joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413595
Capabilities:
Get keyboard layout

Disassembly:
push 0x248
mov eax, 0x50d4c8
call fcn.004f41e2
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [0x5a23ec]
mov dword [ebp - 0x228], eax
mov eax, dword [esi + 0x54ac]
mov dword [ebp - 0x23c], eax
mov eax, dword [esi + 0x54b0]
push 2
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x240], eax
call fcn.004673c5
xor ebx, ebx
test eax, eax
je 0x413623
cmp dword [ebp - 0x228], 0x51
mov edx, str.WM_INPUTLANGCHANGEREQUEST
push ebx
push edi
push dword [ebp + 0xc]
mov eax, str.WM_INPUTLANGCHANGE
cmovne eax, edx
push eax
lea eax, [ebp - 0x224]
push str.CConEmuMain::OnLangChange:__s_CP:_i__HKL:0x_08I64X_
push eax
call fcn.00409bde
add esp, 0x18
lea eax, [ebp - 0x224]
mov ecx, esi
push 1
push 1
push eax
call fcn.00410feb
mov eax, dword [ebp - 0x228]
push edi
push dword [ebp + 0xc]
mov dword [esi + 0x54ac], eax
push eax
mov dword [esi + 0x54b0], edi
push dword [0x5a22a4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x244], eax
lea edi, [ebp - 0x24]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004fe324
add esp, 0xc
mov dword [ebp - 0x230], eax
or edi, 0xffffffff
mov edx, ebx
mov dword [ebp - 0x22c], edi
lea ecx, [edx + 0x70f]
imul ecx, ecx, 0xc
cmp dword [ecx + esi], ebx
mov ecx, dword [ebp - 0x230]
jne 0x4136b6
cmp edi, 0xffffffff
mov eax, edx
cmovne eax, edi
mov edi, eax
mov dword [ebp - 0x22c], edi
jmp 0x4136c2
imul eax, edx, 0xc
cmp dword [eax + esi + 0x54b8], ecx
je 0x4136ca
inc edx
cmp edx, 0x14
jl 0x413690
jmp 0x4136d3
or edi, 0xffffffff
mov dword [ebp - 0x22c], edi
cmp edi, 0xffffffff
mov edi, dword [ebp - 0x234]
je 0x4136ed
push edi
push ecx
push dword [ebp - 0x22c]
mov ecx, esi
call fcn.0041be15
mov eax, dword [ebp - 0x228]
cmp eax, 0x50
je 0x4136fd
cmp eax, 0x51
jne 0x413772
lea ecx, [ebp - 0x254]
call fcn.004d840a
lea eax, [ebp - 0x254]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.004d3e20
pop ecx
pop ecx
test eax, eax
js 0x41372b
mov ecx, dword [ebp - 0x250]
call fcn.004de78b
mov ebx, eax
test ebx, ebx
je 0x413763
cmp dword [ebp - 0x23c], 0x50
mov ecx, dword [ebp - 0x228]
jne 0x413751
cmp ecx, 0x51
jne 0x413751
mov eax, dword [ebp - 0x240]
cmp eax, edi
je 0x413763
test eax, eax
je 0x413763
xor eax, eax
cmp ecx, 0x50
push edi
cmove eax, dword [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.00495b92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.004d84a5
mov ecx, dword [esi + 0x3e6c]
mov dword [esi + 0x54a8], edi
call fcn.004bc0f7
mov eax, dword [ebp - 0x244]
call fcn.004f418c
ret 0xc
Function at 0x41c155
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [0x5a23ec]
mov dword [ebp - 0x260], edi
test byte [ecx + 0x113c9], 1
jne 0x41c1a6
push 2
call fcn.004673c5
test eax, eax
je 0x41c2dc
xor esi, esi
mov ecx, edi
inc esi
push esi
push esi
push str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_isMonitorConsoleLang0
call fcn.00410feb
jmp 0x41c2dc
push ebx
push 0x50
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x254]
xor ebx, ebx
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, dword [ebp + 8]
mov edx, eax
xor esi, esi
mov dword [ebp - 0x25c], edx
xor ecx, ecx
inc esi
cmp ecx, edx
jae 0x41c1ee
cmp dword [ebp + ecx*4 - 0x254], edi
cmove ebx, esi
inc ecx
test ebx, ebx
je 0x41c1db
xor eax, eax
mov dword [ebp - 0x258], eax
test ebx, ebx
jne 0x41c23f
cmp eax, edx
jae 0x41c22d
mov edx, dword [ebp + eax*4 - 0x254]
movzx ecx, dx
movzx eax, di
cmp ecx, eax
cmove ebx, esi
inc dword [ebp - 0x258]
cmp ecx, eax
mov eax, dword [ebp - 0x258]
cmovne edx, edi
mov edi, edx
mov edx, dword [ebp - 0x25c]
test ebx, ebx
je 0x41c1fa
test ebx, ebx
jne 0x41c23f
movzx eax, di
cmp edi, eax
jne 0x41c23f
mov eax, edi
shl eax, 0x10
or edi, eax
mov ebx, dword [ebp - 0x260]
push dword [ebx + 0x77fc]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [0x5a23ec]
push 2
cmp edi, eax
je 0x41c2ad
call fcn.004673c5
test eax, eax
je 0x41c28b
push edi
lea eax, [ebp - 0x204]
push str.CConEmuMain::SwitchKeyboardLayout__posting_WM_INPUTLANGCHANGEREQUEST__WM_INPUTLANGCHANGE_for_0x_08X
push eax
call fcn.00409bde
add esp, 0xc
lea eax, [ebp - 0x204]
mov ecx, ebx
push esi
push esi
push eax
call fcn.00410feb
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push edi
push 0
push 0x50
push dword [0x5a22a4]
call esi
push edi
push 0
push 0x51
push dword [0x5a22a4]
call esi
jmp 0x41c2db
call fcn.004673c5
test eax, eax
je 0x41c2db
push edi
lea eax, [ebp - 0x204]
push str.CConEmuMain::SwitchKeyboardLayout_skipped__cause_of_GetActiveKeyboardLayout__0x_08X
push eax
call fcn.00409bde
add esp, 0xc
lea eax, [ebp - 0x204]
mov ecx, ebx
push esi
push esi
push eax
call fcn.00410feb
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret 4
Function at 0x4202bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x8c], 0
and dword [ebp - 0x88], 0
push ebx
push esi
push edi
call fcn.00421938
mov esi, eax
mov dword [ebp - 0xa0], esi
test esi, esi
je 0x4202fe
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + 1]
jmp 0x420300
xor ebx, ebx
mov dword [ebp - 0x90], ebx
call fcn.004217de
mov edi, eax
test edi, edi
je 0x42031b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
jmp 0x42031d
xor eax, eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x94], eax
push ecx
lea ecx, [ebp - 0x8c]
add eax, ebx
push ecx
add eax, eax
push eax
call fcn.004212b5
mov ebx, dword [ebp - 0x8c]
add esp, 0xc
test al, al
je 0x4204c6
mov eax, dword [ebp - 0x88]
xor esi, esi
push ebx
push 0x421b58
push esi
push esi
mov dword [ebp - 0x98], eax
mov dword [ebx + 0x1dc], esi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push 0xc
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
mov dword [ebx + 0x1b4], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call fcn.004e3d43
xor ecx, ecx
test al, al
setne cl
mov dword [ebx + 0x1b8], ecx
call fcn.004e3b47
xor ecx, ecx
test al, al
setne cl
mov dword [ebx + 0x1bc], ecx
call fcn.004ea09e
xor ecx, ecx
test al, al
setne cl
xor esi, esi
mov dword [ebx + 0x1c0], ecx
cmp dword [ebx + 0x1c4], esi
jne 0x420469
cmp dword [ebx + 0x5c], 5
jne 0x420469
push 0x80
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420469
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x7e
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push esi
push str.ProductName
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42045d
push 0x52aa34
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
inc eax
mov dword [ebx + 0x1c4], eax
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xa0]
test esi, esi
je 0x4204a3
mov eax, dword [ebp - 0x88]
push esi
push dword [ebp - 0x90]
push eax
call fcn.00401a0b
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x90]
mov dword [ebx + 0xa60], ecx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x98], ecx
jmp 0x4204a9
mov ecx, dword [ebp - 0x88]
test edi, edi
je 0x4204c6
push edi
push dword [ebp - 0x94]
push ecx
call fcn.00401a0b
mov eax, dword [ebp - 0x98]
mov dword [ebx + 0xa64], eax
test esi, esi
je 0x4204d1
push esi
call fcn.004e1bea
pop ecx
test edi, edi
je 0x4204dc
push edi
call fcn.004e1bea
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
Function at 0x4218a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x421935
xor ecx, ecx
lea eax, [ebp + 8]
push eax
push ecx
push ecx
push ecx
push str.AutoRun
push dword [esi]
mov dword [ebp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42192a
mov eax, dword [ebp + 8]
test eax, eax
je 0x42192a
push edi
add eax, 2
push 1
push eax
call fcn.004e1c42
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x421929
lea eax, [ebp + 8]
push eax
push edi
xor eax, eax
push eax
push eax
push str.AutoRun
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x421922
cmp word [edi], ax
je 0x421922
push eax
push eax
push eax
push eax
push eax
push 0x5219f4
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004e249f
add esp, 0x24
push edi
call fcn.004e1bea
pop ecx
pop edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi], 0
pop esi
pop ebp
ret
Function at 0x445aaa
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x674], edi
test eax, eax
je 0x445ca2
xor ecx, ecx
mov dword [ebp - 0x670], ecx
cmp word [eax], cx
je 0x445ca2
push ebx
push esi
push eax
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.00401a0b
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x414]
push str..
lea eax, [ecx + eax*2]
lea esi, [eax - 2]
cmp word [esi], 0x5c
cmovne esi, eax
mov eax, ecx
push eax
push esi
mov dword [ebp - 0x668], esi
call fcn.004326bb
add esp, 0xc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x66c], ebx
cmp ebx, 0xffffffff
je 0x445ca0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test byte [ebp - 0x664], 0x10
jne 0x445c79
xor eax, eax
mov word [esi + 2], ax
lea eax, [ebp - 0x638]
push 0x2e
push eax
call fcn.004f6844
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x445c73
push str..ttf
push esi
call ebx
test eax, eax
je 0x445bad
push str..otf
push esi
call ebx
test eax, eax
je 0x445bad
push str..bdf
push esi
call ebx
test eax, eax
jne 0x445c73
lea esi, [ebp - 0x638]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x445bb8
sub esi, ecx
lea ecx, [ebp - 0x414]
sar esi, 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x670]
jne 0x445bd0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
cmp eax, 0x104
jb 0x445c46
add esi, 0x64
push 2
push esi
call fcn.004e1c42
pop ecx
pop ecx
push str.Too_long_full_pathname_for_font:_n
mov edi, eax
push esi
push edi
call fcn.00401a0b
lea eax, [ebp - 0x638]
push eax
push esi
push edi
call fcn.004019cd
mov ecx, dword [0x5a22a0]
push 1
push 0xffffffffffffffff
call fcn.0040eff3
push eax
push 0x11
push edi
call fcn.00421ef1
push edi
mov esi, eax
call fcn.004e1bea
add esp, 0x18
cmp esi, 2
je 0x445c94
mov edi, dword [ebp - 0x674]
jmp 0x445c73
lea eax, [ebp - 0x638]
push eax
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.004019cd
xor eax, eax
mov ecx, edi
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0044523a
test eax, eax
je 0x445c94
mov esi, dword [ebp - 0x668]
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445b58
push dword [ebp - 0x66c]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004f4166
leave
ret 4
Function at 0x44cfd3
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
movzx ecx, dl
push edi
mov word [esi], ax
cmp ecx, 0x5c
ja 0x44d18e
cmp ecx, 0x5b
jae 0x44d184
cmp ecx, 0x1b
ja 0x44d0da
je 0x44d0d0
cmp ecx, 9
ja 0x44d072
je 0x44d068
mov eax, ecx
sub eax, 0
je 0x44d29b
sub eax, 1
je 0x44d05e
sub eax, 1
je 0x44d054
sub eax, 1
je 0x44d04a
sub eax, 1
je 0x44d040
sub eax, 4
jne 0x44d226
push str.Backspace
jmp 0x44d293
push str.MButton
jmp 0x44d293
push str.Break
jmp 0x44d293
push str.RButton
jmp 0x44d293
push str.LButton
jmp 0x44d293
push 0x5364e4
jmp 0x44d293
mov eax, ecx
sub eax, 0xd
je 0x44d0c6
sub eax, 3
je 0x44d0bc
sub eax, 1
je 0x44d0b2
sub eax, 1
je 0x44d0a8
sub eax, 1
jne 0x44d226
cmp byte [ebp + 0x10], 0
mov eax, str.Pause
mov ecx, str.Break
cmove eax, ecx
push eax
jmp 0x44d293
push 0x536454
jmp 0x44d293
push str.Ctrl
jmp 0x44d293
push str.Shift
jmp 0x44d293
push 0x531ad0
jmp 0x44d293
push 0x5364ec
jmp 0x44d293
cmp ecx, 0x25
ja 0x44d133
je 0x44d129
push 0x20
mov eax, ecx
pop edi
sub eax, edi
je 0x44d122
sub eax, 1
je 0x44d11b
sub eax, 1
je 0x44d114
sub eax, 1
je 0x44d10d
sub eax, 1
jne 0x44d226
push str.Home
push edi
jmp 0x44d295
push 0x536520
jmp 0x44d107
push str.PgDn
jmp 0x44d107
push str.PgUp
jmp 0x44d107
push str.Space
jmp 0x44d107
push 0x52c9c0
jmp 0x44d293
mov eax, ecx
sub eax, 0x26
je 0x44d17a
sub eax, 1
je 0x44d170
sub eax, 1
je 0x44d166
sub eax, 5
je 0x44d15c
sub eax, 1
jne 0x44d226
push str.Delete
jmp 0x44d293
push str.Insert
jmp 0x44d293
push str.Down
jmp 0x44d293
push str.Right
jmp 0x44d293
push 0x5364ac
jmp 0x44d293
push 0x536428
jmp 0x44d293
mov eax, 0xa5
cmp ecx, eax
ja 0x44d1ff
je 0x44d1f5
mov eax, ecx
sub eax, 0x5d
je 0x44d1eb
sub eax, 0x43
je 0x44d1e1
sub eax, 1
je 0x44d1d7
sub eax, 1
je 0x44d1cd
sub eax, 1
je 0x44d1c3
sub eax, 1
jne 0x44d226
push str.LAlt
jmp 0x44d293
push str.RCtrl
jmp 0x44d293
push str.LCtrl
jmp 0x44d293
push str.RShift
jmp 0x44d293
push str.LShift
jmp 0x44d293
push 0x5364a0
jmp 0x44d293
push str.RAlt
jmp 0x44d293
mov eax, ecx
sub eax, 0xbb
je 0x44d28e
dec eax
sub eax, 1
je 0x44d287
sub eax, 0x13
je 0x44d280
sub eax, 1
je 0x44d279
sub eax, 1
je 0x44d272
sub eax, 1
je 0x44d26b
lea eax, [edx - 0x70]
cmp al, 0x17
ja 0x44d241
lea eax, [ecx - 0x6f]
push eax
push 0x5365d8
push esi
call fcn.00401104
add esp, 0xc
jmp 0x44d29b
cmp dl, 0x41
jb 0x44d24b
cmp dl, 0x5a
jbe 0x44d252
lea eax, [edx - 0x30]
cmp al, 9
ja 0x44d260
movzx eax, dl
mov word [esi], ax
xor eax, eax
mov word [esi + 2], ax
jmp 0x44d29b
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
jmp 0x44d255
push str.WheelRight
jmp 0x44d293
push str.WheelLeft
jmp 0x44d293
push str.WheelDown
jmp 0x44d293
push str.WheelUp
jmp 0x44d293
push 0x536548
jmp 0x44d293
push 0x536550
push 0x20
push esi
call fcn.004019cd
pop edi
pop esi
pop ebp
ret
Function at 0x44f8cc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov bl, al
push edi
test esi, esi
je 0x44fa12
cmp word [esi], ax
je 0x44fa12
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xa005
push dword [ebp + 8]
call edi
push str.WorkerW
push eax
mov dword [ebp + 0xc], eax
call fcn.0044e9fc
pop ecx
pop ecx
test al, al
je 0x44fa12
push 0xa005
push dword [ebp + 0xc]
call edi
mov edi, eax
push str.ReBarWindow32
push edi
call fcn.0044e9fc
pop ecx
pop ecx
test al, al
je 0x44fa12
push str.ToolbarWindow32
push edi
call fcn.0044ebe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x44fa12
movzx eax, word [esi]
