joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4753a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x589c08]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.00474e4e
mov ebx, eax
cmp ebx, esi
je 0x47540d
lea ecx, [ebp - 0x20c]
call fcn.0040af2d
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00511ff3
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x47542b
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.004753a0
cmp eax, esi
jne 0x475472
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], pe_nt_image_headers32
call ebx
test eax, eax
je 0x475415
lea ecx, [ebp - 0x20c]
call fcn.0040af2d
push dword [ebp - 0x214]
mov ecx, edi
call fcn.00474d93
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.0040af2d
mov eax, esi
jmp 0x4753fc
Function at 0x487bb1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x5331c0
call fcn.00513742
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004062b0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x487c13
call fcn.00442349
cmp eax, 1
jne 0x487c13
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x53cce0
push eax
call fcn.0040d034
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00406500
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004021c0
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004021c0
mov eax, esi
call fcn.0051381a
ret 0x10

Function at 0x487c3c
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x5331c0
call fcn.00513742
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004062b0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x487c9e
call fcn.00442349
cmp eax, 1
jne 0x487c9e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x53cce0
push eax
call fcn.0040d034
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00406500
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004021c0
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004021c0
mov eax, esi
call fcn.0051381a
ret 0x14
Function at 0x4893c1
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x5332f9
call fcn.00513775
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 0xc]
call fcn.004219df
test eax, eax
je 0x489590
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
lea ecx, [esi + 4]
xor edi, edi
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
call fcn.004890e0
test eax, eax
je 0x489407
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.004021e0
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00401f60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040af4a
lea ecx, [ebp - 0x14]
call fcn.004021e0
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00401f60
push eax
push edi
push 0x549788
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0040af4a
push edi
push 0x4000100
push 2
push edi
push edi
push 0xc0000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x48957a
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00443057
push edi
push 0x1000
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.00441f25
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [eax + 0x20], ebx
mov eax, dword [ecx]
push edx
mov byte [ebp - 4], 4
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.00441872
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x88]
mov dword [eax + 0x20], edi
mov byte [ebp - 4], 3
call fcn.00441ee7
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004431ef
mov ecx, dword [ebp - 0x24]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call fcn.004892b9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [eax], esi
call fcn.004021c0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004021c0
mov eax, ebx
jmp 0x489592
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004021c0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004021c0
xor eax, eax
call fcn.0051381a
ret 8
Function at 0x4981e7
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0x20
push ebx
mov ebx, ecx
jne 0x498238
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
add eax, 0x17
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.00497bbb
mov ecx, ebx
call fcn.0049815f
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x49828e
xor eax, eax
cmp dword [ebx + 0x2e4], eax
jne 0x498253
cmp dword [ebp + 0xc], 0x79
je 0x49824e
cmp dword [ebp + 0xc], 0x12
jne 0x49828e
xor eax, eax
inc eax
jmp 0x49828e
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
movzx edi, ax
shr edi, 0xf
push 0x10
and edi, 1
call esi
mov esi, dword [ebp + 0xc]
shr eax, 0xf
and eax, 1
cmp esi, 0x12
je 0x498293
cmp esi, 0x79
je 0x498293
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x58dc54], 0
jne 0x49828a
test byte [ebx + 0x2f4], 2
jne 0x49828a
cmp esi, 0x12
je 0x4982b7
cmp esi, 0x79
jne 0x49828a
test edi, edi
jne 0x49828a
test eax, eax
jne 0x49828a
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.00414748
cmp eax, ebx
jne 0x4982da
test dword [ebp + 0x10], 0x40000000
jne 0x4982da
cmp esi, 0x79
jne 0x4982e8
mov ecx, dword [ebp + 8]
jmp 0x4982e1
cmp esi, 0x79
jne 0x4982e8
mov ecx, ebx
call fcn.0040d687
jmp 0x498303
cmp dword [ebx + 0x2a0], 0
jge 0x498303
push 0
push 0xc8
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
jmp 0x49828c
Function at 0x4a4173
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
xor ecx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebx + 0x9c], ecx
cmp dword [ebx + 0x90], ecx
je 0x4a41f3
cmp dword [ebp + 0xc], ecx
jne 0x4a41f3
cmp dword [ebx + 0x94], ecx
jne 0x4a41f3
mov eax, dword [ebx + 0x20]
cmp eax, ecx
je 0x4a41e9
cmp eax, 0xffffffff
je 0x4a41e9
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xc8]
push dword [ebp - 8]
call fcn.00412541
mov dword [ebx + 0x9c], eax
test eax, eax
jne 0x4a41f3
xor eax, eax
jmp 0x4a4333
mov dword [ebx + 0x9c], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test eax, eax
je 0x4a422e
cmp dword [ebp + 0xc], 0
jne 0x4a422e
lea eax, [ebp - 8]
push eax
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call edi
push dword [ebp - 4]
lea ecx, [ebx + 0xd8]
push dword [ebp - 8]
call fcn.00412541
test eax, eax
jne 0x4a41e2
xor ecx, ecx
cmp dword [ebx + 0x9c], ecx
jne 0x4a4254
mov eax, dword [ebx + 0x20]
cmp eax, ecx
jbe 0x4a4254
cmp eax, 0xffffffff
je 0x4a4254
cmp dword [ebx + 0x90], ecx
jne 0x4a4254
cmp dword [ebx + 0xa8], ecx
je 0x4a41e2
push dword [ebx + 0x6c]
push 0x586054
call fcn.004420c7
lea esi, [ebx + 0x8c]
mov dword [ebp - 4], eax
mov eax, dword [esi]
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x4a428d
mov dword [eax + 0xf8], edi
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [ebp - 4]
mov dword [esi], edi
cmp ecx, edi
je 0x4a42f3
push edi
jmp 0x4a42ee
push dword [ebx + 0x6c]
push 0x587470
call fcn.004420c7
pop ecx
pop ecx
cmp dword [ebp + 0xc], edi
je 0x4a42b9
cmp eax, edi
je 0x4a42b9
cmp dword [0x58d264], edi
jne 0x4a42b9
push 1
push ebx
mov ecx, eax
call fcn.0048a273
jmp 0x4a42e6
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x4a42d1
push edi
call fcn.00421e3b
cmp eax, edi
je 0x4a42d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x58]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test eax, eax
je 0x4a41e2
mov ecx, dword [ebp - 4]
cmp ecx, edi
je 0x4a42f3
push ebx
call fcn.00424a46
cmp dword [ebx + 0x6c], edi
je 0x4a4330
lea esi, [ebx + 0x54]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040b71d
mov eax, dword [eax + 0x94]
push eax
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
push 0x401
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x6c]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4b18bf
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, ecx
mov ecx, 0x104
cmp eax, ecx
ja 0x4b1a19
je 0x4b1a3f
cmp eax, 0xa1
jb 0x4b1a6b
cmp eax, 0xa2
jbe 0x4b1a3f
cmp eax, 0xa3
jbe 0x4b1a6b
cmp eax, 0xa5
jbe 0x4b1a3f
cmp eax, 0xa6
jbe 0x4b1a6b
cmp eax, 0xa8
jbe 0x4b1a3f
cmp eax, 0x100
jne 0x4b1a6b
cmp dword [esi + 0x80], 0xffffffff
je 0x4b1a3f
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4b1a3f
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x4b19e5
dec eax
jne 0x4b1a3f
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [eax + 1]
add ecx, eax
cmp edi, ecx
jge 0x4b19dd
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x4b199e
mov eax, dword [esi + 0x7c]
add eax, dword [esi + 0x80]
inc edi
cmp edi, eax
jl 0x4b1976
jmp 0x4b19dd
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x1e4], 1
call dword [eax + 0x1ec]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1e8]
mov ecx, eax
call fcn.0040d687
push dword [esi + 0x80]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x248]
and dword [esi + 0x1e4], 0
xor eax, eax
inc eax
jmp 0x4b1a73
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
lea edi, [ecx + eax - 1]
cmp edi, eax
jle 0x4b19dd
mov eax, edi
cdq
idiv dword [esi + 0x7c]
mov eax, dword [esi]
mov ecx, esi
push edx
mov dword [ebp + 8], edx
call dword [eax + 0x254]
test eax, eax
jne 0x4b199e
dec edi
cmp edi, dword [esi + 0x80]
jg 0x4b19f6
jmp 0x4b19dd
cmp eax, 0x200
jb 0x4b1a6b
cmp eax, 0x202
jbe 0x4b1a3f
cmp eax, 0x203
jbe 0x4b1a6b
cmp eax, 0x205
jbe 0x4b1a3f
add eax, 0xfffffdf9
cmp eax, 1
ja 0x4b1a6b
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x4b1a55
cmp dword [ecx + 0x20], 0
je 0x4b1a55
push edi
call fcn.00422876
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x4b1a6b
cmp dword [ecx + 0x20], 0
je 0x4b1a6b
push edi
call fcn.00422876
push edi
mov ecx, esi
call fcn.004b758b
pop edi
pop esi
pop ebp
ret 4
Function at 0x4b9db3
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x534a09
call fcn.00513742
xor edi, edi
cmp dword [0x586274], edi
je 0x4b9e7c
cmp dword [0x587f40], 0xfffffffe
jne 0x4b9e69
cmp dword [ebp + 8], 0xffffffff
je 0x4b9e7c
test byte [0x58ee6c], 1
mov esi, 0x58ee4c
jne 0x4b9e12
or dword [0x58ee6c], 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0042f04f
push 0x53adca
call fcn.005121a6
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, esi
call fcn.0042f0a6
cmp dword [0x58ee48], edi
je 0x4b9e26
call fcn.0040f83b
push edi
push edi
push 0x4b9d5b
call fcn.00517cb0
add esp, 0xc
mov dword [0x58ee48], eax
cmp eax, edi
jbe 0x4b9e56
cmp eax, 0xffffffff
je 0x4b9e56
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
mov dword [0x587f40], eax
jmp 0x4b9e5c
mov dword [0x58ee48], edi
push 0x58ee54
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4b9e7c
mov eax, dword [ebp + 8]
mov dword [0x587f40], eax
cmp eax, 0xffffffff
jne 0x4b9e7c
mov dword [0x58ee48], edi
call fcn.0051381a
ret
Function at 0x4bb3ed
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x48
mov eax, 0x534bc5
call fcn.00513775
mov dword [ebp - 0x14], ecx
xor esi, esi
push esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
call fcn.0041ece3
mov edi, dword [0x58e0f0]
mov ebx, dword [0x58e0f4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0041e4f0
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00419586
mov dword [ebp - 0x1c], esi
mov esi, vtable.CBitmap.0
mov dword [ebp - 0x20], esi
push ebx
push edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0041955f
test eax, eax
jne 0x4bb48d
push 0xffffffffffffffff
push 0
push 0x3e8a
call fcn.00409f13
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], esi
call fcn.0040c22b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0041ec3b
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.0041ed37
xor eax, eax
call fcn.0051381a
ret
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
call fcn.004195ac
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x18], eax
push 0x58e074
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
call fcn.0040bb9c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004bb256
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004195ac
call fcn.00407a7e
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4bb450
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4bb50e
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.00409f13
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4bb45e
lea ecx, [ebp - 0x20]
call fcn.0041eeba
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4bb530
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.00409f13
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], esi
call fcn.0040c22b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0041ec3b
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.0041ed37
xor eax, eax
inc eax
jmp 0x4bb487
Function at 0x4bb5bb
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x534bf6
call fcn.005137ab
mov esi, ecx
lea edi, [esi + 0x14]
push edi
lea ecx, [ebp - 0x4d0]
call fcn.00405fb0
xor ebx, ebx
push ebx
push 0x53c61c
lea ecx, [ebp - 0x4d0]
mov dword [ebp - 4], ebx
call fcn.00431249
cmp eax, 0xffffffff
jne 0x4bb69e
push ebx
push 0x54129c
lea ecx, [ebp - 0x4d0]
call fcn.00431249
cmp eax, 0xffffffff
jne 0x4bb69e
push ebx
push 0x541298
lea ecx, [ebp - 0x4d0]
call fcn.00431249
cmp eax, 0xffffffff
jne 0x4bb69e
push edi
lea ecx, [ebp - 0x4d4]
call fcn.00405fb0
mov edi, dword [ebp - 0x4d4]
push ebx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ebx
push edi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4bb681
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov esi, eax
call fcn.004021c0
mov ecx, dword [ebp - 0x4d0]
add ecx, 0xfffffff0
call fcn.004021c0
mov eax, esi
call fcn.0051382e
ret
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00406230
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.004021c0
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push ebx
push dword [ebp - 0x4d0]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4bb6c8
mov esi, dword [ebp - 0x4cc]
jmp 0x4bb66b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov esi, eax
jmp 0x4bb66b
Function at 0x4bc2b1
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x4bc2fb
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4bc2fb
call fcn.004bbb6a
test eax, eax
je 0x4bc2fb
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00405f10
xor eax, eax
inc eax
jmp 0x4bc513
cmp dword [ebx + 4], 0x100
push edi
jne 0x4bc50a
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x4bc3f8
push 0x11
call edi
test ax, ax
jl 0x4bc3f8
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4bc3f8
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x4bc36b
cmp eax, 0x20
jbe 0x4bc3f8
cmp eax, 0x24
jbe 0x4bc35e
cmp eax, 0x26
je 0x4bc35e
cmp eax, 0x28
jne 0x4bc3f8
call fcn.004bbb6a
test eax, eax
je 0x4bc3f8
mov ecx, esi
call fcn.0040d687
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.004bbb6a
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x4bc3a0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00405f10
jmp 0x4bc505
call fcn.00415dba
test eax, eax
je 0x4bc505
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.00415df2
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4bc3ce
xor edi, edi
jmp 0x4bc3d1
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.00415dba
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4bc505
mov eax, dword [ebx + 8]
sub eax, 9
je 0x4bc4d4
sub eax, 0x12
je 0x4bc4ac
sub eax, 0xb
je 0x4bc41a
dec eax
dec eax
jne 0x4bc50a
push 0x12
call edi
test ax, ax
jl 0x4bc50a
push 0x11
call edi
test ax, ax
jl 0x4bc50a
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4bc50a
call fcn.004bbb6a
test eax, eax
jne 0x4bc505
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.004bbae4
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00414748
test eax, eax
je 0x4bc505
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.00414748
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4bc505
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x4bc4c0
push 0
call fcn.004bbae4
mov ecx, esi
call fcn.00415888
test eax, eax
je 0x4bc50a
mov ecx, esi
call fcn.00415888
jmp 0x4bc4fe
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00414748
test eax, eax
je 0x4bc50a
push dword [esi + 0x20]
call edi
push eax
call fcn.00414748
push 0
push esi
mov ecx, eax
call fcn.0040e15d
mov ecx, eax
call fcn.0040d687
xor eax, eax
inc eax
jmp 0x4bc512
push ebx
mov ecx, esi
call fcn.004125b5
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4c5ae5
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [eax + 0x190]
test al, al
jns 0x4c5b07
or eax, 0xffffffff
jmp 0x4c5b0c
mov eax, dword [0x58637c]
mov edx, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x290]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x5882e4
call fcn.004420c7
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x4c5ba9
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x4c5ba9
cmp edi, ebx
je 0x4c5b5e
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x200]
push eax
push 0x588418
call fcn.004420c7
pop ecx
pop ecx
mov ebx, eax
cmp dword [ebp - 8], 2
jne 0x4c5bb2
test ebx, ebx
je 0x4c5b95
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x198]
test al, 0x40
je 0x4c5ba9
cmp dword [ebp - 4], 0
je 0x4c5b95
mov eax, dword [ebx]
push esi
mov ecx, ebx
call dword [eax + 0x224]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x4c5bab
mov eax, dword [esi]
push 5
push 0
push edi
mov ecx, esi
call dword [eax + 0x1d0]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], 3
jne 0x4c5ba9
test edi, edi
je 0x4c5ba9
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x15c]
test eax, eax
je 0x4c5ba9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x164]
test eax, eax
je 0x4c5ba9
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x218]
mov eax, dword [esi]
push 0
push 1
push 5
push edi
mov ecx, esi
call dword [eax + 0x328]
mov edx, dword [ebp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
jmp 0x4c5bab
Function at 0x4c94a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x58f7c8], 1
push ebx
push esi
push edi
mov ebx, ecx
jne 0x4c94cf
or dword [0x58f7c8], 1
mov ecx, 0x58f7c4
call fcn.004021e0
push 0x53ae40
call fcn.005121a6
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4c94db
call fcn.0040f83b
mov eax, dword [ebx + 0x318]
test eax, eax
je 0x4c9554
cmp dword [eax + 0x20], 0
je 0x4c9554
test eax, eax
je 0x4c94f2
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x4c9554
mov eax, dword [edi + 4]
dec eax
je 0x4c9533
dec eax
je 0x4c9509
dec eax
jne 0x4c9554
mov esi, 0x428e
jmp 0x4c9538
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4c9538
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x31c]
test eax, eax
je 0x4c9538
add esi, 3
jmp 0x4c9538
mov esi, 0x3ea0
push esi
mov ecx, 0x58f7c4
call fcn.00402120
test eax, eax
je 0x4c94d6
mov eax, dword [0x58f7c4]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x4c9556
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4d493e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4d4956
mov edi, dword [esi + 0xc]
jmp 0x4d4996
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4d496f
call fcn.0041e40f
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4d4984
call fcn.0041e40f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4d4996
call fcn.0041e40f
call fcn.00442a6f
cmp dword [eax + 0x3c], 0
je 0x4d49ab
push edi
mov ecx, ebx
call fcn.004d3819
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004d4864
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4d49c9
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d49d5
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8