joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472f40
Capabilities:
Get graphical window text
Set registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x118
test eax, eax
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [0x4d67a0]
push esi
push edi
je 0x472fd0
push 0
push 0
push 0x147
push ebx
call ebp
test eax, eax
jle 0x472f7f
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x148
push ebx
call ebp
jmp 0x472f90
lea edx, [esp + 0x24]
push 0x104
push edx
push ebx
call dword [0x4d66c4]
mov al, byte [esp + 0x24]
test al, al
je 0x472fd0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x158
push ebx
call ebp
test eax, eax
jl 0x472fb6
push 0
push eax
push 0x144
push ebx
call ebp
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x14a
push ebx
call ebp
push 0
push eax
push 0x14e
push ebx
call ebp
push 0
push 0
push 0x146
push ebx
call ebp
mov ecx, dword [esp + 0x134]
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x472ff5
cmp eax, ecx
jle 0x472ff5
mov dword [esp + 0x10], ecx
mov eax, ecx
mov edi, 1
xor esi, esi
test eax, eax
mov dword [esp + 0x14], edi
jle 0x47303b
push 0
push esi
push 0x149
push ebx
call ebp
mov ecx, dword [esp + 0x138]
inc eax
test ecx, ecx
je 0x473022
lea edx, [eax + edi]
cmp edx, ecx
jg 0x473033
add edi, eax
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x473004
mov dword [esp + 0x14], edi
jmp 0x47303b
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
push edi
call fcn.004bd49b
mov dword [esp + 0x20], eax
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
xor edi, edi
test eax, eax
jle 0x473072
push esi
push edi
push 0x148
push ebx
call ebp
push esi
call dword [0x4d637c]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x473054
mov edx, dword [esp + 0x13c]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0x20006
push 0
push 0x4f55a8
push 0
push edx
push 0x80000001
mov byte [esi], 0
call dword [0x4d602c]
test eax, eax
je 0x4730b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118
ret
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x18]
push eax
push edi
push 3
push 0
push ecx
push edx
call dword [0x4d6030]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [0x4d6018]
push edi
call fcn.004bd4c4
add esp, 4
xor eax, eax
test esi, esi
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x118
ret
Function at 0x473100
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
call dword [0x4d6024]
test eax, eax
je 0x473129
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [0x4d6028]
lea edx, [esp + 0x18]
push esi
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push ebx
push ecx
mov dword [esp + 0x34], 0
call ebp
mov esi, eax
test esi, esi
jne 0x4731ca
mov edx, dword [esp + 0x1c]
push edi
inc edx
push edx
call fcn.004bd49b
mov edx, dword [esp + 0x14]
add esp, 4
mov edi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
push esi
push ebx
push edx
call ebp
test eax, eax
mov dword [esp + 0x24], eax
jne 0x4731bc
mov eax, dword [esp + 0x20]
mov esi, edi
mov byte [edi + eax], 0
mov al, byte [edi]
test al, al
je 0x4731bc
mov ebx, dword [esp + 0x1c]
mov ebp, dword [0x4d67a0]
push esi
push 0
push 0x143
push ebx
call ebp
push esi
call dword [0x4d637c]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4731a1
push edi
call fcn.004bd4c4
mov esi, dword [esp + 0x28]
add esp, 4
pop edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x4d6018]
xor eax, eax
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x473730
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4d67d8]
push 0x7f02
push 0
call edi
mov ebx, dword [0x4d67dc]
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
push 1
push 0
push 0
push eax
push 0
push ecx
call dword [0x4d6544]
xor edx, edx
cmp eax, 0x1f
setg dl
test esi, esi
mov ebp, edx
je 0x473780
mov eax, esi
push eax
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
push 0x7f00
push 0
call edi
push eax
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x4737e0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [0x4d67a0]
push 0
push eax
push 0x419
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x41d
push esi
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov dword [esp + 8], eax
lea eax, [edx + ecx]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push esi
call dword [0x4d672c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [0x4d67f0]
pop edi
pop esi
add esp, 0x18
ret

Function at 0x473860
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x18
lea eax, [esp]
push esi
push edi
push eax
call dword [0x4d6748]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
push esi
call dword [0x4d6688]
mov edx, dword [esp + 0x28]
mov edi, dword [0x4d67a0]
push 0
push edx
push 0x419
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x41d
push esi
call edi
pop edi
pop esi
test eax, eax
jne 0x4738ad
add esp, 0x18
ret
mov edx, dword [esp + 4]
mov eax, dword [esp]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [0x4d66d4]
add esp, 0x18
ret

Function at 0x473fa0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0xc]
push eax
call dword [0x4d6714]
mov ecx, dword [esi + 8]
push 1
push ecx
call dword [0x4d67f8]
mov edx, dword [esi + 0xc]
push 0
push edx
call dword [0x4d6828]
pop esi
ret

Function at 0x473fd0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0xc]
push eax
call dword [0x4d6714]
mov ecx, dword [esi + 0xc]
push 5
push ecx
call dword [0x4d6828]
mov edx, dword [esi + 8]
push 0
push edx
call dword [0x4d67f8]
pop esi
ret
Function at 0x4746d0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
push eax
call dword [0x4d6530]
test eax, eax
jne 0x4747bd
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 0x4deb30
push 0
push esi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x474719
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret
push ebx
lea edx, [esp + 0xc]
push edi
push edx
push 0
push 0
call dword [0x4d652c]
mov ebx, dword [esp + 0x10]
test esi, esi
je 0x474789
test ebx, ebx
je 0x474789
mov ax, word [esi]
mov edx, esi
test ax, ax
mov ecx, 2
je 0x474756
and eax, 0xffff
add edx, eax
add ecx, eax
mov ax, word [edx]
test ax, ax
jne 0x474745
mov ax, word [ebx]
mov edx, ebx
test ax, ax
mov edi, 2
je 0x474776
and eax, 0xffff
add edx, eax
add edi, eax
mov ax, word [edx]
test ax, ax
jne 0x474765
cmp ecx, edi
jne 0x474789
mov edi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov edx, eax
sete dl
mov esi, edx
jmp 0x47478b
xor esi, esi
mov eax, dword [0x4f6114]
mov edi, ebx
test eax, eax
jne 0x4747a6
push 0x4f6114
call dword [0x4d6520]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
pop edi
test esi, esi
pop ebx
jne 0x4747bf
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x4747d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
lea eax, [esp + 8]
push ebp
push esi
push edi
mov edi, dword [0x4d6530]
push eax
call edi
test eax, eax
jne 0x474962
mov edx, dword [esp + 0x234]
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push 0x104
push ecx
push 0xffffffffffffffff
push edx
push 1
push eax
mov dword [esp + 0x28], eax
call dword [0x4d6400]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x2c]
push edx
push ecx
push 0
push 0
push esi
call dword [eax + 0xc]
mov esi, dword [esp + 0x10]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x14]
setl dl
mov ecx, dword [eax]
dec edx
and edx, esi
push eax
mov ebp, edx
call dword [ecx + 8]
test ebp, ebp
je 0x474962
lea edx, [esp + 0xc]
push edx
call edi
test eax, eax
jne 0x474934
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 0x4deb30
mov ecx, dword [eax]
push 0
push ebp
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x47488d
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [esp + 0x18]
jmp 0x474936
lea edx, [esp + 0x1c]
push ebx
push edx
push 0
push 0
call dword [0x4d652c]
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4748fb
mov ax, word [ebp]
mov edx, ebp
test ax, ax
mov ecx, 2
je 0x4748c6
and eax, 0xffff
add edx, eax
add ecx, eax
mov ax, word [edx]
test ax, ax
jne 0x4748b5
mov ax, word [ebx]
