joyce8/EMBER2024-capa huggingface dataset:
Function at 0x610dfc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x610f38
mov eax, dword [0x66464c]
cmp ebx, dword [eax + 0x1bc]
jne 0x610e1c
test dl, dl
je 0x610f38
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x659594]
cmp eax, 0x64
jae 0x610e7c
call sub.kernel32.dll_GetTickCount_1
mov dword [0x659594], eax
cmp dword [0x659598], 2
jle 0x610e67
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x250]
xor edx, edx
call fcn.00454214
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x250]
mov dl, 1
call fcn.00454214
cmp dword [0x659598], 8
jge 0x610f38
inc dword [0x659598]
jmp 0x610e8d
call sub.kernel32.dll_GetTickCount_1
mov dword [0x659594], eax
xor eax, eax
mov dword [0x659598], eax
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov edx, ebx
call fcn.0062ed7c
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x250]
cmp byte [eax + 0x40], 0
jne 0x610ec1
mov eax, dword [0x65a970]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 7
call fcn.0061eda4
mov edx, ebx
mov eax, dword [0x66464c]
call fcn.0055fc6c
push 0
mov eax, dword [0x66464c]
mov eax, dword [eax + 0x1bc]
push eax
call sub.user32.dll_ActivateKeyboardLayout
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp byte [eax + 0x41], 0
je 0x610ef9
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
call fcn.0062ee98
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov edx, ebx
call fcn.0062eb7c
movzx edx, ax
mov eax, dword [0x659d64]
mov eax, dword [eax]
call fcn.005ff168
mov eax, dword [0x65a804]
mov eax, dword [eax]
mov edx, ebx
call fcn.005f1210
mov eax, dword [0x659af8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [0x659580]
call fcn.005ecf64
pop ebx
ret

Function at 0x6122f4
Capabilities:
Get keyboard layout
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x6123e9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x659584], 0
jne 0x61232c
push 0
mov eax, dword [0x65d7f8]
push eax
mov eax, 0x6111c8
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x659584], eax
cmp dword [0x659584], 0
jne 0x61235b
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048c808
push 0
mov eax, dword [0x65d7f8]
push eax
mov eax, 0x6111c8
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x659584], eax
cmp dword [0x659584], 0
jne 0x612391
lea eax, [ebp - 8]
push eax
mov eax, dword [0x65a508]
mov eax, dword [eax]
mov ecx, 0x6123fc
mov edx, 1
call fcn.00637180
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405950
mov eax, dword [ebp - 4]
call fcn.00638b18
call fcn.006127d8
push 0
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x32c]
push eax
call sub.user32.dll_GetWindowThreadProcessId
push eax
call sub.user32.dll_GetKeyboardLayout
mov dl, 1
call fcn.00610dfc
mov dl, 1
mov eax, dword [0x66464c]
call fcn.0055f914
mov byte [0x65957c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6123f0
lea eax, [ebp - 8]
call fcn.00405ea8
lea eax, [ebp - 4]
call fcn.004056ac
ret
Function at 0x61245c
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x659584], 0
je 0x6124c2
call fcn.006127f0
push 0xa
call sub.kernel32.dll_Sleep_2
cmp dword [0x659584], 0
je 0x612489
mov eax, dword [0x659584]
push eax
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x612490
xor eax, eax
mov dword [0x659584], eax
cmp dword [0x659584], 0
jne 0x6124b3
push 0
mov eax, dword [0x65d7f8]
push eax
mov eax, 0x6111c8
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x659584], eax
call fcn.006127d8
mov eax, 0x32
call fcn.0063c044
ret

Function at 0x612608
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x61265f
push 0x24
push 0x612668
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x612659
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x612653
cmp dword [esp + 4], 4
jne 0x612653
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
mov byte [0x65959c], 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x61267c
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov byte [ebp - 1], 0
call fcn.00639a98
test al, al
je 0x612732
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x612732
push 1
push 0x61273c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x612729
mov ebx, 0x1000
mov eax, ebx
call fcn.0040300c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x612719
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x612703
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612720
mov eax, dword [ebp - 0x10]
call fcn.00403028
ret
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x614878
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp byte [ebx + 0x580], 0
jne 0x6148f5
mov eax, dword [ebx + 0x3b8]
cmp byte [eax + 0x40], 0
jne 0x6148f5
cmp byte [ebx + 0x567], 0
je 0x6148ea
call fcn.00639dbc
test al, al
jne 0x6148f5
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x5a0]
cmp eax, 0x1f4
jb 0x6148f5
cmp esi, dword [ebx + 0x5a8]
jne 0x6148e1
cmp edi, dword [ebx + 0x5ac]
jne 0x6148e1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x5a0]
cmp eax, 0x2710
jb 0x6148f5
xor edx, edx
mov eax, ebx
call fcn.00616788
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0061411c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x617218
Capabilities:
Simulate ctrl alt del

Disassembly:
push ecx
call fcn.00639a90
test al, al
je 0x617248
cmp dword [0x664644], 0
je 0x61725e
xor eax, eax
mov dword [esp], eax
mov eax, esp
push eax
push 0
push 0x208
call fcn.00617174
push eax
call dword [0x664644]
pop edx
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call sub.user32.dll_PostMessageA
pop edx
ret
Function at 0x61d188
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61d38b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
lea eax, [ebp - 0x18c]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18c]
mov dword [edx + 0x38], ecx
mov edx, eax
dec edx
test dl, dl
jb 0x61d200
inc edx
lea eax, [ebp - 0x18c]
cmp esi, dword [eax]
jne 0x61d1ed
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x38], esi
cmp dword [eax], 0x4090409
jne 0x61d1f9
mov byte [ebp - 0x11], 0
add eax, 4
dec dl
jne 0x61d1e3
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403c80
mov bl, 1
mov esi, dword [0x659ce0]
movzx eax, bl
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4 + 0x560]
mov edx, dword [esi]
call fcn.00406090
inc ebx
add esi, 4
test bl, bl
jne 0x61d21a
cmp byte [ebp - 0x11], 0
je 0x61d24d
push 0
push 0x61d398
call sub.user32.dll_LoadKeyboardLayoutA
mov dword [ebp - 0x10], eax
jmp 0x61d254
mov dword [ebp - 0x10], 0x4090409
xor eax, eax
push ebp
push 0x61d33b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, ebx
call fcn.0055ada4
test al, al
je 0x61d315
cmp bl, 0x20
je 0x61d315
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
lea edx, [ebp - 0x111]
movzx eax, bl
call fcn.0063b49c
mov edx, eax
lea eax, [ebp - 0x194]
call fcn.00405fd4
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.0040b058
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 4]
call fcn.0040b354
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004061d4
je 0x61d315
mov eax, dword [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x38]
push eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyExA
push eax
call sub.user32.dll_MapVirtualKeyExA
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x61d2f2
mov byte [ebp - 9], bl
movzx eax, byte [ebp - 9]
call fcn.0055ada4
test al, al
je 0x61d315
movzx eax, byte [ebp - 9]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4 + 0x560]
mov edx, dword [ebp - 4]
call fcn.00405ee4
inc ebx
test bl, bl
jne 0x61d264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d342
cmp byte [ebp - 0x11], 0
je 0x61d33a
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_UnloadKeyboardLayout
ret

Function at 0x61d764
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov dword [ebx + 0x44], edx
cmp dword [ebx + 0x44], 1
jne 0x61d77f
push 0x90
call sub.user32.dll_GetKeyState
test ax, ax
je 0x61d794
cmp dword [ebx + 0x44], 2
jne 0x61d7c9
push 0x90
call sub.user32.dll_GetKeyState
test ax, ax
je 0x61d7c9
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
movzx ebx, byte [eax + 0x2a0]
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
xor edx, edx
call fcn.0062cdc0
mov dl, 1
mov ax, 0x90
call fcn.0063af90
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov edx, ebx
call fcn.0062cdc0
pop ebx
ret
Function at 0x61db74
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebx + 0x24]
mov edx, esi
call fcn.00405700
mov eax, dword [0x65a3dc]
cmp byte [eax], 0
jne 0x61dc09
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
xor ecx, ecx
xor edx, edx
call fcn.005fd7ec
mov eax, dword [ebx + 0x24]
call fcn.0040c048
test al, al
je 0x61dbc1
mov eax, dword [ebx + 0x24]
call fcn.00405b58
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 1
setne al
mov ebx, eax
jmp 0x61dbc3
xor ebx, ebx
mov edx, ebx
xor dl, 1
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x390]
call fcn.0046b598
mov edx, ebx
xor dl, 1
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x394]
call fcn.0046b598
test bl, bl
je 0x61dc09
mov eax, dword [0x65a7a8]
mov eax, dword [eax]
mov eax, dword [eax + 0x1d0]
xor edx, edx
call fcn.00461ebc
pop esi
pop ebx
ret

Function at 0x61df8c
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dl, 1
mov eax, dword [0x433ec4]
call fcn.00433fc4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61e010
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004340a0
call fcn.00639aa8
test al, al
je 0x61dfcf
mov eax, dword [ebp - 8]
or dword [eax + 0x18], 0x100
call fcn.00639a90
test al, al
je 0x61dfea
mov edx, 0x61e028
mov eax, dword [ebp - 8]
call fcn.00434a70
mov byte [ebp - 1], al
jmp 0x61dffa
mov edx, 0x61e0a8
mov eax, dword [ebp - 8]
call fcn.00434a70
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e017
mov eax, dword [ebp - 8]
call fcn.00404748
ret
Function at 0x61e360
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x61e59b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x61e5b4
lea edx, [ebp - 0xc]
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048d1dc
push dword [ebp - 0xc]
push 0x61e5b4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405a5c
call fcn.00639a90
test al, al
je 0x61e3d7
mov eax, dword [0x659d80]
cmp byte [eax], 0
jne 0x61e3d7
test bl, bl
je 0x61e3d7
mov eax, esi
call fcn.0061dcac
cmp bl, al
je 0x61e3d7
call fcn.0061e1b0
mov eax, esi
call fcn.0061dcac
cmp bl, al
je 0x61e41d
test bl, bl
je 0x61e40e
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x659d80]
movzx eax, byte [eax]
mov ecx, 0x61e5c0
mov edx, 0x61e5cc
call fcn.0044f230
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00405994
jmp 0x61e42a
lea eax, [ebp - 4]
mov edx, 0x61e5d8
call fcn.00405994
jmp 0x61e42a
lea eax, [ebp - 4]
mov edx, 0x61e5e4
call fcn.00405994
lea eax, [ebp - 4]
mov edx, 0x61e5e4
call fcn.00405994
lea eax, [ebp - 4]
mov edx, 0x61e5f0
call fcn.00405994
mov eax, esi
call fcn.0061e0f4
cmp al, byte [ebp + 0xc]
jne 0x61e475
mov eax, esi
call fcn.0061df8c
cmp al, byte [ebp - 5]
jne 0x61e475
mov eax, esi
call fcn.0061dcac
cmp bl, al
jne 0x61e475
call fcn.0061267c
cmp al, byte [ebp + 8]
je 0x61e578
xor eax, eax
call fcn.00638538
xor eax, eax
push ebp
push 0x61e571
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0061e0f4
cmp al, byte [ebp + 0xc]
jne 0x61e4f1
mov eax, esi
call fcn.0061df8c
cmp al, byte [ebp - 5]
jne 0x61e4f1
call fcn.0061267c
cmp al, byte [ebp + 8]
jne 0x61e4f1
call fcn.00639ab8
test al, al
jne 0x61e4f1
push 1
push 0x61e5f8
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
lea eax, [ebp - 0x14]
call fcn.00632238
lea eax, [ebp - 0x14]
mov edx, 0x61e604
call fcn.00405994
mov eax, dword [ebp - 0x14]
call fcn.00405b58
push eax
push 0x61e5f8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x61e513
lea eax, [ebp - 0x18]
call fcn.00632238
lea eax, [ebp - 0x18]
mov edx, 0x61e604
call fcn.00405994
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00639c64
mov eax, 0x64
call fcn.0063c044
mov edi, 0x15
mov eax, esi
call fcn.0061dcac
cmp bl, al
jne 0x61e54f
mov eax, esi
call fcn.0061e0f4
cmp al, byte [ebp + 0xc]
jne 0x61e54f
mov eax, esi
call fcn.0061df8c
cmp al, byte [ebp - 5]
jne 0x61e54f
call fcn.0061267c
cmp al, byte [ebp + 8]
je 0x61e55c
mov eax, 0x64
call fcn.0063c044
dec edi
jne 0x61e522
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e578
xor eax, eax
call fcn.00638560
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61e5a2
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004056d0
lea eax, [ebp - 4]
call fcn.004056ac
ret
Function at 0x61ecb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405b48
xor eax, eax
push ebp
push 0x61ed88
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x368], 0
jne 0x61eced
cmp byte [ebp + 8], 0
je 0x61ed6d
cmp dword [ebp - 4], 0
je 0x61ed6d
call fcn.00639a90
test al, al
je 0x61ed2b
test bl, bl
jne 0x61ed22
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi + 0x4f0]
cmp eax, dword [esi + 0x528]
jae 0x61ed22
push 0x10
push 0
call sub.winmm.dll_sndPlaySoundA
test eax, eax
je 0x61ed6d
jmp 0x61ed2b
push 0
push 0
call sub.winmm.dll_sndPlaySoundA
mov edx, dword [ebp - 4]
mov eax, 0x61eda0
call fcn.00412714
test eax, eax
jne 0x61ed52
lea eax, [ebp - 8]
call fcn.00632260
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.004059e0
push 1
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
call sub.winmm.dll_sndPlaySoundA
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x4f0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ed8f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056d0
ret
Function at 0x6205f0
Capabilities:
Check internet connectivity via wininet
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x418], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62077d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.00638538
xor eax, eax
push ebp
push 0x620741
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x620737
push 0
push 0
push 0
push 0
push 0x62078c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x620730
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x620719
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x418]
mov eax, dword [ebx + 0x37c]
call fcn.0046b678
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
mov edx, 0x62079c
call fcn.004059e0
mov eax, dword [ebp - 0x414]
call fcn.00405b58
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x620719
xor eax, eax
push ebp
push 0x620712
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x40e]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0xc], 0
je 0x6206fb
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x40e], 0
jmp 0x6206c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620719
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620737
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x620752
mov al, 1
call fcn.00638560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620784
lea eax, [ebp - 0x418]
call fcn.004056ac
lea eax, [ebp - 0x414]
call fcn.004056ac
ret
Function at 0x62a1e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62a454
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x62a436
cmp byte [ebx + 0x2a0], 0
jne 0x62a436
mov eax, 0x62a468
call fcn.0063caf8
push 0
mov cx, 1
xor edx, edx
xor eax, eax
call fcn.0040e1e8
fstp qword [ebp - 8]
wait
call fcn.0040e57c
fsub qword [ebp - 8]
fstp qword [ebx + 0x2c8]
wait
mov byte [ebx + 0x338], 0
mov byte [ebx + 0x2c0], 0
xor eax, eax
mov dword [ebx + 0x350], eax
xor eax, eax
mov dword [ebx + 0x354], eax
call sub.user32.dll_GetForegroundWindow
mov edx, eax
mov eax, ebx
call fcn.0062b470
call fcn.006122f4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x65a508]
mov eax, dword [eax]
mov ecx, 0x62a478
mov edx, 0x1d
call fcn.00637180
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405950
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x5c]
call fcn.00461cd8
mov edx, 8
mov eax, dword [ebx + 0x5c]
call fcn.00461ecc
mov byte [ebx + 0x2a0], 1
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x2a4], eax
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
push eax
call sub.user32.dll_GetKeyboardLayout
mov edx, eax
mov eax, ebx
call fcn.0062ed7c
mov eax, dword [0x659e2c]
mov eax, dword [eax]
call fcn.005d6f28
cmp byte [ebx + 0x2a8], 0
jne 0x62a309
mov eax, dword [0x659e2c]
mov eax, dword [eax]
call fcn.005d61d8
push 0
xor ecx, ecx
mov dl, 1
mov eax, ebx
call fcn.00630630
mov eax, ebx
call fcn.0062ee98
mov eax, dword [0x65a804]
mov eax, dword [eax]
mov eax, dword [eax + 0x3ac]
cmp byte [eax + 0x38], 0
jne 0x62a351
mov eax, dword [0x65a92c]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x62a488
call fcn.00632564
mov edx, eax
mov eax, dword [0x65a804]
mov eax, dword [eax]
call fcn.00484218
mov eax, ebx
call fcn.00631424
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp dword [eax + 0xc0], 0
jne 0x62a39c
mov dl, 1
mov eax, dword [ebx + 0x194]
call fcn.00461da0
mov dl, 1
mov eax, dword [ebx + 0x198]
call fcn.00461da0
mov dl, 1
mov eax, dword [ebx + 0x1b4]
call fcn.00461da0
mov dl, 1
mov eax, dword [ebx + 0x1d0]
call fcn.00461da0
mov dl, 1
mov eax, dword [ebx + 0x1b8]
call fcn.00461da0
mov dl, 1
mov eax, dword [ebx + 0x1bc]
call fcn.00461da0
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp dword [eax + 0xc0], 1
je 0x62a3d3
mov dl, 1
mov eax, dword [ebx + 0x98]
call fcn.00461da0
call fcn.00639ab0
test al, al
je 0x62a416
mov dl, 1
mov eax, dword [ebx + 0x1cc]
call fcn.00454214
mov dl, 1
mov eax, dword [ebx + 0x278]
call fcn.00454214
mov edx, 0x12c
mov eax, dword [ebx + 0x294]
call fcn.00454224
mov edx, 0x12c
mov eax, dword [ebx + 0x298]
call fcn.00454224
mov byte [ebx + 0x2a8], 1
cmp byte [0x659828], 0
je 0x62a436
mov byte [0x659828], 0
xor edx, edx
mov eax, ebx
call fcn.0062e254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62a45b
lea eax, [ebp - 0x10]
call fcn.00405ea8
lea eax, [ebp - 0xc]
call fcn.004056ac
ret
Function at 0x62b928
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 8]
push eax
call fcn.0062b8fc
pop ecx
mov eax, dword [0x65a418]
mov eax, dword [eax]
call fcn.0061426c
test al, al
jne 0x62ba70
mov eax, dword [0x659af8]
mov eax, dword [eax]
call fcn.005ec1a8
test al, al
jne 0x62ba70
mov eax, dword [0x659c44]
mov eax, dword [eax]
call fcn.005ea384
test al, al
jne 0x62ba70
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x65a418]
mov edx, dword [edx]
sub eax, dword [edx + 0x5a0]
cmp eax, 0x64
jbe 0x62ba70
mov eax, dword [0x659c18]
mov byte [eax], 0
call fcn.00610f48
mov eax, dword [0x65a504]
call fcn.004056ac
mov edx, dword [0x65a504]
mov edx, dword [edx]
mov eax, dword [0x659af8]
mov eax, dword [eax]
mov cl, 1
call fcn.005ecf64
mov eax, dword [0x659c44]
mov eax, dword [eax]
call fcn.005e9e88
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x62ba48
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x65a628]
sub eax, dword [edx]
mov edx, dword [0x65a628]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
movzx eax, word [eax + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0xc]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
lea edx, [ebp - 0x18]
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
call fcn.0046af90
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x62ba66
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
call fcn.005faa80
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
xor edx, edx
call fcn.005fafc4
jmp 0x62ba66
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp byte [eax + 0x51d], 0
je 0x62ba66
mov eax, dword [0x65a5f0]
mov eax, dword [eax]
xor edx, edx
call fcn.005fafc4
mov eax, dword [0x664788]
call fcn.00630e64
mov esp, ebp
pop ebp
ret