joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443bd8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x443d53
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407620
mov eax, dword [ebp - 4]
call fcn.00443470
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x443c2a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407e64
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00444884
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x443d09
xor eax, eax
push ebp
push 0x443d02
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004437d8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00443d88
test al, al
je 0x443ce0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407708
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x443ce0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00407658
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00443738
test al, al
je 0x443cda
mov eax, dword [ebp - 8]
call fcn.00407658
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00407778
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00443bd8
dec ebx
cmp ebx, 0xffffffff
jne 0x443c89
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443d09
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004437d8
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00407658
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004437c4
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00443738
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443d5a
lea eax, [ebp - 0x3c]
call fcn.004075bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004075c4
ret

Function at 0x444760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004434e4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00407658
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00443738
test al, al
jne 0x4447c8
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4cc694]
mov dl, 1
mov eax, dword [0x442294]
call fcn.00417028
call fcn.00406194
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4447d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00407658
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.00443738
test al, al
jne 0x444835
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4cc8f4]
mov dl, 1
mov eax, dword [0x442294]
call fcn.00417028
call fcn.00406194
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00443514
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x444e34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x444f5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004437d8
xor eax, eax
push ebp
push 0x444f37
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443d88
test al, al
je 0x444f1b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00444d14
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407708
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x444f1b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407658
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443738
test al, al
je 0x444f17
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00407658
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00407778
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00444d14
pop ecx
inc edi
dec ebx
jne 0x444ebf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444f3e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004437d8
ret
Function at 0x444f6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4451ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004437d8
xor eax, eax
push ebp
push 0x445190
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443d88
test al, al
je 0x445174
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407708
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x445174
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407658
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00443738
test al, al
je 0x445168
mov eax, dword [ebp - 4]
call fcn.00407658
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00407778
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00444884
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x445168
xor eax, eax
push ebp
push 0x445161
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004437d8
xor eax, eax
push ebp
push 0x445143
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407658
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00407778
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004437dc
mov eax, dword [ebp - 4]
call fcn.00407658
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00407778
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00444884
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x445120
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00444e34
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00444f6c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445127
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x444ff7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445197
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004437d8
ret
Function at 0x449b14
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x449b1a
ret
Function at 0x4544a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor edx, edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45459e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebx + 0x170]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004077b4
lea edx, [ebp - 0x210]
mov eax, 0x24
call fcn.004549d8
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0x164]
call fcn.004075cc
lea edx, [ebp - 0x214]
mov eax, 0x26
call fcn.004549d8
mov edx, dword [ebp - 0x214]
lea eax, [ebx + 0x16c]
call fcn.004075cc
lea edx, [ebp - 0x218]
mov eax, 0x23
call fcn.004549d8
mov edx, dword [ebp - 0x218]
lea eax, [ebx + 0x168]
call fcn.004075cc
lea edx, [ebp - 0x21c]
mov eax, 0x1a
call fcn.004549d8
mov edx, dword [ebp - 0x21c]
lea eax, [ebx + 0x148]
call fcn.004075cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4545a5
lea eax, [ebp - 0x21c]
mov edx, 4
call fcn.004075c4
ret
Function at 0x4545ac
Capabilities:
Check os version
Get hostname
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45478c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebx + 0x144]
xor eax, eax
call fcn.00404630
lea edx, [ebp - 0x208]
mov eax, dword [ebx + 0x144]
call fcn.00412f84
mov edx, dword [ebp - 0x208]
lea eax, [ebx + 0x140]
call fcn.004075cc
mov eax, dword [0x4cc8d8]
mov eax, dword [eax]
mov dword [ebx + 0x14c], eax
mov eax, dword [0x4cc558]
mov eax, dword [eax]
mov dword [ebx + 0x150], eax
mov eax, dword [0x4cc778]
mov eax, dword [eax]
mov dword [ebx + 0x154], eax
mov eax, dword [0x4cc5d4]
mov eax, dword [eax]
mov dword [ebx + 0x158], eax
lea eax, [ebx + 0x15c]
mov edx, dword [0x4cc534]
mov edx, dword [edx]
call fcn.004075cc
mov dword [ebx], 0x11c
push ebx
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x4546cc
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x14c], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0x150], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x154], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x158], eax
lea eax, [ebx + 0x15c]
lea edx, [ebx + 0x14]
mov ecx, 0x80
call fcn.004077b4
cmp byte [ebx + 0x11a], 3
sete al
mov byte [ebx + 0x160], al
cmp dword [ebx + 4], 6
setae al
mov byte [ebx + 0x162], al
cmp byte [ebx + 0x162], 0
je 0x4546c0
cmp byte [ebx + 0x160], 0
je 0x4546c4
xor eax, eax
jmp 0x4546c6
mov al, 1
mov byte [ebx + 0x161], al
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4546fd
lea eax, [ebx + 0x174]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.004077b4
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x45472e
lea eax, [ebx + 0x178]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.004077b4
call sub.kernel32.dll_GetSystemDefaultLCID
mov dword [ebx + 0x17c], eax
call sub.kernel32.dll_GetUserDefaultLCID
mov dword [ebx + 0x180], eax
lea eax, [ebx + 0x11c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
lea edx, [ebp - 0x20c]
xor eax, eax
call fcn.004547b8
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 0x184]
call fcn.004075cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454793
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.004075c4
ret

Function at 0x4549d8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
push esp
push 0
push 0
push ebx
push 0
call sub.shell32.dll_SHGetFolderLocation
test eax, eax
jne 0x454a1a
cmp dword [esp], 0
je 0x454a1a
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004077b4
add esp, 0x210
pop esi
pop ebx
ret
Function at 0x458d4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x458e5a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
cmp esi, 0xffffffff
je 0x458d8c
test edi, edi
jg 0x458d9d
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x458e67
push 0
push 0
push ebx
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x458dbe
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x458e67
lea esi, [edi + 7]
and esi, 0xfffffff8
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x458e1e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x651
jne 0x458e05
mov byte [0x4cab3c], 1
mov dword [ebp - 0xc], 0xfffffffe
call fcn.00406288
jmp 0x458e67
cmp ebx, 2
jne 0x458e18
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x458e67
inc ebx
cmp ebx, 3
jne 0x458dc6
cmp edi, dword [ebp - 0x10]
jle 0x458e26
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0x18
mov ecx, edi
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e61
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 4]
cmp dword [ebp - 0xc], 0xfffffffe
jne 0x458e59
call fcn.004591ec
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x458f04
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
and eax, 0x80000007
jns 0x458f2b
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jle 0x458f45
mov ecx, 0x45905c
mov dl, 1
mov eax, dword [0x40dff4]
call fcn.00416e24
call fcn.00406194
xor edx, edx
push ebp
push 0x459034
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx]
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
je 0x458f6c
test ebx, ebx
jg 0x458f7d
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x459041
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x458fa1
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x459041
lea esi, [ebx + 7]
and esi, 0xfffffff8
mov eax, dword [ebp - 4]
lea edx, [eax + 0x18]
mov eax, edi
mov ecx, esi
call fcn.00404414
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x459010
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x651
jne 0x458ff7
mov byte [0x4cab3c], 1
mov dword [ebp - 0xc], 0xfffffffe
call fcn.00406288
jmp 0x459041
cmp ebx, 2
jne 0x45900a
mov dword [ebp - 0xc], 0xffffffff
call fcn.00406288
jmp 0x459041
inc ebx
cmp ebx, 3
jne 0x458fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45903b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [eax]
call dword [edx + 4]
cmp dword [ebp - 0xc], 0xfffffffe
jne 0x459033
call fcn.004591ec
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x468ae0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x468b01
test edi, 0x40000
je 0x468b1b
test bl, bl
jne 0x468b9c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x468b9c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x468b4e
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x468b63
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x468b72
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x468b83
cmp byte [esp + 2], 0
je 0x468b9c
cmp byte [esp + 2], 0
je 0x468b94
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x468b9c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x468e48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x468e6e
mov eax, esp
push eax
push 0x468e10
call sub.user32.dll_EnumWindows
jmp 0x468e81
mov eax, esp
push eax
push 0x468df0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x468f44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x468f94]
test bl, 4
je 0x468f58
or si, 1
test bl, 8
je 0x468f61
or si, 4
test bl, 1
je 0x468f6a
or si, 8
test bl, 2
je 0x468f73
or si, 0x10
test bl, 0x10
je 0x468f7c
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x468f8c
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x468f98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x468fd4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x468fb3
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x468fc3
or bx, 4
test esi, 0x20000000
je 0x468fcf
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x471b98
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x471baa
add esp, 0xfffffff0
call fcn.00405bf0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043d754
mov eax, dword [0x4cc4d0]
mov dword [eax + 4], ebx
mov dword [eax], 0x471ff4
mov eax, dword [0x4cc4dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x472000
mov eax, ebx
call fcn.0047200c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x426d08]
call fcn.004056a4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x426d08]
call fcn.004056a4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x426d08]
call fcn.004056a4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x426d08]
call fcn.004056a4
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x426d08]
call fcn.004056a4
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x46c940
push eax
push 0
push 0
mov eax, dword [0x4cc688]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x445bb4]
call fcn.0044abbc
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x445bb4]
call fcn.0044abbc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x445bb4]
call fcn.0044abbc
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x445bb4]
call fcn.0044abbc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x445bb4]
call fcn.0044abbc
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.00472564
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4723d4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4723d4
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4723d4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4723d4
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4723d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x471d25
call fcn.00405c48
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret