joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450d18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450e51
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x42e344]
call fcn.0042e480
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x450e27
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042e520
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00405920
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x450e6c
call fcn.00405af4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0042e584
test al, al
je 0x450e11
lea ecx, [ebp - 4]
mov edx, 0x450ee0
mov eax, dword [ebp - 0xc]
call fcn.0042e7d0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00412910
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x450e0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x450ef8
mov eax, dword [ebp - 8]
push eax
call fcn.004082f8
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4bca0c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450e11
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450e2e
mov eax, dword [ebp - 0xc]
call fcn.00403cb0
ret

Function at 0x450f5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x450fa3
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450f86
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450f97
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x450fa3
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x456ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4c4128], 0
je 0x456f1d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4be5ec]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x456f1d
mov eax, dword [0x4c412c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4c4128]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x456eec
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4c4128]
call fcn.00422e80
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x456ee4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x456ee4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x456ee4
mov eax, dword [ebp - 0x14]
call fcn.00462018
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456ee4
push ebp
call fcn.00456d98
pop ecx
test al, al
jne 0x456ee4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403ec0
test al, al
je 0x456ee4
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403ec0
cmp byte [ebp - 1], 0
je 0x456ee4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00408000
test al, al
je 0x456ee4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4c412c]
call fcn.00456510
inc edi
dec ebx
jne 0x456e41
mov eax, dword [0x4c412c]
cmp dword [eax + 8], 0
jle 0x456f04
mov eax, dword [0x4c412c]
call fcn.004565c8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x456f1d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00456bfc
pop ecx
test al, al
jne 0x456f1d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ed04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407fe8
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00459258
test ebx, ebx
jne 0x45ed57
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0045eb98
mov ebx, eax
test ebx, ebx
je 0x45ee42
cmp esi, ebx
je 0x45ed80
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x45ed95
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x45edcd
add eax, 0xffffff5f
sub eax, 2
jb 0x45ede5
dec eax
sub eax, 2
jb 0x45edf9
dec eax
sub eax, 2
jb 0x45edef
jmp 0x45ee03
add eax, 0xfffffdff
sub eax, 2
jb 0x45ede5
dec eax
sub eax, 2
jb 0x45edf9
dec eax
sub eax, 2
jb 0x45edef
jmp 0x45ee03
mov byte [esp + 0x120], 0
jmp 0x45ee0b
mov byte [esp + 0x120], 2
jmp 0x45ee0b
mov byte [esp + 0x120], 1
jmp 0x45ee0b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0046f88c
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0045aa60
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x45ee44
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x46f394
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x46f3b5
test edi, 0x40000
je 0x46f3cf
test bl, bl
jne 0x46f450
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x46f450
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x46f402
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x46f417
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x46f426
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x46f437
cmp byte [esp + 2], 0
je 0x46f450
cmp byte [esp + 2], 0
je 0x46f448
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x46f450
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x46f6f8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x46f71e
mov eax, esp
push eax
push 0x46f6c0
call sub.user32.dll_EnumWindows
jmp 0x46f731
mov eax, esp
push eax
push 0x46f6a0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x46f7f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x46f848]
test si, 4
je 0x46f809
or bl, 1
test si, 8
je 0x46f813
or bl, 4
test si, 1
je 0x46f81d
or bl, 8
test si, 2
je 0x46f827
or bl, 0x10
test si, 0x10
je 0x46f831
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f840
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x46f84c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x46f888]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f866
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f875
or bl, 4
test esi, 0x20000000
je 0x46f880
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x46f8d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0046f88c
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x477be0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x477bf2
add esp, 0xfffffff0
call fcn.004040e8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042a8e0
mov eax, dword [0x4be298]
mov dword [eax + 4], ebx
mov dword [eax], 0x477ff4
mov eax, dword [0x4be2ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x478000
mov eax, ebx
call fcn.0047800c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x473030
push eax
push 0
push 0
mov eax, dword [0x4be518]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42ed98]
call fcn.00430818
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x42ed98]
call fcn.00430818
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x42ed98]
call fcn.00430818
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x42ed98]
call fcn.00430818
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.004785a0
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x478428
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x478428
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x478428
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x478428
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x477d45
call fcn.00404140
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4781c8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478375
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x478356
mov dl, 1
mov eax, dword [0x420cd8]
call fcn.00425d2c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.00405750
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x478345
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00467b50
test al, al
je 0x478338
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x478384
lea eax, [ebp - 0x394]
call fcn.0040c32c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x478338
xor eax, eax
push ebp
push 0x478331
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4783f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x47831a
