joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e592
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
inc edi
push edi
push edi
push str.CConEmuMain::Destroy__
call fcn.00410feb
push dword [ebp + 8]
mov ecx, esi
push dword [0x5a22a4]
call fcn.0040e3ee
cmp dword [0x5a2404], 0
je 0x40e5ca
push edi
push edi
push str.___Destroy_skipped_due_to_gbInDisplayLastError
jmp 0x40e639
cmp byte [ebp + 8], 0
je 0x40e60c
mov ecx, esi
call fcn.0041eecd
test al, al
je 0x40e5e7
push 0
call fcn.004d814a
pop ecx
test al, al
je 0x40e605
push 0
push 0
lea eax, [esi + 0xa30]
push eax
push 0x31
push str.ConEmus_parent_window_was_terminated_abnormally._nContinue_to_kill_ConEmu_process_
call fcn.00421ef1
add esp, 0x14
cmp eax, edi
jne 0x40e640
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x5a22a4], 0
je 0x40e632
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [esi + 0x781c]
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40e640
push edi
push edi
push str.___Destroy_skipped_due_to_ghWnd
mov ecx, esi
call fcn.00410feb
pop edi
pop esi
pop ebp
ret 4
Function at 0x40f8f9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x5a22a4]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40fa46
xor ebx, ebx
lea ecx, [esi + 0x180]
push ebx
call fcn.00432292
test al, al
jne 0x40fa46
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x40fa46
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
imul ecx, eax
mov dword [ebp - 0x34], ecx
test ecx, ecx
jle 0x40fa46
push dword [ebp - 8]
lea esi, [ebp - 0x14]
push dword [ebp - 0xc]
lea edi, [ebp - 0x2c]
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 2
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x40e814
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x18], 1
push 0x64
pop edi
jne 0x40f9c2
mov edi, ebx
jmp 0x40fa39
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_GetRegionData]
mov dword [ebp - 0x30], eax
cmp eax, 4
jbe 0x40fa39
push 1
push eax
call fcn.004e1c42
pop ecx
pop ecx
mov esi, eax
push esi
push dword [ebp - 0x30]
mov dword [esi], 0x20
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_GetRegionData]
test eax, eax
je 0x40fa24
cmp dword [esi + 4], 1
jne 0x40fa24
cmp dword [esi + 8], ebx
jbe 0x40fa24
mov edi, dword [esi + 8]
lea edx, [esi + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
sub ecx, dword [edx - 4]
sub eax, dword [edx]
lea edx, [edx + 0x10]
imul ecx, eax
add ebx, ecx
sub edi, 1
jne 0x40fa09
push 0x64
pop edi
push esi
call fcn.004e1bea
imul eax, ebx, 0x64
pop ecx
cdq
idiv dword [ebp - 0x34]
cmp eax, edi
cmova eax, edi
mov edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, edi
jmp 0x40fa48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
Function at 0x41008c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x420], ebx
push edi
test esi, esi
je 0x41022d
cmp word [esi], 0x40
jne 0x41022d
push ebx
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x424], ebx
push ecx
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x418], ebx
push ecx
lea ecx, [ebp - 0x420]
push ecx
lea eax, [esi + 2]
push 0x100000
push eax
mov dword [ebp - 0x41c], eax
call fcn.004ee30d
add esp, 0x18
cmp eax, 0xffffffff
jne 0x4101b2
xor eax, eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41011f
sub esi, ecx
lea ecx, [ebp - 0x414]
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x410137
sub ecx, edx
sar ecx, 1
add ecx, 0x64
add esi, ecx
push 2
push esi
call fcn.004e1c42
pop ecx
pop ecx
push 0x527308
mov edi, eax
push esi
push edi
call fcn.00401a0b
push dword [ebp - 0x41c]
push esi
push edi
call fcn.004019cd
push str.Uw4
push esi
push edi
call fcn.004019cd
lea eax, [ebp - 0x414]
push eax
push esi
push edi
call fcn.004019cd
push 0x52737c
push esi
push edi
call fcn.004019cd
push ebx
push ebx
push ebx
push dword [ebp - 0x418]
push edi
call fcn.00420ad9
push edi
call fcn.004e1bea
add esp, 0x18
xor eax, eax
jmp 0x41022f
cmp eax, 0xfffffffe
jne 0x4101fd
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x4101ba
sub esi, ecx
sar esi, 1
push 2
lea eax, [esi + 0x64]
push eax
call fcn.004e1c42
pop ecx
pop ecx
push 0x527380
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x41c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
push 0x52737c
push edi
call esi
jmp 0x410196
test eax, eax
jns 0x410227
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x410204
sub esi, ecx
sar esi, 1
push 2
lea eax, [esi + 0x64]
push eax
call fcn.004e1c42
pop ecx
pop ecx
push 0x5273d8
jmp 0x4101db
mov ebx, dword [ebp - 0x420]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 4
Function at 0x411524
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xcc]
push str.Activation_by_mouse:_HWNDx_08X_msgx_X_wParamx_X_lParamx_X
push eax
call fcn.00409b7d
mov ecx, dword [0x5a23ec]
add esp, 0x18
xor ebx, ebx
inc ebx
push ebx
call fcn.004673c5
test eax, eax
je 0x411581
push ebx
push ebx
lea eax, [ebp - 0xcc]
mov ecx, esi
push eax
call fcn.00410feb
cmp dword [ebp + 0x10], 0
je 0x4115a1
test edi, edi
je 0x4115a1
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10f8f], 0
je 0x4115a1
push edi
mov ecx, esi
call fcn.0040b778
mov ebx, dword [esi + 0x3f04]
and dword [esi + 0x3ef8], 0
and dword [esi + 0x3efc], 0
and dword [esi + 0x3f04], 0
mov ecx, dword [esi + 0x3e64]
test ecx, ecx
je 0x4116c6
push 1
call fcn.004bf1c6
test al, al
je 0x4116c6
lea eax, [ebp - 0xdc]
push eax
lea ecx, [esi + 0x180]
call fcn.004bae69
and dword [ebp - 0xe4], 0
lea eax, [ebp - 0xe4]
and dword [ebp - 0xe0], 0
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
lea eax, [ebp - 0xe4]
push eax
push dword [0x5a22a4]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 0xe0]
lea eax, [ebp - 0xdc]
push dword [ebp - 0xe4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4116c6
mov ecx, dword [esi + 0x3e64]
push 0
call fcn.004be622
and dword [esi + 0x3f08], 0
lea eax, [ebp - 0xe4]
and dword [ebp - 0xe4], 0
and dword [ebp - 0xe0], 0
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [esi + 0x114]
call fcn.00447803
test al, al
jne 0x41169a
push 0
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
call fcn.004d485c
add esp, 0xc
test al, al
je 0x411779
shr edi, 0x10
mov eax, 0x201
cmp di, ax
jne 0x41171a
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3efc], 0x202
mov dword [esi + 0x3f00], 0x203
jmp 0x411779
cmp dword [esi + 0x3f08], 0
jne 0x41164b
xor eax, eax
inc eax
cmp di, ax
jne 0x4116fe
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x10faa], 0
je 0x4116fe
test ebx, ebx
jne 0x41164b
test byte [esi + 0x78c0], 9
je 0x41164b
push dword [esi + 0x78c0]
lea eax, [ebp - 0xcc]
push str._Bypassing_ClickActivation_to_console__Condition__Statex_X__
push eax
call fcn.00409b7d
add esp, 0xc
jmp 0x411779
mov eax, 0x204
cmp di, ax
jne 0x411740
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3efc], 0x205
mov dword [esi + 0x3f00], 0x206
jmp 0x411779
mov eax, 0x207
cmp di, ax
jne 0x411766
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3efc], 0x208
mov dword [esi + 0x3f00], 0x209
jmp 0x411779
mov eax, 0x246
cmp di, ax
jne 0x411779
xor eax, eax
inc eax
mov dword [esi + 0x3f04], eax
cmp dword [esi + 0x3e68], 0
je 0x41178e
push dword [0x5a22a4]
call fcn.004ea440
pop ecx
mov ecx, esi
call fcn.0040f093
push eax
push 0
push str.OnActivateByMouse
mov ecx, esi
call fcn.0041863e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0x10
Function at 0x41338f
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x218
mov eax, 0x50d495
call fcn.004f41e2
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, 0x284
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0xc]
cmp eax, ecx
ja 0x4134b9
je 0x4134ad
sub eax, 0x10d
je 0x413484
sub eax, 1
je 0x413465
sub eax, 1
je 0x413443
sub eax, 0x172
je 0x413437
sub eax, 1
je 0x4133ff
sub eax, 1
jne 0x41357b
push edi
push esi
push 0x5282a8
jmp 0x41356c
push edi
push esi
lea eax, [ebp - 0x210]
push 0x528430
push eax
call fcn.00409bde
add esp, 0x10
cmp esi, 8
jne 0x41357b
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
and al, 1
mov byte [ebx + 0x75a6], al
jmp 0x41357b
push edi
push esi
push 0x528550
jmp 0x41356c
push edi
push esi
lea eax, [ebp - 0x210]
push 0x5281d0
push eax
call fcn.00409bde
add esp, 0x10
mov ecx, ebx
call fcn.0041cc97
jmp 0x41357b
push edi
push esi
lea eax, [ebp - 0x210]
push 0x528308
push eax
call fcn.00409bde
mov byte [ebx + 0x75a5], 0
jmp 0x413578
push edi
push esi
lea eax, [ebp - 0x210]
push 0x5285b8
push eax
call fcn.00409bde
add esp, 0x10
mov ecx, ebx
call fcn.0041cc97
mov byte [ebx + 0x75a5], 1
jmp 0x41357b
push edi
push esi
push str.9xG
jmp 0x41356c
sub eax, 0x285
je 0x413565
sub eax, 1
je 0x4134fb
dec eax
sub eax, 1
je 0x4134f2
sub eax, 8
je 0x4134e9
sub eax, 1
jne 0x41357b
push edi
push esi
push 0x5283d8
jmp 0x41356c
push edi
push esi
push 0x528378
jmp 0x41356c
push edi
push esi
push 0x528490
jmp 0x41356c
push edi
push esi
movzx eax, si
push eax
lea eax, [ebp - 0x210]
push 0x528170
push eax
call fcn.00409bde
add esp, 0x14
lea ecx, [ebp - 0x224]
call fcn.004d840a
and dword [ebp - 4], 0
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.004d3e20
mov ebx, dword [ebp - 0x214]
pop ecx
pop ecx
test eax, eax
js 0x413558
mov ecx, dword [ebp - 0x220]
push edi
push esi
push 0x286
push ebx
call fcn.004de78b
mov ecx, eax
call fcn.0048b601
lea ecx, [ebp - 0x224]
call fcn.004d84a5
jmp 0x413581
push edi
push esi
push 0x5284f0
lea eax, [ebp - 0x210]
push eax
call fcn.00409bde
add esp, 0x10
mov ebx, dword [ebp - 0x214]
push edi
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.004f418c
ret 0x10
Function at 0x413595
Capabilities:
Get keyboard layout

Disassembly:
push 0x248
mov eax, 0x50d4c8
call fcn.004f41e2
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [0x5a23ec]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x54ac]
mov dword [ebp - 0x23c], eax
mov eax, dword [esi + 0x54b0]
push 2
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x240], eax
call fcn.004673c5
xor ebx, ebx
test eax, eax
je 0x413623
cmp dword [ebp - 0x228], 0x51
mov edx, 0x528828
push ebx
push edi
push dword [ebp + 0xc]
mov eax, 0x528800
cmovne eax, edx
push eax
lea eax, [ebp - 0x224]
push 0x528860
push eax
call fcn.00409bde
add esp, 0x18
lea eax, [ebp - 0x224]
mov ecx, esi
push 1
push 1
push eax
call fcn.00410feb
mov eax, dword [ebp - 0x228]
push edi
push dword [ebp + 0xc]
mov dword [esi + 0x54ac], eax
push eax
mov dword [esi + 0x54b0], edi
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x244], eax
lea edi, [ebp - 0x24]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004fe324
add esp, 0xc
mov dword [ebp - 0x230], eax
or edi, 0xffffffff
mov edx, ebx
mov dword [ebp - 0x22c], edi
lea ecx, [edx + 0x70f]
imul ecx, ecx, 0xc
cmp dword [ecx + esi], ebx
mov ecx, dword [ebp - 0x230]
jne 0x4136b6
cmp edi, 0xffffffff
mov eax, edx
cmovne eax, edi
mov edi, eax
mov dword [ebp - 0x22c], edi
jmp 0x4136c2
imul eax, edx, 0xc
cmp dword [eax + esi + 0x54b8], ecx
je 0x4136ca
inc edx
cmp edx, 0x14
jl 0x413690
jmp 0x4136d3
or edi, 0xffffffff
mov dword [ebp - 0x22c], edi
cmp edi, 0xffffffff
mov edi, dword [ebp - 0x234]
je 0x4136ed
push edi
push ecx
push dword [ebp - 0x22c]
mov ecx, esi
call fcn.0041be15
mov eax, dword [ebp - 0x228]
cmp eax, 0x50
je 0x4136fd
cmp eax, 0x51
jne 0x413772
lea ecx, [ebp - 0x254]
call fcn.004d840a
lea eax, [ebp - 0x254]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.004d3e20
pop ecx
pop ecx
test eax, eax
js 0x41372b
mov ecx, dword [ebp - 0x250]
call fcn.004de78b
mov ebx, eax
test ebx, ebx
je 0x413763
cmp dword [ebp - 0x23c], 0x50
mov ecx, dword [ebp - 0x228]
jne 0x413751
cmp ecx, 0x51
jne 0x413751
mov eax, dword [ebp - 0x240]
cmp eax, edi
je 0x413763
test eax, eax
je 0x413763
xor eax, eax
cmp ecx, 0x50
push edi
cmove eax, dword [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.00495b92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.004d84a5
mov ecx, dword [esi + 0x3e6c]
mov dword [esi + 0x54a8], edi
call fcn.004bc0f7
mov eax, dword [ebp - 0x244]
call fcn.004f418c
ret 0xc
Function at 0x41b8b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41b8d9
xor al, al
jmp 0x41b9dc
push ebx
push edi
push 0x410
xor ebx, ebx
lea eax, [ebp - 0x514]
push ebx
push eax
call fcn.004f5a90
xor eax, eax
mov dword [ebp - 0x568], 0x44
lea edi, [ebp - 0x524]
stosd dword es:[edi], eax
push 0x40
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x564]
push eax
call fcn.004f5a90
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x7ffe
push eax
lea eax, [esi + 0x1c0e]
push eax
lea eax, [ebp - 0x514]
push str.__s___DEBUGPID_u__BW80__BH25__BZ_u
push eax
call fcn.004064f7
add esp, 0x14
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x568]
push eax
push ebx
push ebx
push 0x30
push ebx
push ebx
push ebx
lea eax, [ebp - 0x514]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41b995
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x104]
push str.Cant_create_debugger_console__ErrCode0x_08X
push eax
call fcn.00401133
push 1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x104]
push 0x40
push eax
call fcn.00421ef1
add esp, 0x20
jmp 0x41b9d8
mov eax, dword [ebp - 0x524]
or edi, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5a23dc], 1
test eax, eax
je 0x41b9bf
cmp eax, edi
je 0x41b9bf
push eax
mov dword [ebp - 0x524], ebx
call esi
mov eax, dword [ebp - 0x520]
test eax, eax
je 0x41b9d6
cmp eax, edi
je 0x41b9d6
push eax
mov dword [ebp - 0x520], ebx
call esi
mov bl, 1
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret
Function at 0x41bf18
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x104
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41bf78
xor eax, eax
cmp word [ecx], 0x3a
cmovne eax, ecx
test eax, eax
je 0x41bf78
cmp word [eax], 0
lea esi, [edi + 0x10ae]
je 0x41c0d2
push eax
push 0x105
push esi
mov byte [edi + 0x1308], 1
call fcn.00401a0b
push esi
call fcn.00420efa
pop ecx
jmp 0x41c0d2
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x41bfb3
cmp eax, ebx
ja 0x41bfb3
lea eax, [ebp - 0x210]
push eax
call fcn.00420efa
pop ecx
jmp 0x41bfbc
xor eax, eax
mov word [ebp - 0x210], ax
cmp byte [edi + 0x70c], 0
jne 0x41c0ba
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x418]
push 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41c002
lea eax, [ebp - 0x418]
push eax
call fcn.00420efa
pop ecx
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0x620]
push eax
call fcn.00401a0b
push str._system32
push ebx
lea eax, [ebp - 0x620]
push eax
call fcn.004019cd
cmp word [ebp - 0x210], 0
je 0x41c074
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
je 0x41c074
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
je 0x41c074
lea eax, [edi + 0xc9a]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x41c0ba
push 0
push 0x28
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41c098
lea eax, [ebp - 0x210]
push eax
call fcn.00420efa
pop ecx
cmp word [ebp - 0x210], 0
jne 0x41c0ba
lea eax, [edi + 0xc9a]
push eax
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.00401a0b
lea eax, [ebp - 0x210]
push eax
push 0x105
lea esi, [edi + 0x10ae]
push esi
call fcn.00401a0b
push ebx
lea eax, [ebp - 0x828]
push eax
push esi
call fcn.004e46f1
add esp, 0xc
push eax
push str.ConEmuWorkDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 4
Function at 0x41c155
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [0x5a23ec]
mov dword [ebp - 0x260], edi
test byte [ecx + 0x113c9], 1
jne 0x41c1a6
push 2
call fcn.004673c5
test eax, eax
je 0x41c2dc
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
push 0x527018
call fcn.00410feb
jmp 0x41c2dc
push ebx
push 0x50
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x254]
xor ebx, ebx
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, dword [ebp + 8]
mov edx, eax
xor esi, esi
mov dword [ebp - 0x25c], edx
xor ecx, ecx
inc esi
cmp ecx, edx
jae 0x41c1ee
cmp dword [ebp + ecx*4 - 0x254], edi
cmove ebx, esi
inc ecx
test ebx, ebx
je 0x41c1db
xor eax, eax
mov dword [ebp - 0x258], eax
test ebx, ebx
jne 0x41c23f
cmp eax, edx
jae 0x41c22d
mov edx, dword [ebp + eax*4 - 0x254]
movzx ecx, dx
movzx eax, di
cmp ecx, eax
cmove ebx, esi
inc dword [ebp - 0x258]
cmp ecx, eax
mov eax, dword [ebp - 0x258]
cmovne edx, edi
mov edi, edx
mov edx, dword [ebp - 0x25c]
test ebx, ebx
je 0x41c1fa
test ebx, ebx
jne 0x41c23f
movzx eax, di
cmp edi, eax
jne 0x41c23f
mov eax, edi
shl eax, 0x10
or edi, eax
mov ebx, dword [ebp - 0x260]
push dword [ebx + 0x77fc]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [0x5a23ec]
push 2
cmp edi, eax
je 0x41c2ad
call fcn.004673c5
test eax, eax
je 0x41c28b
push edi
lea eax, [ebp - 0x204]
push 0x5270b0
push eax
call fcn.00409bde
add esp, 0xc
lea eax, [ebp - 0x204]
mov ecx, ebx
push esi
push esi
push eax
call fcn.00410feb
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push edi
push 0
push 0x50
push dword [0x5a22a4]
call esi
push edi
push 0
push 0x51
push dword [0x5a22a4]
call esi
jmp 0x41c2db
call fcn.004673c5
test eax, eax
je 0x41c2db
push edi
lea eax, [ebp - 0x204]
push 0x527178
push eax
call fcn.00409bde
add esp, 0xc
lea eax, [ebp - 0x204]
mov ecx, ebx
push esi
push esi
push eax
call fcn.00410feb
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret 4
Function at 0x41c31b
Capabilities:
Terminate process

Disassembly:
push 0x10c
mov eax, 0x50d93d
call fcn.004f41e2
mov esi, ecx
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x113e4], 0
je 0x41c43f
lea ecx, [ebp - 0x118]
call fcn.004e4003
and dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
push 0xffffffffffffffff
push dword [esi + 0x78fc]
call fcn.004e77a9
xor ebx, ebx
cmp dword [esi + 0x78ec], ebx
jle 0x41c434
xor edi, edi
mov eax, dword [esi + 0x78f8]
cmp dword [edi + eax], 0
je 0x41c424
push 0
push dword [edi + eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x78f8]
mov edx, dword [ecx + edi]
test eax, eax
jne 0x41c3c9
lea eax, [ecx + 8]
add eax, edi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esi + 0x78f8]
push dword [eax + edi + 8]
push dword [eax + edi + 4]
lea eax, [ebp - 0x110]
push str.ssh_agent.exe_with_PID__u_has_been_already_terminated_with_code__u
push eax
call fcn.00401133
add esp, 0x10
jmp 0x41c3f0
push 1
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x78f8]
push dword [eax + edi + 4]
lea eax, [ebp - 0x110]
push str.ssh_agent.exe_with_PID__u_was_killed_on_ConEmu_termination
push eax
call fcn.00401133
add esp, 0xc
push 1
push 1
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.00410feb
mov ecx, dword [esi + 0x78f8]
mov eax, dword [ecx + edi]
test eax, eax
je 0x41c424
cmp eax, 0xffffffff
je 0x41c424
and dword [ecx + edi], 0
cmp eax, 0xffffffff
je 0x41c424
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add edi, 0xc
cmp ebx, dword [esi + 0x78ec]
jl 0x41c370
lea ecx, [ebp - 0x118]
call fcn.004e7762
call fcn.004f418c
ret
Function at 0x41ef6e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x36c], ebx
je 0x41efb9
lea edi, [esi + 0x180]
push ebx
mov ecx, edi
call fcn.004323d7
test al, al
je 0x41efb9
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x41effa
push ebx
mov ecx, edi
call fcn.0042ada2
cmp byte [ebp + 8], bl
je 0x41f09c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x5a23ec]
push 2
pop ecx
sub dword [ebp - 0x14], ecx
add dword [ebp - 0xc], ecx
add dword [ebp - 8], ecx
cmp byte [eax + 0x10f91], bl
je 0x41f001
inc dword [ebp - 0x10]
jmp 0x41f004
mov al, 1
jmp 0x41f0a8
sub dword [ebp - 0x10], ecx
push dword [ebp - 0x28]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
lea eax, [ebp - 0x14]
push dword [ebp - 0x2c]
push eax
call edi
test eax, eax
je 0x41f0a6
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x180]
call fcn.004ba2d3
inc dword [ebp - 0x24]
mov eax, dword [0x5a23ec]
dec dword [ebp - 0x1c]
dec dword [ebp - 0x18]
cmp byte [eax + 0x10f91], bl
je 0x41f049
sub dword [ebp - 0x10], 2
jmp 0x41f04c
inc dword [ebp - 0x20]
push 2
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push dword [ebp - 0x2c]
push eax
call edi
test eax, eax
je 0x41f098
mov ecx, dword [esi + 0x3e6c]
test ecx, ecx
je 0x41f0a6
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
call fcn.004bb4df
test al, al
je 0x41f0a6
mov bl, 1
jmp 0x41f0a6
cmp dword [esi + 0x36c], 2
sete bl
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 4