mov edx, ebx
test ax, ax
mov esi, 2
je 0x4748e6
and eax, 0xffff
add edx, eax
add esi, eax
mov ax, word [edx]
test ax, ax
jne 0x4748d5
cmp ecx, esi
jne 0x4748fb
mov edi, ebx
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov edx, eax
sete dl
mov esi, edx
jmp 0x4748fd
xor esi, esi
mov eax, dword [0x4f6114]
mov edi, ebx
test eax, eax
pop ebx
jne 0x474919
push 0x4f6114
call dword [0x4d6520]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x47492a
mov esi, dword [esp + 0xc]
jmp 0x474936
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor esi, esi
mov eax, dword [0x4f6114]
test eax, eax
jne 0x47494f
push 0x4f6114
call dword [0x4d6520]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x224
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x224
ret
Function at 0x474970
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x4deb20
push 1
push 0
push 0x4deb50
call dword [0x4d68f0]
test eax, eax
jl 0x474a21
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x4749bf
mov ecx, dword [esp]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov eax, dword [esp]
lea edx, [esp + 4]
push esi
push edx
mov ecx, dword [eax]
push 0x4deb80
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x474a14
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [0x4d6400]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x477220
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x84], ebp
jne 0x47723d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x74]
mov edi, dword [0x4d63a4]
mov ebx, dword [0x4d6384]
cmp eax, ebp
je 0x477298
push 0xbb8
push eax
mov dword [esi + 0x78], 1
call edi
cmp eax, 0x102
jne 0x477278
push 0x20
call dword [0x4d6734]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x74]
push eax
call ebx
mov ecx, dword [esi + 0x60]
push ebp
push 0x244
push ecx
mov dword [esi + 0x74], ebp
call dword [0x4d6808]
push eax
call dword [0x4d6828]
mov eax, dword [esi + 0x7c]
cmp eax, ebp
je 0x4772d3
push 0xbb8
push eax
mov dword [esi + 0x80], 1
call edi
cmp eax, 0x102
jne 0x4772ca
push 0x40
call dword [0x4d6734]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov edx, dword [esi + 0x7c]
push edx
call ebx
mov dword [esi + 0x7c], ebp
cmp dword [esi + 0x74], ebp
je 0x4772e2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x60]
push eax
call dword [0x4d67a4]
push ebp
mov ecx, esi
mov dword [esi + 0x78], ebp
call fcn.00478270
cmp dword [esi + 0xf8], ebp
je 0x47733b
mov eax, dword [esi + 0xf0]
xor edi, edi
cmp eax, ebp
jle 0x47733b
cmp edi, eax
jge 0x477330
cmp edi, ebp
jl 0x477330
mov ecx, dword [esi + 0xec]
mov ebx, dword [ecx + edi*4]
cmp ebx, ebp
je 0x477330
mov ecx, ebx
call fcn.0047b360
push ebx
call fcn.004bd4c4
add esp, 4
mov eax, dword [esi + 0xf0]
inc edi
cmp edi, eax
jl 0x47730f
mov edx, dword [esi + 0xec]
push edx
call fcn.004bd4c4
push 0x80
call fcn.004bd49b
mov edi, dword [0x4d6660]
add esp, 8
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], 0x1f
mov dword [esi + 0xfc], 0x40
mov eax, dword [esi + 0x60]
push 1
push 0x403
push 0x403
lea ecx, [esp + 0x20]
push eax
push ecx
call edi
test eax, eax
je 0x4773b0
mov edx, dword [esi + 0x60]
push 1
push 0x403
push 0x403
lea eax, [esp + 0x20]
push edx
push eax
call edi
test eax, eax
jne 0x477395
lea ecx, [esp + 0x10]
push ecx
push 4
push esi
push 0x475c10
push ebp
push ebp
call fcn.004a899b
add esp, 0x18
mov dword [esi + 0x74], eax
push 0xffffffffffffffff
push eax
call dword [0x4d6464]
mov edx, dword [esi + 0x74]
push edx
call dword [0x4d6460]
mov eax, dword [esi + 0x60]
push 5
push 0x244
push eax
call dword [0x4d6808]
push eax
call dword [0x4d6828]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x479b90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
cmp word [esp + 0x14], 0x220
push esi
mov esi, ecx
jne 0x479d6b
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x84]
push ebx
push ebp
push edi
push 0
push 0
push 0x147
push 0x220
push ecx
mov dword [esp + 0x30], eax
mov dword [esi + 0x84], 0
call dword [0x4d6814]
xor ebx, ebx
cmp eax, 2