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405920
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x47831a
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405920
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478338
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x47823b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00425b18
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47837c
lea eax, [ebp - 0x3a0]
call fcn.00405740
ret

Function at 0x478db4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4c4180]
cmp byte [eax + 0xa9], 0
jne 0x478e26
cmp dword [0x4c4198], 0
jne 0x478de6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4bcd00]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4c4198], eax
cmp dword [0x4c4194], 0
jne 0x478e01
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4c4194], eax
cmp dword [0x4c419c], 0
jne 0x478e26
push esp
push 0
push 0
mov eax, dword [0x4bccfc]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4c419c], eax
pop edx
ret
Function at 0x47903c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x479053
add esp, 0xfffffff0
call fcn.004040e8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042a8e0
mov eax, dword [0x4be13c]
cmp byte [eax], 0
jne 0x479080
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4be4fc]
cmp word [eax + 2], 0
jne 0x47909a
mov eax, dword [0x4be4fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047afa0
mov eax, dword [0x4be638]
cmp word [eax + 2], 0
jne 0x4790b4
mov eax, dword [0x4be638]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047b1b0
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x42ed98]
call fcn.00430818
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x47b634
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x42f5f0]
call fcn.00436440
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x479290
mov eax, dword [0x4be358]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00436844
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47b8e4
mov dl, 1
mov eax, dword [0x420584]
call fcn.00403c80
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4be358]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040c14c
test eax, eax
je 0x4791c2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040bf18
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040c134
test eax, eax
je 0x4791da
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405920
push ebx
push 0x47a99c
call fcn.0046f7d8
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4be13c]
cmp byte [eax], 0
jne 0x47922b
mov eax, ebx
call fcn.00479404
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.0047bb0c
mov eax, ebx
call fcn.0047c6d0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x479288
call fcn.00404140
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4796ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x47974e
cmp dword [ebx + 0x90], 0
jne 0x479748
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x479624
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x479748
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x47970e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x479748
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00422e80
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47971d
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47996c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4c4180]
cmp dword [eax + 0x170], 0
je 0x479ad1
test bl, bl
jne 0x479a1f
cmp dword [esi + 0x98], 0
jne 0x479a14
mov eax, esi
call fcn.0047c520
push eax
push 0x479878
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x4799e5
mov eax, dword [0x4c4180]
cmp byte [eax + 0xcf], 0
je 0x4799e5
mov eax, dword [esi + 0xd4]
call fcn.00406b98
mov edi, eax
cmp edi, 0
jl 0x4799e5
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4799ce
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x479a14
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00422e80
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4799f4
inc dword [esi + 0x98]
jmp 0x479ad1
cmp dword [esi + 0x98], 0
jle 0x479ad1
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x479ad1
cmp dword [esi + 0x40], 0
je 0x479a7c
mov eax, dword [0x4c4180]
cmp byte [eax + 0xcf], 0
je 0x479a7c
mov eax, dword [esi + 0xd4]
call fcn.00406b98
mov edi, eax
cmp edi, 0
jl 0x479a7c
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x479a65
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x479aab
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00422e80
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x479a8b
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x46f1e4]
call fcn.00406d58
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x47a68c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x47a6f7
cmp byte [ebx + 0xcf], 0
jne 0x47a6f7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040588c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x47a6e4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47a704
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405750
jmp 0x47a704
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405750
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x47bce0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x47bd4e
mov eax, esi
call fcn.004623c4
test al, al
je 0x47bd4e
mov eax, dword [ebx + 0x80]
call fcn.00462018
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47bd4e
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x47bd42
push 0
mov eax, dword [ebx + 0x80]
call fcn.00462018
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00459648
jmp 0x47bd4e
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.0047bb2c
pop esi
pop ebx
ret
Function at 0x4b7d00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x4b7d3c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7d17
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7d26
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7d35
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x401030
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403024], eax
call sub.comctl32.dll_InitCommonControls
push 0xa
push 0
push 0
push dword [0x403024]
call 0x401030
push eax
call sub.kernel32.dll_ExitProcess
lea esp, [esp]
nop
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x3020
mov dword [ebp - 0x28], 0x401140
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 0
call sub.gdi32.dll_CreateSolidBrush
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], str.Menu1
mov dword [ebp - 8], str.WndClass
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [0x403140], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [0x403144], eax
push 0x23c
push 0x320
call fcn.004013d0
push 0
push dword [ebp + 8]
push 0
push 0
push eax
push edx
push 0
push 0
push 0xa0000
push str.EditBox6
push str.WndClass
push 0x300
call sub.user32.dll_CreateWindowExA
mov dword [0x403020], eax
push 1
push dword [0x403020]
call sub.user32.dll_ShowWindow
push dword [0x403020]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x401131
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401109
mov eax, 0
leave
ret 0x10
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
adc bh, byte [esp + edx*8 + 0x5b]
inc edx
and eax, 0xf447dc60
pop ecx
dec ebp
test dword [edi + 0x1db1f731], esi
dec ebx
pop eax
mov ecx, 0xe375610a
xor ecx, edi
invalid