joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443a4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x489c44], 0
je 0x443b95
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x484c6c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x443b95
mov eax, dword [0x489c48]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x489c44]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x443b64
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x489c44]
call fcn.0041b128
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x443b5c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x443b5c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x443b5c
mov eax, dword [ebp - 0x14]
call fcn.0044e340
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x443b5c
push ebp
call fcn.00443a08
pop ecx
test al, al
jne 0x443b5c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403d30
test al, al
je 0x443b5c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403d30
cmp byte [ebp - 1], 0
je 0x443b5c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x443b5c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x489c48]
call fcn.00443178
inc edi
dec ebx
jne 0x443ab1
mov eax, dword [0x489c48]
cmp dword [eax + 8], 0
jle 0x443b7c
mov eax, dword [0x489c48]
call fcn.00443230
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x443b95
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044386c
pop ecx
test al, al
jne 0x443b95
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b214
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406ce4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00445dd4
test ebx, ebx
jne 0x44b267
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0044b150
mov ebx, eax
test ebx, ebx
je 0x44b352
cmp esi, ebx
je 0x44b290
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x44b2a5
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x44b2dd
add eax, 0xffffff5f
sub eax, 2
jb 0x44b2f5
dec eax
sub eax, 2
jb 0x44b309
dec eax
sub eax, 2
jb 0x44b2ff
jmp 0x44b313
add eax, 0xfffffdff
sub eax, 2
jb 0x44b2f5
dec eax
sub eax, 2
jb 0x44b309
dec eax
sub eax, 2
jb 0x44b2ff
jmp 0x44b313
mov byte [esp + 0x120], 0
jmp 0x44b31b
mov byte [esp + 0x120], 2
jmp 0x44b31b
mov byte [esp + 0x120], 1
jmp 0x44b31b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00459f24
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00447580
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x44b354
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45379c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x484e70]
cmp byte [eax + 0xc], 0
je 0x453909
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453902
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x489c54], 0
jne 0x4537f0
push 0x453910
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x453918
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c54], eax
cmp dword [0x482740], 0
jne 0x4538eb
push 0x453928
call sub.kernel32.dll_LoadLibraryA
mov dword [0x482740], eax
cmp dword [0x482740], 0
je 0x4538eb
push 0x453934
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c58], eax
push 0x453944
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c5c], eax
push 0x453958
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c60], eax
push 0x453970
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c64], eax
push 0x453988
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c68], eax
push 0x45399c
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c6c], eax
push 0x4539b4
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c70], eax
push 0x4539cc
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c74], eax
push 0x4539e8
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c78], eax
push 0x4539f4
mov eax, dword [0x482740]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x489c7c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453909
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x459a68
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x459a89
test edi, 0x40000
je 0x459aa3
test bl, bl
jne 0x459b24
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x459b24
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x459ad6
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x459aeb
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x459afa
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x459b0b
cmp byte [esp + 2], 0
je 0x459b24
cmp byte [esp + 2], 0
je 0x459b1c
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x459b24
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x459dc8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x459dee
mov eax, esp
push eax
push 0x459d90
call sub.user32.dll_EnumWindows
jmp 0x459e01
mov eax, esp
push eax
push 0x459d70
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x459e8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x459ee0]
test si, 4
je 0x459ea1
or bl, 1
test si, 8
je 0x459eab
or bl, 4
test si, 1
je 0x459eb5
or bl, 8
test si, 2
je 0x459ebf
or bl, 0x10
test si, 0x10
je 0x459ec9
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x459ed8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x459ee4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x459f20]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x459efe
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x459f0d
or bl, 4
test esi, 0x20000000
je 0x459f18
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x461f8c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x461f9e
add esp, 0xfffffff0
call fcn.00403e40
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042110c
mov eax, dword [0x4849d4]
mov dword [eax + 4], ebx
mov dword [eax], 0x462330
mov eax, dword [0x4849e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x46233c
mov eax, ebx
call fcn.00462348
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45d7f0
push eax
push 0
push 0
mov eax, dword [0x484bc4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x428558]
call fcn.00429a78
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x428558]
call fcn.00429a78
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x428558]
call fcn.00429a78
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004627c0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x462690
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x462690
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x462690
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4620db
call fcn.00403e98
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x462474
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46261f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x462600
mov dl, 1
mov eax, dword [0x419120]
call fcn.00403b04
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404968
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4625ef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00453af8
test al, al
je 0x4625e2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x462630
lea eax, [ebp - 0x254]
call fcn.00409a68
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4625e2
xor eax, eax
push ebp
push 0x4625db
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x462668
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4625c4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404bd8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4625c4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4625e2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4624e5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041ce80
