joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c4b0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x613806
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x274], eax
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
call fcn.00401de0
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 0x290], 0
mov eax, dword [esi - 0xc]
test eax, eax
jl 0x45c536
push 0x645b40
push esi
call fcn.005a75c4
add esp, 8
test eax, eax
je 0x45c536
sub eax, esi
cmp eax, 0xffffffff
jne 0x45c5ff
cmp dword [esi - 0xc], 0
jl 0x45c57c
push 0x64fdf8
push esi
call fcn.005a75c4
add esp, 8
test eax, eax
je 0x45c559
sub eax, esi
cmp eax, 0xffffffff
jne 0x45c5ff
cmp dword [esi - 0xc], 0
jl 0x45c57c
push 0x646df4
push esi
call fcn.005a75c4
add esp, 8
test eax, eax
je 0x45c57c
sub eax, esi
cmp eax, 0xffffffff
jne 0x45c5ff
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
call fcn.00401de0
add eax, 0x10
add esp, 4
mov dword [esp + 0x10], eax
push 0
lea ecx, [esp + 0x178]
push ecx
push 0x104
push 0
push eax
push 0
mov byte [esp + 0x2a8], 1
call dword [sym.imp.kernel32.dll_SearchPathA]
test eax, eax
jne 0x45c5d9
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00401280
lea ecx, [esp + 0xc]
call fcn.00401280
mov eax, esi
jmp 0x45c651
lea ecx, [esp + 0x174]
push ecx
lea ecx, [esp + 0x10]
call fcn.004015c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x290], 0
call fcn.00401280
mov esi, dword [esp + 0xc]
push 0x105
push 0x160
lea edx, [esp + 0x1c]
push edx
push 0
push esi
call dword [sym.imp.shell32.dll_SHGetFileInfo]
test eax, eax
je 0x45c621
mov edi, dword [esp + 0x14]
jmp 0x45c62c
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
mov edi, eax
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x290], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45c64f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.005a58d9
mov esp, ebp
pop ebp
ret
Function at 0x45d450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60e068
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x10]
call fcn.005776d4
push 0x6bd90c
lea ecx, [esp + 0x10]
mov dword [esp + 0x64], 0
call fcn.00577951
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.gdi32.dll_GetTextMetricsA]
mov esi, eax
lea eax, [esp + 0x20]
push eax
push ecx
call edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
add eax, edx
add eax, dword [esp + 0x20]
push 0x6bd92c
lea ecx, [esp + 0x10]
mov dword [0x6bd94c], eax
call fcn.00577951
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call edi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add ecx, eax
add ecx, dword [esp + 0x20]
push esi
mov dword [0x6bd950], ecx
lea ecx, [esp + 0x10]
call fcn.00577951
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call fcn.00577728
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x58
ret
Function at 0x460c50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x1c], ebx
call fcn.005702dd
mov esi, dword [eax + 0xc]
movzx eax, word [ebp + 8]
push 0xf1
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
jne 0x460c8a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x460c7f
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x460c7f
movzx eax, word [edi + 6]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005655d6
movzx ecx, word [edi + 4]
add esp, 4
cmp dword [ebp + 0x10], 0
mov dword [esp + 0x10], eax
movzx eax, word [edi + 2]
push ecx
push eax
lea esi, [ecx + 6]
lea edx, [eax + 6]
push esi
push edx
je 0x460ce5
mov eax, ebx
call fcn.004605b0
jmp 0x460ced
call fcn.004604e0
add esp, 0x10
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
mov esi, 1
jne 0x460d01
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
cmp dword [ebx + 0x684], 0
jne 0x460d23
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x17c]
push ecx
push eax
mov ecx, ebx
call edx
test eax, eax
je 0x460da4
mov eax, dword [ebx + 0x680]
xor esi, esi
cmp word [edi + 6], si
mov dword [esp + 0x14], eax
jbe 0x460d7f
mov eax, edi
call fcn.00460dc0
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x10], 0
mov ecx, dword [esp + 0x18]
movzx ebx, word [ecx + esi*2]
mov edx, dword [esp + 0x10]
mov dword [edx + esi*4], ebx
jne 0x460d70
test ebx, ebx
jbe 0x460d70
mov eax, 0x6bd99c
call fcn.004a2f50
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
add ecx, 1
mov dword [esp + 0x14], ecx
movzx eax, word [edi + 6]
add esi, 1
cmp esi, eax
jl 0x460d40
mov ebx, dword [esp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x10]
mov dword [ebx + 0x684], ecx
movzx ecx, word [edi + 6]
push edx
mov edx, ebx
call fcn.00460680
mov esi, eax
test esi, esi
jne 0x460da4
mov dword [ebx + 0x684], eax
mov eax, dword [esp + 0x10]
push eax
call fcn.005655db
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473d90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x618c1b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, esi
call fcn.00470dc0
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], vtable.CBCGVisualManagerXP.0
mov ecx, vtable.CBrush.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ecx
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], vtable.CPen.0
mov byte [esp + 0x10], 9
mov ecx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 4], ecx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 8], 4
call fcn.00473f70
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x47af50
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
test eax, eax
push ebp
mov ebp, dword [esp + 0x10]
je 0x47af64
mov dword [eax], 1
mov eax, dword [0x6bce88]
test eax, eax
je 0x47af9d
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.user32.dll_IsWindow]
test eax, eax
je 0x47af9d
mov ecx, dword [0x6bce88]
mov edx, dword [ecx + 0x20]
push 0
push ebp
push 0x100
push edx
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, 1
pop ebp
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x50]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.user32.dll_IsIconic]
test eax, eax
jne 0x47af93
cmp dword [0x6bce3c], eax
je 0x47afbf
pop ebp
pop ecx
ret 0xc
push ebx
mov ebx, dword [0x6bd984]
push esi
mov dword [esp + 0xc], 0
push edi
test ebx, ebx
je 0x47b026
mov eax, ebx
mov edi, dword [eax + 8]
mov edx, dword [edi + 0x20]
mov ebx, dword [ebx]
push edx
call fcn.005680eb
test eax, eax
je 0x47afd0
mov eax, edi
xor esi, esi
call fcn.00465230
test eax, eax
jle 0x47afd0
mov eax, esi
mov ecx, edi
call fcn.00461d30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x98]
call eax
test eax, eax
jne 0x47b01e
mov eax, edi
add esi, 1
call fcn.00465230
cmp esi, eax
jl 0x47aff5
jmp 0x47afd0
mov dword [esp + 0x10], 1
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x11
mov byte [esp + 0x20], 0
call esi
test ax, ax
jns 0x47b03f
mov byte [esp + 0x1c], 8
push 0x12
call esi
test ax, ax
jns 0x47b04d
or byte [esp + 0x1c], 0x10
push 0x10
call esi
test ax, ax
jns 0x47b05b
or byte [esp + 0x1c], 4
mov edi, dword [esp + 0x10]
test edi, edi
mov esi, dword [esp + 0x18]
jne 0x47b0a0
movzx ebx, byte [esp + 0x1c]
mov ecx, dword [esi + 0x50]
push 1
or ebx, 1
push ebx
push ebp
call fcn.00457e80
add esp, 0xc
test eax, eax
jne 0x47b0d2
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x140]
call eax
push ebx
push ebp
mov ecx, eax
call fcn.00457e80
add esp, 0xc
test eax, eax
jne 0x47b0d2
cmp byte [esp + 0x1c], 0x10
jne 0x47b0c0
push ebp
mov ebx, esi
call fcn.0047bdc0
test eax, eax
je 0x47b0c0
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x47b0d2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47b0d2
mov dword [eax], 0
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
pop ecx
ret 0xc
Function at 0x47cae0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x140
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [edi + 0x94]
push ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageA]
push esi
push 0
push 0
push 0xb
push eax
call ebx
mov ecx, dword [edi + 0x94]
push 0
push 0
push 0x184
push ecx
call ebx
lea ecx, [edi + 0xd4]
mov dword [edi + 0xd0], 1
call fcn.00457320
mov edx, dword [edi + 0xc8]
mov eax, dword [edx + 0xd4]
push 5
push eax
call dword [sym.imp.user32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x47cc33
push esi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
je 0x47cc20
push 0x100
lea ecx, [esp + 0x44]
push ecx
push esi
call dword [sym.imp.user32.dll_GetWindowTextA]
mov eax, dword [edi + 0x94]
lea edx, [esp + 0x40]
push edx
push 0
push 0x180
push eax
call ebx
mov ecx, dword [edi + 0x94]
push esi
push eax
push 0x19a
push ecx
call ebx
push 0xfffffffffffffff0
push esi
call dword [sym.imp.user32.dll_GetWindowLongA]
test eax, 0x80000
jne 0x47cbb8
mov dword [edi + 0xd0], 0
jmp 0x47cc20
push 0
push esi
call dword [sym.imp.user32.dll_GetSystemMenu]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x47cbd1
mov dword [edi + 0xd0], eax
jmp 0x47cc20
push 0x30
lea edx, [esp + 0x14]
push 0
push edx
call fcn.005ab440
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push 0xf060
push ecx
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 1
call dword [sym.imp.user32.dll_GetMenuItemInfoA]
test eax, eax
je 0x47cc14
test byte [esp + 0x1c], 3
je 0x47cc20
push esi
lea ecx, [edi + 0xd4]
call fcn.004572f0
push 2
push esi
call dword [sym.imp.user32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x47cb57
mov edx, dword [edi + 0x94]
push 0
push 1
push 0xb
push edx
call ebx
mov ecx, dword [esp + 0x144]
pop esi
pop ebx
xor ecx, esp
call fcn.005a58d9
mov esp, ebp
pop ebp
ret
Function at 0x482580
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6132f3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
mov eax, esi
call fcn.0046b680
mov dword [esp + 0x18], 0
push 0xa
lea ecx, [esi + 0x64]
mov dword [esi], vtable.CBCGToolbarMenuButton.0
call fcn.0058d1cf
mov eax, esi
mov byte [esp + 0x18], 1
call fcn.00482640
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov dword [esi + 4], ecx
push edx
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0046cbc0
test edi, edi
jne 0x4825f7
mov edi, 0x641d28
test edi, edi
lea ecx, [esi + 0x10]
jne 0x482602
xor eax, eax
jmp 0x482612
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x482607
sub eax, ebx
push eax
push edi
call fcn.004014d0
mov eax, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.00483490
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x14
Function at 0x490010
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x60f87e
mov eax, dword fs:[0]
push eax
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
cmp dword [0x6a6e74], 0xfffffffe
jne 0x4900f3
cmp esi, 0xffffffff
je 0x490108
mov eax, 1
test byte [0x6be794], al
jne 0x49007b
or dword [0x6be794], eax
mov dword [esp + 0xc], 0
call fcn.0048fe50
push 0x6212c0
call fcn.005a5c9a
add esp, 4
mov dword [esp + 0xc], 0xffffffff
push 0x6be35c
call fcn.0048fef0
push 0
push 0
push 0x48ffa0
call fcn.005af46d
add esp, 0xc
test eax, eax
mov dword [0x6bcec4], eax
jbe 0x4900ce
cmp eax, 0xffffffff
je 0x4900ce
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0x6be364
mov dword [0x6a6e74], esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
push 0x6be364
mov dword [0x6bcec4], 0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
cmp esi, 0xffffffff
mov dword [0x6a6e74], esi
jne 0x490108
mov dword [0x6bcec4], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret
Function at 0x49e700
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x610f56
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CBCGOutlookBarPage.0
mov dword [esp + 0x18], 1
mov eax, dword [esi + 0x10]
mov edx, dword [eax + 0x60]
lea edi, [esi + 0x10]
mov ecx, edi
call edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x49e754
push 0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, edi
mov byte [esp + 0x18], 0
call fcn.00472720
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esi + 8]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49e787
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4a51d1
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x148]
push edi
call edx
mov bx, word [esp + 0x10]
mov edi, eax
movzx eax, bx
push 2
push eax
call dword [sym.imp.user32.dll_MapVirtualKeyA]
cmp byte [esp + 0x14], 0
jne 0x4a5224
test edi, edi
jl 0x4a5224
cmp al, 0x20
je 0x4a5207
cmp bx, 0x71
jne 0x4a5224
mov edx, dword [esi]
mov eax, dword [edx + 0x148]
mov ecx, esi
call eax
test eax, eax
jl 0x4a5224
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x160]
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x4ac070
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x617e41
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
push ebp
push esi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov esi, dword [sym.imp.gdi32.dll_GetStockObject]
xor ebx, ebx
push ebx
call esi
push eax
call fcn.0057786b
push 4
mov dword [esp + 0x30], eax
call esi
push eax
call fcn.0057786b
mov ebp, eax
mov eax, vtable.CRgn.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xcc], 2
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
mov ebx, dword [edi + 0x40]
add eax, 2
push eax
sub ebx, 1
push ecx
lea esi, [esp + 0x68]
call fcn.004abf20
push 1
push 6
mov edx, esi
push edx
call dword [sym.imp.gdi32.dll_CreatePolygonRgn]
push eax
lea ecx, [esp + 0x28]
call fcn.00577879
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4ac125
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xd4]
mov edx, dword [ecx + 4]
push 2
push 2
push eax
mov eax, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.gdi32.dll_FrameRgn]
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
mov ebx, dword [edi + 0x40]
add eax, 2
push eax
push ecx
lea esi, [esp + 0x38]
call fcn.004abf20
push 1
push 6
mov edx, esi
push edx
call dword [sym.imp.gdi32.dll_CreatePolygonRgn]
push eax
lea ecx, [esp + 0x20]
call fcn.00577879
test ebp, ebp
jne 0x4ac176
xor eax, eax
jmp 0x4ac179
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0xd4]
mov edx, dword [ecx + 4]
push 1
push 1
push eax
mov eax, dword [esp + 0x2c]
push eax
push edx
call dword [sym.imp.gdi32.dll_FrameRgn]
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
mov ebx, dword [edi + 0x40]
sub eax, 1
push eax
push ecx
lea esi, [esp + 0x98]
call fcn.004abf20
push 1
push 6
mov edx, esi
push edx
call dword [sym.imp.gdi32.dll_CreatePolygonRgn]
push eax
lea ecx, [esp + 0x18]
call fcn.00577879
test ebp, ebp
je 0x4ac1cc
mov ebp, dword [ebp + 4]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xd4]
mov edx, dword [ecx + 4]
push 1
push 1
push ebp
push eax
push edx
call dword [sym.imp.gdi32.dll_FrameRgn]
mov byte [esp + 0xcc], 1
mov esi, vtable.CRgn.0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.00424fa0
mov byte [esp + 0xcc], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], esi
call fcn.00424fa0
mov dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00424fa0
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret 4
Function at 0x4af740
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
cmp dword [0x6bced4], 0
je 0x4af74f
mov eax, 1
ret
call fcn.004aef50
test eax, 0x4003
jne 0x4af75e
xor eax, eax
ret
push ebx
push str.HSTxtCap.dll
xor ebx, ebx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
mov dword [0x6bced4], eax
je 0x4af863
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.GetSharedData
push eax
call esi
mov dword [0x6bced8], eax
mov eax, dword [0x6bced4]
push str.CaptureConsoleText
push eax
call esi
mov ecx, dword [0x6bced8]
test ecx, ecx
mov dword [0x6bcefc], eax
je 0x4af849
test eax, eax
je 0x4af849
call ecx
test eax, eax
mov dword [0x6bcee8], eax
je 0x4af849
mov ecx, dword [0x6bcf00]
test ecx, ecx
je 0x4af7dd
cmp dword [eax + 8], ecx
jne 0x4af7dd
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
ret
cmp dword [eax + 8], ebx
jne 0x4af849
mov ecx, dword [0x6bced4]
push str.InstallTxMsgHook
push ecx
call esi
mov edx, dword [0x6bced4]
push str.ReleaseTxMsgHook
push edx
mov dword [0x6bcedc], eax
call esi
mov dword [0x6bcee0], eax
mov eax, dword [0x6bced4]
push str.TxSnap_SetSnapMoreMode
push eax
call esi
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x4af3b0
mov dword [0x6bcee4], eax
mov dword [0x6bcef8], ecx
mov ebx, 1
mov dword [0x6bcef0], 0
call fcn.005af46d
add esp, 0xc
pop esi
mov eax, ebx
pop ebx
ret
mov edx, dword [0x6bced4]
push edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [0x6bced4], ebx
mov dword [0x6bcee8], ebx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4afa70
Capabilities:
Delete file
Open clipboard
Write clipboard data

Disassembly:
push ecx
mov eax, dword [0x6a6e6c]
push ebx
mov ebx, dword [sym.imp.user32.dll_SetClipboardData]
push ebp
push esi
push edi
xor ebp, ebp
xor edi, edi
test al, 1
je 0x4afac4
test eax, 0x4000
jne 0x4afac4
call fcn.004b1dd0
mov esi, eax
test esi, esi
je 0x4afac4
push edi
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x4afabd
call dword [sym.imp.user32.dll_EmptyClipboard]
push esi
push 0xd
lea ebp, [edi + 1]
call ebx
call dword [sym.imp.user32.dll_CloseClipboard]
mov edi, ebp
jmp 0x4afac4
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [0x6a6e6c]
test eax, 0x4002
je 0x4afb22
test eax, 0x4000
je 0x4afade
call fcn.004b34a0
jmp 0x4afae3
call fcn.004b2440
mov esi, eax
test esi, esi
je 0x4afb22
push 0
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x4afb1b
test ebp, ebp
jne 0x4afaff
call dword [sym.imp.user32.dll_EmptyClipboard]
push esi
push str.Rich_Text_Format
call dword [sym.imp.user32.dll_RegisterClipboardFormatA]
push eax
call ebx
call dword [sym.imp.user32.dll_CloseClipboard]
mov edi, 1
jmp 0x4afb22
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
mov esi, dword [0x6bcee8]
cmp byte [esi + 0x50], 0
lea eax, [esi + 0x50]
je 0x4afb51
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov esi, dword [0x6bcee8]
push 0x106
lea eax, [esi + 0x50]
push 0
push eax
call fcn.005ab440
add esp, 0xc
mov eax, dword [0x6bcef8]
xor ecx, ecx
cmp eax, ecx
je 0x4afb8a
cmp edi, ecx
je 0x4afb8a
push ecx
mov ecx, dword [0x6be184]
push 4
push ecx
push eax
call dword [sym.imp.user32.dll_PostMessageA]
mov eax, dword [0x6bcee8]
mov dword [eax + 0x3c], 0
mov dword [eax + 0x4c], 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [esi + 0x4c], 1
mov dword [esi + 0x3c], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4b0470
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x60dc78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
mov ecx, esi
call fcn.00566b84
mov dword [esp + 0x38], 0
push 0x4c
mov dword [esi], vtable.CTxCoverWin.0
call fcn.0056572d
push 0x4d
mov ebp, eax
call fcn.0056572d
mov edi, eax
push 0x4e
mov dword [esp + 0x28], edi
call fcn.0056572d
add eax, ebp
push 0x4f
mov dword [esp + 0x2c], eax
call fcn.0056572d
push 0
push 0
push 0
add eax, edi
push str.DISPLAY
mov dword [esp + 0x3c], eax
call dword [sym.imp.gdi32.dll_CreateDCA]
mov edi, eax
push edi
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x28]
mov ebx, eax
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
sub ecx, ebp
push eax
push ecx
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esi + 0x54], eax
call dword [sym.imp.gdi32.dll_SelectObject]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0x40cc0020
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
push eax
push ebp
push edi
push ecx
push edx
push 0
push 0
push ebx
call dword [sym.imp.gdi32.dll_BitBlt]
mov eax, dword [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.gdi32.dll_SelectObject]
push ebx
mov ebx, dword [sym.imp.gdi32.dll_DeleteDC]
call ebx
push edi
call ebx
xor edi, edi
cmp dword [0x6bcf08], edi
mov eax, 1
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0x90], 0xffffffff
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
jne 0x4b05b1
push edi
push edi
push edi
push 8
call fcn.0056abae
mov dword [0x6bcf08], eax
mov dword [esi + 0x5c], 2
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
call dword [sym.imp.user32.dll_GetDesktopWindow]
push eax
call fcn.005680c4
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edi
push edi
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [0x6bcf08]
push eax
push ecx
push ebp
push 0x80000000
push 0x641d28
push edx
push 0x80
mov ecx, esi
call fcn.00569f30
mov eax, dword [esi + 0x20]
mov dword [0x6bcd48], eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4