Function at 0x483db0
Capabilities:
Check for foreground window switch
Check mutex on windows
Create directory
Create process on windows
Encode data using xor
Find taskbar
Log keystrokes
Read file via mapping
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0xf8
mov ecx, 0x57d64c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x483de7
test dx, dx
je 0x483de3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x483de7
add eax, 4
add ecx, 4
test dx, dx
jne 0x483dc1
xor eax, eax
jmp 0x483dec
sbb eax, eax
or eax, 1
push ebx
push esi
test eax, eax
je 0x483f30
xor eax, eax
mov dword [ebp - 0xc], 0
push eax
push 0x104
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
call fcn.00402d00
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push dword [ebp - 0xc]
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 8], 8
lea eax, [ebp + 8]
lea esi, [ebp - 0x1c]
mov dword [ebp + 0x10], 1
cmovae esi, dword [ebp - 0x1c]
xor ebx, ebx
push eax
push 8
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x483e91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_open_process_token._Error_code:
push 0x5bb3e8
call fcn.0047dfa0
add esp, 8
mov ecx, eax
call fcn.0047ee90
push eax
call fcn.0047e3b0
add esp, 4
xor bl, bl
jmp 0x483efc
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
push 4
lea eax, [ebp + 0x10]
push eax
push 0x12
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x483ee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_token_information._Error_code:
push 0x5bb3e8
call fcn.0047dfa0
add esp, 8
mov ecx, eax
call fcn.0047ee90
push eax
call fcn.0047e3b0
add esp, 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x483efc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 2
mov eax, 1
cmove ebx, eax
push 1
push 0
push 0x57d64c
mov ecx, str.open
test bl, bl
push esi
mov eax, str.runas
cmove eax, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00403070
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
push edi
push 0
mov dword [0x5ba6f8], eax
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [ebp - 0x54]
push eax
call fcn.00453340
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x54]
add esp, 4
mov esi, 1
cmp dword [ebp - 0x40], 8
cmovae edx, dword [ebp - 0x54]
lea edi, [eax + eax]
lea ebx, [esi + 3]
test edi, edi
je 0x483f91
nop word [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
mov ecx, esi
and ecx, 0x3f
add ecx, ebx
add ebx, 3
imul ecx, eax
mov eax, esi
shl eax, 8
add ecx, eax
xor esi, ecx
sub edi, 1
jne 0x483f70
push esi
lea eax, [ebp - 0xd0]
push str.LucyMutex__08X
push eax
call fcn.004014d0
push esi
lea eax, [ebp - 0x84]
push str.LucyShareMemory__08X
push eax
call fcn.004014d0
add esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp - 0xbc], 8
lea eax, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xd0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x484057
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x70], 8
lea eax, [ebp - 0x84]
cmovae eax, dword [ebp - 0x84]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0x484050
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x484049
push 0
push 0
push 0x465
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x484762
push str.IsWow64Process
push str.kernel32
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x484088
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp + 0x10], 0
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
je 0x4840a7
push 0x40030
push 0x57f698
push 0x57f6a0
push 0
call edi
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x57f6c4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0040bd70
add esp, 0xc
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x58], 8
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4840f8
cmp dword [ebp - 0x58], 8
lea eax, [ebp - 0x6c]
push 0
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.0047a9c0
mov ecx, eax
call fcn.0047fc70
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call fcn.0047a9c0
push 0
push str.Progman
push 0
mov dword [eax + 0xc], esi
call fcn.0047a9c0
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
mov eax, dword [eax + 0xc]
push eax
call ebx
mov esi, eax
call fcn.0047a9c0
push 0
push str.Shell_TrayWnd
push 0
mov dword [eax + 0x10], esi
call fcn.0047a9c0
mov eax, dword [eax + 0xc]
push eax
call ebx
mov esi, eax
call fcn.0047a9c0
mov dword [eax + 0x14], esi
call fcn.0047a9c0
cmp dword [eax + 0x14], 0
je 0x48417f
push 0
push str.TrayNotifyWnd
push 0
call fcn.0047a9c0
mov eax, dword [eax + 0x14]
push eax
call ebx
mov esi, eax
call fcn.0047a9c0
mov dword [eax + 0x18], esi
push 0x10
push str.R7_qsSb_YB_y3T
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.004027c0
lea eax, [ebp - 0x1c]
push eax
push 0x57af88
push 0xc9
call fcn.00409960
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00402770
push 0xa
xor eax, eax
mov dword [ebp - 0x2c], 0
push str.langzh_CN
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
call fcn.00402e60
push 4
xor eax, eax
mov dword [ebp - 0xa8], 0
push str.gray
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00402e60
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], 0x57f7c0
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0x1c]
push 5
xor eax, eax
mov dword [ebp - 0xf4], 0x481060
push str.skin_
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
call fcn.00402e60
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00407c40
add esp, 0x14
lea ecx, [ebp - 0x1c]
call fcn.00403070
mov ecx, dword [ebp - 0xd4]
test ecx, ecx
je 0x4842a3
mov edx, dword [ecx]
lea eax, [ebp - 0xf8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0xd4], 0
lea ecx, [ebp - 0xb8]
call fcn.00403070
lea ecx, [ebp - 0x3c]
call fcn.00403070
call fcn.0047a9c0
cmp dword [eax + 0xa0], 0
je 0x484321
call fcn.0047a9c0
add eax, 0x90
push eax
call fcn.00480350
add esp, 4
test al, al
jne 0x484321
call fcn.0047a9c0
add eax, 0x90
cmp dword [eax + 0x14], 8
jb 0x4842ed
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x3c]
push 0x57f704
push eax
call fcn.004014d0
add esp, 0xc
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
cmovae eax, dword [ebp - 0x3c]
push 0x40030
push 0x57f698
push eax
push 0
call edi
lea ecx, [ebp - 0x3c]
call fcn.00403070
push 0x264
call fcn.00532e0c
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x484382
mov dword [ebx + 8], 0x57f4a0
mov ecx, ebx
mov dword [ebx + method.nbase::SupportWeakCallback.virtual_0], vtable.nbase::SupportWeakCallback.0
push 0
mov dword [ebx + 0x25c], 0
mov dword [ebx + 0x260], 0
call fcn.004387e0
mov eax, dword [ebx + 8]
mov dword [ebx], vtable.CHideWnd.0
mov dword [ebx + method.CHideWnd.virtual_60], vtable.CHideWnd.1.0
mov eax, dword [eax + 4]
mov dword [eax + ebx + 8], vtable.CHideWnd.2.0
jmp 0x484384
xor ebx, ebx
cmp dword [0x5b4818], 8
lea edx, [ebp - 0x14]
mov eax, dword [ebx]
mov ecx, 0x5b4804
cmovae ecx, dword [0x5b4804]
xorps xmm0, xmm0
push edx
push 1
push 0
push 0x80880000
push ecx
push 0
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push 1
push 0
call dword [eax + 0x14]
push 0x156c
call fcn.00532e0c
add esp, 4
test eax, eax
je 0x4843e4
push 1
push dword [ebp + 8]
mov ecx, eax
call fcn.00487830
mov edi, eax
mov dword [ebp - 0x20], eax
jmp 0x4843e9
xor edi, edi
mov dword [ebp - 0x20], edi
cmp dword [0x5b4818], 8
lea ecx, [ebp - 0x14]
mov esi, dword [edi]
mov eax, 0x5b4804
cmovae eax, dword [0x5b4804]
xorps xmm0, xmm0
push ecx
push 1
push 0
push 0xce0000
push eax
mov ecx, ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.004237c0
push eax
mov ecx, edi
call dword [esi + 0xc]
mov ecx, edi
call fcn.004237c0
mov esi, eax
call fcn.0047a9c0
mov dword [eax + 8], esi
call fcn.0047a9c0
mov dword [eax + 4], 0
call fcn.0047a9c0
cmp byte [eax + 0x2f], 0
jne 0x484473
call fcn.0047a9c0
cmp byte [eax + 0x30], 0
jne 0x484473
call fcn.0047a9c0
cmp byte [eax + 0x2e], 0
jne 0x484473
call fcn.0047a9c0
cmp byte [eax + 0x2d], 0
jne 0x484473
call fcn.0047a9c0
cmp byte [eax], 0
je 0x48448f
push 0
push dword [ebp + 8]
push 0x480cc0
push 0xe
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov esi, eax
call fcn.0047a9c0
mov dword [eax + 4], esi
lea eax, [ebp + 8]
push eax
push 0x58e464
push 1
push 0
push 0x58e434
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4844d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
mov ecx, edi
mov esi, dword [eax]
call fcn.004237c0
push eax
push dword [ebp + 8]
call dword [esi + 0x14]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.0047a9c0
mov ecx, edi
cmp byte [eax + 0x23], 0
je 0x4844e7
call fcn.0048d540
jmp 0x4845eb
mov eax, dword [edi]
push 1
push 1
call dword [eax + 0x14]
mov ecx, edi
call fcn.004237c0
mov esi, eax
push esi
mov dword [ebp + 0x10], esi
call dword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
setne byte [ebp + 0xb]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x484536
push 0
push 0xf120
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [ebp + 0xb], 0
jne 0x484605
mov dword [ebp + 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, eax
je 0x4845c4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
mov esi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
inc edi
mov dword [ebp + 8], edi
cmp edi, 0xa
jl 0x484547
mov edi, dword [ebp - 0x20]
push dword [edi + 0x10]
call sub.IMM32.dll_ImmGetContext
push 0
push eax
mov dword [edi + 0x1558], eax
call sub.IMM32.dll_ImmSetOpenStatus
push dword [edi + 0x1558]
push dword [edi + 0x10]
call sub.IMM32.dll_ImmAssociateContext
call fcn.0047a9c0
cmp byte [eax + 0x22], 0
je 0x484615
push 1
mov ecx, ebx
call fcn.0043a7a0
mov byte [ebp + 8], 1
jmp 0x484619
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4845c7
mov byte [ebp + 8], 0
push dword [ebp + 8]
mov ecx, edi
call fcn.0043a7a0
cmp dword [ebp - 0x70], 8
lea eax, [ebp - 0x84]
cmovae eax, dword [ebp - 0x84]
push eax
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 8], eax
test eax, eax
je 0x484670
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x484670
mov ecx, edi
call fcn.004237c0
mov dword [esi], eax
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0xa0]
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
push 0
push eax
movups xmmword [ebp - 0xa0], xmm0
movq qword [ebp - 0x90], xmm0
call esi
test eax, eax
je 0x4846d9
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop dword [eax + eax]
lea eax, [ebp - 0xa0]
push eax
call edi
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0xa0]
push eax
call esi
test eax, eax
jne 0x4846b0
call fcn.0047a9c0
cmp dword [eax + 4], 0
je 0x4846f3
call fcn.0047a9c0
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.0047a9c0
mov ecx, ebx
mov dword [eax + 4], 0
call fcn.00426fd0
push eax
mov ecx, ebx
call fcn.00424690
mov eax, dword [ebx + 8]
push 1
mov ecx, dword [eax + 4]
add ecx, 8
add ecx, ebx
mov eax, dword [ecx]
call dword [eax]
call fcn.00408290
mov eax, dword [ebp - 4]
test eax, eax
je 0x484732
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp + 8]
test eax, eax
je 0x484740
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x48474e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, dword [ebp - 0x98]
lea ecx, [ebp - 0x6c]
call fcn.00403070
lea ecx, [ebp - 0x84]
call fcn.00403070
lea ecx, [ebp - 0xd0]
call fcn.00403070
lea ecx, [ebp - 0x54]
call fcn.00403070
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10