joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5e00
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f5e2f
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f5e23
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f5e2f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f5e54
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f5e54
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f5e54
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004fdb30
mov ebp, eax
cmp ebp, ebx
jne 0x4f5e85
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f5e9c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f5f14
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f5ef9
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f5f0e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f5f58
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f5f58
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f5f58
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f5f68
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f6390
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, eax
cmp esi, ebx
push edi
mov dword [esp + 0x10], ebx
jne 0x4f63bf
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f63b3
mov esi, dword [eax + 4]
cmp esi, ebx
jne 0x4f63bf
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
cmp esi, ebx
je 0x4f63e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x4f63e4
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f63e4
push ebx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov edi, dword [esp + 0x1c]
push esi
mov eax, edi
mov dword [edi + 0x334], ebx
call fcn.004fdcd0
mov ebp, eax
cmp ebp, ebx
jne 0x4f6411
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f6428
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [edi + 4]
push eax
mov eax, esi
call fcn.0044bbb0
cmp dword [edi + 0x324], ebx
je 0x4f64d4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov ebx, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp edi, ebx
je 0x4f6489
push 1
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp edi, ebx
je 0x4f649e
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
add eax, 4
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x4f64ce
mov eax, dword [esp + 0x1c]
push 0
push 0
add eax, 4
mov eax, dword [eax]
push 0xf
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, edi
call fcn.00414cc0
mov ecx, dword [edi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [edi + 0x334], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f651a
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp esi, ebx
je 0x4f651a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 4]
jne 0x4f651a
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f652a
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x338]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f75e0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
mov eax, dword [0x5f8cb4]
push ebx
push ebp
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
je 0x4f75fd
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f7609
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f762e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f762e
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f762e
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004feb70
mov ebp, eax
cmp ebp, ebx
jne 0x4f765f
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f7676
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f76ee
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f76d3
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f76e8
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f7732
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f7732
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f7732
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f7742
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f9460
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f948f
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f9483
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f948f
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f94b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f94b4
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f94b4
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004ff8e0
mov ebp, eax
cmp ebp, ebx
jne 0x4f94e5
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f94fc
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f9574
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f9559
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f956e
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f95b8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f95b8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f95b8
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f95c8
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f96c0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x4f96ef
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f96e3
mov edi, dword [eax + 4]
cmp edi, ebx
jne 0x4f96ef
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, ebx
je 0x4f9714
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x4f9714
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f9714
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x1c]
push ecx
mov eax, esp
push edi
mov dword [esi + 0x378], ebx
push esi
mov dword [eax], ebx
call fcn.004ffa80
mov ebp, eax
cmp ebp, ebx
jne 0x4f9745
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [0x5f8cb4]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x4f975c
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [eax + 4], ebp
lea eax, [esi + 4]
push eax
mov eax, edi
call fcn.0044bbb0
cmp dword [esi + 0x36c], ebx
je 0x4f97d4
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
push 0x2001
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, esi
je 0x4f97b9
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebx, esi
je 0x4f97ce
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [esp + 0x1c]
xor ebx, ebx
call fcn.00515720
mov edx, dword [esi + 4]
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esi + 0x378], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x10], ebx
je 0x4f9818
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, ebx
je 0x4f9818
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4f9818
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x5f8cb4]
cmp eax, ebx
je 0x4f9828
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4f9960
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x58d859
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
xor ebp, ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x18], ebp
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x3c], ebp
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov esi, 1
mov ecx, 0x5f7780
mov dword [esp + 0x18], esi
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
mov ecx, str.bosskey
mov dword [esp + 0x40], esi
call fcn.00481430
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.SoftwareKingsoftKVip
mov byte [esp + 0x40], 2
call fcn.00481430
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
mov ecx, SysReAllocStringLen
mov byte [esp + 0x44], 3
call fcn.0047b9d0
push edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
mov edx, dword [0x5f8cb8]
push ecx
push edx
push 0x5aebdc
mov esi, eax
call fcn.00479130
add esp, 8
push eax
call fcn.0047b850
mov byte [esp + 0x3c], 3
mov eax, dword [esp + 0x30]
cmp eax, ebp
je 0x4f9a4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x30], ebp
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f9a6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3c], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f9a8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3c], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f9ab4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f9ad9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x30
ret
Function at 0x4ffea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58a3d1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebp], eax
test byte [esp + 0x30], 2
mov esi, 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], esi
je 0x4fff0b
push 7
push 0x5b57bc
push ebp
call fcn.00473c80
test byte [esp + 0x30], 1
je 0x4fff1f
push 6
push str.Alt_
push ebp
call fcn.00473c80
test byte [esp + 0x30], 4
je 0x4fff33
push 8
push str.Shift_
push ebp
call fcn.00473c80
cmp dword [esp + 0x34], ebx
je 0x4fff9e
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
movsx eax, byte [esp + 0x34]
push eax
push 0x5b5850
lea edi, [esp + 0x1c]
mov dword [esp + 0x2c], esi
call fcn.00481690
add esp, 8
call fcn.004815c0
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 0xc]
push eax
push esi
push ebp
call fcn.00473c80
lea eax, [esi - 0x10]
mov byte [esp + 0x24], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4fff9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5039b0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x34]
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x28]
push edi
push 1
lea ecx, [ebx + 0x28]
push ebp
push esi
call edx
mov edi, eax
test edi, edi
jne 0x503a05
mov eax, dword [ebx + 0xfc]
mov edx, dword [eax + 0x34]
push 1
lea ecx, [ebx + 0xfc]
push ebp
push esi
call edx
mov edi, eax
test edi, edi
jne 0x503a05
mov eax, dword [ebx + 0x1d0]
mov edx, dword [eax + 0x34]
push 1
lea ecx, [ebx + 0x1d0]
push ebp
push esi
call edx
mov edi, eax
cmp dword [ebx + 0x2c0], 0
je 0x503aa5
cmp dword [ebx + 0x2d0], 0
je 0x503a2b
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebx + 0x2d0], 0
cmp dword [ebx + 0x2c0], edi
jne 0x503a9b
call fcn.004799d0
movzx edi, word [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
movzx ecx, bp
shl ecx, 0x10
or ecx, edi
push ecx
mov ecx, dword [esp + 0x30]
mov esi, eax
mov edx, dword [esi]
mov edx, dword [edx + 0x50]
push ecx
xor eax, eax
push 0x205
push eax
mov ecx, esi
mov dword [esp + 0x20], eax
mov dword [esi + 0xac], eax
call edx
mov eax, dword [ebx + 4]
lea edx, [esp + 0x10]
push edx
push 0xffffffffffffffff
mov dword [esp + 0x20], 0xd
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esi + 0x10]
push 0x4e
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0x2c0], 0
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x503ab0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x24
mov eax, dword [ebx + 4]
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor esi, esi
cmp dword [ebx + 0x2d0], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
je 0x503ae2
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebx + 0x2d0], esi
mov esi, dword [esp + 0x3c]
mov edx, dword [ebx + 0x28]
mov edi, dword [esp + 0x38]
mov eax, dword [edx + 0x34]
push 1
lea ecx, [ebx + 0x28]
push esi
push edi
call eax
mov ebp, eax
test ebp, ebp
jne 0x503b31
mov edx, dword [ebx + 0xfc]
mov eax, dword [edx + 0x34]
push 1
lea ecx, [ebx + 0xfc]
push esi
push edi
call eax
mov ebp, eax
test ebp, ebp
jne 0x503b31
mov edx, dword [ebx + 0x1d0]
mov eax, dword [edx + 0x34]
push 1
lea ecx, [ebx + 0x1d0]
push esi
push edi
call eax
mov ebp, eax
mov edi, dword [ebx + 0x2bc]
test edi, edi
mov dword [esp + 0x18], edi
je 0x503cbf
call fcn.004799d0
mov esi, eax
test esi, esi
je 0x503c17
cmp dword [ebx + 0x2bc], ebp
mov edx, dword [esi]
mov edi, dword [esi + 0x10]
mov eax, dword [edx + 0x2c]
push 2
mov ecx, esi
jne 0x503bd3
push 1
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
mov ecx, esi
call eax
test eax, eax
je 0x503b7f
push 1
push ebx
call fcn.004fb9a0
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x38]
mov eax, dword [esp + 0x34]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push 0x202
mov ecx, esi
call fcn.00479a50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x503bc3
cmp word [eax], 0
je 0x503bc3
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x503c1b
cmp dword [esi + 0x10], 0
je 0x503c1b
mov dword [esp + 0xc], 1
jmp 0x503c1b
push 0
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
mov ecx, esi
call eax
test eax, eax
je 0x503bec
push 1
push ebx
call fcn.004fb9a0
movzx ecx, word [esp + 0x3c]
movzx edx, word [esp + 0x38]
mov eax, dword [esp + 0x34]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push 0x2a3
mov ecx, esi
call fcn.00479a50
mov dword [esp + 0x10], 1
jmp 0x503c1b
mov edi, dword [esp + 0x14]
cmp dword [esp + 0xc], 0
mov dword [ebx + 0x2bc], 0
je 0x503c73
mov ecx, dword [ebx + 4]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x28], edi
call eax
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x34], eax
mov eax, dword [ebx + 4]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
add esp, 0x24
ret 0xc
cmp dword [esp + 0x10], 0
je 0x503cbf
test edi, edi
je 0x503cbf
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [esp + 0x34], 4
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x18]
cmp edx, dword [ebx + 0x2b8]
jne 0x503cbf
mov dword [ebx + 0x2b8], 0
pop edi
pop esi
pop ebp
add esp, 0x24
ret 0xc
Function at 0x504070
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x5040d0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5040c6
cmp edi, 0x1b
jne 0x5040ae
mov ecx, dword [esi + 4]
push 0
push 2
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x37c], 0
ret
cmp edi, 0xd
jne 0x5040c6
mov edx, dword [esi + 4]
push 0
push 1
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x37c], 0
ret
Function at 0x509f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x585e68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push ecx
lea esi, [esp + 0x14]
call fcn.0050cef0
mov esi, eax
mov dword [esp + 0x38], 0
call fcn.00532be0
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x509f6e
mov eax, dword [eax]
test eax, eax
je 0x509f6e
lea edx, [esp + 0x14]
push 1
push edx
mov ecx, edx
push ecx
call eax
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 8

Function at 0x50acd0
Capabilities:
Create thread

Disassembly:
push 0xc
call fcn.00566e45
add esp, 4
test eax, eax
jne 0x50acdf
ret
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push 0
push 0
push eax
push 0x41f160
push 0
push 0
mov dword [eax], ecx
mov dword [eax + 8], 0
mov dword [eax + 4], edx
call fcn.00565c54
add esp, 0x18
ret

Function at 0x50ad60
Capabilities:
Create thread

Disassembly:
push 0x18
call fcn.00566e45
add esp, 4
test eax, eax
jne 0x50ad6f
ret
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push 0
push 0
push eax
push 0x50d8a0
mov dword [eax], ecx
mov ecx, dword [esp + 0x1c]
push 0
push 0
mov dword [eax + 0x10], 0
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.00565c54
add esp, 0x18
ret