joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fef0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450029
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x422bac]
call fcn.00422cac
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44ffff
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00422d4c
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405724
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x450040
call fcn.004057c0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00422ed4
lea ecx, [ebp - 4]
mov edx, 0x45007c
mov eax, dword [ebp - 0xc]
call fcn.00423148
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0041022c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x44ffe2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x450088
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x472de8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ffe9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret

Function at 0x4500d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov bl, byte [esp + 4]
test bx, bx
je 0x45011c
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4500ff
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450110
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x45011c
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x453ad8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
mov edi, eax
test bl, bl
je 0x453af9
test edi, 0x40000
je 0x453b0f
test bl, bl
jne 0x453b8e
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x453b8e
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
mov al, byte [esp + 1]
or al, byte [esp + 2]
je 0x453b41
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x453b56
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
jmp 0x453b65
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongA
mov al, byte [esp]
and al, byte [esp + 1]
jne 0x453b75
cmp byte [esp + 2], 0
je 0x453b8e
cmp byte [esp + 2], 0
je 0x453b86
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x453b8e
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x453e48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x453e6e
mov eax, esp
push eax
push 0x453e10
call sub.user32.dll_EnumWindows
jmp 0x453e81
mov eax, esp
push eax
push 0x453df0
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
mov al, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x453f0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x453f5c]
test si, 4
je 0x453f20
or bl, 1
test si, 8
je 0x453f2a
or bl, 4
test si, 1
je 0x453f34
or bl, 8
test si, 2
je 0x453f3e
or bl, 0x10
test si, 0x10
je 0x453f48
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453f57
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x453f60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x453f98]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453f79
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x453f88
or bl, 4
test esi, 0x20000000
je 0x453f93
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45c1d4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45c1e6
add esp, 0xfffffff0
call fcn.0040499c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421710
mov eax, dword [0x4791c0]
mov dword [eax + 4], ebx
mov dword [eax], 0x45c578
mov eax, dword [0x4791cc]
mov dword [eax + 4], ebx
mov dword [eax], 0x45c584
mov eax, ebx
call fcn.0045c590
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x419518]
call fcn.0040464c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x419518]
call fcn.0040464c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x419518]
call fcn.0040464c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x419518]
call fcn.0040464c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x419518]
call fcn.0040464c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x457840
push eax
push 0
push 0
mov eax, dword [0x47933c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423a24]
call fcn.00424f64
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423a24]
call fcn.00424f64
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423a24]
call fcn.00424f64
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045ca60
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c928
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c928
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45c928
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c323
call fcn.004049f4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45c70c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c8b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45c898
mov dl, 1
mov eax, dword [0x41993c]
call fcn.0040464c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004054b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45c887
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00446d2c
test al, al
je 0x45c87a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45c8c8
lea eax, [ebp - 0x254]
call fcn.0040bee8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45c87a
xor eax, eax
push ebp
push 0x45c873
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45c900
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45c85c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405724
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45c85c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c87a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45c77d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041d610
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c8be
lea eax, [ebp - 0x260]
call fcn.004054b4
ret

Function at 0x45d230
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47ef70]
cmp byte [eax + 0xad], 0
jne 0x45d2a1
cmp dword [0x47ef8c], 0
jne 0x45d262
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x45d1ec
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x47ef8c], eax
cmp dword [0x47ef88], 0
jne 0x45d27d
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x47ef88], eax
cmp dword [0x47ef90], 0
jne 0x45d2a1
push esp
push 0
push 0
push 0x45d190
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x47ef90], eax
pop edx
ret
Function at 0x45da84
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45db23
cmp dword [ebx + 0x94], 0
jne 0x45db1d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45da0c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45db1d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45dae3
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45db1d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b8cc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45daf2
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45dd3c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x47ef70]
cmp dword [eax + 0x30], 0
je 0x45de99
test bl, bl
jne 0x45ddea
cmp dword [esi + 0x9c], 0
jne 0x45dddf
mov eax, esi
call fcn.00460674
push eax
push 0x45dc68
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45ddb0
mov eax, dword [0x47ef70]
call fcn.00460884
test al, al
je 0x45ddb0
mov eax, dword [0x47ef94]
call fcn.00406500
mov edi, eax
cmp edi, 0
jl 0x45ddb0
push 0
mov eax, dword [0x47ef94]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45dd9a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45dddf
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b8cc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45ddbf
inc dword [esi + 0x9c]
jmp 0x45de99
cmp dword [esi + 0x9c], 0
jle 0x45de99
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45de99
cmp dword [esi + 0x44], 0
je 0x45de45
mov eax, dword [0x47ef70]
call fcn.00460884
test al, al
je 0x45de45
mov eax, dword [0x47ef94]
call fcn.00406500
mov edi, eax
cmp edi, 0
jl 0x45de45
push 5
mov eax, dword [0x47ef94]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45de2f
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45de74
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041b8cc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45de54
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x47ef94
mov ecx, 1
mov edx, dword [0x45dc48]
call fcn.004066d4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45e980
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45e9d8
mov eax, ebx
call fcn.00460884
test al, al
jne 0x45e9d8
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004055a4
mov eax, dword [esi]
call fcn.00405774
test eax, eax
jne 0x45e9e5
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405508
jmp 0x45e9e5
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405508
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45fe5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45feca
mov eax, esi
call fcn.004419f4
test al, al
je 0x45feca
mov eax, dword [ebx + 0x84]
call fcn.00441654
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45feca
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45febe
push 0
mov eax, dword [ebx + 0x84]
call fcn.00441654
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00439644
jmp 0x45feca
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045fca8
pop esi
pop ebx
ret
Function at 0x46e86c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea eax, [ebp - 0x160]
mov edx, dword [0x409ea0]
call fcn.00405e24
xor eax, eax
push ebp
push 0x46ea7d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x46ea41
mov eax, ebx
mov edx, 0x46ea94
call fcn.004058c0
je 0x46ea41
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0046ed78
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
or ebx, 0xffffffff
lea eax, [ebp - 0x164]
mov ecx, 0x46eaa0
mov edx, dword [ebp - 8]
call fcn.004057c0
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.0040b5b4
mov esi, eax
test esi, esi
jne 0x46ea36
mov eax, dword [ebp - 0x154]
mov edx, 0x46eaac
call fcn.004058c0
je 0x46ea21
mov eax, dword [ebp - 0x154]
mov edx, 0x46eab8
call fcn.004058c0
je 0x46ea21
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405724
cmp dword [ebp - 0x168], 0
je 0x46e982
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405724
mov ecx, dword [ebp - 0x16c]
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004057c0
jmp 0x46e993
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.004057c0
test dword [ebp - 0x158], 1
jle 0x46e9ba
dec dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
push eax
mov eax, dword [ebp - 4]
call fcn.00405974
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test dword [ebp - 0x158], 0x10
jle 0x46e9d8
mov eax, dword [ebp - 4]
call fcn.0046e86c
mov eax, dword [ebp - 4]
call fcn.0040b80c
jmp 0x46e9e0
mov eax, dword [ebp - 4]
call fcn.0040b644
mov edx, 0x3e8
mov eax, edi
call fcn.0046ee68
test al, al
je 0x46ea21
cmp bl, 0xff
jne 0x46ea0a
call sub.KERNEL32.DLL_GetCurrentThreadId
mov edx, dword [0x479554]
cmp eax, dword [edx]
je 0x46ea08
mov bl, 1
jmp 0x46ea0a
xor ebx, ebx
test bl, bl
jne 0x46ea1a
mov eax, dword [0x4793c4]
mov eax, dword [eax]
call fcn.0045edcc
push 0
call sub.KERNEL32.DLL_Sleep
lea eax, [ebp - 0x160]
call fcn.0040b604
mov esi, eax
test esi, esi
je 0x46e914
lea eax, [ebp - 0x160]
call fcn.0040b628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ea84
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004054d8
lea eax, [ebp - 0x160]
mov edx, dword [0x409ea0]
call fcn.00405ee8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054d8
ret
Function at 0x46ead8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff8c
mov ebp, ecx
mov edi, edx
mov ebx, eax
lea esi, [esp + 4]
lea eax, [esp + 0x20]
xor ecx, ecx
mov edx, 0x44
call fcn.00403e40
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 0x41
mov word [esp + 0x50], di
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x46eba5
call sub.KERNEL32.DLL_GetCurrentThreadId
mov edx, dword [0x479554]
cmp eax, dword [edx]
setne bl
test bl, bl
jne 0x46eb71
jmp 0x46eb5f
cmp dword [esi + 4], 0x12
jne 0x46eb53
mov eax, dword [esi + 8]
call fcn.0040549c
push esi
call sub.user32.dll_TranslateMessage
push esi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x46eb45
push 1
call sub.KERNEL32.DLL_Sleep
push esp
mov eax, dword [esp + 0x68]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [esp], 0x103
je 0x46eb3f
mov eax, dword [esp + 0x68]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp + 0x64]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp]
jmp 0x46ebaa
call sub.KERNEL32.DLL_GetLastError
add esp, 0x74
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46ee98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp dword [ebx], 0
jne 0x46eeae
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx], eax
mov dl, 1
jmp 0x46eed4
call sub.KERNEL32.DLL_GetTickCount
cmp eax, dword [ebx]
jae 0x46eec5
or edx, 0xffffffff
sub edx, dword [ebx]
add edx, eax
cmp esi, edx
setb dl
jmp 0x46eece
mov edx, eax
sub edx, dword [ebx]
cmp esi, edx
setb dl
test dl, dl
je 0x46eed4
mov dword [ebx], eax
mov eax, edx
pop esi
pop ebx
ret
Function at 0x46eedc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x46efc8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
mov eax, edi
call fcn.00405974
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46ef51
push 0
push 0x8000000
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00407204
mov eax, dword [ebp - 0xc]
call fcn.00405cf0
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46efaa
test esi, esi
jne 0x46ef64
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
test esi, esi
jbe 0x46ef9a
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00405b00
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.004059cc
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
cmp esi, dword [ebp - 8]
je 0x46efa2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405b00
jmp 0x46efa2
mov eax, dword [ebp - 4]
call fcn.004054b4
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x46efb2
mov eax, dword [ebp - 4]
call fcn.004054b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46efcf
lea eax, [ebp - 0xc]
call fcn.00405b94
ret
Function at 0x4706a8
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4706b0
push ecx
push ebx
mov eax, 0x470430
call fcn.004075d8
xor eax, eax
push ebp
push 0x47084b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004037e8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040b6e4
mov edx, dword [ebp - 0x14]
mov eax, 0x47f61c
call fcn.00405508
push 0x47f620
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov eax, 0x47f618
mov edx, 0x47f620
mov ecx, 0x105
call fcn.00405724
lea edx, [ebp - 0x1c]
mov eax, dword [0x47f618]
call fcn.0046ed78
mov edx, dword [ebp - 0x1c]
mov eax, 0x47f618
call fcn.00405508
mov eax, dword [0x47f61c]
mov edx, dword [0x47f618]
call fcn.004058c0
je 0x470800
call fcn.00403850
push dword [0x47f618]
mov eax, 0xffffff
call fcn.00403edc
lea ecx, [ebp - 0x20]
mov edx, 6
call fcn.0040b154
push dword [ebp - 0x20]
push 0x470860
mov eax, 0x47f61c
mov edx, 3
call fcn.00405834
push 0
mov eax, dword [0x47f61c]
call fcn.00405974
mov ebx, eax
push ebx
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.004037e8
mov eax, dword [ebp - 0x24]
call fcn.00405974
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, 0x47f728
xor ecx, ecx
mov edx, 0x44
call fcn.00403e40
mov dword [0x47f728], 0x44
mov dword [0x47f754], 0x41
mov word [0x47f758], 1
push 0x47f76c
push 0x47f728
mov eax, dword [0x47f618]
call fcn.00405974
push eax
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
call fcn.004053bc
mov eax, dword [0x4793c4]
mov eax, dword [eax]
call fcn.0045eef0
mov ecx, dword [0x4794c4]
mov eax, dword [0x4793c4]
mov eax, dword [eax]
mov edx, dword [0x46f538]
call fcn.0045ef08
mov eax, dword [0x4793c4]
mov eax, dword [eax]
call fcn.0045f02c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470852
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004054d8
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.090a8fc5
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.090a8fc5
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.090a8fc5
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.090a8fc5
call fcn.09006fcf
ret