joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ffd4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x440024]
test si, 4
je 0x43ffe8
or bl, 1
test si, 8
je 0x43fff2
or bl, 4
test si, 1
je 0x43fffc
or bl, 8
test si, 2
je 0x440006
or bl, 0x10
test si, 0x10
je 0x440010
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x44001f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x440028
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x440060]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x440041
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x440050
or bl, 4
test esi, 0x20000000
je 0x44005b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44699c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4469ae
add esp, 0xfffffff0
call fcn.00424508
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411268
mov eax, dword [0x480944]
mov dword [eax + 4], ebx
mov dword [eax], 0x446d40
mov eax, dword [0x480948]
mov dword [eax + 4], ebx
mov dword [eax], 0x446d4c
mov eax, ebx
call fcn.00446d58
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x443220
push eax
push 0
push 0
mov eax, dword [0x480a94]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x434164]
call fcn.00435878
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x434164]
call fcn.00435878
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x434164]
call fcn.00435878
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00447178
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x447054
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x447054
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x447054
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x446aeb
call fcn.00424560
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x446e38
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x446fe3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x446fc4
mov dl, 1
mov eax, dword [0x407454]
call fcn.00424174
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00424cf0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x446fb3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045be80
test al, al
je 0x446fa6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x446ff4
lea eax, [ebp - 0x254]
call fcn.0041569c
push eax
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x446fa6
xor eax, eax
push ebp
push 0x446f9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44702c
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x446f88
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00424f58
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x446f88
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00424f58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446fa6
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x446ea9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0040b874
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446fea
lea eax, [ebp - 0x260]
call fcn.00424cf0
ret

Function at 0x447918
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x481654]
cmp byte [eax + 0xa5], 0
jne 0x447989
cmp dword [0x48166c], 0
jne 0x44794a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x4478d4
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x48166c], eax
cmp dword [0x481668], 0
jne 0x447965
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x481668], eax
cmp dword [0x481670], 0
jne 0x447989
push esp
push 0
push 0
push 0x447878
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x481670], eax
pop edx
ret
Function at 0x447a80
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x447a97
add esp, 0xfffffff0
call fcn.00424508
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411268
mov eax, dword [0x48094c]
cmp word [eax + 2], 0
jne 0x447abf
mov eax, dword [0x48094c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00449144
mov eax, dword [0x480950]
cmp word [eax + 2], 0
jne 0x447ad9
mov eax, dword [0x480950]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044933c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x406f24]
call fcn.00424174
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], SafeArrayCopy
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x434be4]
call fcn.0043c250
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x447c60
mov eax, dword [0x480910]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043c620
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4498bc
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x480910]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004179c4
test eax, eax
je 0x447bce
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00414ff8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004179ec
test eax, eax
je 0x447be2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00424f58
mov eax, dword [0x480918]
cmp byte [eax], 0
jne 0x447c16
mov eax, ebx
call fcn.00447d88
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00449a98
mov eax, ebx
call fcn.0044a448
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x447c56
call fcn.00424560
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447ffc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x481654]
cmp dword [eax + 0x30], 0
je 0x4480a6
cmp dword [ebx + 0x94], 0
jne 0x4480a0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x447f8c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4480a0
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x448066
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4480a0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004095b8
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x448075
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x448b84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x448bb9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00424de0
jmp 0x448bc6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00424d44
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x449c74
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x449cb5
mov eax, esi
call fcn.00457600
test al, al
je 0x449cb5
mov eax, dword [ebx + 0x84]
call fcn.004572fc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x449cb5
push 0
mov eax, dword [ebx + 0x84]
call fcn.004572fc
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret
Function at 0x44e7e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4816f8], 0
je 0x44e92f
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x480938]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x44e92f
mov eax, dword [0x4816fc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4816f8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44e8fe
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4816f8]
call fcn.004095b8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44e8f6
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x44e8f6
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44e8f6
mov eax, dword [ebp - 0x14]
call fcn.004572fc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x44e8f6
push ebp
call fcn.0044e79c
pop ecx
test al, al
jne 0x44e8f6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x44e8b2
mov eax, dword [ebp - 0x14]
call fcn.00455e90
dec eax
jle 0x44e8f6
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.004243a0
cmp byte [ebp - 1], 0
je 0x44e8f6
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x44e8f6
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4816fc]
call fcn.0044df64
inc edi
dec ebx
jne 0x44e845
mov eax, dword [0x4816fc]
cmp dword [eax + 8], 0
jle 0x44e916
mov eax, dword [0x4816fc]
call fcn.0044dff4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44e92f
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044e604
pop ecx
test al, al
jne 0x44e92f
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451eec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x451f38
mov eax, esi
call fcn.00440120
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x451f38
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x451f38
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x452077
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x451f78
cmp eax, 0x108
ja 0x451f78
mov eax, esi
call fcn.00440120
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45206e
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x452077
jmp 0x45206e
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x452057
cmp eax, 0x20a
ja 0x452057
test byte [esi + 0x50], 0x80
jne 0x451faa
sub eax, 0x203
je 0x451fa7
sub eax, 3
je 0x451fa7
sub eax, 3
jne 0x451faa
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x451fbe
dec eax
je 0x451fd3
dec eax
je 0x451ff0
dec eax
je 0x451fd3
jmp 0x451ff7
mov ecx, ebx
mov eax, dword [0x480938]
mov eax, dword [eax]
mov edx, esi
call fcn.00449b2c
jmp 0x45206e
cmp byte [esi + 0x5d], 1
jne 0x451fe9
mov eax, esi
mov si, 0xffed
call fcn.004243a0
jmp 0x452077
or word [esi + 0x54], 1
jmp 0x45206e
and word [esi + 0x54], 0xfffe
jmp 0x45206e
mov eax, dword [0x4816b4]
cmp byte [eax + 0x20], 0
je 0x45206e
mov eax, dword [0x4816b4]
cmp dword [eax + 0x1c], 0
je 0x45206e
mov eax, dword [ebx]
mov edx, dword [0x4816b4]
cmp eax, dword [edx + 0x1c]
jne 0x45206e
lea eax, [ebp - 0x114]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00440064
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.004243a0
jmp 0x452077
cmp eax, 0xb00b
jne 0x45206e
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00450818
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45552c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x455548
cmp dword [esi + 4], 0
je 0x455575
test byte [ebx + 0x55], 1
jne 0x455567
mov eax, ebx
call fcn.00454184
test eax, eax
jne 0x455567
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x455685
mov edx, esi
mov eax, ebx
call fcn.0045504c
jmp 0x455685
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45567e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004572fc
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00451e20
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0045552c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004572fc
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455685
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bb20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x480778]
cmp byte [eax + 0xc], 0
je 0x45bc8d
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45bc86
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x481708], 0
jne 0x45bb74
push 0x45bc94
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x45bc9c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481708], eax
cmp dword [0x47c8ac], 0
jne 0x45bc6f
push 0x45bcac
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x47c8ac], eax
cmp dword [0x47c8ac], 0
je 0x45bc6f
push 0x45bcb8
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x48170c], eax
push 0x45bcc8
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481710], eax
push 0x45bcdc
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481714], eax
push 0x45bcf4
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481718], eax
push 0x45bd0c
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x48171c], eax
push 0x45bd20
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481720], eax
push 0x45bd38
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481724], eax
push 0x45bd50
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481728], eax
push 0x45bd6c
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x48172c], eax
push 0x45bd78
mov eax, dword [0x47c8ac]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x481730], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc8d
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x460e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x460e72
call fcn.00460dc0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0045d110
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0045d110
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x460ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x47e494], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x460fca
cmp dword [0x47e490], 0
jne 0x460fca
cmp dword [0x47e674], 0
je 0x460f84
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00460cc0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x460f6a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00460cc0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x460f6a
lea ebx, [ebp - 0x84]
jmp 0x460f6b
inc ebx
call fcn.00460eac
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x461005
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x47e498
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0045d110
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x47e49b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x461005
cmp dword [0x47e490], 0
je 0x460fe4
cmp dword [0x47e490], 0xffffffff
je 0x461005
push esi
call dword [0x47e490]
pop ecx
mov eax, dword [0x47e494]
test eax, eax
je 0x461005
cmp dword [0x47e494], 0xffffffff
je 0x461005
cmp byte [eax], 0
je 0x461005
push esi
push eax
call fcn.00460e10
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46179c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x481f94], 0
jne 0x46181d
cmp dword [0x481fb4], 0
jne 0x4617cc
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x481fb4], eax
test eax, eax
jne 0x4617cc
push str.GetEnvironmentStrings_failed
call fcn.0046101c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x481fb4]
jmp 0x4617e0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0045d110
pop ecx
mov edi, eax
test eax, eax
jne 0x4617d8
lea edi, [ebp + 1]
push edi
call fcn.0045ca14
pop ecx
mov ebx, eax
mov dword [0x481f98], ebx
test ebx, ebx
jne 0x46180a
xor eax, eax
jmp 0x4618e0
push edi
mov edx, dword [0x481fb4]
push edx
push ebx
call fcn.0045cfc0
add esp, 0xc
jmp 0x46183d
xor esi, esi
mov ebx, dword [0x481f94]
jmp 0x461837
push eax
call fcn.0045d110
pop ecx
test eax, eax
jne 0x461833
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x461827
lea ebx, [esi + 4]
push 4
mov dword [0x481f9c], ebx
inc ebx
push ebx
call fcn.0045c4ec
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x461860
xor eax, eax
jmp 0x4618e0
cmp dword [0x481f94], 0
jne 0x461891
xor esi, esi
mov ebx, dword [0x481f98]
mov eax, dword [esp]
mov ebp, eax
jmp 0x461882
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0045d110
pop ecx
mov edi, eax
test eax, eax
jne 0x461878
jmp 0x4618c2
xor esi, esi
mov ebx, dword [0x481f94]
mov eax, dword [esp]
mov edi, eax
jmp 0x4618bc
push eax
call fcn.0045d110
pop ecx
test eax, eax
je 0x4618b1
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4618b5
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4618a0
mov eax, dword [0x481f94]
test eax, eax
je 0x4618d2
push eax
call fcn.0045ca24
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x481f94], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46839c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4683ca
mov eax, ebx
call fcn.00468e54
cmp dword [ebx + 0x3c], 0
je 0x4683c3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46843b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x46842d
cmp dword [ebx + 8], 0
je 0x4683ec
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4683fe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46842d
cmp dword [ebx + 8], 0
je 0x4683df
cmp eax, 3
je 0x468411
dec eax
jne 0x4683df
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4683df
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4683df
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x468459
cmp dword [ebx + 0x10], 0xcc
je 0x468459
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00468464
pop ebx
ret