joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453e34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffedc
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407d9c
lea edx, [esp + 0x11c]
call fcn.00408c74
lea edx, [esp + 0x11c]
mov ecx, esp
mov eax, esi
call fcn.0044ea9c
test ebx, ebx
jne 0x453e80
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00453d70
mov ebx, eax
test ebx, ebx
je 0x453f6b
cmp esi, ebx
je 0x453ea9
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x10c], eax
jmp 0x453ebe
mov eax, dword [esp]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x10c], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x110], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x453ef6
add eax, 0xffffff5f
sub eax, 2
jb 0x453f0e
dec eax
sub eax, 2
jb 0x453f22
dec eax
sub eax, 2
jb 0x453f18
jmp 0x453f2c
add eax, 0xfffffdff
sub eax, 2
jb 0x453f0e
dec eax
sub eax, 2
jb 0x453f22
dec eax
sub eax, 2
jb 0x453f18
jmp 0x453f2c
mov byte [esp + 0x114], 0
jmp 0x453f34
mov byte [esp + 0x114], 2
jmp 0x453f34
mov byte [esp + 0x114], 1
jmp 0x453f34
mov byte [esp + 0x114], 0
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 8]
call fcn.0046a244
mov byte [esp + 0x115], al
lea eax, [esp + 0x108]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0045022c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x453f6d
xor eax, eax
add esp, 0x124
pop edi
pop esi
pop ebx
ret
Function at 0x45c2b8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x50cce4]
cmp byte [eax + 0xc], 0
je 0x45c425
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c41e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x512088], 0
jne 0x45c30c
push 0x45c42c
call sub.KERNEL32.DLL_GetModuleHandleA_1
mov ebx, eax
push 0x45c434
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x512088], eax
cmp dword [0x4fb3d4], 0
jne 0x45c407
push 0x45c444
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x4fb3d4], eax
cmp dword [0x4fb3d4], 0
je 0x45c407
push 0x45c450
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51208c], eax
push 0x45c460
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x512090], eax
push 0x45c474
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x512094], eax
push 0x45c48c
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x512098], eax
push 0x45c4a4
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51209c], eax
push 0x45c4b8
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5120a0], eax
push 0x45c4d0
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5120a4], eax
push 0x45c4e8
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5120a8], eax
push 0x45c504
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5120ac], eax
push 0x45c510
mov eax, dword [0x4fb3d4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5120b0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c425
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x461124
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405704
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x461173
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00405974
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466198
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4662d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x42d7bc]
call fcn.0042d88c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4662a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042d92c
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405974
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4662e8
call fcn.00405a2c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0042d990
lea ecx, [ebp - 4]
mov edx, 0x466324
mov eax, dword [ebp - 0xc]
call fcn.0042dbd8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00411ff4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46628a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x466330
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4fb518]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466291
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret

Function at 0x46637c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov bl, byte [esp + 4]
test bx, bx
je 0x4663c4
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4663a7
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4663b8
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4663c4
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x469d80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x469da1
test edi, 0x40000
je 0x469db7
test bl, bl
jne 0x469e36
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x469e36
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
mov al, byte [esp + 1]
or al, byte [esp + 2]
je 0x469de9
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x469dfe
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x469e0d
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov al, byte [esp]
and al, byte [esp + 1]
jne 0x469e1d
cmp byte [esp + 2], 0
je 0x469e36
cmp byte [esp + 2], 0
je 0x469e2e
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x469e36
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46a0f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x46a116
mov eax, esp
push eax
push 0x46a0b8
call sub.user32.dll_EnumWindows
jmp 0x46a129
mov eax, esp
push eax
push 0x46a098
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
mov al, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x46a1b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x46a204]
test si, 4
je 0x46a1c8
or bl, 1
test si, 8
je 0x46a1d2
or bl, 4
test si, 1
je 0x46a1dc
or bl, 8
test si, 2
je 0x46a1e6
or bl, 0x10
test si, 0x10
je 0x46a1f0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46a1ff
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x46a208
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x46a240]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46a221
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46a230
or bl, 4
test esi, 0x20000000
je 0x46a23b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47247c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47248e
add esp, 0xfffffff0
call fcn.00404b00
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042bb74
mov eax, dword [0x50c6e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x472820
mov eax, dword [0x50c6f0]
mov dword [eax + 4], ebx
mov dword [eax], 0x47282c
mov eax, ebx
call fcn.00472838
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41fee4]
call fcn.00404758
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41fee4]
call fcn.00404758
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41fee4]
call fcn.00404758
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41fee4]
call fcn.00404758
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41fee4]
call fcn.00404758
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x46dae8
push eax
push 0
push 0
mov eax, dword [0x50c938]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42e4ac]
call fcn.0042fd20
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x42e4ac]
call fcn.0042fd20
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x42e4ac]
call fcn.0042fd20
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00472d08
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x472bd0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x472bd0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x472bd0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4725cb
call fcn.00404b58
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4729b4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x472b5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x472b40
mov dl, 1
mov eax, dword [0x420550]
call fcn.00404758
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405704
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x472b2f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045c618
test al, al
je 0x472b22
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x472b70
lea eax, [ebp - 0x254]
call fcn.0040d3e0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x472b22
xor eax, eax
push ebp
push 0x472b1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x472ba8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x472b04
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405974
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x472b04
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472b22
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x472a25
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00424ecc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472b66
lea eax, [ebp - 0x260]
call fcn.00405704
ret

Function at 0x4734d8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5120d4]
cmp byte [eax + 0xad], 0
jne 0x473549
cmp dword [0x5120f0], 0
jne 0x47350a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x473494
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x5120f0], eax
cmp dword [0x5120ec], 0
jne 0x473525
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x5120ec], eax
cmp dword [0x5120f4], 0
jne 0x473549
push esp
push 0
push 0
push 0x473438
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x5120f4], eax
pop edx
ret
Function at 0x473d2c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x473dcb
cmp dword [ebx + 0x94], 0
jne 0x473dc5
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x473cb4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x473dc5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x473d8b
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x473dc5
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00422868
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x473d9a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x473fe4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5120d4]
cmp dword [eax + 0x30], 0
je 0x474141
test bl, bl
jne 0x474092
cmp dword [esi + 0x9c], 0
jne 0x474087
mov eax, esi
call fcn.00476998
push eax
push 0x473f10
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x474058
mov eax, dword [0x5120d4]
call fcn.00476ba8
test al, al
je 0x474058
mov eax, dword [0x5120f8]
call fcn.00406bc0
mov edi, eax
cmp edi, 0
jl 0x474058
push 0
mov eax, dword [0x5120f8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x474042
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x474087
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00422868
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x474067
inc dword [esi + 0x9c]
jmp 0x474141
cmp dword [esi + 0x9c], 0
jle 0x474141
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x474141
cmp dword [esi + 0x44], 0
je 0x4740ed
mov eax, dword [0x5120d4]
call fcn.00476ba8
test al, al
je 0x4740ed
mov eax, dword [0x5120f8]
call fcn.00406bc0
mov edi, eax
cmp edi, 0
jl 0x4740ed
push 5
mov eax, dword [0x5120f8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4740d7
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x47411c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00422868
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4740fc
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x5120f8
mov ecx, 1
mov edx, dword [0x473ef0]
call fcn.00406d94
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x474c28
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x474c80
mov eax, ebx
call fcn.00476ba8
test al, al
jne 0x474c80
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004057f4
mov eax, dword [esi]
call fcn.004059e0
test eax, eax
jne 0x474c8d
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405758
jmp 0x474c8d
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405758
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47615c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4761ca
mov eax, esi
call fcn.00457238
test al, al
je 0x4761ca
mov eax, dword [ebx + 0x84]
call fcn.00456e98
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4761ca
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4761be
push 0
mov eax, dword [ebx + 0x84]
call fcn.00456e98
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044ee7c
jmp 0x4761ca
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00475fa8
pop esi
pop ebx
ret

Function at 0x49f728
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff8c
mov ebp, ecx
mov edi, edx
mov ebx, eax
lea esi, [esp + 4]
lea eax, [esp + 0x20]
xor ecx, ecx
mov edx, 0x44
call fcn.00403ed8
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 0x41
mov word [esp + 0x50], di
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x49f7f5
call sub.KERNEL32.DLL_GetCurrentThreadId
mov edx, dword [0x50ccdc]
cmp eax, dword [edx]
setne bl
test bl, bl
jne 0x49f7c1
jmp 0x49f7af
cmp dword [esi + 4], 0x12
jne 0x49f7a3
mov eax, dword [esi + 8]
call fcn.0040561c
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x49f795
push 1
call sub.KERNEL32.DLL_Sleep
push esp
mov eax, dword [esp + 0x68]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [esp], 0x103
je 0x49f78f
mov eax, dword [esp + 0x68]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp + 0x64]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp]
jmp 0x49f7fa
call sub.KERNEL32.DLL_GetLastError
add esp, 0x74
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49fdbc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp dword [ebx], 0
jne 0x49fdd2
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx], eax
mov dl, 1
jmp 0x49fdf8
call sub.KERNEL32.DLL_GetTickCount
cmp eax, dword [ebx]
jae 0x49fde9
or edx, 0xffffffff
sub edx, dword [ebx]
add edx, eax
cmp esi, edx
setb dl
jmp 0x49fdf2
mov edx, eax
sub edx, dword [ebx]
cmp esi, edx
setb dl
test dl, dl
je 0x49fdf8
mov dword [ebx], eax
mov eax, edx
pop esi
pop ebx
ret

Function at 0x49fe00
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x49feec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
mov eax, edi
call fcn.00405be0
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49fe75
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00407928
mov eax, dword [ebp - 0xc]
call fcn.00406058
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x49fece
test esi, esi
jne 0x49fe88
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
test esi, esi
jbe 0x49febe
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00405d6c
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405c38
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
cmp esi, dword [ebp - 8]
je 0x49fec6
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405d6c
jmp 0x49fec6
mov eax, dword [ebp - 4]
call fcn.00405704
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x49fed6
mov eax, dword [ebp - 4]
call fcn.00405704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fef3
lea eax, [ebp - 0xc]
call fcn.00405e2c
ret
Function at 0x49fefc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a0024
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x49ff48
push 0
push 0x80
push 4
push 0
push 3
push 4
mov eax, esi
call fcn.00405be0
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
jmp 0x49ff69
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
mov eax, esi
call fcn.00405be0
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49ffcb
cmp byte [ebp - 1], 0
je 0x49ff9f
push 0
push 0x80
push 4
push 0
push 3
push 4
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00407928
mov eax, dword [ebp - 0xc]
call fcn.00406058
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
jmp 0x49ffcb
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00407928
mov eax, dword [ebp - 0x10]
call fcn.00406058
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a0007
mov eax, edi
call fcn.004059e0
mov esi, eax
test esi, esi
jbe 0x49fff4
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, edi
call fcn.00405be0
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49fff9
xor eax, eax
mov dword [ebp - 8], eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp esi, dword [ebp - 8]
sete bl
jmp 0x4a0009
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a002b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405e44
ret

Function at 0x4a0f84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00408bf4
cmp ax, 0xffff
jne 0x4a0fa5
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x4a1031
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
test edi, edi
je 0x4a1031
push edi
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x4a0ff2
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x4a0fde
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x4a1031
cmp dword [ebp + 8], 0
jle 0x4a1031
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0043794c
mov esi, eax
test esi, esi
jle 0x4a1028
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408c08
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4