joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4581ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x4a5350]
cmp byte [eax + 0xc], 0
je 0x45831e
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x458317
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a6ba0], 0
jne 0x458205
push 0x458324
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebp - 4], eax
push 0x45832c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6ba0], eax
cmp dword [0x4a3cf4], 0
jne 0x458300
push 0x45833c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a3cf4], eax
cmp dword [0x4a3cf4], 0
je 0x458300
push 0x458348
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6ba4], eax
push 0x458358
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6ba8], eax
push 0x45836c
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bac], eax
push 0x458384
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bb0], eax
push 0x45839c
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bb4], eax
push 0x4583b0
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bb8], eax
push 0x4583c8
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bbc], eax
push 0x4583e0
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bc0], eax
push 0x4583fc
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bc4], eax
push 0x458408
mov eax, dword [0x4a3cf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a6bc8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45831e
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x45d32c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.004040c8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45d385
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404338
mov esp, ebp
pop ebp
ret
Function at 0x466068
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x4660c0]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x466082
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x46608c
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x466096
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x4660a0
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x4660aa
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4660ba
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x4660c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x466108]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4660e5
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4660f5
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x4660ff
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x46e068
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x46e07a
add esp, 0xfffffff0
call fcn.00403618
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004207c4
mov eax, dword [0x4a4f94]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x46e5d8
mov eax, dword [0x4a4fa0]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x46e5f8
mov eax, dword [ebp - 4]
call fcn.0046e618
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416bbc]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416bbc]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x416bbc]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x416bbc]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x416bbc]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x469a28
push eax
push 0
push 0
mov eax, dword [0x4a5120]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x422a5c]
call fcn.00424424
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x422a5c]
call fcn.00424424
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x422a5c]
call fcn.00424424
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.0046eb64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46e9b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46e9b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x46e9b0
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x46e202
call fcn.00403670
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46e768
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e933
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46e911
mov dl, 1
mov eax, dword [0x416fd8]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040c8
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x46e8fa
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.0045854c
test al, al
je 0x46e8ee
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x46e944
lea eax, [ebp - 0x25c]
call fcn.00409760
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46e8ee
xor eax, eax
push ebp
push 0x46e8e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x46e97c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46e8d0
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404338
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46e8d0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e8ee
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x46e7dd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.0041b8fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e93a
lea eax, [ebp - 0x268]
call fcn.004040c8
ret
Function at 0x46f46c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4a6bec]
cmp byte [eax + 0xa5], 0
jne 0x46f4e3
cmp dword [0x4a6c04], 0
jne 0x46f4a1
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46f428
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a6c04], eax
cmp dword [0x4a6c00], 0
jne 0x46f4bc
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a6c00], eax
cmp dword [0x4a6c08], 0
jne 0x46f4e3
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x46f3c8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a6c08], eax
pop ecx
pop ebp
ret

Function at 0x46f5ac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0046f544
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x46f5cd
xor eax, eax
call fcn.0046f57c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x46f5e7
mov al, 1
call fcn.0046f57c
mov esp, ebp
pop ebp
ret

Function at 0x46fcac
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x4a6bec]
cmp dword [eax + 0x30], 0
je 0x46fd76
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x46fd6d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x46fc2c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x46fd6d
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46fd27
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x46fd6d
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.00419420
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x46fd3c
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x470a90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x470ad5
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.004041b8
jmp 0x470ae6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.0040411c
mov esp, ebp
pop ebp
ret
Function at 0x471f68
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x471fbb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.004528b4
test al, al
je 0x471fbb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.004523e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x471fbb
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.004523e4
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x472e2c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov edx, dword [0x416160]
call fcn.00404a60
xor eax, eax
push ebp
push 0x472f7f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a3f34], 0
jne 0x472e82
mov ecx, dword [0x4a4ec8]
mov dl, 1
mov eax, dword [0x4075b0]
call fcn.0040c750
call fcn.00403a80
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d08
mov eax, dword [ebp - 4]
call fcn.00404930
mov dword [ebp - 0x2c], eax
mov esi, 0x472f90
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
call fcn.00405a18
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.00404940
test eax, eax
jle 0x472f1d
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x472f14
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.00404350
mov eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x50]
mov ecx, 0x10
call fcn.00404338
mov eax, dword [ebp - 0x58]
pop edx
call fcn.004084d0
test eax, eax
jne 0x472f14
mov dword [ebp - 0x10], 0x15
jmp 0x472f24
mov dword [ebp - 0x10], 0x10
jmp 0x472f24
mov dword [ebp - 0x10], 0x15
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [0x4a3f34]
call fcn.00472d5c
mov eax, dword [ebp - 0x18]
call fcn.00472d5c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
call fcn.00405a30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472f86
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.004040ec
lea eax, [ebp - 0x20]
mov edx, dword [0x416160]
call fcn.00404b30
ret
Function at 0x47cb3c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47cc5d
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
mov edx, dword [0x4a522c]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4a522c]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47cc74
call fcn.00409814
mov eax, dword [ebp - 4]
call fcn.00490fe8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4a500c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [0x4a51f8]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x47cc90
call fcn.00409814
mov eax, dword [ebp - 0x10]
call fcn.00490fe8
call sub.kernel32.dll_GetCurrentThreadId_1
mov esi, eax
push esi
push 0
push 0x47c808
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47ccb0
call fcn.00409814
mov eax, dword [ebp - 0x24]
call fcn.00490fe8
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47ccc8
call fcn.00409814
mov eax, dword [ebp - 0x28]
call fcn.00490fe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cc64
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004040ec
lea eax, [ebp - 0x10]
call fcn.004040c8
lea eax, [ebp - 4]
call fcn.004040c8
ret

Function at 0x483550
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x48359e
mov edx, dword [ebx + 0x48]
cmp dword [edx + 0x140], 0
je 0x48359e
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x140]
mov eax, dword [eax + 0x14]
jmp 0x4835ae
mov edx, dword [ebx + 0x48]
mov edx, dword [edx + 0x13c]
test edx, edx
je 0x4835ae
mov eax, dword [edx + 0x14]
test eax, eax
je 0x4835c7
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00481074
jmp 0x48360a
mov edx, dword [edi + 0x10]
mov eax, dword [ebx + 0x34]
call fcn.00425a44
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x14]
call fcn.00424fbc
mov esi, eax
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0xa8]
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.00424c38
mov edx, esp
mov eax, dword [ebx + 0x34]
call fcn.00425684
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
mov edx, esi
call fcn.00424c38
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4882d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, edx
mov ebp, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0046610c
mov ebx, eax
mov dx, word [edi + 4]
mov eax, ebp
call fcn.00488180
mov esi, eax
test esi, esi
je 0x488321
mov al, byte [0x488334]
cmp al, bl
jne 0x488321
mov edx, esi
mov eax, ebp
call fcn.00488128
mov dword [edi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x488329
mov edx, edi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48b15c
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409260
add esp, 0x3ec
pop ebx
ret

Function at 0x48c558
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
call fcn.004601fc
mov edi, eax
dec edi
test edi, edi
jl 0x48c60b
inc edi
xor esi, esi
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.00460228
mov eax, dword [eax + 0xc]
sub eax, 1
jb 0x48c5a2
je 0x48c5c3
dec eax
je 0x48c5e4
jmp 0x48c603
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.00460228
cmp byte [ebx + 0x15c], 0
setne dl
call fcn.004600ac
jmp 0x48c603
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.00460228
cmp byte [ebx + 0x15c], 1
setne dl
call fcn.004600ac
jmp 0x48c603
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.00460228
cmp byte [ebx + 0x15c], 2
setne dl
call fcn.004600ac
inc esi
dec edi
jne 0x48c583
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x48c630
cmp eax, dword [esp]
pop edx
pop eax
jae 0x48c691
jmp 0x48c634
pop edx
pop eax
jge 0x48c691
mov esi, 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x130]
test byte [eax + 0x50], 2
je 0x48c66d
cmp byte [ebx + 0x159], 2
je 0x48c66d
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [ebx + 0xec]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x48c6ad
push 0
mov eax, dword [ebx + 0x124]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0xfc]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x48c6ad
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00435ae4
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x124]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x495990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x495ada
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x88], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x495abf
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409260
mov dl, 1
mov eax, dword [0x47b6dc]
call fcn.0047b734
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x4172c8]
call fcn.004032c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.0047b7b0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x495abc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, 0x495af0
call fcn.0047bafc
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004043d4
xor eax, eax
push ebp
push 0x495ab5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xc]
call fcn.0041c2f0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00495af8
mov eax, dword [ebp - 0xc]
call fcn.00408dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495abc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.004032f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.004032f4
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495ae1
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004040ec
ret