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462626
lea eax, [ebp - 0x260]
call fcn.00404968
ret

Function at 0x462f98
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x489c98]
cmp byte [eax + 0xad], 0
jne 0x463009
cmp dword [0x489cb4], 0
jne 0x462fca
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x462f54
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x489cb4], eax
cmp dword [0x489cb0], 0
jne 0x462fe5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x489cb0], eax
cmp dword [0x489cb8], 0
jne 0x463009
push esp
push 0
push 0
push 0x462ef8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x489cb8], eax
pop edx
ret
Function at 0x46320c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x463223
add esp, 0xfffffff0
call fcn.00403e40
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042110c
mov eax, dword [0x484bac]
cmp word [eax + 2], 0
jne 0x46324b
mov eax, dword [0x484bac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464d14
mov eax, dword [0x484c94]
cmp word [eax + 2], 0
jne 0x463265
mov eax, dword [0x484c94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464f20
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x418cfc]
call fcn.00403b04
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x428d34]
call fcn.0042ecc0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x46341c
mov eax, dword [0x484a5c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f094
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4655e4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x484a5c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d384
test eax, eax
je 0x46336c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409420
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d3b8
test eax, eax
je 0x463380
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404bd8
mov byte [ebx + 0xd4], 0
push ebx
push 0x4649e0
call fcn.00422288
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4848e0]
cmp byte [eax], 0
jne 0x4633d1
mov eax, ebx
call fcn.00463560
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004657f8
mov eax, ebx
call fcn.0046635c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x463411
call fcn.00403e98
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4637e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46387f
cmp dword [ebx + 0x94], 0
jne 0x463879
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x463768
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x463879
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46383f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x463879
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b128
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46384e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x463a98
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x489c98]
cmp dword [eax + 0x30], 0
je 0x463bf5
test bl, bl
jne 0x463b46
cmp dword [esi + 0x9c], 0
jne 0x463b3b
mov eax, esi
call fcn.004661d8
push eax
push 0x4639c4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x463b0c
mov eax, dword [0x489c98]
call fcn.004668b8
test al, al
je 0x463b0c
mov eax, dword [0x489cbc]
call fcn.00405c60
mov edi, eax
cmp edi, 0
jl 0x463b0c
push 0
mov eax, dword [0x489cbc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x463af6
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x463b3b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b128
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x463b1b
inc dword [esi + 0x9c]
jmp 0x463bf5
cmp dword [esi + 0x9c], 0
jle 0x463bf5
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x463bf5
cmp dword [esi + 0x44], 0
je 0x463ba1
mov eax, dword [0x489c98]
call fcn.004668b8
test al, al
je 0x463ba1
mov eax, dword [0x489cbc]
call fcn.00405c60
mov edi, eax
cmp edi, 0
jl 0x463ba1
push 5
mov eax, dword [0x489cbc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x463b8b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x463bd0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b128
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x463bb0
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x489cbc
mov ecx, 1
mov edx, dword [0x4639a4]
call fcn.00405e14
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4646dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x464746
mov eax, ebx
call fcn.004668b8
test al, al
jne 0x464746
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a58
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x464733
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x464753
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049bc
jmp 0x464753
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049bc
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4659dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x465a4a
mov eax, esi
call fcn.0044e6e0
test al, al
je 0x465a4a
mov eax, dword [ebx + 0x84]
call fcn.0044e340
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x465a4a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x465a3e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044e340
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004461bc
jmp 0x465a4a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00465818
pop esi
pop ebx
ret
Function at 0x46830c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x46839d
movzx ebx, byte [ebx + 0x482a10]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x482910]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x482910]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x482a10]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jb 0x4683f7
movzx ebx, byte [ebx + 0x482a10]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x482a10]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x482910]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x482910]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x482910]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x482910]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x489cd0]
movzx ecx, byte [ecx + 0x482a10]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x482910]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x48a0d0]
movzx eax, byte [eax + 0x482910]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x482a10]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x48a4d0]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x482a10]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x482a10]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x48a8d0]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4684b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
movzx ecx, cl
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jb 0x4684c1
pop esi
pop ebx
ret
Function at 0x469270
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], pe_nt_image_headers32
mov esi, 0x482910
mov ebx, 0x489cd0
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.004681f4
mov dword [esp + 8], eax
mov eax, edi
call fcn.00468204
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.004681f4
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.00468204
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x469289
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret