [esp + 0x20]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x4890fd
lea eax, [esp + 0x18]
push eax
push edi
push esi
push 0x48911f
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4890f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4890f9
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x489114
push esi
call fcn.00488b4b
pop ecx
jmp 0x489116
mov eax, dword [esp + 0x1c]
push esi
mov dword [esi + 0x48], eax
call fcn.00488bff
pop ecx
mov edi, esi
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret 0x18
Function at 0x48972a
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
push 0x489679
push 0x10
push 0x2c
call fcn.004aabfa
xor esi, esi
mov dword [0xb40e10], eax
push esi
push esi
push 8
call fcn.004aaa21
mov dword [0xb42774], eax
cmp word [0xb40e08], si
jne 0x489813
push edi
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x489782
mov word [0xb40e08], di
jmp 0x48978a
xor eax, eax
mov word [0xb40e08], ax
push 0x800
push esi
push 0x54c368
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0xb40e24], eax
test eax, eax
je 0x489812
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x54c380
push eax
call esi
push 0x54c38c
push dword [0xb40e24]
mov dword [0xb40e14], eax
call esi
push 0x54c39c
push dword [0xb40e24]
mov dword [0xb40e18], eax
call esi
push 0x54c3a8
push dword [0xb40e24]
mov dword [0xb40e1c], eax
call esi
cmp dword [0xb40e14], 0
mov dword [0xb40e20], eax
je 0x489812
cmp dword [0xb40e18], 0
je 0x489812
cmp dword [0xb40e1c], 0
je 0x489812
test eax, eax
je 0x489812
mov dword [0xb40e0c], edi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x489951
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0xb42380]
call fcn.004aab27
mov ebx, eax
test ebx, ebx
je 0x4899b5
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x48997a
push dword [esp + 0xc]
push ebx
call eax
jmp 0x4899b5
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004ac2a0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004ac3b0
pop edi
pop esi
pop ebx
ret 8

Function at 0x48a7a6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x48a818
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x48a7cf
mov ebx, eax
push dword [ebp]
call fcn.00489f28
push ebx
push dword [ebp]
mov edi, eax
call fcn.00489eff
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebp]
call fcn.0048a838
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x48c3a7
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0xb4277c]
call fcn.004aa9b6
xor ebp, ebp
mov esi, eax
cmp dword [0xb411a0], ebp
jne 0x48c483
xor ebx, ebx
inc ebx
mov dword [0xb411a0], ebx
call fcn.00490c8a
mov edi, 0xa4
push edi
push ebp
push 0xb411a8
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0xb411a8], 0x13
lea eax, [esp + 0x10]
mov dword [0xb411ac], edi
mov dword [0xb411b8], 0x48c2f2
mov dword [0xb411bc], 0x48c63d
push eax
mov dword [0xb41210], 0x48c2cd
mov dword [0xb41214], 0x48c588
mov dword [0xb411b4], 0x48c2a8
mov dword [0xb41238], 0x48c30d
mov dword [0xb4124c], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48c483
cmp dword [esp + 0x20], ebx
je 0x48c46b
cmp dword [esp + 0x20], 2
jne 0x48c483
cmp dword [esp + 0x14], 5
jae 0x48c473
mov dword [0xb4124c], ebp
jmp 0x48c483
jne 0x48c483
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0xb4124c], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00495c66
mov eax, dword [esp + 0x140]
push ebp
push dword [0xb3fee8]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push 0x54c458
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x48c559
push dword [esp + 0x128]
push dword [0xb42380]
call fcn.004aab66
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x48c528
push edi
call fcn.004a3daa
test eax, eax
je 0x48c528
push ebp
push ebp
push edi
call fcn.004a3968
mov dword [esi + 0x18], eax
jmp 0x48c52b
mov dword [esi + 0x18], ebp
push 0x48bff7
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xb411a8
push ebx
push esi
push dword [esp + 0x134]
mov dword [0xb411a4], eax
call fcn.00490e65
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x48dc7d
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0xb4277c]
call fcn.004aa9b6
xor ebx, ebx
mov ebp, eax
cmp dword [0xb41480], ebx
jne 0x48dd11
mov esi, 0xa4
push esi
push ebx
push 0xb41488
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0xb4148c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0xb41488], 0xa
mov dword [0xb41490], 0x48d812
push 0x7f89
push ebx
mov dword [0xb41500], 0x490f52
mov dword [0xb41504], 0x490f2c
mov dword [0xb41494], 0x48d831
mov dword [0xb41518], 0x48d851
call esi
mov dword [0xb41480], eax
test eax, eax
jne 0x48dd11
push 0x7f00
push ebx
call esi
mov dword [0xb41480], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00495c66
push ebx
push dword [0xb3fee8]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push 0x54c3e0
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x48dddd
push edi
push dword [esp + 0x14]
push dword [0xb42380]
call fcn.004aab66
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0xb3fee4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xb41488
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.00490e65
push 0x48d937
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20

Function at 0x48e49b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x48e4b5
inc esi
push 2
call edi
test bx, ax
je 0x48e4c1
or esi, 2
push 4
call edi
test bx, ax
je 0x48e4cd
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x48ea63
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x48ea9b
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.00490fcf
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x48eb8c
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x48eb8c
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x48ebba
test ebp, ebp
jle 0x48ebba
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x48ebba
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x48eb83
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x48eb2d
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x48eb42
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x48ebba
cmp dword [edi + 0x10], ebx
je 0x48eba6
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x48ebba
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.00490fad
cmp dword [esp + 0x10], 0
je 0x48ebd4
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x48ebdc
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00490e36
push eax
call fcn.00491e24
push dword [0xb415f4]
mov dword [esp + 0x24], eax
call fcn.004aacd1
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x48ec50
inc ebx
push 0x12
call esi
test di, ax
je 0x48ec5c
or ebx, 2
push 0x11
call esi
test di, ax
je 0x48ec68
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.0048e49b
push 0x48ecbd
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00494ff0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x491360
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4914d6
mov eax, dword [esp + 0x24]
dec eax
je 0x4914b9
dec eax
jne 0x4914d6
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00491319
pop ecx
test eax, eax
je 0x491417
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x4913da
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x4914b5
dec ebx
je 0x4914b1
dec ebx
je 0x491490
dec ebx
je 0x49144a
sub ebx, 4
jne 0x4914d6
test edi, edi
jne 0x4914d6
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x4914d6
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4913da
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x4913d5
sub edi, 0
je 0x491482
dec edi
je 0x491474
dec edi
je 0x491466
dec edi
jne 0x4914d6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x4914d6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x4914d6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x4914d6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x4914d6
sub edi, 0
je 0x4914ad
dec edi
je 0x4914a9
dec edi
jne 0x4914d6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4914d6
push 0x3c
jmp 0x4914d5
push 0x32
jmp 0x4914d5
push 0x14
jmp 0x4914d5
push 5
jmp 0x4914d5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4914d3
cmp eax, 0xa
je 0x4914cf
cmp eax, 0x5a
jne 0x4914d6
push 0x28
jmp 0x4914d5
push 0x1e
jmp 0x4914d5
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x491e37
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0xb42384]
call fcn.004aab27
mov esi, eax
test esi, esi
je 0x491f11
cmp dword [ebp + 0xc], 0
je 0x491e83
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x491e74
cmp dword [esi + 0x1c], 0
jne 0x491e74
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x491f11
test byte [ebp + 0x10], 3
je 0x491e9e
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.004929aa
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x491ec3
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x491ed7
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x491ef4
test ebx, ebx
je 0x491ee8
push 8
jmp 0x491efa
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x491f07
test ebx, ebx
je 0x491efd
push 3
pop ecx
jmp 0x491f07
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc