joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459130
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x45927c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
call fcn.00458800
mov ebx, eax
test ebx, ebx
jbe 0x459250
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call fcn.004587f0
call sub.user32.dll_GetKeyboardLayoutList
cmp eax, 0xea
jne 0x459246
mov eax, dword [ebp - 0x14]
mov ecx, 0x24
xor edx, edx
div ecx
mov esi, eax
inc esi
push esi
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x459108]
call fcn.00405d14
add esp, 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
shl eax, 2
lea eax, [eax + eax*8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call fcn.004587f0
test eax, eax
je 0x459240
mov edi, dword [ebp - 0x18]
dec edi
test edi, edi
jl 0x459240
inc edi
xor esi, esi
lea eax, [esi + esi*8]
mov edx, dword [ebp - 0x10]
cmp dword [edx + eax*4], 0
je 0x45923c
lea eax, [ebp - 0x44]
lea edx, [esi + esi*8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + edx*4 + 4]
call fcn.00404b94
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec edi
jne 0x459213
mov byte [ebp - 9], 1
jmp 0x45924a
mov byte [ebp - 9], 0
push ebx
call fcn.004587d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459283
lea eax, [ebp - 0x44]
call fcn.0040499c
lea eax, [ebp - 0x10]
mov edx, dword [0x459108]
call fcn.00405d20
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x45965c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
mov eax, dword [ebp + 8]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x459830
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4597fb
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0x459844
call fcn.00458800
mov ebx, eax
test ebx, ebx
jne 0x4596ec
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x18]
call fcn.0040c334
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x407f94]
call fcn.0040cb60
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459805
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
push 0
push 2
push 0x110
push 0xf01ff
push edi
push esi
push ebx
call fcn.004587e0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45974c
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x1c]
call fcn.0040c334
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x407f94]
call fcn.0040cb60
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459805
mov byte [ebp - 5], 1
mov eax, dword [0x4a5b4c]
cmp dword [eax], 0
je 0x4597e8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.00404ebc
mov eax, 4
call fcn.00402764
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00404c5c
inc eax
call fcn.00402764
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
push ebp
push 0x4597e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00409b4c
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a5b4c]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4597e8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00402784
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
mov eax, dword [ebp - 0xc]
push eax
call fcn.004587d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459805
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459837
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004049c0
lea eax, [ebp - 4]
call fcn.0040499c
lea eax, [ebp + 8]
call fcn.0040499c
ret
Function at 0x459aa8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x459c13
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call fcn.00458800
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459bf5
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00458808
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459bec
mov eax, dword [0x4a578c]
cmp dword [eax], 0
je 0x459be3
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a578c]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x459be3
call sub.user32.dll_GetKeyboardLayoutList
cmp eax, 0x7a
jne 0x459be3
mov eax, dword [ebp - 0x14]
inc eax
call fcn.00402764
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x459bdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a578c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x459bc6
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00409cc8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004049f0
jmp 0x459bb6
mov edx, dword [ebx]
mov eax, 0x459c28
call fcn.00404fa0
mov edx, eax
mov eax, ebx
mov ecx, 2
call fcn.00404efc
mov edx, dword [ebx]
mov eax, 0x459c28
call fcn.00404fa0
test eax, eax
jg 0x459b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459be3
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
mov eax, dword [ebp - 0xc]
push eax
call fcn.004587d0
mov eax, dword [ebp - 8]
push eax
call fcn.004587d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459c1a
lea eax, [ebp - 0x18]
call fcn.0040499c
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x45c594
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x45c61d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a6d94
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x45c607
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c334
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x45c634
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4a5a4c]
mov dl, 1
mov eax, dword [0x45b5c0]
call fcn.0040cc58
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c624
lea eax, [ebp - 0x1c]
call fcn.0040499c
ret

Function at 0x45ccec
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0045cc10
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403da8
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x45cd50
call fcn.0045c4dc
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x45cd42
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403da8
pop esi
pop ebx
ret

Function at 0x45cd74
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045ca90
xor eax, eax
push ebp
push 0x45cdf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040499c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x45cdad
call fcn.004043e4
jmp 0x45cdfa
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x45cddd
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404b94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cdfa
mov eax, dword [ebp - 4]
call fcn.0045ca9c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ce00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045ca90
xor eax, eax
push ebp
push 0x45ce79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040499c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x45ce3c
call fcn.004043e4
jmp 0x45ce80
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x45ce63
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, 0x100
call fcn.00404c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce80
mov eax, dword [ebp - 4]
call fcn.0045ca9c
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4603d0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4603e8
add esp, 0xfffffff0
call fcn.00403ed0
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x460515
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0041bf80
mov byte [ebx + 0x10210], 0
mov eax, 0x400
call fcn.00402764
mov dword [ebx + 0x10068], eax
push ebx
push 0x460c54
call fcn.0044e49c
mov dword [ebx + 0x10060], eax
mov dword [ebx + 0x10208], 1
mov byte [ebx + 0x1006c], 0
push 0x46053c
push 0
push 0xffffffffffffffff
push 0
call sub.user32.dll_DestroyCursor
mov dword [ebx + 0x10248], eax
mov ecx, 0x460548
mov dl, 8
mov eax, ebx
call fcn.00460bd4
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4604e5
xor eax, eax
push ebp
push 0x4604cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x4604a8
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a20
push 4
push 0x46055c
push 0xff7f
push 0xffff
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_setsockopt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4604f3
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a20
mov byte [ebx + 0x10210], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46051c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049c0
ret

Function at 0x4605b0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460684
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1024c]
test eax, eax
je 0x4605df
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
lea eax, [ebx + 0x10070]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x46064b
xor eax, eax
push ebp
push 0x460635
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x1024c], esi
inc esi
jne 0x46062b
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460659
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.00460a20
mov eax, dword [ebp - 4]
mov dword [ebx + 0x1003c], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46068b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049c0
ret
Function at 0x460884
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp dword [ebp + 8], 0
jmp 0x4608ac
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x4608a0
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x460895
nop
nop
nop
nop
mov edx, esp
jmp 0x4082d0
jne 0x460937
test esi, esi
nop
jle 0x4608ce
loopne 0x4608c2
inc esi
add byte [edx + 0x7f94a101], dh
inc eax
add al, ch
cdq
ret 0xfffa
call fcn.0040cb60
call fcn.00404338
jmp 0x46092d
cmp word [ebx + 0x10242], 0
jne 0x4608f0
mov ecx, 0x4609e0
mov dl, 1
mov eax, dword [0x407f94]
call fcn.0040cb60
call fcn.00404338
jmp 0x46092d
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0x10244]
call dword [ebx + 0x10240]
cmp byte [ebp - 9], 0
jne 0x46092c
mov ecx, 0x4609e0
mov dl, 1
mov eax, dword [0x407f94]
call fcn.0040cb60
call fcn.00404338
jmp 0x46092d
inc esi
cmp dword [ebp + 8], 0
je 0x4608b2
mov byte [ebx + 0x1006c], 0
mov eax, ebx
call fcn.00460720
cmp dword [ebx + 0x10044], 0
jne 0x460964
mov ecx, 0x4609f8
mov dl, 1
mov eax, dword [0x45ffa0]
call fcn.0040cb60
call fcn.00404338
mov ecx, 0x460a10
mov dl, 2
mov eax, ebx
call fcn.00460bd4
mov word [ebx + 0x10040], 2
mov ax, word [ebx + 0x10038]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x10042], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x10040]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0x1022a], 0
je 0x4609ca
mov edx, ebx
mov eax, dword [ebx + 0x1022c]
call dword [ebx + 0x10228]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x460cc8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460d9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xffff
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x1024c]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x10030], eax
cmp word [ebx + 0x10222], 0
je 0x460d86
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x460db0
call fcn.0040a1b8
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x10030]
mov edx, ebx
mov eax, dword [ebx + 0x10224]
call dword [ebx + 0x10220]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460da3
lea eax, [ebp - 8]
call fcn.0040499c
ret

Function at 0x469e3c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x469f09
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a4410], 0
jne 0x469eec
push 0x469f1c
call sub.user32.dll_IsChild
mov dword [0x4a4410], eax
cmp dword [0x4a4410], 0
jne 0x469ec4
call sub.user32.dll_GetKeyboardLayoutList
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x4a56bc]
call fcn.0040689c
mov eax, dword [ebp - 8]
push eax
mov eax, 0x469f30
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.0040a1b8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x468e68]
call fcn.00468ee0
call fcn.00404338
push 0x469f3c
mov eax, dword [0x4a4410]
push eax
call fcn.00406f5c
mov dword [0x4a7a24], eax
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
call dword [0x4a7a24]
mov ebx, eax
jmp 0x469eee
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469f10
lea eax, [ebp - 8]
mov edx, 2
call fcn.004049c0
ret
Function at 0x472918
Capabilities:
Access the windows event log
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 4
push 6
push ebx
call sub.advapi32.dll_RegisterEventSourceA
xor edx, edx
push ebp
push 0x472a00
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x472968
call fcn.004043e4
jmp 0x472a07
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x20
call fcn.004032e4
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 1
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 1
mov eax, 0x472a10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 1
call sub.advapi32.dll_RegSetValueExA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 4
push 6
push ebx
call sub.advapi32.dll_ReportEventA
test eax, eax
jne 0x4729d0
call fcn.004043e4
jmp 0x472a07
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472a07
cmp dword [ebp - 0x10], 0
je 0x4729f0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_IsDialogMessageA
cmp dword [ebp - 0xc], 0
je 0x4729ff
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_IsDialogMessageA
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475e10
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x475e3d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_MapVirtualKeyA
cmp eax, 0xffffffff
je 0x475e3d
mov eax, dword [ebp - 4]
mov dword [eax + 4], 2
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
sete al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret
Function at 0x480ff8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor edx, edx
mov dword [ebp - 0x20], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4810e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x94]
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00480ee0
mov dword [ebp - 0x1c], eax
cmp byte [ebx + 0x8a], 1
jne 0x481037
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x481041
mov eax, ebx
call fcn.00480f64
mov dword [ebp - 0x14], eax
mov al, byte [ebx + 0x8a]
mov edx, eax
cmp dl, 7
ja 0x481058
and edx, 0x7f
bt dword [0x4a4bac], edx
jae 0x481067
cmp al, byte [0x4a4b8c]
jne 0x481067
inc dword [ebp - 8]
jmp 0x48106c
xor edx, edx
mov dword [ebp - 8], edx
mov byte [0x4a4b8c], al
xor eax, eax
mov al, byte [ebx + 0x8a]
mov eax, dword [eax*4 + 0x4a4b90]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x98]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x48109d
mov dword [ebp - 0x10], 0x42a
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x8c]
push eax
call fcn.00458828
test eax, eax
jne 0x4810d1
push 0
push 0
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0x20]
call fcn.0040c334
mov edx, dword [ebp - 0x20]
mov ecx, 1
mov eax, ebx
call fcn.00480f80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4810ee
lea eax, [ebp - 0x20]
call fcn.0040499c
ret

Function at 0x481108
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4811b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, edx
dec ebx
test ebx, ebx
jl 0x48114e
inc ebx
xor edi, edi
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + edi*4]
call fcn.00404b94
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x78]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc edi
dec ebx
jne 0x481131
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x58]
mov ebx, eax
push ebx
mov eax, dword [esi + 8]
call fcn.00404e5c
push eax
call fcn.00458820
mov edi, eax
mov dword [esi + 0x8c], edi
test edi, edi
jne 0x481194
push 0
push 0
call sub.user32.dll_GetKeyboardLayoutList
lea edx, [ebp - 0xc]
call fcn.0040c334
mov edx, dword [ebp - 0xc]
mov ecx, 1
mov eax, esi
call fcn.00480f80
jmp 0x48119b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4811bd
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049c0
ret
Function at 0x497c14
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
lea eax, [ebp - 0x170]
mov edx, dword [0x407f74]
call fcn.00405374
xor eax, eax
push ebp
push 0x497e9b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x497e5a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4a7cfc]
mov edx, dword [eax]
call dword [edx + 8]
lea edx, [ebp - 8]
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.004a0bcc
xor edx, edx
push ebp
push 0x497e49
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x174]
mov ecx, 0x497eb4
mov edx, dword [ebp - 8]
call fcn.00404ca8
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
xor edx, edx
call fcn.004096c8
test eax, eax
jne 0x497e30
xor eax, eax
push ebp
push 0x497e13
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404ca8
mov eax, dword [ebp - 0x178]
call fcn.0049bd58
test al, al
je 0x497e09
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 8]
call fcn.00404ca8
mov eax, dword [ebp - 0x17c]
call fcn.00404e5c
push eax
call sub.user32.dll_IsChild
mov ebx, eax
test ebx, ebx
je 0x497e09
push 0x497ebc
push ebx
call fcn.00406f5c
mov dword [ebp - 0xc], eax
push 0x497ecc
push ebx
call fcn.00406f5c
mov dword [ebp - 0x14], eax
push 0x497ed8
push ebx
call fcn.00406f5c
mov dword [ebp - 0x10], eax
push 0x497ee4
push ebx
call fcn.00406f5c
mov dword [ebp - 0x18], eax
push 0x497ef4
push ebx
call fcn.00406f5c
mov edi, eax
cmp dword [ebp - 0xc], 0
je 0x497e03
cmp dword [ebp - 0x14], 0
je 0x497e03
cmp dword [ebp - 0x10], 0
je 0x497e03
cmp dword [ebp - 0x18], 0
je 0x497e03
test edi, edi
je 0x497e03
mov dl, 1
mov eax, dword [0x49bb34]
call fcn.00403b7c
mov esi, eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], ebx
lea eax, [esi + 0x1c]
mov edx, dword [ebp - 0x164]
mov ecx, 0xff
call fcn.00404c38
mov edx, esi
mov eax, dword [0x4a7cfc]
call fcn.004156b8
cmp byte [ebp - 1], 0
je 0x497e09
call edi
test al, al
jne 0x497e09
mov eax, dword [0x4a5b78]
mov eax, dword [eax]
call fcn.00404e5c
push eax
mov eax, dword [0x4a5654]
mov eax, dword [eax]
call fcn.00404e5c
push eax
call dword [ebp - 0x10]
jmp 0x497e09
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497e1d
lea eax, [ebp - 0x170]
call fcn.00409718
test eax, eax
je 0x497cbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e50
lea eax, [ebp - 0x170]
call fcn.0040973c
ret