and dword [ebp + 0xc], 0
mov ecx, eax
test ax, ax
je 0x44fa0e
xor ebx, ebx
mov dword [ebp + 8], esi
mov dword [ebp - 8], 0x79
inc ebx
movzx eax, cx
mov ecx, 0x100
cmp ax, word [ebp - 8]
push 0
push eax
lea edx, [ecx + 4]
cmove ecx, edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp + 8]
shl eax, 0x10
push 0x79
pop edx
movzx ecx, word [ecx]
or eax, ebx
cmp cx, dx
jne 0x44f9c8
push 0x50005
push 0
push 0x201
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x50005
push 0
push 0x202
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x44f9db
push eax
push ecx
push dword [ebp - 0xc]
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], eax
test eax, eax
je 0x44fa06
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
je 0x44fa06
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
lea eax, [esi + eax*2]
mov dword [ebp + 8], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x44f96f
jmp 0x44fa0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
mov al, bl
jmp 0x44fa14
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x484069
Capabilities:
Enumerate processes

Disassembly:
push 0x324
mov eax, 0x51051c
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x310], esi
push dword [esi + 0x5fc]
lea ecx, [ebp - 0x330]
call fcn.004821dd
mov edi, dword [ebp - 0x32c]
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x48428b
cmp dword [esi + 0x5f4], ebx
jne 0x4840b2
mov dword [esi + 0x5f4], ebx
push 0x556414
mov ecx, esi
call fcn.0048a02d
mov dword [ebp - 0x30c], ebx
movaps xmm0, xmmword [0x55a290]
mov dword [ebp - 0x314], ebx
movups xmmword [ebp - 0x324], xmm0
push ebx
push 2
mov byte [ebp - 4], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x308], eax
test eax, eax
je 0x484217
cmp eax, 0xffffffff
je 0x484217
push 0x228
lea eax, [ebp - 0x300]
mov dword [ebp - 0x304], 0x22c
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x308]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48418a
mov esi, dword [ebp - 0x308]
push 0x5563ac
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x484173
push ebx
push ebx
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [edi + 8]
call fcn.0040eeeb
test al, al
jne 0x484173
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x324]
call fcn.00497f1f
lea eax, [ebp - 0x304]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x484136
mov esi, dword [ebp - 0x310]
push dword [ebp - 0x308]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0
jle 0x484217
cmp dword [ebp - 0x320], 1
jle 0x4841e9
push 0x556440
mov ecx, esi
call fcn.0048a02d
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 4
call fcn.0040635a
mov eax, dword [ebp - 0x30c]
inc eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x30c], eax
cmp eax, 1
jle 0x4840c4
jmp 0x484229
mov eax, dword [ebp - 0x314]
mov eax, dword [eax + 8]
mov dword [esi + 0x5f4], eax
test eax, eax
je 0x484211
push eax
lea eax, [ebp - 0xd8]
push 0x5564b8
push eax
call fcn.00409b7d
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x48421b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x324]
call fcn.0040635a
mov byte [ebp - 4], bl
cmp byte [ebp + 8], 0
je 0x48423a
lea ecx, [esi + 0x5f8]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x5a23ec]
push 1
call fcn.004673c5
test eax, eax
je 0x484273
push dword [esi + 0x5f4]
lea eax, [ebp - 0xd8]
push 0x55649c
push eax
call fcn.00409b7d
add esp, 0xc
lea eax, [ebp - 0xd8]
mov ecx, esi
push eax
call fcn.0048a02d
mov ebx, dword [esi + 0x5f4]
test ebx, ebx
je 0x48428b
mov ecx, dword [esi + 4]
call fcn.00419bbf
mov ebx, dword [esi + 0x5f4]
mov dword [ebp - 4], 7
test edi, edi
je 0x48429d
mov ecx, edi
call fcn.0040771d
mov eax, ebx
call fcn.004f418c
ret 4
Function at 0x4842a7
Capabilities:
Enumerate processes

Disassembly:
push 0x244
mov eax, 0x51054f
call fcn.004f41e2
mov ebx, ecx
push dword [ebx + 0x5fc]
lea ecx, [ebp - 0x250]
call fcn.004821dd
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x24c]
test edi, edi
je 0x4843a9
push 0x556370
mov ecx, ebx
call fcn.0048a02d
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x240], eax
call fcn.004919f2
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x48439d
cmp esi, 0xffffffff
je 0x48439d
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x484396
mov edi, dword [ebp - 0x240]
mov dword [ebp - 0x244], 1
push 0x5563ac
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48437f
lea eax, [ebp - 0x244]
mov ecx, edi
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0041a8f9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x484354
mov edi, dword [ebp - 0x24c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5563c8
mov ecx, ebx
call fcn.0048a02d
mov dword [ebp - 4], 2
test edi, edi
je 0x4843bb
mov ecx, edi
call fcn.0040771d
call fcn.004f418c
ret
Function at 0x487dd1
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
call fcn.00497a64
test al, al
jne 0x487e3b
test esi, esi
je 0x487e3b
cmp dword [esi + 0x5d8], 0
je 0x487e3b
lea eax, [esi + 0x4066]
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x4868b3
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x208]
jmp 0x487e3d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret

Function at 0x488f7b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x488f9b
cmp dword [esi], 0
je 0x488f9b
call fcn.00496ee8
test al, al
je 0x488f9b
mov ecx, dword [esi]
add ecx, 0xc
pop esi
jmp 0x4cfd6c
xor al, al
pop esi
ret
push esi
mov esi, ecx
cmp byte [esi + 0x7c], 0
je 0x4cfd8f
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4cfd8b
mov byte [esi + 0x7c], 0
cmp byte [esi + 0x7c], 0
setne al
pop esi
ret
Function at 0x48d516
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x48d543
mov edi, dword [ebp + 8]
test edi, edi
je 0x48d543
xor bl, bl
call fcn.00497a2e
test al, al
jne 0x48d54c
push 0x556f3c
mov ecx, esi
call fcn.00489fb2
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [esi + 0x828]
test eax, eax
je 0x48d55b
cmp eax, 0xffffffff
jne 0x48d56d
mov ecx, esi
call fcn.0048c716
test al, al
jne 0x48d56d
push 0x556f78
jmp 0x48d53c
xor eax, eax
inc eax
mov dword [0x5a4f5c], eax
mov eax, dword [ebp + 0xc]
imul ecx, eax, 0x18
push 0
mov dword [edi + 4], eax
lea eax, [ebp + 8]
push eax
add ecx, 8
push ecx
push edi
mov dword [edi], ecx
push dword [esi + 0x828]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48d5a5
xor eax, eax
lea ebx, [eax + 1]
jmp 0x48d601
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [ebp + 0xc], eax
call fcn.00497047
test al, al
jne 0x48d601
mov eax, dword [ebp + 0xc]
cmp eax, 0xe8
je 0x48d5ca
cmp eax, 0xe9
jne 0x48d601
mov ecx, esi
call fcn.00497a2e
test al, al
je 0x48d601
mov ecx, esi
call fcn.0048c716
test al, al
je 0x48d601
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
push edi
push dword [esi + 0x828]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
and dword [0x5a4f5c], 0
mov al, bl
jmp 0x48d545