joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427810
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4278a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.004057e8
mov dword [ebp - 0x14], 0x1000
mov eax, dword [ebp - 4]
call fcn.0040515c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x427885
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push 0x406d1388
call sub.KERNEL32.DLL_GetCommandLineW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42788f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4278ac
lea eax, [ebp - 4]
call fcn.00404d3c
ret

Function at 0x428474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
xor eax, eax
push ebp
push 0x4285a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb4]
push eax
call sub.KERNEL32.DLL_WinExec
sub eax, 0xffffffff
je 0x4284b7
dec eax
je 0x4284e0
dec eax
je 0x4284f3
dec eax
je 0x4284e8
jmp 0x4284fe
lea edx, [ebp - 0xb8]
mov eax, dword [0x4a75a4]
call fcn.004076dc
mov ecx, dword [ebp - 0xb8]
mov dl, 1
mov eax, dword [0x425db8]
call fcn.00424a0c
call fcn.00404544
jmp 0x428525
mov ebx, dword [ebp - 0xb4]
jmp 0x428525
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0xc]
jmp 0x428525
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0x60]
jmp 0x428525
lea edx, [ebp - 0xbc]
mov eax, dword [0x4a75a4]
call fcn.004076dc
mov ecx, dword [ebp - 0xbc]
mov dl, 1
mov eax, dword [0x425db8]
call fcn.00424a0c
call fcn.00404544
push 0
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, ecx
mov esi, 0x3c
cdq
idiv esi
cmp edx, 0xffff
jbe 0x428547
call fcn.00403a28
push edx
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
cmp eax, 0xffff
jbe 0x428565
call fcn.00403a28
xor ecx, ecx
pop edx
call fcn.0040e008
fstp qword [ebp - 8]
wait
test ebx, ebx
jle 0x428582
fld dword [0x4285b0]
fsub qword [ebp - 8]
fstp qword [ebp - 8]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4285a7
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.004055b4
ret
Function at 0x42a050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
xor eax, eax
mov dword [ebp - 0x194], eax
xor eax, eax
push ebp
push 0x42a12b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a4f48], 0
jne 0x42a112
mov edx, 0x8000
mov eax, 0x42a144
call fcn.00412be0
mov dword [0x4a4f48], eax
cmp dword [0x4a4f48], 0
je 0x42a0c6
lea eax, [ebp - 0x18e]
push eax
push 0x202
call dword [0x4a4d68]
mov ebx, eax
test ebx, ebx
je 0x42a112
mov eax, dword [0x4a4f48]
push eax
call sub.KERNEL32.DLL_GetTempPathW
xor eax, eax
mov dword [0x4a4f48], eax
jmp 0x42a0cd
call sub.KERNEL32.DLL_SetEvent
mov ebx, eax
lea edx, [ebp - 0x194]
mov eax, dword [0x4a7328]
call fcn.004076dc
mov eax, dword [ebp - 0x194]
push eax
mov eax, 0x42a144
mov dword [ebp - 0x19c], eax
mov byte [ebp - 0x198], 0x11
lea eax, [ebp - 0x19c]
push eax
push 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x429fa8]
call fcn.0042a19c
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a132
lea eax, [ebp - 0x194]
call fcn.004055ac
ret

Function at 0x432cd4
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4a75f8]
cmp dword [eax], 2
jne 0x432d53
mov eax, dword [0x4a7098]
cmp dword [eax], 5
jl 0x432d53
mov eax, 0x4a4f88
xor edx, edx
call fcn.0042605c
test eax, eax
je 0x432cfe
push eax
call sub.KERNEL32.DLL_GetTempPathW
mov eax, 0x4a4f90
xor edx, edx
call fcn.0042605c
test eax, eax
je 0x432d14
push eax
call sub.KERNEL32.DLL_GetTempPathW
mov byte [0x4a4f84], 0
xor eax, eax
mov dword [0x4a4f50], eax
xor eax, eax
mov dword [0x4a4f54], eax
xor eax, eax
mov dword [0x4a4f58], eax
xor eax, eax
mov dword [0x4a4f70], eax
xor eax, eax
mov dword [0x4a4f74], eax
xor eax, eax
mov dword [0x4a4f78], eax
xor eax, eax
mov dword [0x4a4f7c], eax
xor eax, eax
mov dword [0x4a4f80], eax
ret

Function at 0x44fab4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x44fb0e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0044faa8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0044cd9c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0044c900
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fb15
lea eax, [ebp - 4]
call fcn.004055ac
ret

Function at 0x45a02c
Capabilities:
Get common file path

Disassembly:
call dword [0x4adbd4]
cmp eax, 0x90801f
jne 0x45a050
call dword [0x4a6074]
mov edx, dword [0x4a5ddc]
push edx
push eax
call dword [0x4a6078]
add esp, 8
call dword [0x4a6070]
call dword [0x4a6068]
push 0
call dword [0x4a606c]
pop ecx
call dword [0x4a5dcc]
cmp dword [0x4a607c], 0
jle 0x45a08f
mov eax, dword [0x4a607c]
test eax, eax
jns 0x45a082
call fcn.00403a28
push eax
call sub.KERNEL32.DLL_GetTempPathW
xor eax, eax
mov dword [0x4a607c], eax
cmp dword [0x4a6080], 0
jle 0x45a0b3
mov eax, dword [0x4a6080]
test eax, eax
jns 0x45a0a6
call fcn.00403a28
push eax
call sub.KERNEL32.DLL_GetTempPathW
xor eax, eax
mov dword [0x4a6080], eax
ret
Function at 0x466638
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46663e
ret

Function at 0x4666b8
Capabilities:
Write file on windows

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x46c06c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x466274]
call fcn.00403b38
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c0f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov esi, eax
lea edi, [edx + 0x18]
mov ecx, 0x15
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
movzx edx, byte [ebp + 0xc]
mov byte [eax + 0x71], dl
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x46c0d6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x4194d8]
call fcn.00403d2c
mov edx, dword [ebp - 8]
mov dword [edx + 0x6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c10b
push 0x4adc50
call sub.KERNEL32.DLL_GetExitCodeThread
xor edx, edx
push ebp
push 0x46c154
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0046a6c4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x28], eax
call fcn.0046a6c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c15b
push 0x4adc50
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x46d92c
Capabilities:
Write file on windows

Disassembly:
add eax, 8
push eax
call sub.KERNEL32.DLL_WriteFile
ret

Function at 0x470a10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x470a8f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.user32.dll_GetKeyboardLayout
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x470a79
cmp byte [ebx + 0x40], 0
je 0x470a79
cmp word [ebx + 0x3a], 0
je 0x470a79
push 0
push esi
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x470a79
lea edx, [ebp - 4]
mov eax, dword [0x4a75c8]
call fcn.004076dc
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4189c0]
call fcn.00410660
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470a96
lea eax, [ebp - 4]
call fcn.004055ac
ret
Function at 0x475f78
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe0c
mov dword [ebp - 0x1f4], 0x1f4
push 0
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0x29
call sub.user32.dll_MapVirtualKeyW
test eax, eax
je 0x475fbd
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x118]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x477ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x478009
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_DefMDIChildProcW
mov dl, 1
mov eax, dword [0x44a874]
call fcn.0044a9b0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x477fdf
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0044aa50
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.004057a4
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x478024
call fcn.00405978
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0044aab4
test al, al
je 0x477fc9
lea ecx, [ebp - 4]
mov edx, 0x478098
mov eax, dword [ebp - 0xc]
call fcn.0044ad00
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00412be0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x477fc2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4780b0
mov eax, dword [ebp - 8]
push eax
call fcn.00407e60
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4a6ad8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fc9
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetTempPathW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fe6
mov eax, dword [ebp - 0xc]
call fcn.00403b68
ret
Function at 0x47d830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4ade98], 0
je 0x47d971
push 0x11
call sub.user32.dll_CreateMenu
test ax, 0x8000
setne al
mov edx, dword [0x4a7358]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x47d971
mov eax, dword [0x4ade9c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4ade98]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x47d940
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4ade98]
call fcn.0041b330
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x47d938
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x47d938
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x47d938
mov eax, dword [ebp - 0x14]
call fcn.0048890c
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x47d938
push ebp
call fcn.0047d7ec
pop ecx
test al, al
jne 0x47d938
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403d78
test al, al
je 0x47d938
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403d78
cmp byte [ebp - 1], 0
je 0x47d938
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00407b38
test al, al
je 0x47d938
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4ade9c]
call fcn.0047cf64
inc edi
dec ebx
jne 0x47d895
mov eax, dword [0x4ade9c]
cmp dword [eax + 8], 0
jle 0x47d958
mov eax, dword [0x4ade9c]
call fcn.0047d01c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x47d971
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0047d650
pop ecx
test al, al
jne 0x47d971
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483e28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
mov eax, dword [esi]
call fcn.0048890c
push eax
call sub.user32.dll_GetKeyState
test eax, eax
je 0x483ee4
mov eax, dword [esi]
call fcn.0048890c
push eax
call sub.user32.dll_DrawIcon
test eax, eax
jne 0x483ee4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
call fcn.0048890c
push eax
call sub.user32.dll_FindWindowExW
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [esi]
call fcn.00481f4c
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x483eba
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
cmp edx, ecx
jne 0x483eba
cmp eax, dword [ebp - 4]
jne 0x483eba
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
cmp eax, dword [ebp - 8]
je 0x483edb
push 0x16
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
push 0
mov eax, dword [esi]
call fcn.0048890c
push eax
call sub.user32.dll_LoadBitmapW
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x58]
jmp 0x483eef
mov eax, dword [esi]
mov si, 0xffee
call fcn.00403d78
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x484764
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48486b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0xcc
call fcn.00403448
mov eax, dword [esi + 0x16c]
mov dword [ebx], eax
mov dword [ebx + 4], 0x44000000
lea edx, [ebx + 8]
mov eax, esi
call fcn.004846fc
test byte [esi + 0x50], 1
je 0x4847b9
or dword [ebx + 4], 0x2000000
or dword [ebx + 8], 0x10000
test byte [esi + 0x1c], 0x10
jne 0x4847d1
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
jne 0x4847d1
or dword [ebx + 4], 0x8000000
cmp byte [esi + 0x1e0], 0
je 0x4847e1
or dword [ebx + 4], 0x10000
mov eax, dword [esi + 0x40]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x18], eax
mov edi, dword [esi + 0x30]
test edi, edi
je 0x48480c
mov eax, edi
call fcn.0048890c
mov dword [ebx + 0x1c], eax
jmp 0x484815
mov eax, dword [esi + 0x1cc]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x24], 0xb
push 0x7f00
push 0
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x40], eax
mov eax, dword [0x4aab18]
mov dword [ebx + 0x34], eax
mov eax, fcn.0040828c
mov dword [ebx + 0x28], eax
lea edx, [ebp - 4]
mov eax, dword [esi]
call fcn.00403a40
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x4c]
call fcn.0040befc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484872
lea eax, [ebp - 4]
call fcn.004055ac
ret
Function at 0x4884b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
mov ebx, dword [edi + 0x24c]
test ebx, ebx
je 0x4884dc
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
jne 0x4884e0
xor eax, eax
jmp 0x4884e2
mov al, 1
mov byte [esp + 8], al
cmp byte [esp + 8], 0
je 0x488507
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edi + 0x24c]
push eax
call sub.user32.dll_GetWindowLongW
mov eax, edi
call fcn.00484644
mov esi, eax
dec esi
test esi, esi
jl 0x488581
inc esi
xor ebp, ebp
mov edx, ebp
mov eax, edi
call fcn.00484608
mov ebx, eax
mov eax, ebx
mov edx, dword [0x47b7b8]
call fcn.00403d08
test al, al
je 0x48853d
cmp dword [ebx + 0x24c], 0
jne 0x48854c
mov eax, dword [esp]
add dword [ebx + 0x40], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x44], eax
jmp 0x48857d
cmp byte [esp + 8], 0
jne 0x48857d
push 0x14
mov eax, ebx
mov edx, dword [eax + 0x4c]
push edx
mov edx, dword [eax + 0x48]
push edx
mov edx, dword [eax + 0x44]
add edx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 0x40]
add edx, dword [esp + 0x10]
push edx
push 0
mov eax, dword [eax + 0x24c]
push eax
call sub.user32.dll_LoadBitmapW
inc ebp
dec esi
jne 0x488518
mov eax, edi
call fcn.00484170
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48dcb8
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
sub edx, 1
jb 0x48dcc7
sub edx, 0x67
je 0x48dce6
jmp 0x48dd17
mov eax, ebx
call fcn.0048dbf4
cmp byte [ebx + 0xd], 0
jne 0x48dcdd
mov eax, ebx
call fcn.0048dc40
jmp 0x48dd17
mov eax, ebx
call fcn.0048dc10
pop ebx
ret
cmp byte [ebx + 0x20], 0
je 0x48dd17
cmp byte [ebx + 0xd], 0
je 0x48dd03
push 0
lea eax, [ebx + 0x10]
push eax
push 0
push 0x68
call sub.user32.dll_MapVirtualKeyW
jmp 0x48dd17
push 0
push 0
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.user32.dll_GetWindowPlacement
mov dword [ebx + 0x10], eax
pop ebx
ret

Function at 0x48e164
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4adea8]
xor edx, edx
mov dword [0x4adea8], edx
call fcn.00403b68
mov eax, dword [0x4a7358]
mov eax, dword [eax]
call fcn.00403b68
mov eax, dword [0x4a7358]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4a75d0]
mov eax, dword [eax]
call fcn.00403b68
mov eax, dword [0x4a75d0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4ade4c]
call fcn.00403b68
xor eax, eax
mov dword [0x4ade4c], eax
mov eax, dword [0x4adea4]
call fcn.00403b68
movzx eax, word [0x4ade62]
push eax
call sub.KERNEL32.DLL_RaiseException
mov eax, 0x4ade68
xor edx, edx
call fcn.004055bc
movzx eax, word [0x4ade60]
push eax
call sub.KERNEL32.DLL_RaiseException
mov eax, 0x4ade64
xor edx, edx
call fcn.004055bc
cmp dword [0x4a6c1c], 0
je 0x48e201
mov eax, dword [0x4a6c1c]
push eax
call sub.KERNEL32.DLL_GetTempPathW
ret
Function at 0x48e204
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e38f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x48e3a8
call fcn.0040c71c
mov edx, dword [ebp - 4]
mov eax, 0x4ade64
call fcn.004055bc
mov eax, dword [0x4ade64]
call fcn.00405648
push eax
call sub.KERNEL32.DLL_GetStdHandle
mov word [0x4ade60], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4aab18]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.KERNEL32.DLL_MulDiv
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x48e3cc
call fcn.0040c71c
mov edx, dword [ebp - 0x10]
mov eax, 0x4ade68
call fcn.004055bc
mov eax, dword [0x4ade68]
call fcn.00405648
push eax
call sub.KERNEL32.DLL_GetStdHandle
mov word [0x4ade62], ax
mov eax, dword [0x4ade68]
call fcn.00405648
push eax
call sub.user32.dll_GetSysColor
mov dword [0x4ade6c], eax
mov dl, 1
mov eax, dword [0x418b14]
call fcn.0041b630
mov dword [0x4adea4], eax
call fcn.0048dd1c
mov dl, 1
mov eax, dword [0x47c434]
call fcn.0048dab4
mov dword [0x4ade4c], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49519c]
call fcn.0049dc68
mov edx, dword [0x4a75d0]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4952b8]
call fcn.0049f028
mov edx, dword [0x4a7358]
mov dword [edx], eax
mov eax, dword [0x4a7358]
mov eax, dword [eax]
mov dl, 1
call fcn.004a12cc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47b050]
call fcn.0047eee8
mov dword [0x4adea8], eax
push 0x48e3f4
call sub.KERNEL32.DLL_SignalObjectAndWait
mov ebx, eax
mov ecx, 0x47cd20
mov edx, 0x47cd30
mov eax, dword [0x479b5c]
call fcn.0041ad18
test ebx, ebx
je 0x48e371
push 0x48e404
push ebx
call fcn.00407e60
mov dword [0x4a6aec], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e396
lea eax, [ebp - 0x10]
call fcn.004055ac
lea eax, [ebp - 4]
call fcn.004055ac
ret
Function at 0x4902ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
call fcn.0048890c
push eax
call sub.user32.dll_FillRect
test ah, 2
je 0x490449
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.0048890c
push eax
call sub.user32.dll_FindWindowExW
mov ecx, dword [ebp - 0x24]
neg ecx
mov edx, dword [ebp - 0x28]
neg edx
lea eax, [ebp - 0x28]
call fcn.00407bd4
mov eax, dword [ebp - 4]
call fcn.0048890c
push eax
call sub.user32.dll_EnumWindows
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x490442
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
test bl, bl
je 0x4903e0
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
call fcn.0048890c
push eax
call sub.user32.dll_FillRect
test eax, 0x100000
je 0x4903e0
test eax, 0x200000
je 0x4903e0
push 2
call sub.user32.dll_EnumChildWindows
mov edi, eax
push 3
call sub.user32.dll_EnumChildWindows
mov ebx, eax
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_GetCapture
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov edx, dword [ebp - 0xc]
sub edx, ebx
mov eax, dword [ebp - 0x10]
sub eax, edi
mov ecx, dword [ebp - 0x10]
call fcn.00407ad8
push esi
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push 0xf
call sub.user32.dll_EnableWindow
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00408344
mov eax, dword [ebp - 0x1c]
sub eax, 2
push eax
mov eax, dword [ebp - 0x20]
sub eax, 2
push eax
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
mov eax, dword [ebp - 0x28]
add eax, 2
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_ExcludeClipRect
lea ecx, [ebp - 0x34]
mov dl, 2
mov eax, esi
call fcn.0048fdc0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0048fc80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490449
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0048890c
push eax
call sub.user32.dll_GetSystemMenu
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49e094
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
push 0x7f00
push 0
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [ebp + 0xa4], eax
mov ebx, 0xffffffea
mov esi, 0x4a6d70
cmp ebx, 0xffffffef
jl 0x49e0c0
cmp ebx, 0xfffffff4
jle 0x49e0c5
cmp ebx, 0xffffffeb
jne 0x49e0cd
mov edi, dword [0x4aab18]
jmp 0x49e0cf
xor edi, edi
mov eax, dword [esi]
push eax
push edi
call sub.user32.dll_GetKeyboardLayoutNameW
mov ecx, eax
mov edx, ebx
mov eax, ebp
call fcn.0049e1d8
inc ebx
add esi, 4
cmp ebx, 0xffffffff
jne 0x49e0b6
pop ebp
pop edi
pop esi
pop ebx
ret