joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51cfec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
sub ecx, 0x200
push edi
je 0x51d01c
dec ecx
dec ecx
jne 0x51d10c
and dword [esi + 0x9c], ecx
jmp 0x51d10c
movsx ecx, ax
shr eax, 0x10
cwde
cmp dword [esi + 0x38], ecx
jne 0x51d031
cmp dword [esi + 0x3c], eax
je 0x51d10c
xor ebx, ebx
inc ebx
push ebx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x51d081
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0051c7c2
test eax, eax
je 0x51d10c
mov eax, esi
call fcn.0051e002
mov eax, esi
call fcn.0051e023
mov eax, ebx
jmp 0x51d10e
mov ecx, esi
call fcn.0051d7be
mov edi, eax
push 0xfffffffffffffffe
pop eax
cmp edi, eax
jne 0x51d09e
cmp dword [esi + 0x20], eax
je 0x51d0a3
mov dword [esi + 0x20], eax
mov dword [ebp - 4], ebx
jmp 0x51d0d9
cmp edi, 0xffffffff
je 0x51d0d9
push edi
call fcn.0051d5f6
mov ebx, eax
lea eax, [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, 0xffffffff
je 0x51d0bd
cmp ebx, eax
jge 0x51d10c
cmp dword [esi + 0x20], edi
je 0x51d0d9
push ebx
mov eax, esi
call fcn.0051d828
cmp eax, 3
je 0x51d0d9
mov dword [esi + 0x20], edi
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x51d10c
push eax
mov eax, esi
call fcn.0051ce74
test eax, eax
je 0x51d10c
cmp dword [ebp - 4], 0
je 0x51d102
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
je 0x51d102
mov eax, esi
call fcn.0051e002
mov edi, dword [esi + 0x20]
mov eax, esi
call fcn.0051d113
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51dab5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSubMenu]
push edi
xor edi, edi
push edi
push dword [ebx + 0x40]
mov dword [ebx + 0x24], eax
call esi
cmp dword [ebx + 0x20], 0xffffffff
mov dword [esp + 0xa4], eax
jne 0x51db05
mov ecx, ebx
call fcn.0051dd2e
test eax, eax
je 0x51dc22
mov eax, dword [ebx + 0x20]
cmp eax, 0xfffffffe
je 0x51db24
cmp eax, 0xffffffff
je 0x51db21
push eax
push dword [esp + 0xa8]
call esi
mov dword [ebx + 0x44], eax
jmp 0x51db24
mov dword [ebx + 0x44], edi
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x170]
mov eax, dword [eax]
mov dword [esp + 0x9c], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x170]
mov eax, dword [eax + 4]
push 2
mov dword [esp + 0xa4], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x98]
push edx
push eax
call dword [ecx + 0x138]
mov eax, dword [ebx + 0x20]
cmp eax, 0xffffffff
je 0x51dc0f
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call fcn.0051d8e8
mov esi, eax
lea edi, [esp + 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x9c]
xor edi, edi
cmp dword [ebx + 0x4c], edi
jne 0x51dbb0
mov eax, dword [esp + 0x94]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0xa8], eax
cmp dword [ebx + 0x44], edi
je 0x51dc05
lea esi, [esp + 0x10]
call fcn.00408484
push dword [ebx + 0x44]
call fcn.0050e7d1
pop ecx
push edi
push edi
push edi
push dword [esp + 0xb4]
mov ecx, esi
push dword [esp + 0xb4]
push 0x102
push dword [ebx + 0x44]
call fcn.0050e680
mov ecx, esi
call fcn.0050e29b
jmp 0x51dc0f
push dword [ebx + 0x20]
mov esi, ebx
call fcn.0051dc39
push 0x1b
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x51dc22
or dword [ebx + 0x20], 0xffffffff
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403fc1
mov esp, ebp
pop ebp
ret 4
Function at 0x51e49e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x51e52f
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
push 0x12
shr eax, 8
movzx edi, al
call esi
push 0x10
shr eax, 8
movzx ebx, al
call esi
xor esi, esi
shr eax, 8
movzx eax, al
test edi, edi
je 0x51e4dc
inc esi
test ebx, ebx
je 0x51e4e3
or esi, 2
test eax, eax
je 0x51e4ea
or esi, 4
cmp dword [ebp + 0xc], 0x26
je 0x51e4f6
cmp dword [ebp + 0xc], 0x28
jne 0x51e4ff
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
cmp dword [0x6b7e14], 0
je 0x51e516
call fcn.0050398f
test eax, eax
je 0x51e516
xor edx, edx
inc edx
jmp 0x51e518
xor edx, edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov edi, dword [ecx]
push edx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [edi + 4]
pop edi
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
ret 0x10

Function at 0x51e536
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x41
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x51e56f
push 0x11
call edi
shr eax, 8
test al, al
je 0x51e56f
push 0xffffffffffffffff
lea eax, [ebx + 0x18]
mov ecx, dword [eax]
xor esi, esi
push esi
push eax
call dword [ecx + 0x34]
push esi
push esi
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.004626fc
mov esi, eax
call fcn.0046996a
test eax, eax
je 0x51e5b5
mov esi, dword [ebp + 0xc]
cmp esi, 0x25
je 0x51e58c
cmp esi, 0x27
jne 0x51e59e
push 0
push 0
push 0x48e
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, 0x26
je 0x51e5a8
cmp esi, 0x28
jne 0x51e5b5
push 0
push 0
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebx + 0x20], 0
je 0x51e631
push 0x11
call edi
push 0x12
shr eax, 8
movzx esi, al
call edi
push 0x10
shr eax, 8
movzx eax, al
mov dword [ebp + 8], eax
call edi
xor edi, edi
shr eax, 8
movzx eax, al
test esi, esi
je 0x51e5e3
inc edi
cmp dword [ebp + 8], 0
je 0x51e5ec
or edi, 2
test eax, eax
je 0x51e5f3
or edi, 4
cmp dword [ebp + 0xc], 0x26
je 0x51e5ff
cmp dword [ebp + 0xc], 0x28
jne 0x51e608
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
cmp dword [0x6b7e14], 0
je 0x51e61f
call fcn.0050398f
test eax, eax
je 0x51e61f
xor eax, eax
inc eax
jmp 0x51e621
xor eax, eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [edx]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 0x10
Function at 0x51ec20
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x51ed3f
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 8], eax
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x51ec62
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x51ed3f
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x51ec65
sub eax, edx
sar eax, 1
mov edi, eax
lea esi, [edi + edi + 2]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x51ec54
push eax
call ebx
mov ebx, eax
test ebx, ebx
jne 0x51eca8
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 8]
call esi
jmp 0x51ed3f
push esi
push 0
push ebx
call fcn.00402394
add esp, 0xc
xor edx, edx
xor ecx, ecx
test edi, edi
jle 0x51ed1a
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
cmp eax, 0xd
je 0x51ecd5
cmp eax, 0xa
je 0x51ecd5
mov word [ebx], ax
add ebx, 2
jmp 0x51ecd8
xor edx, edx
inc edx
inc ecx
cmp ecx, edi
jl 0x51ecbc
test edx, edx
je 0x51ed1a
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 8]
call esi
mov esi, dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x51ed36
push dword [ebp - 4]
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x51ed36
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 8]
call esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x51efb1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.00405ecb
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x104c], ax
lea eax, [ebp - 0x104a]
push eax
call fcn.00402394
add esp, 0xc
push 0x823
lea eax, [ebp - 0x104c]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x104c]
lea eax, [esi + 0x28]
lea edx, [ecx + 2]
push edi
mov di, word [ecx]
add ecx, 2
test di, di
jne 0x51f008
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x104c]
push ecx
call fcn.0040aa40
lea edi, [esi + 0x18]
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x54]
cmp dword [esi + 0x20], 0
je 0x51f054
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x1050], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x40]
mov ecx, dword [esi + 0x20]
push eax
mov eax, dword [ebp - 0x1050]
push esi
call dword [eax + 0x14]
push 1
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00403fc1
leave
ret
Function at 0x51fe4f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.00405ecb
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x104c], ax
lea eax, [ebp - 0x104a]
push eax
call fcn.00402394
add esp, 0xc
push 0x823
lea eax, [ebp - 0x104c]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x104c]
lea eax, [esi + 0x28]
lea edx, [ecx + 2]
push ebx
mov bx, word [ecx]
add ecx, 2
test bx, bx
jne 0x51fea6
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x104c]
push ecx
call fcn.0040aa40
lea eax, [esi + 0x18]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x48]
cmp dword [esi + 0x20], 0
pop ebx
je 0x51fee0
push dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
push 1
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00403fc1
leave
ret

Function at 0x51fefb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x41
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x51ff35
push 0x11
call edi
shr eax, 8
test al, al
je 0x51ff35
push 0xffffffffffffffff
lea eax, [ebx + 0x18]
mov ecx, dword [eax]
xor esi, esi
push esi
push eax
call dword [ecx + 0x30]
push esi
push esi
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.004626fc
mov esi, eax
call fcn.0046996a
test eax, eax
je 0x51ff7b
mov esi, dword [ebp + 0xc]
cmp esi, 0x25
je 0x51ff52
cmp esi, 0x27
jne 0x51ff64
push 0
push 0
push 0x48f
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, 0x26
je 0x51ff6e
cmp esi, 0x28
jne 0x51ff7b
push 0
push 0
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp + 0xc], 0x26
je 0x51ff87
cmp dword [ebp + 0xc], 0x28
jne 0x51ff90
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
cmp dword [ebx + 0x20], 0
je 0x51ffdd
push 0x11
call edi
push 0x12
shr eax, 8
movzx esi, al
call edi
push 0x10
shr eax, 8
movzx eax, al
mov dword [ebp + 8], eax
call edi
xor edx, edx
shr eax, 8
movzx eax, al
test esi, esi
je 0x51ffbe
inc edx
cmp dword [ebp + 8], 0
je 0x51ffc7
or edx, 2
test eax, eax
je 0x51ffce
or edx, 4
mov ecx, dword [ebx + 0x20]
mov eax, dword [ecx]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [eax]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0x52005b
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x520169
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 8], eax
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x52009d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x520169
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5200a0
sub eax, edx
sar eax, 1
mov edi, eax
lea esi, [edi + edi + 2]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x52008f
push eax
call ebx
mov ebx, eax
test ebx, ebx
jne 0x5200de
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
jmp 0x520164
push esi
push 0
push ebx
call fcn.00402394
add esp, 0xc
xor edx, edx
xor ecx, ecx
test edi, edi
jle 0x520150
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
cmp eax, 0xd
je 0x52010b
cmp eax, 0xa
je 0x52010b
mov word [ebx], ax
add ebx, 2
jmp 0x52010e
xor edx, edx
inc edx
inc ecx
cmp ecx, edi
jl 0x5200f2
test edx, edx
je 0x520150
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 8]
call esi
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x520169
push dword [ebp - 4]
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x520169
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 8]
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x520178
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.005201c2
test eax, eax
js 0x5201a8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x114]
lea eax, [esi + 0x18]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 4]
test eax, eax
je 0x5201c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
leave
ret

Function at 0x521416
Capabilities:
Hide graphical window

Disassembly:
xor eax, eax
push 0x71
push dword [esi + 0x1c]
inc eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x521447
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, esi
jmp fcn.0052144e
Function at 0x5214c6
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0x71
push ebx
push esi
push edi
mov esi, ecx
jne 0x52155c
push 0x71
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x25c], ebx
lea edi, [ebp - 0x258]
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
push eax
mov dword [esi + 0x5c], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov dword [ebp - 0x224], ebx
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x258]
lea eax, [ebp - 0x224]
push dword [ebp - 0x25c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x521695
call fcn.005213de
jmp 0x52168e
cmp dword [ebp + 8], 0x70
jne 0x521695
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x521695
cmp dword [esi + 0x4c], ebx
je 0x521695
cmp dword [esi + 0x50], ebx
jne 0x521695
cmp dword [esi + 0x54], ebx
jne 0x521695
xor eax, eax
mov dword [ebp - 0x25c], ebx
lea edi, [ebp - 0x258]
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov dword [ebp - 0x224], ebx
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x224]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x521695
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x254], 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test byte [ebp - 0x250], 4
jne 0x521695
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
push 0x104
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x521661
lea eax, [ebp - 0x214]
push str.edit
push eax
call fcn.00452719
pop ecx
pop ecx
test eax, eax
je 0x521695
push dword [ebp - 0x258]
lea eax, [ebp - 0x224]
push dword [ebp - 0x25c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x521695
push 0x70
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00521416
mov eax, esi
call fcn.00521296
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00403fc1
leave
ret 4
Function at 0x523006
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 1
push dword [0x6d48cc]
mov esi, eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc4]
push 5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
and dword [ebp - 4], 0
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x64fea0
push 0
push eax
call dword [ecx + 0x104]
test eax, eax
js 0x523059
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x160]
mov esi, dword [esi + 0xc]
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x114]
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x523075
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
leave
ret
Function at 0x5344f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push ebx
push esi
push 0x60
push eax
call dword [ecx + 0x24]
push ecx
mov eax, esp
mov dword [eax], str.NEW_SKIN
push ecx
xor ebx, ebx
mov eax, esp
lea esi, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [eax], str.SKIN
call fcn.0043affa
push dword [ebp - 8]
push dword [0x6d08a8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea esi, [edi + 0xc0]
push esi
push dword [ebp - 4]
push eax
push 0x673da0
call fcn.004e3593
mov ecx, dword [esi]
mov eax, dword [edi + 0x24]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x18]
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push dword [edi + 0xc4]
push 0x1450
push eax
call dword [ecx + 0x44]
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push dword [edi + 0xc8]
push 0x13a4
push eax
call dword [ecx + 0x44]
push ebx
push 0xa
push 0x3f1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x44], ebx
mov esi, dword [esi]
mov eax, dword [esi]
push 0x3fe
push esi
call dword [eax + 0x80]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0xd4], eax
mov eax, edi
call fcn.00534b26
cmp dword [ebp - 0xc], ebx
je 0x5345e8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x53a59d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x53a5bf
xor eax, eax
jmp 0x53a6ab
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x53a5d2
xor eax, eax
inc eax
jmp 0x53a6ab
and dword [ebp - 0x214], 0
mov eax, ebx
push esi
mov esi, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x53a5e1
sub eax, ecx
sar eax, 1
cmp eax, 0xdc
jbe 0x53a5fe
xor eax, eax
jmp 0x53a6aa
xor eax, eax
push edi
cmp ax, word [ebx]
je 0x53a6a3
push 0x6403a4
push esi
call fcn.005e8146
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x53a630
push 0x6377d4
push esi
call fcn.005e8146
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x53a6a3
mov esi, edi
sub esi, ebx
sar esi, 1
test esi, esi
jle 0x53a695
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00402394
push esi
push ebx
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004190f0
add esp, 0x1c
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x53a68f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], 1
cmp eax, 0xb7
je 0x53a695
mov dword [ebp - 0x214], esi
lea esi, [edi + 2]
xor eax, eax
cmp ax, word [esi]
jne 0x53a60a
mov eax, dword [ebp - 0x214]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 4
Function at 0x53eb21
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x53ebf6
call fcn.0053ec07
test eax, eax
je 0x53ebf6
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push str.vkballoon
push 0x666ab8
xor ebx, ebx
push 0x80000001
mov dword [edi + 0x68], ebx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, dword [edi + 0x40]
cmp esi, ebx
je 0x53ebf6
mov eax, dword [ebp + 8]
mov dword [edi + 0x64], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
push dword [ebp - 0x1c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
sub esi, dword [ebp - 0x14]
mov ecx, edx
sub ecx, dword [ebp - 0x18]
push 0x50
add eax, ecx
mov ecx, dword [ebp - 0xc]
add ecx, esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
sub ecx, esi
push ecx
mov dword [ebp - 0x10], eax
sub eax, edx
push eax
push esi
push edx
push ebx
push dword [edi + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call fcn.0053eded
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret 0xc