joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6080
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push esi
mov esi, eax
mov eax, dword [esp + 0xc]
xor ebp, ebp
mov dword [esi], ebp
mov dword [eax], ebp
call fcn.004d5170
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d612d
mov ecx, dword [0x6923a0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push ecx
call ebx
mov edi, eax
test edi, edi
jne 0x4d60ce
mov edx, dword [0x69239c]
push edx
call ebx
mov edi, eax
test edi, edi
mov dword [esi], 1
je 0x4d6125
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
cmp dword [esi], 8
jne 0x4d611e
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
add esi, 4
mov dword [eax], ecx
sub ebx, 0xc
push 0
mov dword [eax + 4], edx
call fcn.0043ace0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4d611e
mov eax, dword [esp + 0x14]
push ebx
add esi, 8
push esi
push ebp
mov dword [eax], ebx
call fcn.005dffd0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x4d8660
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x218
mov eax, dword [0x67f864]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [esi + 0x14], 0
push ebx
lea ebx, [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4d86de
call edi
sub eax, dword [esi]
cmp eax, 0x3e8
jb 0x4d86de
push 0x7f00
push 0
mov dword [0x692570], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
movzx ecx, word [esi + 4]
push 0x100
lea eax, [esp + 0x1c]
push eax
push ecx
push 0x13
call fcn.0051a1e0
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push edx
push eax
push ebx
lea ebx, [esp + 0x34]
call fcn.004f0cf0
add esp, 0x1c
jmp 0x4d87b6
call edi
sub eax, dword [esi]
cmp eax, 0x1f4
jb 0x4d87b6
call fcn.00589b56
test eax, eax
je 0x4d86ff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
mov ecx, dword [esi + 4]
push 0x7f02
push 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x4d8580
mov dword [0x692570], 1
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x695314], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
je 0x4d874d
cmp ecx, dword [0x695318]
jne 0x4d874d
cmp eax, dword [0x69531c]
je 0x4d879d
cmp dword [0x6930b8], 0
lea edx, [esp + 0xc]
mov dword [0x695314], edx
mov dword [0x695318], ecx
mov dword [0x69531c], eax
mov dword [0x695320], 1
je 0x4d877f
mov ecx, 0x6930a0
call fcn.00454610
lea edi, [esp + 0x14]
call fcn.004ae850
test eax, eax
je 0x4d879d
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
je 0x4d8798
mov eax, ecx
call fcn.004eff70
mov ecx, dword [ebx]
test ecx, ecx
mov dword [esi + 0x10], 1
je 0x4d87b6
mov eax, dword [esp + 0x224]
call fcn.004f0dd0
mov ecx, dword [esp + 0x21c]
mov eax, dword [0x685c04]
pop edi
pop ebx
xor ecx, esp
call fcn.005ce60a
add esp, 0x218
ret
Function at 0x4dfa10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x414
mov eax, dword [0x67f864]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [esp + 0x10], 0
lea esp, [esp]
cmp dword [0x6928c0], 0
jne 0x4dfa74
push 0xa
push 0x80
push 0
call ebx
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], 1
jmp 0x4dfa79
mov eax, dword [0x690b40]
movzx edi, word [esp + 0x10]
movzx esi, word [eax + 0x5c]
movzx eax, di
add esi, eax
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0x1c]
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
cmp word [esp + 0x18], cx
lea eax, [esp + 0x18]
je 0x4dfb71
add eax, 2
add ecx, 1
cmp word [eax], 0
jne 0x4dfab5
test ecx, ecx
je 0x4dfb71
cmp dword [0x6928c0], 0
jne 0x4dfafd
push 0xa
push 0x80
push 0
call ebx
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 2
mov dword [0x690b40], eax
mov dword [0x6928c0], 1
jmp 0x4dfb02
mov eax, dword [0x690b40]
movzx eax, word [eax + 0x5c]
add edi, 1
movzx esi, di
add esi, eax
call fcn.0057ee1a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x100
lea ecx, [esp + 0x21c]
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
