joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
test ebx, ebx
je 0x48a551
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48a551
mov byte [ebp + 0xb], 0
test esi, esi
je 0x48a551
mov eax, dword [esi + 0x944]
test eax, eax
je 0x48a533
cmp eax, 0xffffffff
je 0x48a533
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
test al, al
jne 0x48a55c
mov esi, dword [esi + 0x4964]
test esi, esi
je 0x48a551
push 0
push 1
push 0
push 0
push str.PostConsoleEventPipe_skipped_due_to_server_not_alive
mov ecx, esi
call fcn.004c87c0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xb74]
test eax, eax
je 0x48a56b
cmp eax, 0xffffffff
jne 0x48a59c
mov ecx, esi
call fcn.0048a340
test eax, eax
jne 0x48a59c
mov esi, dword [esi + 0x4964]
test esi, esi
je 0x48a551
push eax
push 1
push eax
push eax
push str.PostConsoleEventPipe_skipped_due_to_OpenConsoleEventPipe_failed
mov ecx, esi
call fcn.004c87c0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
lea edi, [edi + edi*2 - 3]
lea edi, [edi*8 + 0x20]
push edi
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov edx, dword [esi + 0xb74]
push ebx
push edx
mov dword [0x5329d4], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x48a626
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [ebp + 0xc], eax
call fcn.004883a0
test al, al
jne 0x48a62a
mov eax, dword [ebp + 0xc]
cmp eax, 0xe8
je 0x48a5f7
cmp eax, 0xe9
jne 0x48a62a
mov ecx, esi
call fcn.00487030
test al, al
je 0x48a62a
mov ecx, esi
call fcn.0048a340
test eax, eax
je 0x48a62a
mov ecx, dword [esi + 0xb74]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48a62a
mov byte [ebp + 0xb], 1
mov al, byte [ebp + 0xb]
pop edi
pop esi
mov dword [0x5329d4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48a9f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x48aa10
cmp dword [esi], 0
je 0x48aa10
call fcn.00486ee0
test eax, eax
je 0x48aa10
mov ecx, dword [esi]
add ecx, 8
pop esi
jmp 0x4b3a60
xor al, al
pop esi
ret
push esi
mov esi, ecx
cmp dword [esi + 0x80], 0
je 0x4b3a8d
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4b3a8d
mov dword [esi + 0x80], 0
xor eax, eax
cmp dword [esi + 0x80], eax
pop esi
setne al
ret
Function at 0x48ae70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov esi, ecx
je 0x48aebd
mov eax, dword [esi + 0x10]
test eax, eax
je 0x48aebd
push eax
call edi
test eax, eax
je 0x48aebd
mov eax, dword [esi + 0x10]
push 1
push 5
push eax
mov ecx, esi
mov byte [esi + 0x41], 0
call fcn.00487c20
mov ecx, dword [esi]
add ecx, 8
call fcn.004b32e0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
mov ecx, dword [esi]
add ecx, 8
mov byte [esi + 0x41], 1
call fcn.004b32e0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x48aef1
push eax
call edi
test eax, eax
je 0x48aef1
mov ecx, dword [esi + 0x10]
push 1
push 0
push ecx
mov ecx, esi
call fcn.00487c20
mov ecx, dword [esi]
add ecx, 8
call fcn.004b37a0
pop edi
pop esi
pop ebp
ret 4
Function at 0x48d9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x48d9fc
cmp dword [esi + 0xb78], 0
je 0x48d9b9
cmp dword [esi + 0x940], 0
je 0x48d9fc
cmp dword [esi + 0x4954], 0
jne 0x48d9fc
mov eax, dword [esi + 0x944]
test eax, eax
je 0x48d9fc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48d9e1
mov ecx, esi
pop esi
jmp fcn.0048a7c0
mov ecx, dword [esi + 0x41f0]
call fcn.0047bd40
test al, al
je 0x48d9fc
mov ecx, dword [esi + 0x41f0]
pop esi
jmp fcn.00486960
pop esi
ret
Function at 0x48f030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0x286
push edi
mov edi, ecx
jne 0x48f1f8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x48f071
cmp eax, 0xffffffff
je 0x48f071
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [edi + 0x10]
push eax
push ecx
push 0x286
push edx
mov ecx, edi
call fcn.0048a640
pop edi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov eax, 1
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x28], ax
xor eax, eax
push 0x14
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call esi
and ax, 1
push 0x90
movzx ebx, ax
call esi
and ax, 1
movzx ecx, ax
push 0x91
mov dword [ebp + 0xc], ecx
call esi
and ax, 1
movzx edx, ax
push 0xa4
mov dword [ebp - 4], edx
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0xa5
mov dword [ebp - 8], edx
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0xa2
mov dword [ebp - 0xc], edx
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0xa3
mov dword [ebp - 0x10], edx
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0x10
mov dword [ebp - 0x14], edx
call esi
mov esi, 0x8000
mov ecx, esi
and ax, cx
movzx edx, ax
mov eax, 1
mov word [ebp - 0x20], ax
test edi, edi
jne 0x48f133
xor al, al
jmp 0x48f156
mov ecx, dword [edi + 0x46c8]
test ecx, ecx
je 0x48f14f
mov eax, dword [edi + 0x4924]
test al, 4
je 0x48f14f
test al, 0x10
jne 0x48f14f
mov eax, ecx
jmp 0x48f151
xor eax, eax
test eax, eax
setne al
movzx ecx, al
mov ax, word [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe5
mov word [ebp - 0x1e], cx
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 0x14]
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
mov dword [ebp - 0x24], 1
mov word [ebp - 0x1c], cx
mov dword [ebp - 0x18], 0
test eax, 0x1000000
je 0x48f19d
mov dword [ebp - 0x18], 0x100
test bl, 1
je 0x48f1a9
or dword [ebp - 0x18], 0x80
test byte [ebp + 0xc], 1
je 0x48f1b3
or dword [ebp - 0x18], 0x20
test byte [ebp - 4], 1
je 0x48f1bd
or dword [ebp - 0x18], 0x40
test dword [ebp - 8], esi
je 0x48f1c6
or dword [ebp - 0x18], 2
test dword [ebp - 0xc], esi
je 0x48f1cf
or dword [ebp - 0x18], 1
test dword [ebp - 0x10], esi
je 0x48f1d8
or dword [ebp - 0x18], 8
test dword [ebp - 0x14], esi
je 0x48f1e1
or dword [ebp - 0x18], 4
test esi, edx
pop esi
pop ebx
je 0x48f1eb
or dword [ebp - 0x18], 0x10
push 1
lea edx, [ebp - 0x28]
push edx
mov ecx, edi
call fcn.0048d7e0
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x491c50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x491c99
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x5329e4]
sub ecx, eax
cmp ecx, 0x3e8
jae 0x491c88
push 1
push 0xffffffffffffffff
push 0
push 0x40
push str.Space_bounce_recieved_from_unknown_window
call fcn.004262f0
add esp, 0x14
pop edi
pop esi
ret
call edi
push 0xffffffffffffffff
mov ecx, esi
mov dword [0x5329e4], eax
call fcn.00490180
pop edi
pop esi
ret

Function at 0x491ca0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x491ce3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x491cbf
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x491cce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x491d13
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x491d1f
mov eax, 0x538
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x491d32
cmp dword [ebp + 0xc], ebx
jne 0x491d32
xor ecx, ecx
jmp 0x491d37
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x491d53
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x491d5c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x491d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x491d7f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x491dcd
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x491de1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x491dc5
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x491df0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x491e33
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x491e0f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x491e1e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x491e63
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x491e6f
mov eax, 0x10
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x491e82
cmp dword [ebp + 0xc], ebx
jne 0x491e82
xor ecx, ecx
jmp 0x491e87
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x491ea3
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x491eac
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x491ed9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x491ecf
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x491f1d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x491f31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x491f15
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x495ff0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
push 5
push str.Initializing_ConEmu__4_
mov ecx, esi
mov ebx, eax
call fcn.00489420
lea eax, [esi + 0x3d00]
push eax
push 0
push esi
push 0x495e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 5
push str.Initializing_ConEmu__5_
mov ecx, esi
mov dword [esi + 0x3cfc], eax
call fcn.00489420
call edi
sub eax, ebx
cmp eax, 0x9c4
jbe 0x496080
push eax
lea ecx, [ebp - 0xa0]
push str._DBG__Very_high_CPU_load__CreateThread_takes__u_ms
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi + 0x4964]
add esp, 0xc
test ecx, ecx
je 0x496080
push 1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
call fcn.004c77f0
cmp dword [esi + 0x3cfc], 0
pop edi
pop esi
pop ebx
jne 0x4960a7
push 0
push 0
push 0
push 0
push str.Cant_create_console_thread_
call fcn.004263e0
add esp, 0x14
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x499990
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp word [eax + 0x30], 0
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0xc]
lea esi, [eax + 0x30]
mov dword [ebp - 8], ecx
je 0x4999ed
push ebx
push edi
nop
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call ebx
lea edi, [esi + eax*2 + 2]
push edi
call ebx
push 6
push 0x4e5ea4
push esi
lea ebx, [edi + eax*2 + 2]
call fcn.0044d3f0
add esp, 0xc
test eax, eax
je 0x4999e0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp word [ebx], 0
mov esi, ebx
jne 0x4999b0
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
push ecx
push eax
call fcn.004b7860
mov edx, dword [ebp - 8]
push 0x34
push edx
call fcn.0042b600
add esp, 0x10
pop esi
test eax, eax
je 0x499a13
mov dword [eax + 0x30], 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49a4a0
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
je 0x49a4e5
mov eax, dword [esi + 8]
push eax
mov byte [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 4]
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x49a4db
mov edx, dword [esi + 4]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x49a502
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x20], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
pop edi
pop esi
ret
Function at 0x49a510
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor edi, edi
mov ebx, 4
mov esi, ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xcccccccc
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.004c6bf0
push 0xffffffffffffffff
lea eax, [esi + 0x24]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004c7670
mov dword [ebp - 0x10], edi
lea ebx, [ebx]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x49a5d8
mov eax, dword [esi + 0x14]
test eax, eax
jle 0x49a5d8
push ecx
mov ecx, dword [esi + 0x20]
lea edx, [ecx + eax*4 - 4]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004c9f70
dec dword [esi + 0x14]
add esp, 0xc
test ebx, ebx
je 0x49a570
mov eax, dword [ebp - 0x34]
cmp eax, edi
jg 0x49a5bc
cmp eax, 0x100
jge 0x49a5ad
mov eax, 0x100
push eax
lea ecx, [ebp - 0x3c]
call fcn.00445bd0
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x2c]
mov eax, edi
push ebx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [edx + eax*4]
inc edi
push eax
mov dword [ebp - 0x38], edi
call fcn.004c9f70
add esp, 0xc
jmp 0x49a570
lea ecx, [ebp - 0x1c]
call fcn.004c6c00
cmp byte [esi + 0xc], 0
jne 0x49a6c8
lea ebx, [ebx]
test ebx, ebx
je 0x49a6c8
test edi, edi
jle 0x49a6c8
mov ecx, dword [ebp - 0x2c]
push ebx
lea edx, [ecx + edi*4 - 4]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004c9f70
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push ecx
mov ecx, dword [0x52fe2c]
dec edi
mov dword [ebp - 0x38], edi
call fcn.0040aa50
test al, al
je 0x49a6be
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x28]
call fcn.004bca20
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004bc9d0
test eax, eax
je 0x49a6b2
cmp dword [esi + 0x40], 0
je 0x49a66e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x40]
cmp eax, 0x64
jae 0x49a66e
mov ecx, 0x64
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esi + 0x3c], 1
mov ecx, dword [0x52fe2c]
call fcn.00409d70
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], al
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc80
mov ecx, eax
call fcn.00498970
mov eax, dword [ebp - 0x14]
mov ecx, dword [0x52fe2c]
push eax
call fcn.00409d80
mov byte [esi + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004bc960
cmp byte [esi + 0xc], 0
je 0x49a5f0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004c6c00
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
mov dword [ebp - 4], 0xffffffff
pop ebx
test eax, eax
je 0x49a6ee
push eax
call fcn.0044c4f0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x49a850
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0x24]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xcccccccc
push eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x3c], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push ebx
push ebx
mov dword [esi], ebx
mov byte [esi + 0xc], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push ebx
push esi
push 0x49a830
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ebx
ret
Function at 0x49c250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 0x1c]
push 0
push ecx
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49c2e6
mov edi, dword [ebp - 4]
test edi, edi
je 0x49c2e6
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
shr edi, 1
test eax, eax
je 0x49c29d
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi], 0
lea eax, [edi + edi + 4]
push eax
call fcn.0044c4d0
mov edx, dword [ebp + 8]
add esp, 4
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
mov dword [esi], eax
mov eax, dword [ebx + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
test al, al
jne 0x49c2ce
xor edi, edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + edi*2], dx
mov ecx, dword [esi]
pop esi
mov word [ecx + edi*2 + 2], dx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49e290
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x49e2fe
push edi
push esi
push 0x4e4b90
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.0044cff0
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x10
lea ecx, [ebp - 0x20]
push ecx
push str.ConEmuHWND
call edi
lea edx, [ebp + 8]
push edx
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp + 8]
push eax
push 0x4e4bb8
lea ecx, [ebp - 0x20]
push 0x10
push ecx
call fcn.0044cff0
add esp, 0x10
lea edx, [ebp - 0x20]
push edx
push str.ConEmuPID
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push str.ConEmuHWND
call esi
push 0
push str.ConEmuPID
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49e320
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push esi
test eax, eax
je 0x49e348
push eax
push 0x4e4b90
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.0044cff0
add esp, 0x10
lea ecx, [ebp - 0x20]
push ecx
jmp 0x49e34a
push 0
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.ConEmuDrawHWND
call esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49e382
push eax
push 0x4e4b90
lea edx, [ebp - 0x20]
push 0x10
push edx
call fcn.0044cff0
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push str.ConEmuBackHWND
call esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push str.ConEmuBackHWND
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a2010
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor bl, bl
cmp edi, 0x100
jb 0x4a20d2
cmp edi, 0x101
ja 0x4a20d2
cmp dword [ebp + 0xc], 0x46
jne 0x4a20d2
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x4a20ca
push 0x12
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4a20ca
push 0x10
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x4a20ca
cmp edi, 0x100
jne 0x4a20b9
xor eax, eax
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [0x5329fc]
call fcn.004a1840
test al, al
je 0x4a20ca
mov edx, dword [ebp - 8]
push 0
push 0
push 0x8024
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x10]
pop esi
mov dword [eax], 0
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5750
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1133f], 0
jne 0x4a5768
or eax, 0xffffffff
pop ebp
ret 0xc
add ecx, 8
pop ebp
jmp fcn.00441c10

Function at 0x4a58a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa5c], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4a58c2
call edi
sub eax, dword [esi + 0xa58]
cmp eax, 0x7d0
jbe 0x4a58ef
cmp dword [esi + 0xa54], 0
jle 0x4a58d5
pop edi
mov byte [esi + 0xa5d], 1
pop esi
ret
mov byte [esi + 0xa5c], 1
mov ecx, dword [0x52fe2c]
call fcn.0040c870
call edi
mov dword [esi + 0xa58], eax
pop edi
pop esi
ret