joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cba40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5c29d8]
push ebx
push ebp
push esi
push edi
cmp eax, 1
mov edi, ecx
jne 0x4cba71
lea ebx, [edi + 0x1e720]
push 0xa
mov ecx, ebx
call fcn.00504bb0
mov esi, dword [esp + 0x14]
mov ebp, eax
mov eax, dword [ebx]
push esi
push 0xa
mov ecx, ebx
call dword [eax + 0x3c]
jmp 0x4cba90
lea ebx, [edi + 0x13134]
push 0xa
mov ecx, ebx
call fcn.00504bb0
mov esi, dword [esp + 0x14]
mov edx, dword [ebx]
push esi
push 0xa
mov ecx, ebx
mov ebp, eax
call dword [edx + 0x3c]
test ebp, ebp
je 0x4cbae2
lea ebx, [edi + 0x14f34]
mov ecx, ebx
call fcn.00409ab0
mov ebp, dword [esi + 4]
mov ecx, eax
mov eax, dword [esi + 0xc]
push 0x40
sub eax, ebp
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esi]
mov esi, dword [esi + 8]
sar eax, 1
add eax, ebp
sub esi, edx
add ecx, eax
sub ecx, eax
push ecx
push esi
push eax
mov eax, dword [edi + 0x14f38]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
call fcn.00407860
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ecx, dword [edi + 0x14f38]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4cbb00
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5c29d8]
push ebx
push ebp
push esi
push edi
cmp eax, 1
mov edi, ecx
jne 0x4cbb31
lea ebx, [edi + 0x1f610]
push 0x13
mov ecx, ebx
call fcn.00504bb0
mov esi, dword [esp + 0x14]
mov ebp, eax
mov eax, dword [ebx]
push esi
push 0x13
mov ecx, ebx
call dword [eax + 0x3c]
jmp 0x4cbb50
lea ebx, [edi + 0x13134]
push 0x13
mov ecx, ebx
call fcn.00504bb0
mov esi, dword [esp + 0x14]
mov edx, dword [ebx]
push esi
push 0x13
mov ecx, ebx
mov ebp, eax
call dword [edx + 0x3c]
test ebp, ebp
je 0x4cbba2
lea ebx, [edi + 0x11db8]
mov ecx, ebx
call fcn.004a4d70
mov ebp, dword [esi + 4]
mov ecx, eax
mov eax, dword [esi + 0xc]
push 0x40
sub eax, ebp
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esi]
mov esi, dword [esi + 8]
sar eax, 1
add eax, ebp
sub esi, edx
add ecx, eax
sub ecx, eax
push ecx
push esi
push eax
mov eax, dword [edi + 0x11dbc]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
call fcn.004a4d90
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov ecx, dword [edi + 0x11dbc]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4cf7a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x50]
lea edi, [esi + 0x2145c]
push eax
mov ecx, edi
call fcn.004e8d50
push esi
mov ecx, edi
call fcn.004e98d0
lea ecx, [esi + 0x4c]
test ecx, ecx
je 0x4cf7c9
lea eax, [esi + 0x74]
jmp 0x4cf7cb
xor eax, eax
push edi
mov dword [esi + 0x2148c], eax
call fcn.004f32c0
call fcn.004478a0
mov ecx, dword [eax + 0x80]
pop edi
test ecx, ecx
pop esi
jne 0x4cf802
mov ecx, 0x571210
call fcn.0040c940
test eax, eax
jne 0x4cf802
call fcn.004da830
mov ecx, eax
jmp 0x4dad00
ret
sub esp, 0x454
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x66]
mov word [esp + 0x64], 0
push 0x56e2ac
rep stosd dword es:[edi], eax
mov ecx, 0x571210
stosw word es:[edi], ax
call fcn.0040c1b0
push eax
push str._sdata_s
lea eax, [esp + 0x70]
push 0x1ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x78]
push 0
push ecx
call fcn.0043f710
add esp, 0x1c
test eax, eax
je 0x4dae9f
push 0
push 0x20
push 3
push 0
push 1
lea edx, [esp + 0x78]
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4dae9f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4dada7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
lea edi, [ebp + 2]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
je 0x4daddd
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, 0x18
jbe 0x4dae9f
mov ecx, 6
mov esi, ebx
lea edi, [esp + 0x4c]
add eax, 0xffffffe8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x54]
mov ebp, edx
imul ebp, dword [esp + 0x58]
cmp ebp, eax
ja 0x4dae9f
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
xor edi, edi
push edi
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov word [esp + 0x30], 1
mov word [esp + 0x32], 0x20
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_GetDC]
push edi
lea edx, [esp + 0x14]
mov esi, eax
push edi
push edx
lea eax, [esp + 0x2c]
push edi
push eax
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
lea esi, [ebx + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4dae9f
mov ecx, dword [esp + 0x14]
push eax
call fcn.004daa00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
Function at 0x4d1510
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1048
call fcn.0051e250
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1050]
xor eax, eax
shr ecx, 0x10
cmp ecx, 0x13
jne 0x4d15e7
push edi
mov ecx, 0x411
lea edi, [esp + 0xa]
mov word [esp + 8], ax
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x11db8]
stosw word es:[edi], ax
call fcn.004a4d40
test eax, eax
pop edi
je 0x4d157a
cmp word [eax], 0
je 0x4d157a
push 1
push 1
lea edx, [esp + 0xc]
push 0x824
push edx
push eax
push 0xffffffffffffffff
call fcn.004a5400
mov ecx, eax
call fcn.004a58e0
jmp 0x4d1594
push 1
lea eax, [esp + 8]
push 0x824
push eax
push 0xffffffffffffffff
call fcn.004a5400
mov ecx, eax
call fcn.004a5a00
cmp word [esp + 4], 0
je 0x4d15e2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x58be58]
lea edx, [esp + 4]
push ecx
push 0
push 0
push 1
push 1
push 8
push 0
push edx
lea ecx, [esi + 0xedb8]
call fcn.00488630
call fcn.00422b70
mov eax, dword [eax + 4]
push 0
push 0x7612
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
pop esi
add esp, 0x1048
ret 4

Function at 0x4d1970
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x28]
push 0x2008
push 1
push 0x9d99
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x4d1b00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x10
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x11
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
test esi, esi
jne 0x4d1b94
test edi, edi
jne 0x4d1b94
test eax, eax
jne 0x4d1b94
mov eax, dword [esp + 0x14]
add eax, 0xffffff90
mov ecx, eax
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*8]
cmp word [eax*8 + 0x5a4b0c], di
lea esi, [eax*8 + 0x5a4b0c]
je 0x4d1b94
push edi
call dword [sym.imp.USER32.dll_InSendMessageEx]
and eax, 9
cmp al, 1
jne 0x4d1b7c
push 1
call dword [sym.imp.USER32.dll_ReplyMessage]
push esi
lea ecx, [ebp + 0xedb8]
call fcn.00488040
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4da6a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004da390
lea eax, [ebp + 0xc]
push 0x56e2a4
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
je 0x4da780
push ebx
push edi
lea esi, [ebp + 4]
push 1
push 4
push esi
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4da752
mov eax, dword [esi]
test eax, eax
je 0x4da752
mov ecx, dword [ebp + 8]
shl ecx, 1
cmp eax, ecx
jge 0x4da752
mov edx, eax
shl edx, 5
add edx, eax
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4da752
mov eax, dword [esi]
mov edi, ebx
mov ecx, eax
shl ecx, 5
add ecx, eax
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push eax
push ecx
push 0x21
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
add esp, 0x10
cmp eax, ecx
je 0x4da74e
push ebx
mov dword [esi], 0
call fcn.0051e1fa
add esp, 4
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp], ebx
test ebx, ebx
pop ebx
je 0x4da77a
mov edx, dword [0x5d0150]
pop edi
mov dword [ebp + 0x214], edx
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x4da790
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x5699f8
lea eax, [esi + 0xc]
mov dword [esp + 0x10], edi
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4da81a
mov eax, dword [esi]
push ebp
test eax, eax
je 0x4da806
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
lea edi, [esi + 4]
push 1
push 4
push edi
call ebp
add esp, 0x10
cmp eax, 1
jne 0x4da806
mov ecx, dword [edi]
mov edx, dword [esi]
push ebx
push ecx
push 0x21
push edx
call ebp
mov ecx, dword [edi]
add esp, 0x10
cmp eax, ecx
jne 0x4da806
push 0x5d0150
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x5d0150]
mov dword [esp + 0x10], 1
mov dword [esi + 0x214], eax
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4dac40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
test eax, eax
push esi
je 0x4dacf1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4dacf1
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push 0x18
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4dacf1
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4dacf1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x18
push ecx
push esi
mov dword [esp + 0x38], 0
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push 0
push edx
push eax
push ecx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x18
ret 8

Function at 0x4db9e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x524481
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004f9290
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call fcn.0050bd10
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 1
call fcn.004933f0
lea ecx, [esi + 0x2d0]
mov byte [esp + 0x1c], 2
call fcn.004ff840
mov al, byte [esp + 0xf]
lea edx, [esi + 0x2c8]
mov byte [esi + 0x11d0], al
mov dword [esi + 0x11d4], edi
mov dword [esi + 0x11d8], edi
mov dword [esi + 0x11dc], edi
xor ecx, ecx
mov dword [esi], 0x52ab1c
mov dword [ebx], 0x52ab08
mov dword [edx], ecx
mov eax, esi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x11c0], edi
mov dword [esi + 0x11c4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x11c8], edi
mov dword [esi + 0x11cc], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x11e8], edi
mov dword [esi + 0x11ec], edi
mov dword [esi + 0x28], 0x64
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4dd780
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4dd79e
mov eax, dword [ecx + 8]
push 5
push eax
mov dword [ecx + 0x2c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov dword [ecx + 0x2c], 1
mov ecx, dword [ecx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x4dddc0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x11c4]
test eax, eax
je 0x4dde9c
mov eax, dword [esi + 0x11c0]
test eax, eax
je 0x4dde9c
mov dword [esi + 0x40], 1
mov eax, dword [eax + 4]
test eax, eax
je 0x4dddfc
push 0x4001
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x11c0]
call fcn.0046afa0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xf8]
mov ecx, dword [esi + 0x11c0]
mov edx, dword [ecx]
call dword [edx + 0x6c]
cmp eax, 0x64
mov dword [esi + 0x28], eax
je 0x4dde35
mov ecx, dword [esi + 0x11c0]
push 0x64
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov ecx, esi
call fcn.004de4e0
mov ecx, esi
call fcn.004de360
xor ecx, ecx
mov edx, dword [esi + 0x34]
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x30]
mov dword [esp + 8], ecx
push 0x14
mov dword [esp + 0x10], ecx
push 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x11c0]
push edx
push 0x53
mov dword [esp + 0x24], eax
call fcn.004159d0
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
mov ecx, esi
call fcn.004dd690
pop esi
add esp, 0x14
ret
Function at 0x4e1280
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1a8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
push 0x80
push 3
stosb byte es:[edi], al
mov edi, dword [esp + 0x1c8]
push ebx
push 1
push SysReAllocStringLen
push edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e12ed
push edi
push 0x56e9f8
call fcn.004350b0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push ebx
push esi
call ebp
cmp eax, 0x100
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], pe_nt_image_headers32
jge 0x4e1318
push edi
push 0x56e9a8
jmp 0x4e147e
push 2
push 0
push 0xffffff00
push esi
call ebp
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x3c]
push pe_nt_image_headers32
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea edx, [esp + 0x34]
push 0x56e998
push edx
call edi
mov ebp, eax
test ebp, ebp
jne 0x4e1366
mov eax, dword [esp + 0x1bc]
push eax
push 0x56e958
jmp 0x4e147e
push 0x56e954
push ebp
call edi
mov edi, eax
test edi, edi
jne 0x4e1386
mov ecx, dword [esp + 0x1bc]
push ecx
push 0x56e918
jmp 0x4e147e
mov edx, edi
lea eax, [esp + 0x34]
sub edx, eax
add edx, 3
cmp edx, 0x100
je 0x4e13ab
mov ecx, dword [esp + 0x1bc]
push ecx
push 0x56e8a4
jmp 0x4e147e
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x34]
sub eax, edx
lea eax, [eax + ebp - 0x100]
cmp eax, 0xf4240
mov dword [esp + 0x10], eax
jbe 0x4e13d9
mov eax, dword [esp + 0x1bc]
push eax
push 0x56e85c
jmp 0x4e147e
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4e1486
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [edi], 0
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
add ebp, 0xe
lea eax, [esp + 0x138]
push ebp
push eax
call fcn.004821b0
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
lea edx, [esp + 0x140]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0x52ace4
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], 0x80
call fcn.004ae9c0
add esp, 0xc
test eax, eax
jne 0x4e14a7
mov ecx, dword [esp + 0x1bc]
push ecx
push 0x56e808
call fcn.004350b0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4e149a
push ebx
call fcn.0051e1fa
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0051e1fa
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x4e14d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x218]
mov esi, dword [esp + 0x214]
lea ecx, [esp + 8]
dec edx
push ecx
push 0x56ea30
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043fb20
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4e1540
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push esi
push eax
call fcn.004e0e00
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e1562
pop esi
add esp, 0x208
ret
cmp word [esi], 0
je 0x4e15be
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1a
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x21c]
lea edx, [esp + 8]
push esi
mov esi, dword [esp + 0x21c]
push edx
dec eax
push 0x56ea64
push eax
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043fb20
add esp, 0x18
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0x4e1e30
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x4e1e69
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x50], 1
test ecx, ecx
je 0x4e1e69
push 2
call fcn.00417000
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x58]
push 0
push 0
push 1
call fcn.00416d30
pop esi
ret

Function at 0x4e9630
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov edx, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x10], eax
push ecx
push edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
add ecx, 0x32
add eax, 0xa
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
add eax, 0x32
cmp ecx, ebx
mov dword [esp + 0x14], eax
je 0x4e96e3
call fcn.00494590
test eax, eax
je 0x4e96e3
mov ecx, dword [esi + 0x38]
push ebp
push edi
call fcn.00494650
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
call fcn.00494650
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4e96c4
push 1
mov ebx, edi
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4e96c4
lea ebx, [edi + edi]
mov eax, dword [esp + 0x24]
push 0
mov ecx, dword [esi + 0x38]
push 0
push ebp
push edi
push 0
push ebx
lea edx, [esp + 0x28]
push 0
push edx
push eax
call fcn.00493ba0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4ec0c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ec265
mov ecx, dword [esi + 4]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push ecx
call edi
mov edx, dword [esi + 0xeae0]
xor eax, eax
test edx, edx
sete al
push eax
lea ecx, [esi + 0x28]
mov dword [esi + 0xeae0], eax
call fcn.004f6270
mov eax, dword [esi + 0xeae0]
test eax, eax
je 0x4ec1e9
mov edx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsZoomed]
push edx
call ebp
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esi + 0xed6c], eax
lea eax, [esi + 0xed70]
push eax
push ecx
call ebx
mov edx, dword [esi + 4]
push 0xfffffffffffffff0
push edx
call edi
mov dword [esi + 0xed68], eax
mov ecx, dword [0x591234]
test ecx, ecx
jne 0x4ec155
and eax, 0xff3fffff
and eax, 0xfffbffff
push eax
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
call fcn.004c12c0
add esp, 0x10
test eax, eax
jne 0x4ec18e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub edi, ecx
mov ecx, dword [esi + 4]
push ecx
sub ebx, eax
call ebp
test eax, eax
je 0x4ec1c6
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0x60
push ebx
push edi
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi + 4]
push 3
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 0x190
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop ebp
pop ebx
jmp 0x4ec254
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0xed68]
mov eax, dword [esi + 4]
push edx
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 0xed74]
mov edx, dword [esi + 0xed7c]
mov ecx, dword [esi + 0xed70]
sub edx, eax
push 0x60
push edx
mov edx, dword [esi + 0xed78]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0xed6c]
test eax, eax
je 0x4ec248
mov ecx, dword [esi + 4]
push 3
push ecx
jmp 0x4ec24e
mov edx, dword [esi + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 1
push 0
push eax
call fcn.0050c270
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4ec830
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 6
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
pop edi
pop esi
ret