movzx eax, word [esp + 0x218]
add dword [esp + 0x10], 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.004e1de0
lea edx, [esp + 0x18]
lea ecx, [edx + 2]
nop
mov si, word [edx]
add edx, 2
test si, si
jne 0x4dfb50
sub edx, ecx
sar edx, 1
push edx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.0044bd60
jmp 0x4dfa40
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005ce60a
add esp, 0x414
ret
Function at 0x4e4de0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x612c64
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67f864]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
test esi, esi
mov dword [esp + 0x18], 0x687a08
jl 0x4e4f49
mov edi, dword [0x687a10]
cmp esi, edi
push 0x687a08
jl 0x4e4e3b
lea ecx, [esi + 1]
call fcn.004e4af0
jmp 0x4e4ed0
lea ecx, [edi + 1]
call fcn.004e4af0
mov eax, edi
imul eax, eax, 0x64
add eax, dword [0x687a0c]
push eax
call fcn.004e0930
mov ecx, dword [0x687a0c]
mov ebx, esi
sub edi, esi
imul ebx, ebx, 0x64
imul edi, edi, 0x64
lea eax, [esi + 1]
imul eax, eax, 0x64
push edi
lea edx, [ebx + ecx]
push edx
add eax, ecx
push edi
push eax
call fcn.005d072d
push eax
call fcn.0044a7b0
mov eax, dword [0x687a0c]
add esp, 0x14
push 0x64
add ebx, eax
push 0
push ebx
call fcn.005d5de0
xor edi, edi
add esp, 0xc
mov dword [esp + 0x34], edi
or ebx, 0xffffffff
mov edi, edi
lea eax, [edi + esi]
imul eax, eax, 0x64
add eax, dword [0x687a0c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
je 0x4e4ec0
push eax
call fcn.004df920
add edi, 1
cmp edi, 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], edi
jl 0x4e4ea0
imul esi, esi, 0x64
add esi, dword [0x687a0c]
lea ecx, [ebp + 0x58]
mov edx, ebp
mov dword [esp + 0x34], ecx
lea eax, [ebp + 0x4c]
mov ecx, esi
sub edx, esi
mov edi, 0x20
mov edi, edi
mov bx, word [edx + ecx]
mov word [ecx], bx
add ecx, 2
sub edi, 1
jne 0x4e4ef0
mov dl, byte [ebp + 0x40]
mov byte [esi + 0x40], dl
mov cl, byte [ebp + 0x41]
mov byte [esi + 0x41], cl
mov dx, word [ebp + 0x42]
mov word [esi + 0x42], dx
mov ecx, dword [ebp + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [ebp + 0x48]
lea ecx, [esi + 0x4c]
mov dword [esi + 0x48], edx
call fcn.004e1b30
mov eax, dword [esp + 0x34]
lea ecx, [esi + 0x58]
call fcn.004e1b30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
call fcn.00574b84
int3

Function at 0x4e9650
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov esi, eax
call edi
test ax, ax
mov eax, dword [0x690ca0]
setge bl
sub bl, 1
lea edx, [esp + 0x14]
and ebx, 0x23
mov byte [esp + 0xf], bl
call fcn.00404050
push 0x12
call edi
test ax, ax
jge 0x4e9690
or bl, 0x10
mov byte [esp + 0xf], bl
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esp + 0x10]
lea ebx, [esp + 0x20]
call fcn.00502410
cmp byte [esp + 0x1c], 0
je 0x4e96d8
mov edx, dword [0x690230]
push 0
push edx
call fcn.004bbac0
mov eax, dword [esp + 0x1c]
add esp, 8
xor edx, edx
call fcn.00404050
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x10]
push eax
mov al, byte [esp + 0x13]
call fcn.004a8470
add esp, 4
push esi
call fcn.00505680
mov eax, dword [esp + 0x14]
xor edx, edx
call fcn.00404050
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4eab90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x60f920
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67f864]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ebx, edx
cmp dword [ebx + 0x54], 0
mov esi, dword [esp + 0x34]
mov dword [ebp], 0
mov dword [esi], 0
je 0x4eac75
push str.License
mov edi, 0x20019
call fcn.004ea880
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x4eac6e
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x34], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], eax
call edi
test eax, eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [edx], ecx
jne 0x4eac54
push ecx
call fcn.0056bb01
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push ebx
