joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429c84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ec
push ebx
push esi
mov dword [ebp - 0x814], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404a3c
xor eax, eax
push ebp
push 0x429da0
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x429cbb
mov esi, dword [ebp - 0x814]
push ebp
call fcn.00429a88
pop ecx
push ebp
mov eax, dword [ebp + 0xc]
call fcn.00429bf4
pop ecx
mov edx, dword [ebp + 0x10]
dec edx
test edx, edx
jl 0x429d8a
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x810]
inc ecx
and ecx, 0x800000ff
jns 0x429cf2
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x810], ecx
mov ecx, dword [ebp - 0x810]
mov ecx, dword [ebp + ecx*4 - 0x808]
mov ebx, ecx
add ebx, dword [ebp - 0x80c]
and ebx, 0x800000ff
jns 0x429d1d
dec ebx
or ebx, 0xffffff00
inc ebx
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x80c]
mov ecx, dword [ebp + ecx*4 - 0x808]
mov ebx, dword [ebp - 0x810]
mov dword [ebp + ebx*4 - 0x808], ecx
mov ebx, dword [ebp - 0x80c]
mov ecx, dword [ebp - 8]
mov dword [ebp + ebx*4 - 0x808], ecx
mov ebx, dword [ebp - 0x810]
mov ebx, dword [ebp + ebx*4 - 0x808]
add ebx, ecx
and ebx, 0x800000ff
jns 0x429d6f
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, byte [ebp + ebx*4 - 0x808]
mov ebx, dword [ebp - 0x814]
xor cl, byte [ebx + eax]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x429cdb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429da7
lea eax, [ebp - 4]
call fcn.0040457c
ret

Function at 0x42a150
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42a226
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x42a210
push 0
push 0
push ebp
lea eax, [ebp - 8]
call fcn.00429fe4
pop ecx
mov eax, dword [ebp - 8]
call fcn.00404a4c
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a4c
push eax
push 0
mov eax, dword [0x46b5d8]
push eax
push 0x10
push 0xf01ff
mov eax, edi
call fcn.00404a4c
push eax
mov eax, esi
call fcn.00404a4c
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
test eax, eax
je 0x42a1dd
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x42a20a
push 0x42a240
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x46c288]
mov eax, dword [eax]
mov ecx, 1
mov edx, 0x42a264
call fcn.00429918
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a22d
lea eax, [ebp - 8]
call fcn.0040457c
ret
Function at 0x42a26c
Capabilities:
Delete service
Query service status

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x42a2f5
push 0x10004
mov eax, esi
call fcn.00404a4c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x42a2ef
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x42a2e9
cmp dword [esp + 4], 1
jne 0x42a2e9
push esi
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x42a2e9
push 0x42a304
call sub.kernel32.dll_GetLastError_1
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [0x46c288]
mov eax, dword [eax]
mov ecx, 2
mov edx, 0x42a328
call fcn.00429918
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x42e3d8
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x42e3e1
mov eax, dword [ebp - 4]
add esp, 0xfffffc90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4374], edx
mov dword [ebp - 0x4370], edx
mov dword [ebp - 0x436c], edx
mov dword [ebp - 0x4368], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42e5cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041a104
lea edi, [ebp - 0x4008]
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 8]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x42e5ad
test edi, edi
je 0x42e5ad
mov eax, dword [edi + 0x1a0]
cmp eax, 6
je 0x42e468
cmp eax, 0x47
je 0x42e468
mov edi, dword [edi]
jmp 0x42e5a5
mov eax, dword [edi + 0x19c]
mov dword [ebp - 0x4164], eax
lea eax, [ebp - 0x4364]
push eax
call sub.iphlpapi.dll_GetIfEntry
test eax, eax
lea esi, [edi + 0x1d4]
test esi, esi
je 0x42e4d2
lea eax, [ebp - 0x4368]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.004047fc
cmp dword [ebp - 0x4368], 0
je 0x42e4cc
lea eax, [ebp - 0x436c]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.004047fc
mov edx, dword [ebp - 0x436c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, dword [esi]
test esi, esi
jne 0x42e48c
lea esi, [edi + 0x1ac]
test esi, esi
je 0x42e5a3
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x42df58]
call fcn.00419dbc
mov ebx, eax
lea edx, [ebx + 0x1c]
lea eax, [edi + 0x194]
mov ecx, 6
call fcn.0040297c
mov eax, dword [edi + 0x19c]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x10]
lea edx, [edi + 8]
mov ecx, 0x104
call fcn.004047fc
lea eax, [ebx + 0xc]
lea edx, [edi + 0x10c]
mov ecx, 0x84
call fcn.004047fc
lea eax, [ebp - 0x4370]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.004047fc
mov edx, dword [ebp - 0x4370]
mov eax, dword [0x46b704]
call fcn.0042e8ac
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x4374]
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.004047fc
mov edx, dword [ebp - 0x4374]
mov eax, dword [0x46b704]
call fcn.0042e8ac
mov dword [ebx + 0x24], eax
mov byte [ebx + 0x23], 1
cmp dword [ebp - 0x4144], 5
sete al
mov byte [ebx + 0x22], al
mov byte [ebx + 0x28], 0
mov byte [ebx + 0x29], 0
mov byte [ebx + 0x2a], 0
mov esi, dword [esi]
test esi, esi
jne 0x42e4e0
mov edi, dword [edi]
test edi, edi
jne 0x42e451
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e5d2
lea eax, [ebp - 0x4374]
mov edx, 4
call fcn.004045a0
ret

Function at 0x42e5dc
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
add esp, 0x190
ret
Function at 0x42ea7c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x42eab3
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x42eaa9
or edi, 0xffffffff
jmp 0x42eab3
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x42ea91
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x42eac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x42eaf7
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x42eaed
or edi, 0xffffffff
jmp 0x42eaf7
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x42ead5
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x42eb6c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
mov ebx, edx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
setne al
pop ebx
ret

Function at 0x42f0a8
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
inc esi
je 0x42f1a2
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
mov dword [esp], 0x10000
push 4
lea eax, [esp + 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00403038
mov word [esp + 4], 2
mov eax, dword [ebx + 4]
test eax, eax
je 0x42f14a
mov eax, dword [eax + 0x18]
mov dword [esp + 8], eax
jmp 0x42f150
xor eax, eax
mov dword [esp + 8], eax
mov ax, word [ebx + 0xc]
push eax
call sub.wsock32.dll_htons
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x42f189
mov eax, dword [0x46c298]
mov eax, dword [eax]
mov edx, dword [ebx + 8]
call fcn.0042e5f8
mov dword [ebx + 8], 0xffffffff
mov eax, dword [ebx + 4]
test eax, eax
je 0x42f1a2
mov ecx, dword [eax + 0x10]
mov eax, dword [0x46c298]
mov eax, dword [eax]
mov edx, dword [ebx + 8]
call fcn.0042e7fc
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x42f1f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov word [eax + 0x20], 2
push 0x10
lea ebx, [eax + 0x20]
push ebx
push 0
push ecx
push edx
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
pop ebx
ret
Function at 0x42f390
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
mov dword [ebp - 0x108], eax
call fcn.0040a580
fstp qword [ebp - 0x118]
wait
jmp 0x42f5bd
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0x186a0
push ebp
call fcn.0042f30c
pop ecx
test eax, eax
jne 0x42f3df
push 0x3e8
call sub.kernel32.dll_Sleep_1
jmp 0x42f5bd
lea edx, [ebp - 0x110]
push edx
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push eax
call sub.wsock32.dll_select
mov ebx, eax
test ebx, ebx
jge 0x42f409
push 0x64
call sub.kernel32.dll_Sleep_1
jmp 0x42f5bd
mov eax, dword [0x46c288]
mov eax, dword [eax]
call fcn.004294bc
test al, al
jne 0x42f5dd
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
jne 0x42f5dd
test ebx, ebx
jle 0x42f4e2
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x42f46b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x108]
call fcn.0042f638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42f4d4
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 4]
call fcn.0040a580
fsub qword [ebp - 0x118]
mov eax, dword [ebp - 0x108]
fild dword [eax + 0x48]
fdiv dword [0x42f614]
fcompp
fnstsw ax
sahf
jae 0x42f5bd
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx]
call fcn.0040a580
fstp qword [ebp - 0x118]
wait
xor eax, eax
push ebp
push 0x42f543
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x108]
call fcn.0042f68c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42f5af
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x46c288]
mov eax, dword [eax]
call fcn.004294bc
test al, al
jne 0x42f5dd
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0xd], 0
je 0x42f3b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432054
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404a4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4320ac
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46c4fc]
mov dl, 1
mov eax, dword [0x431bd0]
call fcn.0040c3cc
call fcn.00403f34
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00431cd8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43703c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x437042
ret
Function at 0x439484
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4394d5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4394bc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4394ac
jmp 0x4394d5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4394bd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441950
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x44189c
call sub.user32.dll_EnumWindows
ret

Function at 0x441a70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x441aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004414d0
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x441a95
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004410d0
cmp dword [ebp - 4], 0
je 0x441ad7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404a4c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441af4
lea eax, [ebp - 4]
call fcn.0040457c
ret

Function at 0x444fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x445010]
test si, 4
je 0x444fd4
or bl, 1
test si, 8
je 0x444fde
or bl, 4
test si, 1
je 0x444fe8
or bl, 8
test si, 2
je 0x444ff2
or bl, 0x10
test si, 0x10
je 0x444ffc
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44500b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x445014
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44504c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44502d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44503c
or bl, 4
test esi, 0x20000000
je 0x445047
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44b6f4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44b706
add esp, 0xfffffff0
call fcn.00403acc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423e58
mov eax, dword [0x46c16c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44ba98
mov eax, dword [0x46c178]
mov dword [eax + 4], ebx
mov dword [eax], 0x44baa4
mov eax, ebx
call fcn.0044bab0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x447ecc
push eax
push 0
push 0
mov eax, dword [0x46c2e4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x436740]
call fcn.00437b84
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x436740]
call fcn.00437b84
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x436740]
call fcn.00437b84
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044bed0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bdac
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bdac
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44bdac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b843
call fcn.00403b24
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44bb90
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44bd3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44bd1c
mov dl, 1
mov eax, dword [0x4171b4]
call fcn.00403750
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040457c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44bd0b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00466f5c
test al, al
je 0x44bcfe
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44bd4c
lea eax, [ebp - 0x254]
call fcn.00409858
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44bcfe
xor eax, eax
push ebp
push 0x44bcf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44bd84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44bce0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44bce0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bcfe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44bc01
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b920
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bd42
lea eax, [ebp - 0x260]
call fcn.0040457c
ret

Function at 0x44c670
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46dbc0]
cmp byte [eax + 0xa5], 0
jne 0x44c6e1
cmp dword [0x46dbd8], 0
jne 0x44c6a2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44c62c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46dbd8], eax
cmp dword [0x46dbd4], 0
jne 0x44c6bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46dbd4], eax
cmp dword [0x46dbdc], 0
jne 0x44c6e1
push esp
push 0
push 0
push 0x44c5d0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x46dbdc], eax
pop edx
ret
Function at 0x44c7d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44c7ef
add esp, 0xfffffff0
call fcn.00403acc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423e58
mov eax, dword [0x46c2d0]
cmp word [eax + 2], 0
jne 0x44c817
mov eax, dword [0x46c2d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044dd2c
mov eax, dword [0x46c384]
cmp word [eax + 2], 0
jne 0x44c831
mov eax, dword [0x46c384]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044df24
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416b50]
call fcn.00403750
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x436ef0]
call fcn.0043cb38
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44c9b8
mov eax, dword [0x46c1d0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043cf08
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44e4c4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46c1d0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d0bc
test eax, eax
je 0x44c926
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040920c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d0e4
test eax, eax
je 0x44c93a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004047fc
mov eax, dword [0x46c0c4]
cmp byte [eax], 0
jne 0x44c96e
mov eax, ebx
call fcn.0044cae0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044e6a0
mov eax, ebx
call fcn.0044f064
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c9ae
call fcn.00403b24
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret