joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1675
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4e178d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e178d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004f6500
mov esi, eax
test esi, esi
je 0x4e178d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4e178d
mov ecx, esi
call fcn.004e1600
cmp edi, eax
jge 0x4e178d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4e1713
mov dword [esp + 0x34], 1
jmp 0x4e176e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4e178d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004e0bf0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4f6ea4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f6edc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f4f31
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f4f09
jmp 0x4f6ee8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f859a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f85dc
call fcn.004fe049
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f85dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f85d3
xor eax, eax
jmp 0x4f85e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f85ea
pop edi
pop esi
pop ebx
ret 4
Function at 0x4fe579
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4fe5a7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4fe5c5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004fe4df
jmp 0x4fe5c5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4fe5c5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004fe4df
test edi, edi
mov eax, edi
jne 0x4fe5af
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret
Function at 0x41ea92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x41eb67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x41eb31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x41eb5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041eb71
test eax, eax
je 0x41eb67
add ebx, 0x14
jmp 0x41eb3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x41eb71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x41eddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x41eddd
mov eax, 1
test eax, eax
je 0x41eddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x41eddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x41edd3
mov ebx, eax
and eax, 0x80000000
jne 0x41ed4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x41eddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x41eddd
mov eax, 1
test eax, eax
je 0x41eddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x41eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x41eca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x41eddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x41eb67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x41eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x41eca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x41ee9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x41efee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x41efee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.0041eff8
test eax, eax
je 0x41efee
add ebx, 0x28
dec ecx
jne 0x41efc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x41f09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x41f0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x41f12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x41f0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x41f12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x41f105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x41f12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x41f123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x41f12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x41f16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x41f172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x41f1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x41f1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x41fdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0041ff04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0041ff20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0041feec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0041ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0041fecb
push ecx
push dword [ebp + 8]
call fcn.0041ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0041ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0041fecb
push ecx
push dword [ebp + 8]
call fcn.0041ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0041ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0041fecb
push ecx
push dword [ebp + 8]
call fcn.0041ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0041ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0041fecb
cmp ecx, 0x2b
jne 0x41fe0f
leave
ret 0xc

Function at 0x4214b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x421544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0xcc10
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4215d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0xcc10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0xcc10
call fcn.004213fa
push 0xcc10
push dword [ebp + 0xc]
call fcn.0041f1a8
test eax, eax
jne 0x4215b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0xcc10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004215dd
test eax, eax
je 0x4215d6
jmp 0x421574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4215d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x42160b
Capabilities:
Terminate process

Disassembly:
call fcn.00421618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x442578
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44258a
add esp, 0xfffffff0
call fcn.004030ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041532c
mov eax, ebx
call fcn.004428c4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x442548
push eax
push 0
push 0
mov eax, dword [0x47afb0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4167f4]
call fcn.00417ad0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x4167f4]
call fcn.00417ad0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4167f4]
call fcn.00417ad0
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.00442ca4
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x442bc0
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x442bc0
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x442bc0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x442699
call fcn.00403144
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x443504
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44351b
add esp, 0xfffffff0
call fcn.004030ec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041532c
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40e0d4]
call fcn.00402dd4
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x416f28]
call fcn.0041caec
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x443690
mov eax, dword [0x47ae30]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041cebc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x445038
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x47ae30]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040b7a0
test eax, eax
je 0x44360e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b54
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b7c8
test eax, eax
je 0x443622
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403d44
mov eax, dword [0x47ac18]
cmp byte [eax], 0
jne 0x443653
mov eax, ebx
call fcn.0044377c
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x443685
call fcn.00403144
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4439ec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47c7d8]
cmp dword [eax + 0x24], 0
je 0x443a8f
cmp dword [ebx + 0x84], 0
jne 0x443a89
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44397c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x443a89
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x443a52
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x443a89
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040fa9c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x443a61
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44449c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4444d1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403bfc
jmp 0x4444db
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b68
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4453ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x4453e4
mov eax, esi
call fcn.0042d18c
test al, al
je 0x4453e4
mov eax, dword [ebx + 0x74]
call fcn.0042ce90
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4453e4
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042ce90
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44b094
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f58
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x44b0ec
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47b2a0]
mov dl, 1
mov eax, dword [0x44ab98]
call fcn.0040ac54
call fcn.00403544
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044aca0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8