push esi
mov dword [ebp], eax
call edi
test eax, eax
jne 0x4eac54
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ead4c
mov eax, dword [ebp]
push eax
call fcn.0056bb06
add esp, 4
push esi
mov dword [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4ead51
mov ecx, dword [esp + 0x2c]
push 0
push ecx
push str.License
lea edx, [esp + 0x40]
push edx
mov ecx, ebx
call fcn.0058d203
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x34]
mov edi, dword [eax - 0xc]
test edi, edi
jne 0x4eaccb
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4eacc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4ead51
mov eax, edi
shr eax, 1
push eax
mov dword [esi], eax
call fcn.0056bb01
add esp, 4
mov ebx, eax
xor esi, esi
test edi, edi
mov dword [ebp], ebx
jle 0x4ead24
lea ecx, [esi + 1]
test ecx, ecx
jl 0x4ead67
mov eax, dword [esp + 0x34]
mov edx, dword [eax - 0xc]
cmp ecx, edx
jg 0x4ead67
test esi, esi
movzx ecx, word [eax + esi*2 + 2]
jl 0x4ead67
cmp esi, edx
jg 0x4ead67
movzx eax, word [eax + esi*2]
sub cl, 1
shl cl, 4
add cl, al
mov eax, esi
cdq
sub eax, edx
sub cl, 0x41
sar eax, 1
add esi, 2
cmp esi, edi
mov byte [eax + ebx], cl
jl 0x4eace5
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ead4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
push 0x80070057
call fcn.0044a870
int3
Function at 0x4eae40
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x54], 0
push ebp
mov ebp, dword [esp + 0x10]
je 0x4eaee1
cmp dword [esp + 0xc], 0
push esi
push edi
jne 0x4eae79
mov eax, 0x2001f
call fcn.004ea7d0
mov esi, eax
test esi, esi
je 0x4eaea4
push str.License
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4eaeca
push str.License
mov edi, 0x2001f
call fcn.004ea880
test ebp, ebp
mov esi, eax
jne 0x4eaea0
test esi, esi
je 0x4eaea4
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4eaeca
test esi, esi
jne 0x4eaead
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x14]
lea ecx, [eax + eax + 2]
push ecx
push ebp
push 1
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
ret 8
mov eax, dword [ebx + 0x68]
mov ecx, dword [esp + 0xc]
push eax
push ebp
push ecx
push str.License
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop ebp
pop ebx
ret 8

Function at 0x4eaf00
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, eax
cmp dword [ebx + 0x54], 0
push esi
push edi
je 0x4eaf5d
mov ecx, dword [esp + 0x14]
push str.License
mov edi, 0x2001f
call fcn.004ea880
mov esi, eax
test esi, esi
jne 0x4eaf30
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push 3
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
ret 0x10
mov edi, dword [esp + 0x20]
xor ecx, ecx
lea eax, [edi + edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056bb01
mov esi, eax
add esp, 4
xor eax, eax
test edi, edi
jbe 0x4eafbe
jmp 0x4eaf90
movzx ecx, byte [eax + ebp]
and cl, 0xf
movzx dx, cl
add dx, 0x41
mov word [esi + eax*4], dx
movzx ecx, byte [eax + ebp]
shr cl, 4
movzx dx, cl
add dx, 0x41
mov word [esi + eax*4 + 2], dx
add eax, 1
cmp eax, edi
jb 0x4eaf90
mov ecx, dword [esp + 0x14]
mov word [esi + eax*4], 0
mov eax, dword [esp + 0x18]
push esi
push eax
mov eax, ebx
call fcn.004eae40
push esi
mov edi, eax
call fcn.0056bb06
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x4ecfd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.0057ee1a
cmp byte [ebp + 8], 0
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x20]
mov ecx, dword [edi + 0xdc]
je 0x4ed16b
cmp ecx, esi
je 0x4ed202
xor ebx, ebx
cmp ecx, ebx
je 0x4ed00d
push ebx
call fcn.004ecfd0
push 0x17
mov dword [edi + 0xdc], esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4ed033
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
jmp 0x4ed045
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
test ax, ax
setl dl
mov eax, edx
cmp eax, ebx
je 0x4ed095
lea eax, [esp + 0x10]
push eax
mov byte [esi + 0x131], 1
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call fcn.0056eb4e
mov ebx, eax
test ebx, ebx
je 0x4ed093
push 0x63bdac
mov ecx, ebx
call fcn.00580b10
test eax, eax
je 0x4ed093
cmp dword [ebx + 0x54], esi
jne 0x4ed093
mov byte [esi + 0x130], 1
xor ebx, ebx
mov eax, dword [esi + 0x158]
mov eax, dword [eax + 0x48]
xor edx, edx
call fcn.00404050
mov edx, dword [esi]
mov eax, dword [edx + 0x60]
mov ecx, esi
call eax
cmp eax, ebx
mov dword [esp + 0xc], eax
je 0x4ed0f1
mov edx, dword [esi]
mov edx, dword [edx + 0x64]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call edx
mov ebx, eax
push 0x63bdac
mov ecx, ebx
call fcn.00580b10
test eax, eax
je 0x4ed0e8
cmp dword [ebx + 0x6c], 0
jne 0x4ed0e8
mov eax, ebx
call fcn.00505140
call fcn.005051b0
cmp dword [esp + 0xc], 0
jne 0x4ed0b6
xor ebx, ebx
call fcn.004040e0
mov eax, dword [edi + 0x104]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ed131
cmp dword [0x691c08], ebx
je 0x4ed121
cmp dword [0x691c00], ebx
je 0x4ed121
mov esi, 0x691be8
call fcn.00454650
mov ecx, dword [edi + 0x104]
push 1
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x690c9c]
cmp eax, ebx
mov dword [0x690ca4], ebx
je 0x4ed202
mov ecx, dword [0x691ca8]
mov dword [0x691ca8], ebx
mov dword [0x690c9c], ebx
mov dword [0x690ca8], ebx
mov dword [eax + 0x18c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, esi
jne 0x4ed202
xor ebx, ebx
cmp dword [0x68f434], 1
jne 0x4ed189
push ebx
push ebx
push ebx
call fcn.00499740
add esp, 0xc
mov edx, dword [0x690cac]
mov dword [edi + 0xdc], ebx
cmp edx, dword [esi + 0x158]
jne 0x4ed202
mov eax, dword [0x690c9c]
cmp eax, ebx
mov dword [0x690ca4], ebx
je 0x4ed1ca
mov ecx, dword [0x691ca8]
mov dword [0x691ca8], ebx
mov dword [0x690c9c], ebx
mov dword [0x690ca8], ebx
mov dword [eax + 0x18c], ecx
call fcn.004040e0
push ebx
push 1
mov ebx, 1
call fcn.004ecdd0
mov eax, dword [edi + 0x104]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ed202
call fcn.004c5350
mov ecx, dword [edi + 0x104]
push ebx
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f0020
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
cmp dword [0x69256c], 0
push esi
push edi
je 0x4f0039
mov eax, 1
pop edi
pop esi
add esp, 8
ret
mov eax, dword [0x690ca0]
lea edx, [esp + 0xc]
xor edi, edi
mov dword [0x69256c], 1
call fcn.00404050
cmp dword [0x691bdc], edi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x4f0076
push 0x10
call esi
test ax, ax
jl 0x4f006e
xor eax, eax
jmp 0x4f0084
cmp dword [0x691bdc], edi
jne 0x4f0089
push 0x10
call esi
test ax, ax
jge 0x4f0089
mov eax, 1
call fcn.004c4c30
call fcn.0057ee1a
mov eax, dword [eax + 4]
cmp byte [eax + 0xa5], 0
je 0x4f00eb
cmp dword [0x692568], edi
jne 0x4f00a9
call fcn.0049b060
mov edi, eax
cmp dword [0x690ca0], 0
je 0x4f00eb
push 1
call fcn.004dbed0
mov ecx, dword [0x690c9c]
mov eax, dword [ecx + 0x3a0]
add esp, 4
cmp dword [esp + 0x14], 0
je 0x4f00eb
cmp byte [eax + 0x128], 0
jne 0x4f00eb
mov eax, dword [eax + 0x12c]
cmp eax, dword [ecx + 0x530]
jge 0x4f00eb
call fcn.0049b990
mov eax, dword [esp + 0xc]
xor edx, edx
call fcn.00404050
mov eax, edi
pop edi
mov dword [0x69256c], 0
pop esi
add esp, 8
ret

Function at 0x4f0770
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
call fcn.00589b56
test eax, eax
je 0x4f0786
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4f0788
xor eax, eax
mov ecx, eax
call fcn.00572380
mov edi, eax
call fcn.00589b56
test eax, eax
je 0x4f07a5
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4f07a7
xor eax, eax
push 0
mov ecx, eax
call fcn.0057239b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
call fcn.00589b56
test eax, eax
je 0x4f07f1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
push edi
mov ecx, eax
call fcn.0057239b
mov eax, esi
pop edi
pop esi
ret
xor eax, eax
push edi
mov ecx, eax
call fcn.0057239b
pop edi
mov eax, esi
pop esi
ret
Function at 0x4f1300
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor ebx, ebx
push 0x11
mov dword [esp + 0x14], ebx
xor edi, edi
call esi
xor ecx, ecx
test ax, ax
setl cl
push 0x12
mov ebp, ecx
call esi
xor ecx, ecx
test ax, ax
mov eax, dword [esp + 0x18]
setl cl
add eax, 0xfffffff8
cmp eax, 0x26
ja case.0x4f1344.10
movzx edx, byte [eax + 0x4f14ac]
jmp dword [edx*4 + 0x4f1474]
test ecx, ecx
mov edi, 1
mov ebx, edi
je 0x4f135b
lea esi, [edi + 0xc]
jmp 0x4f136f
mov eax, ebp
neg eax
sbb eax, eax
and eax, 0x10
add eax, 2
movzx esi, ax
test si, si
je case.0x4f1344.10
test ecx, ecx
je 0x4f1377
test edi, edi
je case.0x4f1344.10
test ebp, ebp
je 0x4f137f
test ebx, ebx
je case.0x4f1344.10
mov eax, dword [0x690ca0]
lea edx, [esp + 0x18]
call fcn.00404050
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
mov ecx, esi
call fcn.004584d0
test eax, eax
je 0x4f13b2
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x18]
xor edx, edx
call fcn.00404050
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ecx, ecx
mov edi, 1
mov ebx, edi
je 0x4f13d7
lea esi, [edi + 0xd]
jmp 0x4f136f
mov edx, ebp
neg edx
sbb edx, edx
and edx, 0xe
add edx, 3
movzx esi, dx
jmp 0x4f136a
mov eax, ecx
neg eax
sbb eax, eax
and eax, 0xb
mov edi, 1
add eax, 4
jmp 0x4f1367
mov edx, ecx
neg edx
sbb edx, edx
and edx, 0xb
add edx, 5
mov edi, 1
movzx esi, dx
jmp 0x4f136a
mov esi, 6
jmp 0x4f136f
mov esi, 7
jmp 0x4f136f
mov esi, 1
jmp 0x4f136f
mov esi, 9
jmp 0x4f136f
mov esi, 0xb
jmp 0x4f136f
mov esi, 0xc
jmp 0x4f136f
mov esi, 8
jmp 0x4f136f
mov esi, 0x13
jmp 0x4f136f
mov esi, 0x14
jmp 0x4f136f

Function at 0x4f14e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
mov esi, eax
xor edi, edi
push 0x25
mov word [esi], di
mov word [esi + 2], di
call ebx
test ax, ax
je 0x4f1509
add word [esi], 0xffff
mov edi, 1
push 0x27
call ebx
test ax, ax
je 0x4f151a
mov edi, 1
add word [esi], di
push 0x26
call ebx
test ax, ax
je 0x4f152d
add word [esi + 2], 0xffff
mov edi, 1
push 0x28
call ebx
test ax, ax
je 0x4f153f
mov edi, 1
add word [esi + 2], di
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.00589b56
test eax, eax
je 0x4f1559
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4f155b
xor eax, eax
mov ecx, dword [eax + 0x20]
push 3
push 0x109
push 0x100
push ecx
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
jne 0x4f1545
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4f15c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetACP]
push ebx
xor ecx, ecx
push esi
lea ebx, [ebx]
cmp dword [ecx*8 + 0x685c10], eax
je 0x4f163e
add ecx, 1
cmp ecx, 0x87
jl 0x4f15d0
mov ebx, 3
call fcn.0057ee1a
mov esi, dword [eax + 0xc]
test esi, esi
je 0x4f1642
push edi
push 0xa
push 0x118
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4f1647
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 2
jne 0x4f1647
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4f1647
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4f1647
movzx eax, word [eax]
cmp ax, 8
jae 0x4f1647
pop edi
pop esi
movzx eax, ax
pop ebx
ret
mov ebx, ecx
jmp 0x4f15e9
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4f1650
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
push esi
push edi
mov dword [0x691154], 0
mov dword [0x691158], 0
call fcn.0057ee1a
mov edi, dword [eax + 0xc]
test edi, edi
je 0x4f16cf
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push 0x117
push edi
call ebp
mov esi, eax
test esi, esi
je 0x4f16cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 8
jne 0x4f16cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4f16cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4f16cf
mov ecx, dword [eax]
test ecx, ecx
mov dword [0x691154], ecx
mov eax, dword [eax + 4]
mov dword [0x691158], eax
jle 0x4f16d6
push 5
push 0x110
push edi
call ebp
test eax, eax
jne 0x4f16d6
push 1
call fcn.005ceecc
pop edi
pop esi
pop ebp
ret