mov edx, dword [esi + 0x60]
mov edi, dword [0x4d6808]
setl bl
dec ebx
mov dword [esp + 0x24], eax
and ebx, 5
push ebx
push 0x221
push edx
call edi
mov ebp, dword [0x4d6828]
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x222
push eax
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
push ebx
push 0x21b
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x60]
push ebx
push 0x224
push edx
call edi
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x22f
push eax
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
push ebx
push 0x230
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x60]
push ebx
push 0x22d
push edx
call edi
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x22e
push eax
call edi
push eax
call ebp
mov ebx, dword [esp + 0x24]
mov ecx, ebx
neg ecx
sbb ecx, ecx
mov edx, dword [esi + 0x60]
and ecx, 5
push ecx
push 0x223
push edx
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
xor eax, eax
cmp ebx, 3
setne al
mov ebp, eax
push ebp
push 0x205
push ecx
call edi
push eax
call dword [0x4d67f8]
mov edx, dword [esi + 0x60]
push ebp
push 0x203
push edx
call edi
push eax
call dword [0x4d67f8]
cmp ebx, 3
je 0x479cc0
cmp ebx, 2
jne 0x479d50
fild dword [esi + 0xcc]
cmp ebx, 3
fidiv dword [esi + 0xd4]
fstp dword [esp + 0x14]
fild dword [esi + 0xd0]
fidiv dword [esi + 0xd8]
fstp dword [esp + 0x18]
jne 0x479cfb
mov eax, dword [esi + 0xc0]
mov edx, dword [esi + 0xc4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edx
jmp 0x479d0f
mov ecx, dword [esi + 0xb8]
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x60]
push ecx
push 0
push edx
push 0x221
push 0x21b
push eax
call fcn.00476270
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x60]
push ecx
push 0
push edx
push 0x222
push 0x224
push eax
call fcn.00476270
add esp, 0x30
mov eax, dword [esi + 0x64]
mov ecx, dword [esp + 0x1c]
pop edi
pop ebp
test eax, eax
mov dword [esi + 0x84], ecx
pop ebx
je 0x479d6b
mov ecx, esi
call fcn.00477220
pop esi
add esp, 0x10
ret 4
Function at 0x47cc40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
push 0x218
push esi
call dword [0x4d6808]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push ebx
call dword [0x4d6870]
mov edi, dword [0x4d6688]
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
lea edx, [esp + 0x14]
push edx
push esi
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov ecx, dword [0x4f6130]
cdq
fld qword [0x4f0ca0]
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
mov dword [0x4f6138], eax
mov eax, dword [esp + 0x18]
add eax, edx
push 0xffffffffffffffff
cdq
sub eax, edx
push 0
sar eax, 1
mov dword [0x4f613c], eax
push 0
fstp qword [ecx + 0x70]
mov ecx, dword [0x4f6130]
call fcn.004a14c0
mov eax, dword [0x4f612c]
test eax, eax
je 0x47cdda
mov edi, dword [0x4d681c]
push 0x1fd
push esi
call edi
test eax, eax
je 0x47cd46
mov edx, dword [0x4f612c]
mov ecx, dword [0x4f6130]
push 0xffffffffffffffff
push 0
push edx
call fcn.004a14c0
mov ecx, dword [0x4f6130]
push 0
call fcn.004a2350
mov eax, dword [0x4f6144]
mov ecx, dword [0x4f6140]
push eax
push ecx
mov ecx, dword [0x4f6130]
call fcn.004a25e0
mov ecx, dword [0x4f6130]
push 1
push 1
call fcn.004a1770
mov edx, dword [0x4f6130]
mov eax, dword [0x4f6148]
push 0
mov dword [edx + 0x7c], eax
mov ecx, dword [0x4f6130]
call fcn.004a20c0
mov ecx, dword [0x4f612c]
test ecx, ecx
je 0x47cdda
push 0xffffffffffffffff
call fcn.0049ddf0
test eax, eax
je 0x47cdda
push 0x1fd
push esi
call edi
test eax, eax
je 0x47cdda
mov ecx, dword [0x4f612c]
push 0xffffffffffffffff
call fcn.0049ddf0
mov ecx, dword [0x4f612c]
push 0xffffffffffffffff
mov esi, eax
call fcn.0049de70
mov edi, eax
push 0x44
lea edx, [esi + 2]
lea ecx, [edi + 2]
push ecx
mov ecx, dword [0x4f613c]
push edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, esi
cdq
sub eax, edx
mov edx, dword [0x4f6138]
sar eax, 1
sub edx, eax
dec ecx
dec edx
push ecx
push edx
push 0
push ebx
mov ebx, dword [0x4d6774]
call ebx
mov eax, dword [0x4f6130]
push 0x44
push edi
push esi
mov ecx, dword [eax + 0x50]
push 0
push 0
push 0
push ecx
call ebx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0
push ebx
call dword [0x4d6828]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x47f1c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, dword [esp + 0x4c]
mov esi, ecx
push 9
mov ecx, edi
call fcn.004c28d9
test eax, eax
jle 0x47f1e2
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 8
mov eax, dword [esp + 0x50]
push ebx
push ebp
push eax
mov ecx, esi
xor ebx, ebx
call fcn.0047f690
mov esi, eax
test esi, esi
je 0x47f2ae
mov ebp, dword [0x4d657c]
test ebx, ebx
mov eax, 0x4f0e50
jne 0x47f210
mov eax, 0x4f0e54
push eax
mov ecx, edi
call fcn.004c2806
test byte [esi], 0x10
je 0x47f229
push str.Alt
mov ecx, edi
call fcn.004c2806
test byte [esi], 8
je 0x47f23a
push 0x4f0e60
mov ecx, edi
call fcn.004c2806
test byte [esi], 4
je 0x47f24b
push 0x4f0e68
mov ecx, edi
call fcn.004c2806
test byte [esi], 1
je 0x47f27a
xor ecx, ecx
push 0
mov cx, word [esi + 2]
push ecx
call ebp
lea edx, [esp + 0x10]
push 0x40
shl eax, 0x10
push edx
push eax
call dword [0x4d6578]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004c2806
jmp 0x47f285
mov cl, byte [esi + 2]
push ecx
mov ecx, edi
call fcn.004c282d
mov ax, word [esi + 4]
mov ebx, 1
test ax, ax
je 0x47f2ae
and eax, 0xffff
lea edx, [eax*4]
sub edx, eax
neg edx
lea esi, [esi + edx*2]
test esi, esi
jne 0x47f202
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x40
ret 8

Function at 0x47f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4194
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
lea ecx, [esp + 4]
call fcn.0047fc50
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x68], esi
call fcn.0047fc70
push esi
push esi
push esi
lea ecx, [esp + 0x10]
call fcn.0047fc90
lea ecx, [esp + 0xc]
call fcn.004c0be8
lea eax, [esp + 4]
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], 1
call fcn.004c0d00
lea ecx, [esp + 0x34]
call fcn.0047f610
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], 8
push ecx
push 0x400
push esi
lea ecx, [esp + 0x10]
call fcn.0047faa0
push eax
call dword [0x4d6720]
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 4]
call fcn.004c19f0
lea ecx, [esp + 4]
mov dword [esp + 0x68], 0xffffffff
call fcn.00405100
mov ecx, dword [esp + 0x60]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x4804a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [0x4d67a0]
push ebp
push esi
mov esi, ecx
push edi
push 0
push 0
mov eax, dword [esi + 0x1c]
push 0x418
push eax
call ebx
mov ecx, esi
mov edi, eax
call fcn.00480360
add eax, edi
lea edi, [eax*4]
push edi
call fcn.004bd49b
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
push 0
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x1c]
push 0x418
push eax
mov dword [esp + 0x24], ebp
call ebx
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x48052b
push edi
mov ecx, esi
call fcn.004c65ab
and eax, 0xffff
add ebp, 4
or eax, 0x10000
inc edi
mov dword [ebp - 4], eax
cmp edi, ebx
jl 0x48050a
mov ebp, dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.00480360
test eax, eax
jle 0x480593
lea ecx, [ebp + edi*4]
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov edx, dword [esi + 0xbc]
mov ecx, esi
mov eax, dword [edx + ebx + 4]
push eax
call fcn.004c6595
cmp eax, 0xffffffff
jne 0x48057a
mov ecx, dword [esi + 0xbc]
mov eax, dword [esp + 0x14]
xor edx, edx
inc edi
mov dx, word [ecx + ebx + 4]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, esi
inc eax
add ebx, 0x64
mov dword [esp + 0x10], eax
call fcn.00480360
cmp dword [esp + 0x10], eax
jl 0x480548
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push ecx
push 0x80000001
call dword [0x4d600c]
test eax, eax
jne 0x4805d3
mov ecx, dword [esp + 0x18]
lea edx, [edi*4]
push edx
push ebp
push 3
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [0x4d6030]
mov edx, dword [esp + 0x18]
push edx
call dword [0x4d6018]
push ebp
call fcn.004bd4c4
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8