joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f097
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x58], esi
je 0x41f0e4
push esi
push dword [ebp + 8]
call fcn.0041eef2
mov edi, eax
test edi, edi
je 0x41f16c
push dword [ebp + 0x14]
push ebx
push 3
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x41f16c
mov eax, dword [ebp + 0x14]
push 2
pop ecx
lea eax, [eax*2 + 1]
mul ecx
setb cl
movsx ecx, cl
neg ecx
or ecx, eax
push ecx
call fcn.0042edaa
mov edx, dword [ebp + 0x14]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x41f13e
mov dword [ebp - 4], 0x41
mov al, byte [ebx + esi]
and al, 0xf
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4], ax
mov al, byte [ebx + esi]
shr al, 4
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4 + 2], ax
inc esi
cmp esi, edx
jb 0x41f117
xor eax, eax
mov word [ecx + esi*4], ax
mov eax, dword [edi]
push ecx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x57c9a0]
mov ecx, edi
call esi
push dword [ebp - 8]
mov esi, eax
call fcn.00423e01
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41fedd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x41ff25
call fcn.0042f166
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ff25
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ff32
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x41ff6e
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x41ff51
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x41ff5a
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x41ff6c
test di, di
jne 0x41ff6c
test dx, dx
je 0x41ff6e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ffd7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.0042f166
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x420017
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x420017
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0042001f
jmp 0x420019
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x42030f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x56dc2b
call fcn.0054dcb8
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0042f166
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x42036e
call fcn.0042f166
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x420382
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x42037e
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x42038a
or eax, 0xffffffff
jmp 0x4204dc
mov ecx, edi
call fcn.00420947
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.00425168
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x420416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x420416
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x420416
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00402e20
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x420413
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x420413
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0042b4ad
test eax, eax
je 0x420413
push 0
mov ecx, esi
call fcn.0042b280
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.00424deb
push ebx
call fcn.00426509
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.004202b2
test eax, eax
jne 0x42045f
cmp dword [edi + 0x9c], eax
jne 0x42045f
call fcn.0042f166
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.00426509
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.004202b2
and dword [edi + 0x9c], 0
jmp 0x42048a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x42049e
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0042b280
test esi, esi
je 0x4204ab
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x4204c1
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x4204c1
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, edi
call esi
mov ecx, edi
call fcn.004208fe
mov eax, dword [edi + 0x68]
call fcn.0054dc1d
ret
Function at 0x42649c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x4264db
call fcn.0042f166
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4264db
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4264e3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.004a0f57
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x426edf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x426f6b
cmp dword [esi + 0x20], 0
je 0x426f6b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426f6b
cmp dword [ebp + 8], 0
je 0x426f6b
xor edi, edi
mov ebx, edi
call fcn.0042f166
push 0x57f390
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x426f4f
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x426f6b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004ba305
mov edi, eax
add esp, 0xc
test edi, edi
je 0x426f67
mov ecx, esi
call fcn.00426c7d
mov eax, edi
jmp 0x426f6d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42b3e2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x56da74
call fcn.0054dc4f
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x42b408
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42b462
lea ecx, [ebp - 0x10]
call fcn.00409e60
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005570bd
push eax
call fcn.00402b90
add esp, 0x14
test esi, esi
je 0x42b455
push esi
call fcn.00552bee
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402e00
mov eax, ebx
call fcn.0054dc1d
ret 8

Function at 0x42f76f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x42f799
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42f79f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00409ff0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004c38a3
int3
Function at 0x42fa7a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x42fa8b
xor eax, eax
jmp 0x42faa7
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42faac
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00409ff0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004c38a3
int3

Function at 0x42fb4a
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x42fb7d
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.00409ff0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004c38a3
int3

