joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x7fff
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x8060402
mov al, byte [esi]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0x8060402
mov dword [ebp - 0xc4], 0x80007
mov dword [ebp - 0xc0], 0xa0009
mov dword [ebp - 0xbc], 0xc000b
mov dword [ebp - 0xb8], 0xe000d
mov dword [ebp - 0xb4], 0x110010
mov dword [ebp - 0xb0], 0x150013
mov dword [ebp - 0xac], 0x190017
mov dword [ebp - 0xa8], 0x1f001c
mov dword [ebp - 0xa4], 0x250022
mov dword [ebp - 0xa0], 0x2d0029
mov dword [ebp - 0x9c], 0x370032
mov dword [ebp - 0x98], 0x42003c
mov dword [ebp - 0x94], 0x500049
mov dword [ebp - 0x90], 0x610058
mov dword [ebp - 0x8c], 0x76006b
mov dword [ebp - 0x88], 0x8f0082
mov dword [ebp - 0x84], 0xad009d
mov dword [ebp - 0x80], 0xd100be
mov dword [ebp - 0x7c], 0xfd00e6
mov dword [ebp - 0x78], 0x1330117
mov dword [ebp - 0x74], 0x1730151
mov dword [ebp - 0x70], 0x1c10198
mov dword [ebp - 0x6c], 0x22001ee
mov dword [ebp - 0x68], 0x2920256
mov dword [ebp - 0x64], 0x31c02d4
mov dword [ebp - 0x60], 0x3c3036c
mov dword [ebp - 0x5c], 0x48e0424
mov dword [ebp - 0x58], 0x5830502
mov dword [ebp - 0x54], 0x6ab0610
mov dword [ebp - 0x50], 0x8120756
mov dword [ebp - 0x4c], 0x9c308e0
mov dword [ebp - 0x48], 0xbd00abd
mov dword [ebp - 0x44], 0xe4c0cff
mov dword [ebp - 0x40], 0x114c0fba
mov dword [ebp - 0x3c], 0x14ee1307
mov dword [ebp - 0x38], 0x19541706
mov dword [ebp - 0x34], 0x1ea51bdc
mov dword [ebp - 0x30], 0x251521b6
mov dword [ebp - 0x2c], 0x2cdf28ca
mov dword [ebp - 0x28], 0x364b315b
mov dword [ebp - 0x24], 0x41b23bb9
mov dword [ebp - 0x20], 0x4f7e4844
mov dword [ebp - 0x1c], 0x602f5771
mov dword [ebp - 0x18], 0x746269ce
cmp al, 0x58
jle 0x4945f4
mov dl, 0x58
jmp 0x4945fe
xor ecx, ecx
movzx edx, al
test al, al
cmovs edx, ecx
mov bl, byte [ebp + 0x10]
movsx eax, dl
movzx ecx, word [ebp + eax*2 - 0xc4]
movzx eax, bl
mov al, byte [ebp + eax - 0x10]
add al, dl
mov edx, ecx
shr edx, 3
mov byte [esi], al
test bl, 4
je 0x494623
add edx, ecx
test bl, 2
je 0x49462e
mov eax, ecx
shr eax, 1
add edx, eax
test bl, 1
je 0x494638
shr ecx, 2
add edx, ecx
movsx eax, word [ebp + 0xc]
mov ecx, edx
neg ecx
and bl, 8
pop esi
cmove ecx, edx
add ecx, eax
pop ebx
cmp ecx, 0x7fff
jle 0x49465b
mov eax, 0x7fff
mov esp, ebp
pop ebp
ret
mov eax, 0xffff8000
cmp ecx, eax
cmovl ecx, eax
mov ax, cx
mov esp, ebp
pop ebp
ret
Function at 0x4a19b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, 0x1505
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
fld dword [edi + esi*8]
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, edx
shl eax, 5
add eax, edx
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov edx, ecx
fldcw word [ebp - 2]
shl edx, 5
add edx, ecx
fld dword [edi + esi*8 + 4]
inc esi
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
add edx, dword [ebp - 0xc]
fldcw word [ebp - 2]
cmp esi, 0x40
jl 0x4a19c2
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bc800
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x67b960], 0
jne 0x4bc888
push 0x67b958
mov dword [0x67b968], 0x40000
mov dword [0x67b96c], 0x200000
mov dword [0x67b970], 7
call fcn.004bdc00
add esp, 4
cmp dword [0x67b95c], 0
jne 0x4bc861
mov eax, dword [0x67b970]
mov dword [0x67b95c], 0x58585858
mov dword [0x67bb30], 0
mov dword [0x67bb2c], eax
push 0x67b958
call fcn.004bdc40
add esp, 4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x67b960], eax
mov eax, dword [ebp - 8]
mov dword [0x67b964], eax
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4bdd30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4bdd92
cmp byte [esi], 0
je 0x4bdd92
push dword [0x67bb48]
push dword [0x67bb44]
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
je 0x4bdd92
cmp edi, dword [0x67bb48]
jbe 0x4bdd89
push edi
push dword [0x67bb44]
call fcn.004bc4e0
add esp, 8
test eax, eax
je 0x4bdd92
push edi
push eax
push esi
mov dword [0x67bb44], eax
mov dword [0x67bb48], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x67bb44]
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4c4980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [esi + 0x28]
mov ecx, edx
neg ecx
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
and ecx, 0x10000
test eax, eax
je 0x4c49c1
push edi
lea edi, [ebp + 8]
push edi
push ecx
push esi
push 0x4c4960
push edx
push 0
call eax
add esp, 0x18
pop edi
jmp 0x4c49d5
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 0x4c4960
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
test eax, eax
jne 0x4c49ec
push str.Not_enough_resources_to_create_thread
call fcn.004868d0
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4ca520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x4ca558
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [esi + eax]
movzx eax, bl
xor ecx, eax
push ecx
call fcn.004ca560
shr ebx, 8
inc esi
add esp, 4
xor ebx, eax
cmp esi, edi
jb 0x4ca532
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x4ca600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], 0
mov ebx, dword [esi + 0x30]
cmp dword [esi + 0x18], edi
jne 0x4ca682
push dword [esi + 0xc]
mov dword [esi + 0x18], 1
push edi
push dword [esi + 0x1c]
call fcn.004bf140
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0x20]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
push dword [esi + 0x1c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4ca682
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4ca682
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [esi + 0x18], edi
push 0x626458
push esi
call fcn.004cbe00
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
test eax, eax
cmovns ecx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ca6a2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x20]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [esi + 0x18], edi
test eax, eax
je 0x4ca66a
mov eax, dword [ebp - 4]
test eax, eax
je 0x4ca701
mov ecx, dword [esi + 0x1c]
mov edi, dword [ebp + 0x10]
cmp byte [ecx], 0
jne 0x4ca6ef
dec eax
cmp edi, eax
mov dword [ebp - 4], eax
cmova edi, eax
lea eax, [ecx + 1]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004bf0c0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, eax
cmova edi, eax
push edi
push ecx
push dword [ebp + 0xc]
call fcn.004bf0c0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cbb90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x48], 0
je 0x4cbbaf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004cbb60
add esp, 0xc
pop esi
pop ebp
ret
movzx eax, word [esi + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
cmp ebx, eax
jb 0x4cbbc1
mov edi, dword [ebp + 0xc]
jmp 0x4cbbec
push eax
call fcn.004bc4a0
push ebx
push dword [ebp + 0xc]
mov edi, eax
push edi
call fcn.004bf0c0
movzx ecx, word [esi + 8]
lea eax, [edi + ebx]
sub ecx, ebx
push ecx
push 0
push eax
call fcn.004bf140
movzx ebx, word [esi + 8]
add esp, 0x1c
lea eax, [esi + 0x34]
push eax
push 0
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4cbc0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4cbc47
push dword [ebp + 0x14]
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4cbc31
push str.WriteFile_WaitForSingleObject_Timeout
push esi
mov dword [ebp + 8], 0xffffffff
call fcn.004cbe00
jmp 0x4cbc59
push 0
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x34]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4cbc5c
push 0x626424
push esi
call fcn.004cbe00
mov dword [ebp + 8], 0xffffffff
add esp, 8
cmp edi, dword [ebp + 0xc]
je 0x4cbc6a
push edi
call fcn.004bc470
add esp, 4
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4cbf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x4cbfcd
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
xor al, bl
movzx eax, al
push eax
call fcn.004cbfe0
shr bx, 8
inc esi
xor ax, bx
add esp, 4
movzx ebx, ax
cmp esi, edi
jb 0x4cbfa2
mov ax, bx
pop ebx
pop edi
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x4cc0d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call sub.KERNEL32.dll_GetCurrentThreadId
push dword [0x67a520]
mov esi, eax
xor edi, edi
call fcn.004b05e0
mov ecx, dword [0x67a524]
add esp, 4
test ecx, ecx
je 0x489b24
cmp dword [ecx], esi
je 0x489b21
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x489b03
push dword [0x67a520]
call fcn.004b0620
add esp, 4
mov eax, edi
pop edi
pop esi
ret
mov edi, dword [ecx + 4]
push dword [0x67a520]
call fcn.004b0620
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp dword [0x67bce4], 0
jne 0x489ae0
mov eax, dword [0x6726cc]
cmp eax, 0xffffffff
je 0x4cc0ef
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret
xor eax, eax
ret

Function at 0x4cc180
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x67bce4], 0
je 0x4cc192
pop ebp
jmp fcn.00489be0
push dword [ebp + 8]
push dword [0x6726cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4cc1b2
mov dword [ebp + 8], str.TlsSetValue__
pop ebp
jmp fcn.004cc480
xor eax, eax
pop ebp
ret
Function at 0x4cc250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
mov esi, dword [ebp + 0xc]
push 0x6264f8
push esi
mov dword [ebp - 8], 0
call fcn.004cc200
add esp, 8
test eax, eax
je 0x4cc29f
mov esi, dword [ebp + 8]
push esi
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0xf]
push edi
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 6]
push eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 3]
push eax
push str.SystemCurrentControlSetControlMediaCategories_02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.00487fb0
lea eax, [ebp - 0x88]
push eax
call fcn.004881d0
add esp, 0x50
inc eax
push eax
lea eax, [ebp - 0x88]
push eax
push str.UTF_8
push str.UTF_16LE
call fcn.004bfe00
add esp, 0x10
mov edi, eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
push edi
sbb esi, esi
call fcn.004bc470
add esp, 4
add esi, 1
je 0x4cc393
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.Name
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4cc38a
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.004bc4a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4cc3bd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
push esi
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push str.Name
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
test esi, esi
je 0x4cc40f
call fcn.004bc470
mov esi, dword [ebp + 8]
push esi
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push edi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
push edi
mov esi, eax
call fcn.004bc470
add esp, 0x18
test esi, esi
jne 0x4cc46c
mov esi, dword [ebp + 8]
push esi
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cc5c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0xd
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4cc604
mov ebx, dword [ebp + 8]
xor esi, esi
lea esp, [esp]
push ebx
call fcn.004cc570
add esp, 4
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4cc614
push 0xa
call fcn.004c50b0
inc esi
add esp, 4
cmp esi, 3
jl 0x4cc5e0
pop edi
pop esi
pop ebx
mov dword [ebp + 8], 0x64e2f4
pop ebp
jmp fcn.00488110
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x4cc657
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push esi
call fcn.00489740
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.004bfe00
add esp, 0x14
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4cc664
push str.Couldnt_get_clipboard_data
call fcn.004cc480
add esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
test edi, edi
je 0x4cc604
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ccf70
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, word [ebx + 0xf0]
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test esi, esi
jle 0x4ccfc0
cmp dword [ebx + 0x7c], esi
jge 0x4ccfc0
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x4ccfae
push eax
call fcn.004bc470
add esp, 4
lea eax, [esi + 2]
push eax
call fcn.004bc4a0
add esp, 4
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], esi
push dword [ebx + 0x7c]
push dword [ebx + 0x78]
push dword [ebp + 0x10]
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
xor eax, eax
push eax
push eax
test esi, esi
push 0x80
cmovs esi, eax
push edi
shr esi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, ax
mov eax, dword [ebp + 8]
mov dword [ebx + 0xa0], edx
cmp eax, 0x404
je 0x4cd001
cmp eax, 0x804
jne 0x4cd03b
test edx, edx
je 0x4cd03b
mov eax, dword [ebx + 0x7c]
shr eax, 1
cmp edx, eax
jae 0x4cd03b
mov eax, dword [ebx + 0x78]
mov ecx, 0x3000
movzx eax, word [eax]
cmp ax, cx
je 0x4cd023
cmp eax, 0x20
jne 0x4cd03b
inc edx
cmp edx, esi
jae 0x4cd03a
mov eax, dword [ebx + 0x78]
lea ecx, [eax + edx*2]
inc edx
mov ax, word [ecx]
mov word [ecx - 2], ax
cmp edx, esi
jl 0x4cd028
dec esi
mov eax, dword [ebx + 0x78]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [ebx + 0xa0], ecx
jne 0x4cd0c4
test esi, esi
jle 0x4cd0c4
xor esi, esi
push esi
push esi
push 0x10
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x4cd0be
lea ecx, [edi + 2]
push ecx
call fcn.004bc4a0
add esp, 4
mov esi, eax
mov dword [ebp + 8], esi
push edi
push esi
push 0x10
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
xor ecx, ecx
mov al, byte [esi + ecx]
cmp al, 1
je 0x4cd091
cmp al, 3
je 0x4cd091
inc ecx
cmp ecx, edi
jl 0x4cd081
mov edx, dword [ebp + 8]
mov esi, ecx
cmp ecx, edi
jge 0x4cd0b2
lea ebx, [ebx]
mov al, byte [edx + esi]
cmp al, 1
je 0x4cd0ab
cmp al, 3
jne 0x4cd0b0
inc esi
cmp esi, edi
jl 0x4cd0a0
cmp ecx, edi
push edx
cmove esi, edi
call fcn.004bc470
add esp, 4
mov dword [ebx + 0xa0], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4cd0d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, dword [edi + 0xf0]
cmp dword [0x67bcf0], eax
jne 0x4cd10f
mov eax, dword [ebp + 0xc]
pop edi
mov eax, dword [eax*4 + 0x67bcf4]
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x110], 0
movzx ecx, ax
mov dword [0x67bcf0], eax
mov dword [ebp + 8], ecx
je 0x4cd149
cmp ecx, 0x404
jne 0x4cd149
mov dword [0x67bcf4], 0x7000404
mov eax, 0x7000404
mov dword [0x67bcf8], 0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
cmp eax, 0xe0080404
je 0x4cd172
cmp eax, 0xe0090404
je 0x4cd172
cmp eax, 0xe00a0404
je 0x4cd172
cmp eax, 0xe00b0404
je 0x4cd172
cmp eax, 0xe00e0804
jne 0x4cd300
push 0xff
lea ecx, [ebp - 0x10c]
push ecx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x4cd300
cmp dword [edi + 0xf8], 0
jne 0x4cd300
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x10c]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x4cd239
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x4cd239
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x4cd239
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x4cd239
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x4cd300
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4cd300
push ebx
call fcn.004bc4a0
mov esi, eax
add esp, 4
test esi, esi
je 0x4cd2f7
push esi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x10c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4cd2f7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x62372c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4cd2f7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
movzx ecx, al
and eax, 0xffff0000
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
shl ecx, 8
cmp dword [edi + 0xf8], 0
jne 0x4cd33c
cmp eax, 0x404
jne 0x4cd31d
cmp ecx, 0x4020000
je 0x4cd33c
cmp ecx, 0x4030000
je 0x4cd33c
cmp ecx, 0x4040000
je 0x4cd33c
cmp ecx, 0x5000000
je 0x4cd33c
cmp ecx, 0x5010000
je 0x4cd33c
cmp ecx, 0x5020000
je 0x4cd33c
cmp ecx, 0x6000000
je 0x4cd33c
push esi
call fcn.004bc470
add esp, 4
pop esi
pop ebx
mov dword [0x67bcf8], 0
xor eax, eax
mov dword [0x67bcf4], 0
pop edi
mov esp, ebp
pop ebp
ret
cmp eax, 0x804
jne 0x4cd2f7
cmp ecx, 0x4010000
je 0x4cd33c
cmp ecx, 0x4020000
je 0x4cd33c
cmp ecx, 0x5030000
jne 0x4cd2f7
or ecx, eax
mov eax, dword [edx + 0xc]
push esi
mov dword [0x67bcf4], ecx
mov dword [0x67bcf8], eax
call fcn.004bc470
mov eax, dword [0x67bcf4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4ce2b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0x42
mov esi, dword [eax + 0x448]
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x7c], 0x40
call fcn.004bc4a0
mov dword [esi + 0x78], eax
xor ecx, ecx
push 0x10
mov word [eax], cx
xor eax, eax
mov word [esi + 0x80], ax
push eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc4], eax
lea eax, [esi + 0xc8]
push eax
mov dword [esi + 0xc0], 1
call fcn.004bf140
push 0x10
lea eax, [esi + 0xd8]
push 0
push eax
call fcn.004bf140
push 0
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], 0xffffffff
mov dword [esi + 0x124], 0xffffffff
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
call fcn.004ce700
push str.Menu
push 0x65
call fcn.004a7fa0
push str.Left_Windows
push 0xe3
call fcn.004a7fa0
push str.Right_Windows
push 0xe7
call fcn.004a7fa0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x38
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.004a7fc0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.004a7fc0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.004a7fc0
add esp, 8
pop esi
pop ebp
ret

Function at 0x4ce700
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
lea eax, [ebp - 0x800]
push ebx
push esi
push edi
push eax
call fcn.004a74b0
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esp, 4
xor esi, esi
mov edi, dword [esi*4 + 0x626630]
test edi, edi
je 0x4ce762
test dword [ebp + edi*4 - 0x800], 0x40000000
jne 0x4ce762
push 1
push esi
call ebx
test eax, eax
je 0x4ce762
push 2
push eax
call ebx
and eax, 0x7fff
je 0x4ce762
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x4ce75b
add eax, 0x20
mov dword [ebp + edi*4 - 0x800], eax
inc esi
cmp esi, 0x80
jb 0x4ce723
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push 0x200
push eax
push 0
call fcn.004a7e20
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret