joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015e0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x4015f6
mov esi, 0x100000
jmp 0x401602
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_WinExec
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x40163f
mov edx, ebx
mov eax, 0x4ad5ec
call fcn.00401494
test al, al
jne 0x40163f
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x401644
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_WinExec
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x40168e
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_WinExec
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4016b6
mov edx, ebx
mov eax, 0x4ad5ec
call fcn.00401494
test al, al
jne 0x4016b6
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4016bc
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x4ad5ec]
jmp 0x40173c
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x40173a
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x40173a
cmp esi, dword [esp + 8]
jae 0x401709
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401718
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x401733
mov dword [0x4ad5c8], 1
mov eax, ebx
call fcn.004014c4
mov ebx, edi
cmp ebx, 0x4ad5ec
jne 0x4016eb
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x40176c
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401774
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edx, eax
mov ebp, edx
and ebp, 0xfffff000
add edx, dword [esp]
add edx, 0xfff
and edx, 0xfffff000
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 8]
sub eax, ebp
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov esi, dword [0x4ad5ec]
jmp 0x4017f6
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebp, ebx
jbe 0x4017c8
mov ebx, ebp
cmp edi, dword [esp + 8]
jbe 0x4017d2
mov edi, dword [esp + 8]
cmp edi, ebx
jbe 0x4017f4
push 4
push 0x1000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WinExec
test eax, eax
jne 0x4017f4
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
jmp 0x4017fe
mov esi, dword [esi]
cmp esi, 0x4ad5ec
jne 0x4017ba
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401808
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x4ad5ec]
jmp 0x401877
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x40184f
mov ebx, dword [esp]
cmp ebp, edi
jae 0x401855
mov edi, ebp
cmp edi, ebx
jbe 0x401875
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x401875
mov dword [0x4ad5c8], 2
mov esi, dword [esi]
cmp esi, 0x4ad5ec
jne 0x40183f
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b8c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4ad5c4], 0
je 0x401c69
xor edx, edx
push ebp
push 0x401c62
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x4ad04d], 0
je 0x401bbe
push 0x4ad5cc
call sub.KERNEL32.DLL_lstrcpyA
mov byte [0x4ad5c4], 0
mov eax, dword [0x4ad624]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [0x4ad624], eax
mov ebx, dword [0x4ad5ec]
jmp 0x401bf1
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, dword [ebx]
cmp ebx, 0x4ad5ec
jne 0x401bdf
mov eax, 0x4ad5ec
call fcn.0040148c
mov eax, 0x4ad5fc
call fcn.0040148c
mov eax, 0x4ad628
call fcn.0040148c
mov eax, dword [0x4ad5e4]
test eax, eax
je 0x401c37
mov edx, dword [eax]
mov dword [0x4ad5e4], edx
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [0x4ad5e4]
test eax, eax
jne 0x401c20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c69
cmp byte [0x4ad04d], 0
je 0x401c57
push 0x4ad5cc
call sub.KERNEL32.DLL_GetVersionExA
push 0x4ad5cc
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402b28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404214
test esi, esi
jne 0x402b5e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_MulDiv
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404304
jmp 0x402b7c
call sub.KERNEL32.DLL_LoadResource
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a3c
mov edi, eax
test esi, esi
je 0x402b7c
cmp dword [ebx], 0
je 0x402b7c
dec esi
jmp 0x402b65
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4048f8
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x40490c
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x4048f0
ret

Function at 0x405860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x4059f4
call sub.KERNEL32.DLL_MultiByteToWideChar
mov esi, eax
test esi, esi
je 0x4058c8
push 0x405a04
push esi
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
test ebx, ebx
je 0x4058c8
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x4058c8
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x4059ea
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x405908
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x4059ea
mov eax, dword [ebp - 4]
add eax, 2
call fcn.0040584c
mov esi, eax
cmp byte [esi], 0
je 0x4059ea
lea eax, [esi + 1]
call fcn.0040584c
mov esi, eax
cmp byte [esi], 0
je 0x4059ea
jmp 0x40590e
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x4059cd
lea eax, [esi + 1]
call fcn.0040584c
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x4059ea
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
cmp esi, 0xffffffff
je 0x4059ea
push esi
call sub.KERNEL32.DLL_InitializeCriticalSection
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEvent
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x4059ea
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetEvent
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x40592c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a18
Capabilities:
Clear file content
Extract resource via kernel32 functions
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_MulDiv
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c48
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405a9b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c48
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405a9b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405c64
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x405b24
xor eax, eax
push ebp
push 0x405b1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405860
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405b02
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405c84
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x405b02
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b24
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ResumeThread
push eax
call sub.KERNEL32.DLL_LockResource
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405c3e
cmp byte [ebp - 0xd], 0
jne 0x405b6b
cmp byte [ebp - 0x12], 0
je 0x405c3e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEvent
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405b84
dec ebx
cmp byte [ebx], 0x2e
je 0x405b93
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405b83
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405c3e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405bd0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
jne 0x405c3e
cmp byte [ebp - 0xd], 0
je 0x405c3e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
test esi, esi
jne 0x405c3e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetErrorMode
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406344
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4063aa
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_LockResource
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404484
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e4c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406394
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063b1
lea eax, [ebp - 0x10]
call fcn.00404214
ret

Function at 0x408f20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
call fcn.004046d4
push eax
call sub.user32.dll_GetKeyState
cmp eax, 0xffffffff
je 0x408f79
push eax
call sub.user32.dll_GetKeyNameTextA
test byte [ebp - 0x14c], 0x10
jne 0x408f79
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
call sub.user32.dll_GetIconInfo
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetForegroundWindow
test eax, eax
jne 0x408f80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409064
Capabilities:
Get keyboard layout

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x409084
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_GetKeyboardLayout
test eax, eax
jne 0x409084
call sub.user32.dll_GetSystemMetrics
jmp 0x4090c3
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x40906c
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_GetIconInfo
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetForegroundWindow
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.00404484
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x409118
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_GetKeyboardLayout
test eax, eax
je 0x409135
mov eax, ebx
call fcn.00409064
pop ebx
ret
call sub.user32.dll_GetSystemMetrics
pop ebx
ret

Function at 0x40c0ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_GetKeyboardState
jmp 0x40c113
dec eax
test eax, eax
jle 0x40c125
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x40c112
sub dl, 0xd
je 0x40c112
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.00404304
add esp, 0x100
pop ebx
ret
Function at 0x40d18c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d262
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042ac
lea eax, [ebp - 8]
call fcn.00404724
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d24c
mov eax, ebx
call fcn.00402788
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d245
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d22f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d274
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d22f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d24c
mov eax, dword [ebp - 0x10]
call fcn.004027a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d269
lea eax, [ebp - 8]
call fcn.00404214
ret

Function at 0x425b64
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x425b6a
ret

Function at 0x427ae4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x427b80
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetSystemMetrics
mov ebx, eax
test ebx, ebx
je 0x427b62
push 0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x400
push ebx
push 0
push 0x1000
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x427b62
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.00404484
mov ecx, dword [ebp - 0x104]
mov dl, 1
mov eax, dword [0x418a74]
call fcn.0040c8f4
call fcn.00403bb0
jmp 0x427b67
call fcn.00427a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427b87
lea eax, [ebp - 0x104]
call fcn.00404214
ret

Function at 0x45cd3c
Capabilities:
Read clipboard data

Disassembly:
push ecx
mov eax, dword [0x4adbb8]
cmp byte [eax + 0xa5], 0
jne 0x45cdad
cmp dword [0x4adbd0], 0
jne 0x45cd6e
call sub.user32.dll_GetParent
push eax
push 0
mov eax, 0x45ccf8
push eax
push 3
call fcn.0040719c
mov dword [0x4adbd0], eax
cmp dword [0x4adbcc], 0
jne 0x45cd89
push 0
push 0
push 0
push 0
call sub.user32.dll_GetClassNameA
mov dword [0x4adbcc], eax
cmp dword [0x4adbd4], 0
jne 0x45cdad
push esp
push 0
push 0
push 0x45cc9c
push 0x3e8
push 0
call sub.user32.dll_GetClipboardData
mov dword [0x4adbd4], eax
pop edx
ret
Function at 0x46bf5c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c0ef
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 0x4ade38
mov edx, dword [0x46b984]
call fcn.0040573c
xor eax, eax
mov dword [0x4ade3c], eax
mov eax, 0x4ade40
call fcn.00404214
mov eax, esi
call fcn.00404214
mov word [ebp - 6], 0
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0046b9ac
mov eax, dword [ebp - 0x10]
call fcn.004044d4
cmp eax, 2
jge 0x46c00f
mov eax, ebx
mov edx, 0x46c104
call fcn.00404620
jne 0x46bfde
call sub.user32.dll_IsWindow
mov word [ebp - 6], ax
jmp 0x46c00f
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408b2c
test al, al
je 0x46c0d9
cmp dword [ebp - 0xc], 0
jle 0x46c0d9
cmp dword [ebp - 0xc], 0xffff
jg 0x46c0d9
mov ax, word [ebp - 0xc]
mov word [ebp - 6], ax
mov eax, dword [ebp - 0x10]
mov edx, 0x46c110
call fcn.00404620
je 0x46c0d9
cmp word [ebp - 6], 0x409
je 0x46c0d9
push 0xa
push 0x2d5a
mov eax, dword [0x4ad668]
push eax
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
je 0x46c0d9
xor eax, eax
push ebp
push 0x46c0d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2d5a
push 0xa
mov ecx, dword [0x4ad668]
mov dl, 1
mov eax, dword [0x4195ac]
call fcn.0041e384
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46c0bc
lea ecx, [ebp - 6]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0046bc18
test al, al
je 0x46c0bc
mov eax, 0x4ade38
mov edx, dword [ebp - 4]
call fcn.0046ba80
mov dword [0x4ade3c], eax
cmp dword [0x4ade3c], 0
jbe 0x46c0bc
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.00404268
mov eax, 0x4ade40
mov edx, dword [ebp - 0x10]
call fcn.00404268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c0d9
lea eax, [ebp - 4]
call fcn.0040e450
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c0f6
lea eax, [ebp - 0x10]
call fcn.00404214
ret
Function at 0x46c1a0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c30b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0x409
mov eax, dword [ebp - 8]
mov edx, 0x46c320
call fcn.00404268
test ebx, ebx
jne 0x46c1fc
cmp dword [0x4ade38], 0
je 0x46c1fc
mov eax, dword [ebp - 8]
mov edx, dword [0x4ade40]
call fcn.00404268
mov eax, dword [0x4ade3c]
mov dword [ebp - 0x10], eax
test ebx, ebx
jle 0x46c29f
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov edx, 0x46c334
call fcn.00404268
and ebx, 0xff
mov dword [ebp - 0x10], ebx
xor eax, eax
push ebp
push 0x46c298
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x2d5a
mov eax, dword [0x4ad668]
push eax
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
je 0x46c282
push 0x2d5a
push 0xa
mov ecx, dword [0x4ad668]
mov dl, 1
mov eax, dword [0x4195ac]
call fcn.0041e384
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46c282
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046be18
test al, al
je 0x46c282
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00404268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c29f
lea eax, [ebp - 0xc]
call fcn.0040e450
ret
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x46c334
call fcn.00404620
je 0x46c2f0
cmp dword [ebp - 4], 0
jne 0x46c2dc
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x18]
mov eax, 4
call fcn.00408aa8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov edx, 0x46c340
call fcn.00404520
jmp 0x46c2f0
cmp dword [ebp - 4], 0xffffffff
je 0x46c2f0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0046c114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c312
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404238
ret
Function at 0x47ade4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47adec
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47afde
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x47aff4
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404268
lea ecx, [ebp - 0x10]
mov edx, 0x47b008
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404268
lea ecx, [ebp - 0x14]
mov edx, 0x47b020
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404268
lea ecx, [ebp - 0x18]
mov edx, 0x47b03c
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404268
lea ecx, [ebp - 0x1c]
mov edx, 0x47b058
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404268
lea ecx, [ebp - 0x24]
mov edx, 0x47b070
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408704
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408b14
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47b088
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x28]
call fcn.00464e84
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47b098
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x2c]
call fcn.00464e84
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47b0b0
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408b14
inc eax
je 0x47af81
lea ecx, [ebp - 0x34]
mov edx, 0x47b0b0
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x34]
call fcn.00408ad8
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a770
fstp qword [ebp - 0x3c]
wait
call fcn.0040aad4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47af9c
lea ecx, [ebp - 0x40]
mov edx, 0x47b0b0
mov eax, esi
call fcn.00478c70
mov eax, dword [ebp - 0x40]
call fcn.00464e84
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47b0c0
mov eax, esi
call fcn.00478c70
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47afe5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404238
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404238
ret