joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524d60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00412c48
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0051e98c
test ebx, ebx
jne 0x524db3
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00524bd8
mov ebx, eax
test ebx, ebx
je 0x524ea9
cmp esi, ebx
je 0x524ddc
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x524df1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x524e29
add eax, 0xffffff5f
sub eax, 2
jb 0x524e41
dec eax
sub eax, 2
jb 0x524e55
dec eax
sub eax, 2
jb 0x524e4b
jmp 0x524e5f
add eax, 0xfffffdff
sub eax, 2
jb 0x524e41
dec eax
sub eax, 2
jb 0x524e55
dec eax
sub eax, 2
jb 0x524e4b
jmp 0x524e5f
mov byte [esp + 0x120], 0
jmp 0x524e67
mov byte [esp + 0x120], 2
jmp 0x524e67
mov byte [esp + 0x120], 1
jmp 0x524e67
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005bbccc
mov esi, eax
call fcn.0051b3ac
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00520524
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x524eab
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x54ae18
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409edc
xor eax, eax
push ebp
push 0x54af55
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x54af28
xor edx, edx
push ebp
push 0x54af21
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x54ae65
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54aef6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x54aee5
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x54aea8
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040a8e8
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.004070fc
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54aeec
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x615aa8]
mov dl, 1
mov eax, dword [0x41c3bc]
call fcn.0042a4a4
call fcn.004094b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54af5c
lea eax, [ebp - 4]
call fcn.00409df8
ret

Function at 0x54f9fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x54fa38]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54fa14
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54fa24
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54fa34
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x56e94c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.00409f80
test ebx, ebx
je 0x56e9a0
mov eax, dword [esi]
call fcn.0040a8e8
push eax
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageW
sub ebx, eax
test ebx, ebx
jle 0x56e9a0
mov eax, dword [esi]
test eax, eax
je 0x56e995
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sub edx, ebx
mov eax, esi
call fcn.0040aa64
pop edi
pop esi
pop ebx
ret
Function at 0x577174
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0057723c
test eax, eax
je 0x5771c6
mov edi, dword [ebx + 8]
test edi, edi
je 0x5771a2
test edi, edi
je 0x5771a2
mov edx, esi
mov eax, edi
call fcn.0051efcc
jmp 0x5771d4
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0057723c
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409f80
jmp 0x5771d4
mov ecx, esi
mov edx, 0x5771f4
mov eax, ebx
call fcn.005770fc
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a1d8
add esp, 0x200
pop edi
pop esi
pop ebx
ret

Function at 0x5ab0c4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409df8
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5ab116
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5ab10f
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a98c
jmp 0x5ab116
mov eax, esi
call fcn.00409df8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5b0b70
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b0ccf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x615850], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4ef5e0]
call fcn.004f072c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5b0ca5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004f0814
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a98c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5b0ce8
call fcn.0040ab3c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004f0aa0
test al, al
je 0x5b0c8f
lea ecx, [ebp - 4]
mov edx, 0x5b0d5c
mov eax, dword [ebp - 0xc]
call fcn.004f132c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042d510
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5b0c8f
xor edx, edx
push ebp
push 0x5b0c88
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5b0d74
mov eax, dword [ebp - 8]
push eax
call fcn.00414ccc
test eax, eax
je 0x5b0c71
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5b0c71
call fcn.005b0afc
test eax, eax
je 0x5b0c61
mov eax, dword [ebx + 0x50]
jmp 0x5b0c64
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x615850]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0c8f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0cac
mov eax, dword [ebp - 0xc]
call fcn.00407fd0
ret
Function at 0x5b0dd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5b0e1f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b0e02
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b0e13
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5b0e1f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x5bb7dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5bb7fd
test edi, 0x40000
je 0x5bb817
test bl, bl
jne 0x5bb898
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5bb898
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5bb84a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5bb85f
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5bb86e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5bb87f
cmp byte [esp + 2], 0
je 0x5bb898
cmp byte [esp + 2], 0
je 0x5bb890
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5bb898
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5bbb3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5bbb62
mov eax, esp
push eax
push 0x5bbb04
call sub.user32.dll_EnumWindows
jmp 0x5bbb75
mov eax, esp
push eax
push 0x5bbae4
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5bbc38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x5bbc88]
test bl, 4
je 0x5bbc4c
or si, 1
test bl, 8
je 0x5bbc55
or si, 4
test bl, 1
je 0x5bbc5e
or si, 8
test bl, 2
je 0x5bbc67
or si, 0x10
test bl, 0x10
je 0x5bbc70
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbc80
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5bbc8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x5bbcc8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbca7
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbcb7
or bx, 4
test esi, 0x20000000
je 0x5bbcc3
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5c5134
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c5146
add esp, 0xfffffff0
call fcn.00408658
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c205c
mov eax, dword [0x615bbc]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c5600
mov eax, dword [0x615bd0]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c560c
mov eax, ebx
call fcn.005c5618
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5bfaec
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c5bf4
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c5a24
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c5a24
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c5a24
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c5a24
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c5a24
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c52c6
call fcn.004086b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c57c4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c596f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c5950
mov dl, 1
mov eax, dword [0x48dd08]
call fcn.004b1684
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409df8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c593f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052ed8c
test al, al
je 0x5c5932
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c5980
lea eax, [ebp - 0x394]
call fcn.00425804
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c5932
xor eax, eax
push ebp
push 0x5c592b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c59f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c5914
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a98c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c5914
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c5932
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c5835
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b15a8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c5976
lea eax, [ebp - 0x3a0]
call fcn.00409df8
ret

Function at 0x5c657c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x61d1b8]
cmp byte [eax + 0xc5], 0
jne 0x5c65ee
cmp dword [0x61d1dc], 0
jne 0x5c65ae
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x615968]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x61d1dc], eax
cmp dword [0x61d1d8], 0
jne 0x5c65c9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x61d1d8], eax
cmp dword [0x61d1e0], 0
jne 0x5c65ee
push esp
push 0
push 0
mov eax, dword [0x615964]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x61d1e0], eax
pop edx
ret
Function at 0x5c6a10
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c6a27
add esp, 0xfffffff0
call fcn.00408658
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c205c
mov eax, dword [0x6159ec]
cmp byte [eax], 0
jne 0x5c6a54
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x615e94]
cmp word [eax + 2], 0
jne 0x5c6a6e
mov eax, dword [0x615e94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8e04
mov eax, dword [0x616054]
cmp word [eax + 2], 0
jne 0x5c6a88
mov eax, dword [0x616054]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c9008
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f52c8]
call fcn.004fb7f0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c9580
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4fa064]
call fcn.00505a48
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c6c78
mov eax, dword [0x615ca4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00505f64
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c9868
mov dl, 1
mov eax, dword [0x48a34c]
call fcn.00407fa0
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x615ca4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425604
test eax, eax
je 0x5c6ba2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042545c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004255e8
test eax, eax
je 0x5c6bba
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a98c
push ebx
push 0x5c87e0
call fcn.005bbc1c
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6159ec]
cmp byte [eax], 0
jne 0x5c6c0b
mov eax, ebx
call fcn.005c6e5c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005c9aa0
mov eax, ebx
call fcn.005ca740
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c6c6f
call fcn.004086b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c71a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c7242
cmp dword [ebx + 0xac], 0
jne 0x5c723c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c70dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c723c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c7202
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c723c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004acb18
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c7211
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c74fc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x61d1b8]
cmp dword [eax + 0x188], 0
je 0x5c7676
test bl, bl
jne 0x5c75c1
cmp dword [esi + 0xb4], 0
jne 0x5c75b6
mov eax, esi
call fcn.005ca590
push eax
push 0x5c73f0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c7587
mov eax, dword [0x61d1b8]
cmp byte [eax + 0xeb], 0
je 0x5c7587
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c7568
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c7587
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7570
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c75b6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acb18
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c7596
inc dword [esi + 0xb4]
jmp 0x5c7676
cmp dword [esi + 0xb4], 0
jle 0x5c7676
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c7676
cmp dword [esi + 0x58], 0
je 0x5c762b
mov eax, dword [0x61d1b8]
cmp byte [eax + 0xeb], 0
je 0x5c762b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c760c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c762b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7614
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c765a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acb18
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c763a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b8a58]
call fcn.0040c210
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5c8314
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c8371
cmp byte [ebx + 0xeb], 0
jne 0x5c8371
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409f80
mov eax, dword [esi]
test eax, eax
je 0x5c835e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c837e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a1d8
jmp 0x5c837e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a1d8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c9cb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c9d25
mov eax, esi
call fcn.005288a8
test al, al
je 0x5c9d25
mov eax, dword [ebx + 0x98]
call fcn.005284d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c9d25
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5c9d16
push 0
mov eax, dword [ebx + 0x98]
call fcn.005284d4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0051eed0
jmp 0x5c9d25
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005c9ac0
pop esi
pop ebx
ret