joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439618
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x439773
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.00438e40
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00405c3c
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x43966d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x439670
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
dec eax
sub al, 2
jae 0x43967f
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4395e4]
call fcn.00407580
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004035b4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00405cc8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x4396d5
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405de8
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4396e8
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x43973d
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x439700
sub esi, 4
mov esi, dword [esi]
push 0x439790
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c264
push dword [ebp - 0x1c]
push 0x4397d0
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040c264
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004061dc
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.00438d78
mov eax, dword [ebp - 0xc]
call fcn.00438e70
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43977a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405c34
lea eax, [ebp - 4]
mov edx, dword [0x4395e4]
call fcn.0040758c
ret

Function at 0x4398d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.00405c3c
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00405e24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x439918
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405e24
add esp, 0x200
pop ebx
ret
Function at 0x439948
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405e24
add esp, 0x200
pop ebx
ret

Function at 0x439974
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405e24
add esp, 0x200
pop ebx
ret

Function at 0x4399a4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00405c3c
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4399e1
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.00405de8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4399e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x439a64
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x439a4b
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00405e24
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.004063d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439a6b
lea eax, [ebp - 0x20c]
call fcn.00405c2c
ret
Function at 0x43a40c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43a56f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43a48a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43a4b5
xor eax, eax
push ebp
push 0x43a4f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43a522
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.00403364
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0040ce1c
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00405c3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a576
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00405c34
ret
Function at 0x43a784
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x43a90d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.0042e950
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x43a8ef
xor eax, eax
push ebp
push 0x43a8e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.004035b4
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0042e970
mov ebx, eax
jmp 0x43a8c9
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.00405e24
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0040cf18
mov edx, dword [ebp - 0x244]
mov eax, 0x43a928
call fcn.0040ba1c
test al, al
je 0x43a8b9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId
test eax, eax
je 0x43a8b9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4d5118]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x43a8b9
xor eax, eax
push ebp
push 0x43a8b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x43a89b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.004047bc
call fcn.004047bc
jmp 0x43a8ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a8b9
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0042e990
mov ebx, eax
test ebx, ebx
jne 0x43a807
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a8ef
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a914
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00405c34
ret

Function at 0x43a944
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x4d511c], 0
je 0x43a95e
call dword [0x4d511c]
mov dword [ebp - 4], eax
jmp 0x43a963
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43a9d1
cmp dword [ebp - 4], 0xffffffff
je 0x43a9d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x4d5118]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x43a9cc
xor eax, eax
push ebp
push 0x43a9c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x43a9a9
call fcn.004047bc
jmp 0x43a9e5
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a9d1
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43a9dd
cmp dword [ebp - 4], 0xffffffff
jne 0x43a9e5
call fcn.0043a784
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43adcc
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00405c3c
cmp byte [0x4e1104], 0
je 0x43ae03
xor eax, eax
call fcn.0043ad54
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x43ae72
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0043ae94
jmp 0x43ae72
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.0043a944
push eax
mov eax, dword [0x4d5118]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x43ae50
mov eax, ebx
mov edx, dword [esp]
call fcn.00405de8
mov eax, dword [ebx]
mov edx, 0x43ae84
call fcn.0040ba1c
test al, al
je 0x43ae47
mov eax, ebx
xor edx, edx
call fcn.00405c3c
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x43ae72
xor eax, eax
call fcn.0043ad54
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x43ae72
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0043ae94
pop ecx
pop edx
pop ebx
ret

Function at 0x43bd6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c24
xor eax, eax
push ebp
push 0x43be4c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x43be2e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407fb4
mov eax, dword [ebp - 8]
test eax, eax
je 0x43bdcd
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x43bdcd
lea eax, [ebp - 8]
mov cx, 0xfde9
mov edx, dword [ebp - 8]
call fcn.0040518c
test eax, eax
je 0x43bdd6
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.00407e78
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.004031a8
add ebx, 4
lea eax, [ebp - 8]
call fcn.004057a8
mov ecx, esi
mov edx, ebx
call fcn.004031a8
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x43be2e
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x4d513c]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x43be16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43be53
lea eax, [ebp - 8]
call fcn.00404f70
lea eax, [ebp - 4]
call fcn.00405c2c
ret
Function at 0x444120
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405c3c
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x444167
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405e24
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x449580
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4496b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x42ec4c]
call fcn.0042ed88
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x44968f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042ee28
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00405e24
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4496d4
call fcn.004060f8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0042efb4
test al, al
je 0x449679
lea ecx, [ebp - 4]
mov edx, 0x449748
mov eax, dword [ebp - 0xc]
call fcn.0042f200
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00415e1c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x449672
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x449760
mov eax, dword [ebp - 8]
push eax
call fcn.00408f2c
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4d5754]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449679
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449696
mov eax, dword [ebp - 0xc]
call fcn.00403cec
ret

Function at 0x4497c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x44980b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4497ee
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4497ff
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x44980b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x44eee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4e131c], 0
je 0x44f021
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4daea4]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x44f021
mov eax, dword [0x4e1320]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4e131c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44eff0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4e131c]
call fcn.00422378
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44efe8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x44efe8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x44efe8
mov eax, dword [ebp - 0x14]
call fcn.00459fbc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44efe8
push ebp
call fcn.0044ee9c
pop ecx
test al, al
jne 0x44efe8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403efc
test al, al
je 0x44efe8
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403efc
cmp byte [ebp - 1], 0
je 0x44efe8
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00408ba4
test al, al
je 0x44efe8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4e1320]
call fcn.0044e614
inc edi
dec ebx
jne 0x44ef45
mov eax, dword [0x4e1320]
cmp dword [eax + 8], 0
jle 0x44f008
mov eax, dword [0x4e1320]
call fcn.0044e6cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44f021
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044ed00
pop ecx
test al, al
jne 0x44f021
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456ca8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00408b8c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0045135c
test ebx, ebx
jne 0x456cfb
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00456b3c
mov ebx, eax
test ebx, ebx
je 0x456de6
cmp esi, ebx
je 0x456d24
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x456d39
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x456d71
add eax, 0xffffff5f
sub eax, 2
jb 0x456d89
dec eax
sub eax, 2
jb 0x456d9d
dec eax
sub eax, 2
jb 0x456d93
jmp 0x456da7
add eax, 0xfffffdff
sub eax, 2
jb 0x456d89
dec eax
sub eax, 2
jb 0x456d9d
dec eax
sub eax, 2
jb 0x456d93
jmp 0x456da7
mov byte [esp + 0x120], 0
jmp 0x456daf
mov byte [esp + 0x120], 2
jmp 0x456daf
mov byte [esp + 0x120], 1
jmp 0x456daf
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00466ff0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00452b04
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x456de8
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x466af4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x466b15
test edi, 0x40000
je 0x466b2f
test bl, bl
jne 0x466bb0
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x466bb0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x466b62
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x466b77
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x466b86
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x466b97
cmp byte [esp + 2], 0
je 0x466bb0
cmp byte [esp + 2], 0
je 0x466ba8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x466bb0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x466e5c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x466e82
mov eax, esp
push eax
push 0x466e24
call sub.user32.dll_EnumWindows
jmp 0x466e95
mov eax, esp
push eax
push 0x466e04
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x466f58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x466fac]
test si, 4
je 0x466f6d
or bl, 1
test si, 8
je 0x466f77
or bl, 4
test si, 1
je 0x466f81
or bl, 8
test si, 2
je 0x466f8b
or bl, 0x10
test si, 0x10
je 0x466f95
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x466fa4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x466fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x466fec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x466fca
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x466fd9
or bl, 4
test esi, 0x20000000
je 0x466fe4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46f414
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46f426
add esp, 0xfffffff0
call fcn.00404124
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00429fa4
mov eax, dword [0x4dab08]
mov dword [eax + 4], ebx
mov dword [eax], 0x46f828
mov eax, dword [0x4dab14]
mov dword [eax + 4], ebx
mov dword [eax], 0x46f834
mov eax, ebx
call fcn.0046f840
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41fbcc]
call fcn.00403cbc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41fbcc]
call fcn.00403cbc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41fbcc]
call fcn.00403cbc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41fbcc]
call fcn.00403cbc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41fbcc]
call fcn.00403cbc
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x46a774
push eax
push 0
push 0
mov eax, dword [0x4dadc0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42f8e0]
call fcn.00431360
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x42f8e0]
call fcn.00431360
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x42f8e0]
call fcn.00431360
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x42f8e0]
call fcn.00431360
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0046fd38
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46fc10
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46fc10
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46fc10
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46fc10
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46f579
call fcn.0040417c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret