joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fedc8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x4fee74
cmp dword [ebx + 0x98], 0
jne 0x4fee6e
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4fed00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x4fee6e
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4fee34
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4fee6e
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00445ca4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4fee43
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ff094
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x53c2b8]
cmp dword [eax + 0x178], 0
je 0x4ff1f9
test bl, bl
jne 0x4ff147
cmp dword [esi + 0xa0], 0
jne 0x4ff13c
mov eax, esi
call fcn.00501f90
push eax
push 0x4fefa0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x4ff10d
mov eax, dword [0x53c2b8]
cmp byte [eax + 0xd7], 0
je 0x4ff10d
mov eax, dword [esi + 0xdc]
call fcn.00409588
mov edi, eax
cmp edi, 0
jl 0x4ff10d
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ff0f6
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ff13c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00445ca4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ff11c
inc dword [esi + 0xa0]
jmp 0x4ff1f9
cmp dword [esi + 0xa0], 0
jle 0x4ff1f9
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x4ff1f9
cmp dword [esi + 0x48], 0
je 0x4ff1a4
mov eax, dword [0x53c2b8]
cmp byte [eax + 0xd7], 0
je 0x4ff1a4
mov eax, dword [esi + 0xdc]
call fcn.00409588
mov edi, eax
cmp edi, 0
jl 0x4ff1a4
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ff18d
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ff1d3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00445ca4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ff1b3
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4f118c]
call fcn.00409734
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4ffe4c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x4ffeb7
cmp byte [ebx + 0xd7], 0
jne 0x4ffeb7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00407774
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ffea4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ffec4
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.004079cc
jmp 0x4ffec4
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.004079cc
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x5016fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x50176a
mov eax, esi
call fcn.004918f8
test al, al
je 0x50176a
mov eax, dword [ebx + 0x88]
call fcn.00491544
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50176a
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x50175e
push 0
mov eax, dword [ebx + 0x88]
call fcn.00491544
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.00488360
jmp 0x50176a
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.00501534
pop esi
pop ebx
ret
Function at 0x510f04
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004076d0
xor eax, eax
push ebp
push 0x511043
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x511016
xor edx, edx
push ebp
push 0x51100f
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x510f51
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x510fe4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x510fd3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x510f96
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.004082d4
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00404768
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510fda
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x536864]
mov dl, 1
mov eax, dword [0x41975c]
call fcn.0042453c
call fcn.00406d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51104a
lea eax, [ebp - 4]
call fcn.004075ec
ret
Function at 0x46e45e
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004aca30
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [esp], eax
cmp dword [esp], 0
je 0x46e49f
push 0
push dword [esp + 4]
lea eax, [0x47166c]
push eax
push 0xd
call sub.USER32.DLL_SetWindowsHookExW
mov dword [0x6201dc], eax
jmp 0x46e5be
push 0
push 0x131
push 0x42c
push dword [0x620210]
call sub.USER32.DLL_SendMessageW
mov ebx, eax
movzx eax, byte [0x620311]
cmp ebx, eax
jne 0x46e531
push edx
call fcn.004ac890
pop edx
push eax
push 0x30
push edx
call fcn.004ac890
pop edx
push eax
mov edx, 0x5d6784
push edx
call fcn.004ac8d0
push edx
call fcn.004ac890
pop edx
push eax
push edx
call fcn.004ac890
pop edx
push eax
mov eax, dword [esp + 0x18]
cdq
push edx
push eax
call fcn.004a9e50
pop eax
mov edx, 0x5d2dea
push edx
call fcn.004ac8d0
call fcn.004ac9c0
mov eax, 0x5ceb18
push eax
call fcn.00476122
add dword [esp + 4], edx
call fcn.0047a5cb
call fcn.00476140
jmp 0x46e5be
push 0
push 0x131
push 0x42c
push dword [0x620210]
call sub.USER32.DLL_SendMessageW
mov ebx, eax
movzx eax, byte [0x620313]
cmp ebx, eax
jne 0x46e5be
push edx
call fcn.004ac890
pop edx
push eax
push 0x30
push edx
call fcn.004ac890
pop edx
push eax
mov edx, str.Error_code:_3564_nLine
push edx
call fcn.004ac8d0
push edx
call fcn.004ac890
pop edx
push eax
push edx
call fcn.004ac890
pop edx
push eax
mov eax, dword [esp + 0x18]
cdq
push edx
push eax
call fcn.004a9e50
pop eax
mov edx, str.:_cant_get_module_handle.
push edx
call fcn.004ac8d0
call fcn.004ac9c0
mov eax, str.Error__
push eax
call fcn.00476122
add dword [esp + 4], edx
call fcn.0047a5cb
call fcn.00476140
xor eax, eax
add esp, 8
pop ebx
ret

Function at 0x477007
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x50]
push dword [0x621568]
call fcn.004ac00f
mov esi, eax
test esi, esi
je 0x4770be
mov edi, dword [sym.imp.USER32.DLL_SendMessageW]
xor ebp, ebp
push ebp
push dword [esp + 0x58]
push 0x419
push dword [esi]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4770be
lea eax, [esp + 0x10]
push eax
push ebx
push 0x41d
push dword [esi]
call edi
mov dword [esp + 0x20], 0x2c
mov dword [esp + 0x24], 0x10
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x433
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], ebp
push dword [esi + 4]
call edi
lea eax, [esp + 0x20]
push eax
push ebp
push 0x432
push dword [esi + 4]
call edi
xor eax, eax
inc eax
jmp 0x4770c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x477187
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x47721f
push edi
push 0x621574
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x6203f8]
test edi, edi
je 0x4771f3
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4771ec
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x6203f8
call fcn.004ac7ae
pop ecx
pop ecx
jmp 0x4771ee
mov edi, dword [edi]
test edi, edi
jne 0x4771c3
pop ebx
mov eax, dword [0x61d744]
mov esi, eax
inc eax
push 0x10
push 0x6203f8
mov dword [0x61d744], eax
call fcn.004ac7ee
pop ecx
pop ecx
push 0x621574
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x477227
Capabilities:
Suspend thread

Disassembly:
push dword [esp + 4]
call fcn.0047713b
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret 4

Function at 0x47723a
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.0047713b
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x621574
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x6203f8]
jmp 0x47726b
cmp dword [esi + 0xc], edi
je 0x477271
mov esi, dword [esi]
test esi, esi
jne 0x477264
jmp 0x477289
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x6203f8
call fcn.004ac7ae
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4

Function at 0x477296
Capabilities:
Resume thread

Disassembly:
push dword [esp + 4]
call fcn.0047713b
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret 4
Function at 0x478609
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push ebx
push dword [0x62042c]
xor ebp, ebp
mov edi, ebp
mov dword [esp + 0x18], ebp
call fcn.004ac00f
mov esi, eax
test esi, esi
je 0x47879e
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
cmp dword [esi + 0x14], ebp
je 0x4786b3
push ebx
call fcn.00478979
jmp 0x47864b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], 0
jne 0x478643
push dword [esi + 0x14]
call fcn.00478aeb
mov eax, dword [esp + 0x1c]
push ebp
push esi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
call fcn.00478594
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
push ebp
push esi
push 0x4787b8
push 0x2000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x478690
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], 0xffffffff
je 0x4786a1
push dword [esp + 0x20]
push ebx
call fcn.00478a4d
mov eax, dword [esi]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esi]
push 1
jmp 0x478753
test byte [esp + 0x1c], 1
je 0x4786c2
mov dword [esp + 0x10], 1
test byte [esp + 0x1c], 2
je 0x47875d
push esi
call fcn.0047852b
lea eax, [esi + 4]
push 0x10
push eax
call fcn.004ac7ee
pop ecx
pop ecx
mov ecx, dword [0x62098c]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x14]
test eax, eax
jne 0x47879e
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov byte [edi + 5], al
mov byte [edi + 4], 1
mov eax, dword [esp + 0x18]
push dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [esp + 0x18]
push dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [esp + 0x20], 0xffffffff
je 0x47873e
push edi
push dword [esp + 0x24]
push ebx
call fcn.004789ad
jmp 0x47874b
mov eax, dword [esp + 0x18]
push dword [esi + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x18]
push dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x30]
jmp 0x47879e
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
mov eax, dword [esp + 0x18]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [esp + 0x20], 0xffffffff
je 0x47877f
push dword [esp + 0x20]
push ebx
call fcn.00478a4d
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
push ebx
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x47879e
xor edi, edi
mov byte [esi + 0x1c], 1
inc edi
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x47aac9
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x47ab1e
push dword [esp + 0x10]
push 0x47aa48
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x620748]
test esi, esi
je 0x47ab77
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x47ab16
cmp byte [esi + 0x10], 0
je 0x47ab16
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x47aaf2
jmp 0x47ab77
mov esi, dword [0x620748]
test esi, esi
je 0x47ab77
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x47ab70
cmp byte [esi + 0x11], 0
je 0x47ab4c
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x47ab63
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x620748
call fcn.004ac7ae
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x47ab2b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x496fe0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x6209cc], 0
jne 0x496fee
call fcn.00496f60
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x6209d0]
call esi
test eax, eax
jne 0x497011
call fcn.00496f60
push dword [0x6209d0]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x497020
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x497080
mov ebx, 0x10
test edi, edi
jns 0x497089
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x497052
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4970a0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x6209cc], 0
jne 0x4970ae
call fcn.00496f60
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x6209d0]
call esi
mov edx, eax
test edx, edx
jne 0x4970d5
call fcn.00496f60
push dword [0x6209d0]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x497108
mov ebx, 0x10
test esi, esi
jns 0x497111
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x497120
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x49cb88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6218cc]
call fcn.004ac00f
mov ebx, eax
test ebx, ebx
je 0x49cbec
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x49cbb1
push dword [esp + 0xc]
push ebx
call eax
jmp 0x49cbec
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004acbf0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004accd0
pop edi
pop esi
pop ebx
ret 8

Function at 0x49d766
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, eax
jle 0x49d7d8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x49d78f
mov ebx, eax
push dword [ebp]
call fcn.0049cf32
push ebx
push dword [ebp]
mov edi, eax
call fcn.0049cf09
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.DLL_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.DLL_EnableWindow]
push esi
push dword [ebp]
call fcn.0049d7f8
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4a0a19
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x4a0a93
push 9
call esi
test al, al
jns 0x4a0a93
push 0x11
call esi
test al, al
js 0x4a0a93
push 0x10
call esi
test al, al
js 0x4a0a93
push 0x12
call esi
test al, al
js 0x4a0a93
push 5
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [ebp - 0x10]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4a0a93
push eax
push eax
push 0x44e
push ebx
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x4a0a93
xor eax, eax
jmp 0x4a0b14
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a0abb
push 0x11
call esi
test al, al
js 0x4a0ab3
push 0x10
call esi
test al, al
js 0x4a0ab3
push 0x12
call esi
test al, al
jns 0x4a0abb
push 1
push edi
call fcn.004a0b1c
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test ebx, ebx
je 0x4a0ad1
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x4a0b11
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x4a0b11
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x4a0b11
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x4a0b11
lea eax, [esi - 1]
push eax
push dword [0x621a78]
call fcn.004ac00f
test eax, eax
je 0x4a0b11
mov eax, dword [eax + 8]
jmp 0x4a0b13
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a0c7b
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4a0dc3
xor ecx, ecx
cmp word [eax], cx
je 0x4a0dc3
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x4a0cd4
cmp eax, 3
jne 0x4a0d0e
cmp word [esp + 0xa], 0x3a
jne 0x4a0d0e
cmp eax, 2
jne 0x4a0cf2
lea eax, [esp + 8]
push 0x58b8f4
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4a0dc3
push 0xfffffffffffffffe
pop edi
jmp 0x4a0dc3
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x4a0d23
cmp ax, bx
jne 0x4a0d2d
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x4a0d16
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4a0d6c
test byte [esp + 0x21c], 0x10
je 0x4a0d53
push 0xfffffffffffffffe
pop edi
jmp 0x4a0d63
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4a0dc1
cmp word [esp + 0x10], bp
jne 0x4a0d7a
cmp word [esp + 0x12], bp
je 0x4a0d99
cmp word [esp + 0x10], bx
jne 0x4a0d88
cmp word [esp + 0x12], bx
je 0x4a0d99
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x4a0dc1
cmp word [esp + 0x12], ax
jne 0x4a0dc1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4a0dae
test al, 0x10
je 0x4a0dc1
jmp 0x4a0dbe
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4a0dc1
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4