joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4034f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or al, 8
jne 0x403684
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040280e
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004027c3
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004027fe
pop esp
das
outsd dx, dword [esi]
lodsd eax, dword [esi]
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004029da
add esp, 0x14
call fcn.004027fe
mov ah, 0x4f
dec ebx
stosb byte es:[edi], al
push dword [ebp - 0x698]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
mov eax, dword [ebp - 0x33c]
mov esp, dword [ebp + 0x1c]
mov dword [esp - 4], eax
popal
add esp, 0x14
call fcn.004027fe
inc ecx
xchg ebp, eax
imul esp, dword [edx - 0x80], 0xfffabca5
inc dword [eax]
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104

Function at 0x403708
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004027dc
or byte [eax + 0x2ff845c6], ah
inc ebp
clc
das
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
add dh, al
test dword [esi - 0x55000004], edx

Function at 0x4044f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
add byte [eax], al
add byte [eax - 0x7ab5b], al
inc dword [eax]
and byte [ebp - 0x7ab], 0
movsd dword es:[edi], dword [esi]
push ebp
clc
invalid
inc dword [eax]
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
invalid
invalid
dec esi

Function at 0x4049a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, 0x24
push esp
call fcn.004027fe
arpl word [esi - 0x5e9b5ab7], di
xor byte [eax], al
add byte [eax], al
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
Function at 0x4049b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ebp, 0x24
push esp
call fcn.004027fe
arpl word [esi - 0x5e9b5ab7], di
xor byte [eax], al
add byte [eax], al
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad

Function at 0x404aa4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
int3
test ecx, ecx
je fcn.004049b0
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404980
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404b18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
test edx, edx
je 0x404b4b
push edx
cmp cx, word [edx]
je 0x404b44
cmp cx, word [edx + 2]
je 0x404b41
cmp cx, word [edx + 4]
je 0x404b3e
cmp cx, word [edx + 6]
je 0x404b3b
add edx, 8
jmp 0x404b1f
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.00404aa4
Function at 0x40b1f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b231
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404374
jmp 0x40b23a
mov eax, ebx
mov edx, esi
call fcn.004042d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c5b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c614
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044fc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408e04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c61b
lea eax, [ebp - 0xc]
call fcn.00404284
ret

Function at 0x423178
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48ba24
cmp dword [edi], 0
jne 0x4231f4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x48ba20]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4895e8
mov ecx, 2
call fcn.004028fc
mov edx, 0x423150
lea eax, [esi + 5]
call fcn.00423170
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00423170
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4231c9
mov dword [0x48ba20], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424700
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424706
ret

Function at 0x426cec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426d3d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426d24
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426d14
jmp 0x426d3d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426d25
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438160
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404734
xor eax, eax
push ebp
push 0x43828e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438261
xor eax, eax
push ebp
push 0x43825a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040454c
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43822f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x43821e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040454c
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404744
mov edx, ebx
pop ecx
call fcn.004028fc
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438225
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x48a2b8]
mov dl, 1
mov eax, dword [0x407c1c]
call fcn.0040ba68
call fcn.00403cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438295
lea eax, [ebp - 4]
call fcn.00404284
ret

Function at 0x43afc4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x43af10
call sub.user32.dll_EnumWindows
ret