Function at 0x42fc56
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x42fc81
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42fc87
cmp dword [ebp - 4], esi
jne 0x42fc9e
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.00409ff0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.004c38a3
lea ecx, [edi + 0xc]
call fcn.00409ff0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.004c34f9
int3
Function at 0x4306fb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x430777
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43073c
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x43073c
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x43076a
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x43076d
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x430764
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x430720
test eax, eax
je 0x4307be
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.004309ef
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x430a41
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x56e6a4
call fcn.0054dcb8
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x430b38
cmp edi, dword [ebx + 0xc]
jge 0x430b38
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x430a98
cmp edi, dword [esi + 8]
jl 0x430b26
cmp dword [ebp + 0xc], 0
je 0x430b26
xor edi, edi
jmp 0x430aca
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.004304ee
mov esi, eax
test esi, esi
je 0x430ab2
mov dword [esi], vtable.CThreadData.0
jmp 0x430ab4
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.0042cec3
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x430ae6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x430af2
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x430b5f
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0054f890
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x430b38
cmp edi, dword [esi + 8]
jge 0x430b38
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0054dc1d
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004218d3
int3
Function at 0x436271
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x43628a
call fcn.0042f166
mov esi, dword [eax + 0xc]
push 0x5b0654
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4362cc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4362cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4362cc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004362d5
jmp 0x4362ce
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x454414
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x454572
push esi
push edi
push 0x590448
call fcn.004303a4
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x4544ad
mov edi, dword [ebx + 0x168]
jmp 0x454499
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x454499
push esi
call fcn.00426509
push eax
push 0x5cf598
call fcn.00430305
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x454499
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x454499
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x454448
lea ecx, [ebx + 0x164]
call fcn.0041a19f
jmp 0x454570
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x454570
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00412e32
mov edi, dword [eax]
test edi, edi
jne 0x4544d9
xor esi, esi
jmp 0x4544dc
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x454560
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x454560
cmp dword [ebp - 0x10], 0
jne 0x454535
push edi
push 0x5cf598
call fcn.00430305
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, edi
call esi
push eax
push 0x586810
call fcn.00430305
pop ecx
pop ecx
test eax, eax
je 0x454560
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.00453585
test eax, eax
jne 0x454560
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.004516bb
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x4544c4
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4943ff
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x49449e
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x49449a
mov eax, dword [eax + 0x20]
test eax, eax
je 0x49449a
cmp dword [ebx], eax
jne 0x49449a
mov eax, dword [ebx + 4]
sub eax, 1
je 0x494474
sub eax, 1
je 0x494444
sub eax, 1
jne 0x49449a
mov edi, 0x428e
jmp 0x494479
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x494479
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x57c9a0]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x494479
add edi, 3
jmp 0x494479
mov edi, 0x3ea0
push edi
mov ecx, 0x5d94ec
call fcn.004095f0
test eax, eax
je 0x49449e
mov eax, dword [0x5d94ec]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x494493
call fcn.004218b9
int3
Function at 0x49cc8f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5d0000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x5d9504]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x49cce8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49cd0d
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5d9504], eax
jmp 0x49ccf1
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x49cd0d
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [0x57c9a0]
call esi
jmp 0x49ce4f
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.0049d108
lea eax, [ebp - 0x14]
push eax
call fcn.00552bee
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.00556f8b
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0049d108
lea eax, [ebp - 0x14]
push eax
call fcn.00552bee
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.00556f8b
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.0049d108
lea eax, [ebp - 0x14]
push eax
call fcn.00552bee
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00556f8b
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0049d108
lea eax, [ebp - 0x14]
push eax
call fcn.00552bee
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00556f8b
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.0049d108
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.00552bee
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.00556f8b
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d6d8
leave
ret
Function at 0x4a1a6c
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5d0000]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x4a1a98
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4a1ac3
cmp dword [0x5d8204], 0
jne 0x4a1ac3
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x4a1abf
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4a1abf
push edi
call fcn.00558edc
pop ecx
jmp 0x4a1b3a
mov eax, edi
jmp 0x4a1b3a
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0054f890
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4a1b49
push esi
call fcn.00411723
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push esi
push 1
push 2
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054d6d8
leave
ret 4
call fcn.004218b9
int3

Function at 0x4bbd6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x4bbdc0
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4bbd99
call fcn.0042c14f
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4bbdae
call fcn.0042c14f
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4bbdc0
call fcn.0042c14f
call fcn.0042f166
cmp dword [eax + 0x3c], 0
je 0x4bbdd5
push esi
mov ecx, ebx
call fcn.004bb486
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.004bbfbf
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4bbdfe
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4bbe0a
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8