joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4ddc53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x810
push ebx
push esi
mov dword [esp + 0xc], 0
mov eax, dword [0x52251c]
mov ebx, 1
mov dword [esp + 0x820], ebx
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov byte [esp + 0x820], 2
call fcn.004c5712
mov ecx, dword [esp + 0x82c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea edx, [esp + 0x1c]
push 0x800
push edx
push 0
push str.HotIcon
push 0x51c740
call esi
test eax, eax
jne 0x414ff5
mov eax, dword [esp + 0x82c]
lea ecx, [esp + 0x18]
push eax
push 0x800
push ecx
push 0
push str.Icon
push 0x51c740
call esi
test eax, eax
jne 0x414ff5
mov esi, dword [esp + 0x828]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0xc], ebx
jmp 0x415079
push 0x5c
lea ecx, [esp + 0x830]
call fcn.004bd781
inc eax
lea ecx, [esp + 0x82c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004bd709
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x82c], 3
call fcn.004c5a1c
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x824], 4
call fcn.004c58c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x820], 3
call fcn.004c5787
lea ecx, [esp + 0x14]
mov byte [esp + 0x820], 2
call fcn.004c5787
mov esi, dword [esp + 0x828]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x820], bl
call fcn.004c5787
lea ecx, [esp + 0x82c]
mov byte [esp + 0x820], 0
call fcn.004c5787
mov ecx, dword [esp + 0x818]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x81c
ret
Function at 0x4154d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ddd68
push eax
mov dword fs:[0], esp
sub esp, 0x28
lea eax, [esp + 4]
push esi
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x41550c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
mov ecx, dword [0x52251c]
mov dword [esp + 8], ecx
mov eax, dword [0x52700c]
mov dword [esp + 0x38], 0
test eax, eax
push 0x6d
je 0x415538
lea edx, [esp + 0xc]
push edx
call fcn.00417b10
add esp, 8
jmp 0x415541
lea ecx, [esp + 0xc]
call fcn.004c681c
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x41556c
lea ecx, [esp + 0x48]
push ecx
push eax
call fcn.00415430
mov edx, dword [esp + 0x50]
add esp, 8
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x41557a
mov dword [esp + 0x10], eax
jmp 0x415581
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x44]
push 0x104
mov ecx, esi
call fcn.004c5bb7
mov ecx, dword [esp + 8]
push 0x104
mov dword [esp + 0x20], ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], 0x4154a0
call fcn.004c5bb7
lea edx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, eax
test edi, edi
jne 0x4155f2
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004c5787
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push 0xffffffffffffffff
mov ecx, esi
call fcn.004c5c06
push 0x104
mov ecx, esi
call fcn.004c5bb7
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x41564c
mov eax, dword [esp + 0xc]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004c5787
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push 0xffffffffffffffff
mov ecx, esi
call fcn.004c5c06
mov eax, dword [esp + 0xc]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x30]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x416d40
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4de02c
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x120]
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x416f15
push ebx
push esi
push 1
push 0x22
lea ecx, [esp + 0x18]
call fcn.004bd113
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, edi
mov dword [esp + 0x128], 0
call fcn.004bd709
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x416dc6
test cl, cl
je 0x416dc2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x416dc6
add eax, 2
add esi, 2
test cl, cl
jne 0x416d9e
xor eax, eax
jmp 0x416dcb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
invalid
xchg esp, eax
Function at 0x417410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], 0xffffffff
push eax
push ecx
push edx
mov dword [esp + 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x417443
or eax, 0xffffffff
add esp, 8
ret
mov edx, dword [esp + 0x14]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41746d
mov dword [esp], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 8
ret

Function at 0x417480
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push eax
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4174bf
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4174bf
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x417515
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0
or edi, 0xffffffff
push esi
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4174f4
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp edx, eax
jne 0x417515
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push 4
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x417538
mov ebx, 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
Function at 0x417550
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4de0e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
mov eax, dword [0x52251c]
push esi
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov dword [esp + 0x124], 1
mov dword [esp + 0x14], 0x104
call fcn.004c5712
mov edx, dword [esp + 0x134]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4175e3
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0xc], 1
jmp 0x41763c
mov ecx, dword [esp + 0x138]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417616
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.004c5910
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x12c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x124], 0
call fcn.004c5787
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret

Function at 0x417670
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4176a1
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4176a1
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x1c]
push 1
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
ret
Function at 0x4176e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x108
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x114]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x417775
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push edi
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x417764
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call edi
test eax, eax
je 0x41774d
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.004176e0
add esp, 8
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push 0
push edx
call esi
test eax, eax
je 0x41772b
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x4177c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4de0f8
push eax
mov dword fs:[0], esp
push esi
push edi
mov eax, dword [esp + 0x18]
push 0
mov dword [esp + 0x14], 0
mov esi, dword [eax - 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41784b
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x41784b
lea ecx, [esi + esi + 2]
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x417845
lea ecx, [esp + 0x18]
call fcn.004dade2
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.004ae1ac
add esp, 8
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x417870
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x4de12f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x52251c]
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ebp, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ebp
call fcn.004c5712
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4178d0
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0x10], ebp
jmp 0x417953
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
cmp esi, ebx
jne 0x4178eb
call dword [sym.imp.USER32.dll_CloseClipboard]
lea edx, [esp + 0xc]
push edx
jmp 0x417944
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebx
jbe 0x417939
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call fcn.004ae1d1
add esp, 4
lea eax, [eax + eax + 1]
lea ecx, [esp + 0x10]
push ebx
push ebx
push eax
push eax
call fcn.004c5bb7
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004c5c06
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [esp + 0xc]
push eax
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.004c5787
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14

Function at 0x418150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4de1b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov ecx, dword [0x52790c]
xor esi, esi
mov dword [esp + 0x38], esi
call fcn.00455190
mov edx, dword [esp + 0x40]
lea ecx, [esp + 4]
mov dword [esp + 8], 0x20
mov dword [esp + 0x24], esi
mov dword [esp + 4], 0x2c
mov eax, dword [eax + 4]
push ecx
push esi
push edx
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
mov esi, dword [esp + 0x24]
push 1
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.004c54fc
call fcn.0041b8e0
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x4c]
push esi
push eax
call fcn.004833f0
add esp, 0x10
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x419db0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4de356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x148]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x527030
mov dword [esp + 0x140], ebp
mov dword [eax], 0xffffffff
call fcn.004c54fc
call fcn.00415270
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esp + 0x20], edi
je 0x419fcc
mov ecx, dword [0x52251c]
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x144]
lea eax, [esp + 0x14]
push edx
push 0x51c974
push eax
mov byte [esp + 0x144], 1
call fcn.004c5a90
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x140]
mov byte [esp + 0x138], 2
mov esi, edi
mov edx, dword [ecx - 8]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004ad970
mov esi, eax
add esp, 8
test esi, esi
je 0x419fa1
cmp byte [esi], 0
je 0x419fa1
add esi, dword [esp + 0x28]
cmp byte [esi], 0x5d
jne 0x419f2c
mov ecx, dword [0x527030]
mov eax, dword [esp + 0x144]
push ecx
lea edx, [esp + 0x30]
push 0x104
push edx
push 0
push str._GB_PageTitle
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x2c]
test al, al
je 0x419ece
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x28]
call fcn.004c57f5
or dword [esp + 0x10], 1
mov byte [esp + 0x138], 3
jmp 0x419ed5
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x1c]
call fcn.004c58c0
mov al, byte [esp + 0x10]
mov dword [esp + 0x138], 2
test al, 1
je 0x419f05
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
and al, 0xfe
mov dword [esp + 0x10], eax
call fcn.004c5787
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push edx
push ebp
push 1
mov ecx, ebx
call fcn.004be754
mov eax, dword [esp + 0x148]
mov dword [eax], ebp
inc ebp
inc esi
jmp 0x419e55
push 0x51c94c
push esi
call fcn.004ad970
add esp, 8
cmp eax, esi
jne 0x419e55
add esi, 3
push 0x51c950
push esi
call fcn.004ad970
mov edi, eax
add esp, 8
mov ecx, edi
sub ecx, esi
push ecx
push esi
lea ecx, [esp + 0x24]
call fcn.004bd147
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push edx
push ebp
push 1
mov ecx, ebx
mov byte [esp + 0x154], 4
call fcn.004be754
lea ecx, [esp + 0x1c]
inc ebp
lea esi, [edi + 1]
mov byte [esp + 0x138], 2
call fcn.004c5787
mov edi, dword [esp + 0x20]
jmp 0x419e55
push edi
call fcn.004ae1ee
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 1
call fcn.004c5787
lea ecx, [esp + 0x18]
mov byte [esp + 0x138], 0
call fcn.004c5787
lea ecx, [esp + 0x144]
mov dword [esp + 0x138], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x12c
ret
Function at 0x41b050
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x4de4f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0x12
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
test ax, ax
jge 0x41b08e
push 0
push 2
push 0
push 0x12
call esi
push 0x51c8b4
push str._r_n
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51c8b4
push 0x51c8b8
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51c8b4
push 0x51c8b0
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51c8ec
push 0x51c8e8
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51ca58
push 0x51ca54
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51ca50
push 0x51ca4c
lea ecx, [esp + 0x28]
call fcn.004bd420
push 0x51ca48
push 0x51ca44
lea ecx, [esp + 0x28]
call fcn.004bd420
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [ecx - 8]
test edx, edx
mov dword [esp + 0xc], edx
jle 0x41b226
push ebx
push ebp
push edi
jmp 0x41b139
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
movsx ebp, byte [eax + ecx]
cmp ebp, 0x11
je 0x41b193
cmp ebp, 0x10
je 0x41b193
cmp ebp, 0x12
je 0x41b193
push ebp
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx edi, ax
push 0
cmp edi, 0x100
push 0
push 0
jle 0x41b187
push 0x10
call esi
push 0
push 0
push 0
push edi
call esi
push 0
push 2
push 0
push edi
call esi
push 0
push 2
push 0
push 0x10
jmp 0x41b20c
push edi
call esi
push 0
push 2
push 0
push edi
jmp 0x41b20c
movsx edi, byte [eax + ecx + 1]
inc eax
xor ebx, ebx
cmp edi, 0x11
mov dword [esp + 0x10], eax
je 0x41b1ba
cmp edi, 0x10
je 0x41b1ba
cmp edi, 0x12
je 0x41b1ba
push edi
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx edi, ax
jmp 0x41b1d4
inc eax
mov dword [esp + 0x10], eax
mov al, byte [eax + ecx]
mov byte [esp + 0x14], al
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ebx, ax
push 0
push 0
push 0
push ebp
call esi
push 0
push 0
push 0
push edi
call esi
test ebx, ebx
je 0x41b1fc
push 0
push 0
push 0
push ebx
call esi
push 0
push 2
push 0
push ebx
call esi
push 0
push 2
push 0
push edi
call esi
push 0
push 2
push 0
push ebp
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x41b131
pop edi
pop ebp
pop ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41b250
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4de569
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push esi
push edi
mov dword [esp + 0x1c], 0
mov eax, dword [0x52251c]
mov dword [esp + 0x168], 1
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov byte [esp + 0x168], 2
call fcn.004c5712
push 0x5c
lea ecx, [esp + 0x178]
call fcn.004bd781
inc eax
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x17c]
call fcn.004bd5d4
push 0x5c
lea ecx, [esp + 0x178]
mov byte [esp + 0x16c], 3
call fcn.004bd781
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x17c]
call fcn.004bd709
push 0x51c590
lea ecx, [esp + 0x18]
mov byte [esp + 0x16c], 4
call fcn.004c5b63
lea eax, [esp + 0x14]
push 0x51c590
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.004c5a1c
mov eax, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004c5787
cmp edi, 0xffffffff
je 0x41b433
mov esi, dword [esp + 0x10]
push ebx
push ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41b362
test cl, cl
je 0x41b35e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41b362
add eax, 2
add esi, 2
test cl, cl
jne 0x41b33a
xor eax, eax
jmp 0x41b367
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41b3ba
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [esp + 0x28]
push eax
push edi
call ebp
test eax, eax
je 0x41b42a
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41b3b1
test cl, cl
je 0x41b3ad
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41b3b1
add eax, 2
add esi, 2
test cl, cl
jne 0x41b389
xor eax, eax
jmp 0x41b3b6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41b371
push 0x5c
lea ecx, [esp + 0x180]
call fcn.004bd781
inc eax
lea ecx, [esp + 0x17c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004bd709
lea ecx, [esp + 0x158]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x17c], 5
call fcn.004c5a1c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 6
call fcn.004c58c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 5
call fcn.004c5787
lea ecx, [esp + 0x20]
mov byte [esp + 0x170], 4
call fcn.004c5787
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
mov esi, dword [esp + 0x170]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004c54fc
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x168], 3
call fcn.004c5787
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 2
call fcn.004c5787
lea ecx, [esp + 8]
mov byte [esp + 0x168], 1
call fcn.004c5787
lea ecx, [esp + 0x174]
mov byte [esp + 0x168], 0
call fcn.004c5787
mov ecx, dword [esp + 0x160]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x164
ret