Function at 0x43b0e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43b165
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043ab34
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43b10d
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0043a78c
cmp dword [ebp - 4], 0
je 0x43b14f
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404744
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b16c
lea eax, [ebp - 4]
call fcn.00404284
ret
Function at 0x43e4f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x48bbe0], 0
je 0x43e643
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x48a504]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x43e643
mov eax, dword [0x48bbe4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x48bbe0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x43e612
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x48bbe0]
call fcn.0041a2e0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43e60a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43e60a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43e60a
mov eax, dword [ebp - 0x14]
call fcn.00447050
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43e60a
push ebp
call fcn.0043e4b0
pop ecx
test al, al
jne 0x43e60a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x43e5c6
mov eax, dword [ebp - 0x14]
call fcn.00445be4
dec eax
jle 0x43e60a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004036f0
cmp byte [ebp - 1], 0
je 0x43e60a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43e60a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x48bbe4]
call fcn.0043dc78
inc edi
dec ebx
jne 0x43e559
mov eax, dword [0x48bbe4]
cmp dword [eax + 8], 0
jle 0x43e62a
mov eax, dword [0x48bbe4]
call fcn.0043dd08
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43e643
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0043e318
pop ecx
test al, al
jne 0x43e643
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441c40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x441c8c
mov eax, esi
call fcn.004583d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x441c8c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x441c8c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x441dcb
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x441ccc
cmp eax, 0x108
ja 0x441ccc
mov eax, esi
call fcn.004583d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x441dc2
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x441dcb
jmp 0x441dc2
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x441dab
cmp eax, 0x20a
ja 0x441dab
test byte [esi + 0x50], 0x80
jne 0x441cfe
sub eax, 0x203
je 0x441cfb
sub eax, 3
je 0x441cfb
sub eax, 3
jne 0x441cfe
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x441d12
dec eax
je 0x441d27
dec eax
je 0x441d44
dec eax
je 0x441d27
jmp 0x441d4b
mov ecx, ebx
mov eax, dword [0x48a504]
mov eax, dword [eax]
mov edx, esi
call fcn.00461ae0
jmp 0x441dc2
cmp byte [esi + 0x5d], 1
jne 0x441d3d
mov eax, esi
mov si, 0xffed
call fcn.004036f0
jmp 0x441dcb
or word [esi + 0x54], 1
jmp 0x441dc2
and word [esi + 0x54], 0xfffe
jmp 0x441dc2
mov eax, dword [0x48bb9c]
cmp byte [eax + 0x20], 0
je 0x441dc2
mov eax, dword [0x48bb9c]
cmp dword [eax + 0x1c], 0
je 0x441dc2
mov eax, dword [ebx]
mov edx, dword [0x48bb9c]
cmp eax, dword [edx + 0x1c]
jne 0x441dc2
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0045828c
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004036f0
jmp 0x441dcb
cmp eax, 0xb00b
jne 0x441dc2
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00440554
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448676
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x48a664]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x44871f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004409f0
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00441c18
mov eax, dword [esi]
call fcn.0045ec94
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x4485ca
mov eax, dword [esi]
call fcn.0045ec94
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0045eca0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x4485ee
mov eax, dword [esi]
call fcn.0045eca0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045ec88
cmp eax, dword [ebp - 0x18]
jle 0x448604
mov eax, dword [esi]
call fcn.0045ec88
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0045ec7c
cmp eax, dword [ebp - 0xc]
jle 0x44861a
mov eax, dword [esi]
call fcn.0045ec7c
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00447050
push eax
call sub.user32.dll_SetWindowPos
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x4486e1
mov eax, ebx
call fcn.0040454c
cmp eax, 0x64
jge 0x4486e1
cmp dword [0x489b5c], 0
je 0x4486e1
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x4486e1
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x4486a4
mov bl, 2
jmp 0x4486bf
lea edx, [ebp - 0x20]
mov eax, dword [0x48bb9c]
call fcn.0044b7a8
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x4486bd
xor ebx, ebx
jmp 0x4486bf
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x489c64]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00447050
push eax
call dword [0x489b5c]
push 4
mov eax, dword [ebp - 4]
call fcn.00447050
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448726
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x44b8b8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x48a688]
cmp byte [eax + 0xc], 0
je 0x44ba25
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ba1e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48bbf0], 0
jne 0x44b90c
push 0x44ba2c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44ba34
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bbf0], eax
cmp dword [0x489c8c], 0
jne 0x44ba07
push 0x44ba44
call sub.kernel32.dll_LoadLibraryA
mov dword [0x489c8c], eax
cmp dword [0x489c8c], 0
je 0x44ba07
push 0x44ba50
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bbf4], eax
push 0x44ba60
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bbf8], eax
push 0x44ba74
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bbfc], eax
push 0x44ba8c
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc00], eax
push 0x44baa4
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc04], eax
push 0x44bab8
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc08], eax
push 0x44bad0
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc0c], eax
push 0x44bae8
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc10], eax
push 0x44bb04
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc14], eax
push 0x44bb10
mov eax, dword [0x489c8c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48bc18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ba25
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4581fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45824c]
test si, 4
je 0x458210
or bl, 1
test si, 8
je 0x45821a
or bl, 4
test si, 1
je 0x458224
or bl, 8
test si, 2
je 0x45822e
or bl, 0x10
test si, 0x10
je 0x458238
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x458247
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x458250
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x458288]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x458269
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x458278
or bl, 4
test esi, 0x20000000
je 0x458283
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45ea44
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45ea56
add esp, 0xfffffff0
call fcn.00403858
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004220e0
mov eax, dword [0x48a324]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ede8
mov eax, dword [0x48a330]
mov dword [eax + 4], ebx
mov dword [eax], 0x45edf4
mov eax, ebx
call fcn.0045ee00
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417ab0]
call fcn.004034c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417ab0]
call fcn.004034c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417ab0]
call fcn.004034c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417ab0]
call fcn.004034c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417ab0]
call fcn.004034c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45b218
push eax
push 0
push 0
mov eax, dword [0x48a478]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423b34]
call fcn.00425248
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423b34]
call fcn.00425248
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423b34]
call fcn.00425248
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045f268
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f144
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f144
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f144
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45eb93
call fcn.004038b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x460214
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48bc38]
cmp dword [eax + 0x30], 0
je 0x4602be
cmp dword [ebx + 0x94], 0
jne 0x4602b8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4601a4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4602b8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46027e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4602b8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a2e0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46028d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460d84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460db9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404374
jmp 0x460dc6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042d8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x461c58
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461c99
mov eax, esi
call fcn.00447354
test al, al
je 0x461c99
mov eax, dword [ebx + 0x84]
call fcn.00447050
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461c99
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447050
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x465c88
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x465cec
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044fc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408e04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465cf3
lea eax, [ebp - 0xc]
call fcn.00404284
ret