joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dcac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x42dcbe
add esp, 0xfffffff0
call fcn.00463a64
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00459130
mov eax, ebx
call fcn.0042dff8
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x70], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x42a79c
push eax
push 0
push 0
mov eax, dword [0x47c518]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41be98]
call fcn.0041d3d0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x41be98]
call fcn.0041d3d0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x41be98]
call fcn.0041d3d0
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0042e3d8
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42e2f4
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42e2f4
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x42e2f4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x42ddcd
call fcn.00463abc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x42e0d8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42e283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x42e264
mov dl, 1
mov eax, dword [0x452e28]
call fcn.00463734
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004641d4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x42e253
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00444028
test al, al
je 0x42e246
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x42e294
lea eax, [ebp - 0x254]
call fcn.0045d954
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x42e246
xor eax, eax
push ebp
push 0x42e23f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x42e2cc
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x42e228
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00464404
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x42e228
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00464404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e246
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x42e149
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.004561c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e28a
lea eax, [ebp - 0x260]
call fcn.004641d4
ret

Function at 0x42ead0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x47e4f4]
cmp byte [eax + 0x95], 0
jne 0x42eb41
cmp dword [0x47e510], 0
jne 0x42eb02
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x42ea8c
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x47e510], eax
cmp dword [0x47e50c], 0
jne 0x42eb1d
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x47e50c], eax
cmp dword [0x47e514], 0
jne 0x42eb41
push esp
push 0
push 0
push 0x42ea30
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x47e514], eax
pop edx
ret
Function at 0x42ec38
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42ec4f
add esp, 0xfffffff0
call fcn.00463a64
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00459130
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x452a24]
call fcn.00463734
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41c828]
call fcn.004239ec
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x42edc4
mov eax, dword [0x47c6ac]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423dbc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x430760
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47c6ac]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0045fe64
test eax, eax
je 0x42ed42
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0045d2f4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0045fe8c
test eax, eax
je 0x42ed56
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00464404
mov eax, dword [0x47c6b0]
cmp byte [eax], 0
jne 0x42ed87
mov eax, ebx
call fcn.0042eeb0
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x42edb9
call fcn.00463abc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f120
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47e4f4]
cmp dword [eax + 0x24], 0
je 0x42f1c3
cmp dword [ebx + 0x84], 0
jne 0x42f1bd
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x42f0b0
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x42f1bd
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x42f186
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x42f1bd
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004541a0
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x42f195
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x42fbd0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x42fc05
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004642bc
jmp 0x42fc0f
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00464228
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x430ad4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x430b0c
mov eax, esi
call fcn.0043fd8c
test al, al
je 0x430b0c
mov eax, dword [ebx + 0x74]
call fcn.0043fa90
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x430b0c
push 0
mov eax, dword [ebx + 0x74]
call fcn.0043fa90
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x437754
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x47e590], 0
sete dl
or al, dl
jne 0x437894
mov eax, dword [0x47e594]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x47e590]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x437863
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x47e590]
call fcn.004541a0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43785b
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x43785b
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x43785b
mov eax, dword [ebp - 0x14]
call fcn.0043fa90
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x43785b
push ebp
call fcn.00437710
pop ecx
test al, al
jne 0x43785b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x437817
mov eax, dword [ebp - 0x14]
call fcn.0043e41c
dec eax
jle 0x43785b
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00463940
cmp byte [ebp - 1], 0
je 0x43785b
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x43785b
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47e594]
call fcn.00436f5c
inc edi
dec esi
jne 0x4377aa
mov eax, dword [0x47e594]
cmp dword [eax + 8], 0
jle 0x43787b
mov eax, dword [0x47e594]
call fcn.00436fec
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x437894
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00437578
pop ecx
test al, al
jne 0x437894
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d428
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43d459
je 0x43d4b3
sub eax, 7
je 0x43d47a
dec eax
je 0x43d4a4
sub eax, 0x17
je 0x43d558
jmp 0x43d596
add eax, 0xffffff00
sub eax, 9
jb 0x43d544
add eax, 0xffffff09
sub eax, 0xb
jb 0x43d50c
jmp 0x43d596
mov eax, ebx
call fcn.0042781c
mov edi, eax
test edi, edi
je 0x43d5f6
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x43d5ff
jmp 0x43d5f6
test byte [ebx + 0x44], 0x20
jne 0x43d5ff
jmp 0x43d5f6
mov edx, esi
mov eax, ebx
call fcn.0043aa28
cmp dword [esi + 0xc], 0xffffffff
jne 0x43d5ff
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.0045ad84
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0043955c
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043d300
test eax, eax
je 0x43d5ff
mov dword [esi + 0xc], 1
jmp 0x43d5ff
mov edx, esi
mov eax, ebx
call fcn.0043d394
test al, al
je 0x43d5f6
cmp dword [esi + 0xc], 0
jne 0x43d5ff
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0043fa90
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x43d5ff
mov eax, ebx
call fcn.0043a0c4
test al, al
jne 0x43d5ff
jmp 0x43d5f6
mov eax, ebx
call fcn.0043fa90
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x43d5f6
cmp dword [0x478a20], 0
je 0x43d5f6
mov eax, dword [0x478a20]
cmp ebx, dword [eax + 0x24]
jne 0x43d5f6
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x478a20]
call fcn.0043a95c
jmp 0x43d5f6
mov eax, dword [0x47e558]
cmp byte [eax + 0x20], 0
je 0x43d5f6
mov eax, dword [0x47e558]
cmp dword [eax + 0x1c], 0
je 0x43d5f6
mov eax, dword [esi]
mov edx, dword [0x47e558]
cmp eax, dword [edx + 0x1c]
jne 0x43d5f6
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00427760
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00463940
jmp 0x43d5ff
mov edx, esi
mov eax, ebx
call fcn.0043aa28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dac0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43dadc
cmp dword [esi + 4], 0
je 0x43db09
test byte [ebx + 0x45], 1
jne 0x43dafb
mov eax, ebx
call fcn.0043c9f8
test eax, eax
jne 0x43dafb
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43dc19
mov edx, esi
mov eax, ebx
call fcn.0043d738
jmp 0x43dc19
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43dc12
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043fa90
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043a95c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043dac0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043fa90
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc19
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448774
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44884c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47e5dc], 0
jne 0x448830
lea eax, [ebp - 4]
mov edx, 0x448864
call fcn.0046426c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00464618
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x448830
mov eax, ebx
call fcn.00463044
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x448829
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x448813
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x448874
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x448813
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x47e5dc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448830
mov eax, dword [ebp - 0xc]
call fcn.0046305c
ret
mov ebx, dword [0x47e5dc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448853
lea eax, [ebp - 4]
call fcn.004641d4
ret

Function at 0x45198c
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x47e600], 0
jne 0x4519af
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x451910
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x47e600], eax
ret

Function at 0x45ea14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45ea4d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004642bc
jmp 0x45ea56
mov eax, ebx
mov edx, esi
call fcn.00464228
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45ea60
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x45ea81
mov al, byte [esp]
jmp 0x45ea83
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x463288
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4632b7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004642bc
jmp 0x4632d5
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00463210
mov edi, eax
test ebx, ebx
je 0x4632d5
cmp dword [esi], 0
je 0x4632d5
dec ebx
jmp 0x4632be
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x4635dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x478e2c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x463674
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x463654
xor eax, eax
push ebp
push 0x46364d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x463690
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463654
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x478e2c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x478e2c], ax
mov esp, ebp
pop ebp
ret
Function at 0x46574c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x465908
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4657ad
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x465924
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46581f
xor eax, eax
push ebp
push 0x465818
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004655a4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x465801
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x465944
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46581f
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x465900
cmp byte [ebp - 0xd], 0
jne 0x465861
cmp byte [ebp - 0x12], 0
je 0x465900
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x46587a
dec ebx
cmp byte [ebx], 0x2e
je 0x465889
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x465879
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x465900
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4658b6
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x465900
cmp byte [ebp - 0xd], 0
je 0x465900
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x465900
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465cf4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x465ddc
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x47ec44], 1
jae 0x465dce
xor eax, eax
mov dword [0x47e850], eax
xor eax, eax
mov dword [0x47e858], eax
xor eax, eax
mov dword [0x47e85c], eax
mov byte [0x47e862], 2
mov byte [0x47e863], 2
mov byte [0x47e864], 3
mov word [0x47ec0c], 0
mov word [0x47ec1c], 1
mov word [0x47ec2c], 0xa
mov dword [0x47ec34], 0x80020004
mov dword [0x47ec00], 0x464ee0
mov dword [0x47ec04], 0x464ed8
mov dword [0x47ec08], 0x464ee0
call fcn.004635ac
test al, al
je 0x465d8d
call fcn.004635dc
call fcn.004636a0
mov eax, 0x47e868
mov edx, 0x465de8
call fcn.00460d82
mov eax, 0x47ea34
mov edx, 0x465de8
call fcn.00460d82
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x47e848], eax
call fcn.00461d00
mov dword [0x47e844], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x47e83c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465de3
ret

Function at 0x467a3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x467a58
call fcn.00468edc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x467a74
test bl, 1
je 0x467a74
call fcn.0046cc60
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret