joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1c6
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x40f0f0
call fcn.0040acdb
push 1
call fcn.0040a330
pop ecx
test al, al
jne 0x40a07d
push 7
call fcn.0040aaa3
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040a2fb
mov byte [ebp - 0x24], al
mov eax, dword [0x4120bc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40a076
test eax, eax
jne 0x40a0e7
mov dword [0x4120bc], ecx
push 0x40c2c4
push 0x40c2ac
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40a0ca
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40a1c0
push 0x40c2a8
push 0x40c290
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4120bc], 2
jmp 0x40a0ec
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040a49d
pop ecx
call fcn.0040aa97
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40a11c
push esi
call fcn.0040a413
pop ecx
test al, al
je 0x40a11c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040aa28
call esi
call fcn.0040aa9d
mov esi, eax
cmp dword [esi], edi
je 0x40a13a
push esi
call fcn.0040a413
pop ecx
test al, al
je 0x40a13a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0040abb9
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040abec
test al, al
jne 0x40a165
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40a16e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040a4ba
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40a1c0
call fcn.0040ad20
ret
call fcn.00409f04
jmp 0x40a05e
Function at 0x5e0eb8
Capabilities:
Execute syscall

Disassembly:
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5f3a0821
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4a715b3f
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x424ed4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404dec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x424f2c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x482ab0]
mov dl, 1
mov eax, dword [0x4249e0]
call fcn.0040c4e8
call fcn.00404384
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00424ae8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x425d88
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x425d8e
ret
Function at 0x43041c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040495c
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43046a
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404bcc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43554c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43567f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x424a40]
call fcn.00424b10
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x435655
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00424bb0
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00404bcc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x435694
call fcn.00404c74
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00424c14
lea ecx, [ebp - 4]
mov edx, 0x4356d0
mov eax, dword [ebp - 0xc]
call fcn.00424e5c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040e028
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x435638
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4356dc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x47f478]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43563f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x43572c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x435773
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435756
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x435767
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x435773
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x43a264
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x487c44], 0
je 0x43a3ad
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x48289c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x43a3ad
mov eax, dword [0x487c48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x487c44]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43a37c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x487c44]
call fcn.00417fb0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43a374
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x43a374
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43a374
mov eax, dword [ebp - 0x14]
call fcn.00444920
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43a374
push ebp
call fcn.0043a220
pop ecx
test al, al
jne 0x43a374
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403d0c
test al, al
je 0x43a374
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403d0c
cmp byte [ebp - 1], 0
je 0x43a374
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43a374
mov edx, dword [ebp - 0x14]
mov eax, dword [0x487c48]
call fcn.00439990
inc edi
dec ebx
jne 0x43a2c9
mov eax, dword [0x487c48]
cmp dword [eax + 8], 0
jle 0x43a394
mov eax, dword [0x487c48]
call fcn.00439a48
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43a3ad
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043a084
pop ecx
test al, al
jne 0x43a3ad
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4417f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406bc4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0043c5ec
test ebx, ebx
jne 0x441847
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00441730
mov ebx, eax
test ebx, ebx
je 0x441932
cmp esi, ebx
je 0x441870
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x441885
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4418bd
add eax, 0xffffff5f
sub eax, 2
jb 0x4418d5
dec eax
sub eax, 2
jb 0x4418e9
dec eax
sub eax, 2
jb 0x4418df
jmp 0x4418f3
add eax, 0xfffffdff
sub eax, 2
jb 0x4418d5
dec eax
sub eax, 2
jb 0x4418e9
dec eax
sub eax, 2
jb 0x4418df
jmp 0x4418f3
mov byte [esp + 0x120], 0
jmp 0x4418fb
mov byte [esp + 0x120], 2
jmp 0x4418fb
mov byte [esp + 0x120], 1
jmp 0x4418fb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004500fc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0043dd5c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x441934
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x449a88
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x482aa0]
cmp byte [eax + 0xc], 0
je 0x449bf5
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449bee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x487c54], 0
jne 0x449adc
push 0x449bfc
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x449c04
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c54], eax
cmp dword [0x47f5c0], 0
jne 0x449bd7
push 0x449c14
call sub.kernel32.dll_LoadLibraryA
mov dword [0x47f5c0], eax
cmp dword [0x47f5c0], 0
je 0x449bd7
push 0x449c20
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c58], eax
push 0x449c30
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c5c], eax
push 0x449c44
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c60], eax
push 0x449c5c
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c64], eax
push 0x449c74
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c68], eax
push 0x449c88
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c6c], eax
push 0x449ca0
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c70], eax
push 0x449cb8
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c74], eax
push 0x449cd4
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c78], eax
push 0x449ce0
mov eax, dword [0x47f5c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x487c7c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449bf5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44fc40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x44fc61
test edi, 0x40000
je 0x44fc7b
test bl, bl
jne 0x44fcfc
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x44fcfc
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x44fcae
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x44fcc3
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x44fcd2
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x44fce3
cmp byte [esp + 2], 0
je 0x44fcfc
cmp byte [esp + 2], 0
je 0x44fcf4
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x44fcfc
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x44ffa0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x44ffc6
mov eax, esp
push eax
push 0x44ff68
call sub.user32.dll_EnumWindows
jmp 0x44ffd9
mov eax, esp
push eax
push 0x44ff48
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x450064
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4500b8]
test si, 4
je 0x450079
or bl, 1
test si, 8
je 0x450083
or bl, 4
test si, 1
je 0x45008d
or bl, 8
test si, 2
je 0x450097
or bl, 0x10
test si, 0x10
je 0x4500a1
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4500b0
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4500bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4500f8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4500d6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4500e5
or bl, 4
test esi, 0x20000000
je 0x4500f0
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x458164
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x458176
add esp, 0xfffffff0
call fcn.00403e34
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041df94
mov eax, dword [0x482638]
mov dword [eax + 4], ebx
mov dword [eax], 0x458508
mov eax, dword [0x482644]
mov dword [eax + 4], ebx
mov dword [eax], 0x458514
mov eax, ebx
call fcn.00458520
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4539c8
push eax
push 0
push 0
mov eax, dword [0x4827fc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4253e8]
call fcn.00426908
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4253e8]
call fcn.00426908
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4253e8]
call fcn.00426908
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00458998
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458868
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458868
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x458868
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4582b3
call fcn.00403e8c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45864c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4587f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4587d8
mov dl, 1
mov eax, dword [0x415fa8]
call fcn.00403ae0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040495c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4587c7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00449de4
test al, al
je 0x4587ba
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458808
lea eax, [ebp - 0x254]
call fcn.00409920
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4587ba
xor eax, eax
push ebp
push 0x4587b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458840
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45879c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404bcc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45879c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4587ba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4586bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00419d08
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4587fe
lea eax, [ebp - 0x260]
call fcn.0040495c
ret

Function at 0x459170
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x487c98]
cmp byte [eax + 0xad], 0
jne 0x4591e1
cmp dword [0x487cb4], 0
jne 0x4591a2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45912c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x487cb4], eax
cmp dword [0x487cb0], 0
jne 0x4591bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x487cb0], eax
cmp dword [0x487cb8], 0
jne 0x4591e1
push esp
push 0
push 0
push 0x4590d0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x487cb8], eax
pop edx
ret
Function at 0x4593e4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4593fb
add esp, 0xfffffff0
call fcn.00403e34
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041df94
mov eax, dword [0x4827e4]
cmp word [eax + 2], 0
jne 0x459423
mov eax, dword [0x4827e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045ae7c
mov eax, dword [0x4828c8]
cmp word [eax + 2], 0
jne 0x45943d
mov eax, dword [0x4828c8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b088
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x415b84]
call fcn.00403ae0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x425bc4]
call fcn.0042bda8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4595f4
mov eax, dword [0x4826b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042c17c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b74c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4826b8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d1c8
test eax, eax
je 0x459544
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004092d8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d1fc
test eax, eax
je 0x459558
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404bcc
mov byte [ebx + 0xd4], 0
push ebx
push 0x45ab60
call fcn.0041f110
mov dword [ebx + 0xc8], eax
mov eax, dword [0x48254c]
cmp byte [eax], 0
jne 0x4595a9
mov eax, ebx
call fcn.00459738
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045b960
mov eax, ebx
call fcn.0045c4c4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4595e9
call fcn.00403e8c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret