joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57dd75
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5c9c68
push 0x5c9c60
push str.FlsAlloc
push 0x1e
call fcn.0057dbf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x57dda9
push dword [ebp + 8]
mov ecx, esi
call dword [0x59a9ec]
call esi
jmp 0x57ddaf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x57ddf3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5c9c78
push 0x5c9c70
push str.FlsGetValue
push 0x20
call fcn.0057dbf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x57de2a
push dword [ebp + 8]
mov ecx, esi
call dword [0x59a9ec]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x58030a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5f3004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x580355
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.005804a9
test al, al
jne 0x58034f
sub edx, 2
cmp edx, edi
jne 0x580335
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x580377
lea eax, [edi + 2]
cmp edx, eax
je 0x580377
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00580256
add esp, 0x10
jmp 0x580471
push esi
lea ecx, [ebp - 0x255]
call fcn.005804a9
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5803ba
push dword [ebp - 0x25c]
jmp 0x580367
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x5803f7
cmp word [ebp - 0x226], 0
je 0x580418
cmp word [ebp - 0x226], ax
jne 0x5803f7
cmp word [ebp - 0x224], 0
je 0x580418
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00580256
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x580464
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5803d1
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x58044c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x580471
push 0x57ffb7
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00571210
add esp, 0x10
jmp 0x580441
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00567aa7
leave
ret
Function at 0x580f27
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x580fc4
push ebx
push esi
call fcn.00580ef0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00580e39
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x580f71
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x580fc3
push edi
push eax
call fcn.0057cc3f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x580f91
call fcn.0057acaa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x580fc2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00580e39
add esp, 0x20
test eax, eax
jne 0x580fb0
push edi
call fcn.0057acaa
jmp 0x580fb8
push ebx
call fcn.0057acaa
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x580fc7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x580fd8
pop esi
ret
push ebx
push edi
push esi
call fcn.00580ef0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0057cc3f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x581000
push ebx
push esi
push edi
call fcn.00569990
add esp, 0xc
push 0
call fcn.0057acaa
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x58174c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00581273

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x521a30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x521a5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x521a5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403740
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x403754
inc dword [0x4ca6d4]
add dword [0x4c6a44], 0x108
mov edx, dword [0x4c6a44]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4c91b0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403783
push 0
mov eax, 0x4cb520
call fcn.00417590
cmp dword [0x4ca708], 0
mov dword [0x4cc008], 0
mov dword [0x4cc00c], 0
je 0x4037bb
mov eax, dword [0x4c7b78]
test eax, eax
je 0x4037af
mov eax, dword [eax]
test eax, eax
jne 0x4037b4
mov eax, 0x4a3920
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x40383f
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x4037ea
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x4037ea
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4cc014], 0
je 0x4037fc
cmp dword [0x4cc010], 0
jne 0x403805
cmp byte [esi + 0xee], 0
je 0x40383f
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x40383f
cmp dword [0x4cc014], 0
jge 0x403827
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4cc014]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret

Function at 0x404590
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x4045b3
call fcn.00404860
test eax, eax
jne 0x4045b3
push 0x4a3c00
call fcn.00404690
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4045ec
cmp dword [esi + 0x18], ebx
je 0x4045de
cmp dword [esi + 8], ebx
je 0x4045d3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c44
call fcn.00404690
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x404625
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40464c
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40464c
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x404642
cmp dword [esi + 8], ebx
je 0x404637
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x404661
mov dword [esi + 4], ebx
jmp 0x404625
cmp dword [esi + 0x18], ebx
je 0x40467e
cmp dword [esi + 8], ebx
je 0x404673
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4a3c64
call fcn.00404690
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x404760
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x404770
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40483f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push 0x4a3c88
push edx
call fcn.0048ffb7
add esp, 0xc
test eax, eax
je 0x404836
lea eax, [esp]
push 0x4a3ca0
push eax
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea ecx, [esp]
push 0x4a3cb8
push ecx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea edx, [esp]
push 0x4a3ccc
push edx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea eax, [esp]
push 0x4a3cdc
push eax
call fcn.0048f769
add esp, 8
test eax, eax
je 0x404836
lea ecx, [esp]
push 0x4a3cf8
push ecx
call fcn.0048f769
add esp, 8
test eax, eax
je 0x40482c
lea edx, [esp]
push 0x4a3d1c
push edx
call fcn.0048f769
add esp, 8
test eax, eax
jne 0x404845
test esi, esi
je 0x404836
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret

Function at 0x404860
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ecx + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
jne 0x4048ea
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
mov eax, dword [0x4ca564]
push eax
call ebx
test eax, eax
jne 0x4048df
mov eax, dword [0x4c6948]
cmp eax, 0xffffffff
je 0x4048af
test eax, eax
je 0x4048f6
call esi
mov ecx, dword [0x4c6948]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4048f6
push 1
push 0x8000012f
mov dword [0x4c694c], 0
call fcn.004013d0
mov edx, dword [0x4ca564]
add esp, 8
push edx
mov dword [0x4c694c], 1
call ebx
test eax, eax
je 0x404890
mov eax, dword [esp + 0xc]
mov dword [eax + 0x18], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4ca694], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x408d94
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4ca698], 0
je 0x408da3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x408fb0
test al, al
jne 0x408de6
cmp byte [ebp + 0xc], al
jne 0x408de6
push 0x4c9470
push 0
push 0
push 0x4090a0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4cad90], eax
test eax, eax
je 0x408e77
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4c9470]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x408e1c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x408df6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x408e83
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x408eea
cmp dword [esp + 0x2c], 0
je 0x408e92
mov byte [esp + 0x1f], 1
call fcn.004093c0
test al, al
jne 0x408e92
cmp byte [ebp + 0xc], al
jne 0x408f7e
mov byte [ebp + 8], al
jmp 0x408e31
call fcn.004093e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x408ece
call fcn.004093c0
test al, al
jne 0x408eea
cmp byte [ebp + 0xc], 0
jne 0x408f77
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4ca694], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
je 0x408f22
test byte [esp + 0x1e], 1
jne 0x408f3b
push 0x4a59ac
push 0
push 0
call esi
mov dword [0x4cad88], eax
jmp 0x408f3b
mov ecx, dword [0x4cad90]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x408f02
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x408e92
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408e31
mov edx, dword [0x4cad90]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4cad90], 0
call fcn.004093e0
jmp 0x408ea2
test byte [esp + 0x1e], 1
je 0x408f3b
mov eax, dword [0x4cad88]
push eax
call edi
mov dword [0x4cad88], 0
cmp dword [0x4ca698], 0
je 0x408f5d
test byte [esp + 0x1e], 2
jne 0x408f77
push 0x4a59c0
push 0
push 0
call esi
mov dword [0x4cad8c], eax
jmp 0x408f77
test byte [esp + 0x1e], 2
je 0x408f77
mov ecx, dword [0x4cad8c]
push ecx
call edi
mov dword [0x4cad8c], 0
cmp byte [esp + 0x1f], 0
je 0x408fb0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4c694c], 0
push 0
push 0
push 0x10000
push 0x4a59d8
call fcn.0047ab10
add esp, 0x18
mov dword [0x4c694c], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aa40
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1004
call fcn.0049af60
cmp byte [0x4cc1fc], 0
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
jne 0x40abb2
cmp dword [0x4cadac], 0
jne 0x40aa76
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cadac], eax
mov ebx, 1
add dword [0x4cc200], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4cc200]
mov esi, dword [0x4c6960]
mov ecx, eax
sub ecx, dword [0x4cadac]
mov dword [0x4cadb0], eax
cmp edx, dword [0x4c695c]
jbe 0x40aaac
cmp ecx, esi
jb 0x40ab10
xor ebx, ebx
cmp ecx, esi
jbe 0x40aac9
mov dword [0x4cc200], 0
mov dword [0x4cadac], eax
test ebx, ebx
jne 0x40abb2
mov esi, dword [esp + 0x1018]
mov cl, byte [esi + 0xf]
push 0
mov byte [0x4cbfe6], cl
mov ecx, dword [ebp]
inc byte [ebp + 0x16]
push 0
push 0x4a3914
push ecx
xor eax, eax
xor edx, edx
call fcn.0046e030
dec byte [ebp + 0x16]
add esp, 0x10
test eax, eax
jne 0x40ab80
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
push ecx
push edx
push 0x4a6328
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.00475ec0
add esp, 0xc
call fcn.004099e0
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4cc1fc], bl
mov dword [0x4c694c], 0
call fcn.0047ab10
add esp, 0x18
cmp eax, 7
jne 0x40ab69
push 0
push 5
push 0x4cb520
call fcn.00417910
mov eax, dword [0x4cadb0]
mov dword [0x4c694c], ebx
mov byte [0x4cc1fc], 0
jmp 0x40aab2
cmp byte [ebp + 0x1b], 0
je 0x40abb2
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x40abb2
movzx edx, word [esi + 4]
mov eax, dword [0x4ca564]
push 0
push edx
push 0x312
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret 8
Function at 0x4136c0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x34
push esi
xor esi, esi
push edi
test eax, eax
je 0x4136fe
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x4136fe
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4136fe
push 0
push eax
call edi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
pop edi
pop esi
add esp, 0x34
ret

Function at 0x413710
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x284
push ebx
push ebp
xor ebp, ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ebx, eax
test ebx, ebx
je 0x4137bf
xor eax, eax
jmp 0x413740
movzx ecx, word [eax + 0x4a6f10]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x413740
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x4137ad
lea edx, [esp + 8]
push edx
push 1
push 0
lea eax, [esp + 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4137ad
push esi
push edi
lea edi, [esp + 0x10]
lea esi, [esp + 0x8c]
mov ecx, 0x4a6f78
call fcn.00477430
pop edi
pop esi
test eax, eax
je 0x4137ad
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp dword [esp + 0x290], ebx
je 0x4137bf
push 0
push ebx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov eax, ebp
pop ebp
pop ebx
add esp, 0x284
ret

Function at 0x4139c0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push ebx
push edi
push 0
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
lea eax, [ebx - 0x41]
cmp al, 0x19
ja 0x413aaf
push ebp
push esi
push 0x100
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00498640
mov ebp, dword [sym.imp.USER32.dll_ToUnicodeEx]
add esp, 0xc
push edi
xor esi, esi
push esi
push 2
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push 0x6e
call ebp
cmp eax, 2
jne 0x413a1a
movzx esi, word [esp + 0x14]
push edi
push 0
push 2
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
movzx eax, bl
push 0
push eax
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
jns 0x413a4e
push edi
push 0
push 2
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push 0x6e
call ebp
test si, si
je 0x413a8d
push 1
lea eax, [esp + 0x17]
push edi
push eax
call fcn.00413c70
mov bl, al
add esp, 0xc
test bl, bl
je 0x413a8d
mov al, byte [esp + 0x13]
lea ecx, [esp + 0x24]
call fcn.00413230
push edi
push 0
push 2
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
movzx eax, bl
push 0
push eax
call ebp
cmp dword [esp + 0x1c], 0
pop esi
pop ebp
je 0x413aa4
movzx eax, word [esp + 0xc]
pop edi
pop ebx
add esp, 0x114
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x114
ret
push edi
movzx ecx, bl
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
pop edi
pop ebx
add esp, 0x114
ret
Function at 0x41e440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov cx, word [0x4c6968]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
push esi
mov word [esp + 0xc], ax
push edi
lea ebx, [esp + 0x10]
mov eax, ebp
mov word [esp + 0x12], cx
mov dword [esp + 0x14], 0x90028
mov dword [esp + 0x18], 0x3e003c
mov dword [esp + 0x1c], 0x3d003a
mov dword [esp + 0x20], 0x2d002b
mov dword [esp + 0x24], 0x2f002a
mov dword [esp + 0x28], 0x7e0021
mov dword [esp + 0x2c], 0x7c0026
mov dword [esp + 0x30], 0x5b005e
mov dword [esp + 0x34], 0x3f002e
mov dword [esp + 0x38], 0x7b
call fcn.00409770
test eax, eax
je 0x41e4c9
cmp eax, ebp
jbe 0x41e4e3
sub eax, 2
jmp 0x41e4e3
mov eax, ebp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e4d0
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 2]
mov edi, eax
cmp eax, ebp
jbe 0x41e504
lea esp, [esp]
movzx eax, word [edi]
cmp eax, 0x20
je 0x41e4fd
cmp eax, 9
jne 0x41e504
sub edi, 2
cmp edi, ebp
ja 0x41e4f0
mov esi, edi
sub esi, ebp
sar esi, 1
inc esi
cmp esi, 0xfd
jbe 0x41e535
cmp byte [esp + 0x4c], 0
je 0x41e529
mov ecx, dword [esp + 0x40]
push ebp
push 0x4a8b08
call fcn.004301a0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ebx, dword [esp + 0x44]
push esi
push ebp
push ebx
call fcn.00492474
add esp, 0xc
xor ecx, ecx
mov eax, edi
pop edi
mov word [ebx + esi*2], cx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x430750
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.0049af60
cmp dword [esp + 0x4008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4018]
mov ebx, ecx
je 0x430873
test ebx, ebx
jne 0x430788
mov eax, dword [esp + 0x400c]
mov ebx, dword [eax + 0x634]
test ebx, ebx
je 0x430792
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x43079f
mov ecx, dword [eax + 0x270]
movzx eax, word [eax + 0x274]
mov edx, dword [esp + 0x4014]
mov ecx, dword [ecx*4 + 0x4c94ac]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push 0x4ab768
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.00475ec0
add esp, 0x10
cmp word [ebp], 0
lea edi, [esp + eax*2 + 0x10]
je 0x4307f0
lea eax, [esp + 0x10]
mov edx, edi
sub edx, eax
sar edx, 1
push ebp
push 0x4ab388
sub esi, edx
call fcn.00475ec0
add esp, 8
mov esi, dword [esp + 0x4018]
cmp esi, 3
jne 0x43081f
call fcn.0048fd1d
add eax, 0x20
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004917a9
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x430871
test ebx, ebx
jne 0x430844
mov ecx, dword [esp + 0x4014]
mov ebx, dword [ecx + 0x634]
test ebx, ebx
je 0x430863
mov eax, dword [esp + 0x401c]
push ebp
push 1
push eax
mov ecx, ebx
call fcn.0042fec0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
mov edx, dword [esp + 0x401c]
push ebp
push edx
call fcn.004301a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10