joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e614
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e7bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46e7a0
mov dl, 1
mov eax, dword [0x417f64]
call fcn.00403390
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004042d4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46e78f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045bec0
test al, al
je 0x46e782
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46e7d0
lea eax, [ebp - 0x254]
call fcn.00409b64
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46e782
xor eax, eax
push ebp
push 0x46e77b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46e808
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46e764
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404544
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46e764
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e782
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46e685
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041cd48
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e7c6
lea eax, [ebp - 0x260]
call fcn.004042d4
ret

Function at 0x46f0f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x50ebf4]
cmp byte [eax + 0xa5], 0
jne 0x46f165
cmp dword [0x50ec0c], 0
jne 0x46f126
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46f0b0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x50ec0c], eax
cmp dword [0x50ec08], 0
jne 0x46f141
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x50ec08], eax
cmp dword [0x50ec10], 0
jne 0x46f165
push esp
push 0
push 0
push 0x46f054
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x50ec10], eax
pop edx
ret
Function at 0x46f25c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46f273
add esp, 0xfffffff0
call fcn.00403724
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423498
mov eax, dword [0x50ce1c]
cmp word [eax + 2], 0
jne 0x46f29b
mov eax, dword [0x50ce1c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047094c
mov eax, dword [0x50cf10]
cmp word [eax + 2], 0
jne 0x46f2b5
mov eax, dword [0x50cf10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00470b44
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417754]
call fcn.00403390
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417754]
call fcn.00403390
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x425a64]
call fcn.0042d3f8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46f43c
mov eax, dword [0x50ccf0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042d7c8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4710f4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x50ccf0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d770
test eax, eax
je 0x46f3aa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409544
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d798
test eax, eax
je 0x46f3be
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404544
mov eax, dword [0x50cb50]
cmp byte [eax], 0
jne 0x46f3f2
mov eax, ebx
call fcn.0046f564
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004712d0
mov eax, ebx
call fcn.00471c94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46f432
call fcn.0040377c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f7e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x50ebf4]
cmp dword [eax + 0x30], 0
je 0x46f88e
cmp dword [ebx + 0x94], 0
jne 0x46f888
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46f774
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46f888
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46f84e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46f888
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a284
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46f85d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4703f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x470425
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043c4
jmp 0x470432
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404328
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4714ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4714ed
mov eax, esi
call fcn.00457488
test al, al
je 0x4714ed
mov eax, dword [ebx + 0x84]
call fcn.00457184
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4714ed
push 0
mov eax, dword [ebx + 0x84]
call fcn.00457184
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x486d60
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x486d8e
mov eax, ebx
call fcn.00487814
cmp dword [ebx + 0x40], 0
je 0x486d87
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x486dff
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x486df1
cmp dword [ebx + 8], 0
je 0x486db0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x486dc2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x486df1
cmp dword [ebx + 8], 0
je 0x486da3
cmp eax, 3
je 0x486dd5
dec eax
jne 0x486da3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x486da3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x486da3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x486e1d
cmp dword [ebx + 0x14], 0xcc
je 0x486e1d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00486e28
pop ebx
ret
Function at 0x497c0c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407470
ret

Function at 0x497d34
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404784
xor eax, eax
push ebp
push 0x497e82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00497c0c
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404794
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x497e61
xor eax, eax
push ebp
push 0x497e5a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x497e43
xor eax, eax
push ebp
push 0x497e3c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x497e25
xor eax, eax
push ebp
push 0x497e1e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00497c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e25
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e43
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e61
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.00497cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e89
lea eax, [ebp - 4]
call fcn.004042d4
ret
Function at 0x49e22c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49e29d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x50c928]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x49e287
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0049e21c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49e024]
call fcn.0049e2c4
mov dword [0x50c98c], eax
mov eax, dword [ebp - 4]
call fcn.0049e1cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e2a4
lea eax, [ebp - 8]
call fcn.00405fc8
ret

Function at 0x49fef0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49ffaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004049e0
mov eax, dword [0x50d0cc]
cmp dword [eax], 2
jne 0x49ff5f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404e1c
mov eax, dword [ebx]
call fcn.00404b54
push eax
mov eax, dword [ebx]
call fcn.00404b44
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404b54
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404e1c
jmp 0x49ff91
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.004096f4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ffb1
lea eax, [ebp - 0x3f0]
call fcn.004042d4
ret
Function at 0x4c334c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004c3338
test eax, eax
jne 0x4c336d
mov eax, esi
call fcn.004042d4
jmp 0x4c33fe
mov eax, ebx
call fcn.004c3494
test al, al
je 0x4c33b3
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004043c4
test edi, edi
je 0x4c33aa
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4c33fe
mov eax, esi
call fcn.004042d4
jmp 0x4c33fe
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x4c33f7
mov eax, dword [ebp + 0x208]
call fcn.0041b5d4
test eax, eax
jle 0x4c33e5
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0043d4ec
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404328
jmp 0x4c33fe
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.00404328
jmp 0x4c33fe
mov eax, esi
call fcn.004042d4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4da9fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x4dabaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042be2c
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.00463050
call fcn.004c5c58
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x4daa80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.00426bf4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042be2c
mov eax, dword [eax + 0xc]
pop edx
call fcn.00426bfc
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426adc
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.004095a0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042be2c
call fcn.0042799c
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426b50
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426b8c
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426b8c
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426b8c
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.00426bf4
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042be2c
mov eax, dword [eax + 0xc]
pop edx
call fcn.00426a88
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0042be2c
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x23
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*4 + 0xc]
call fcn.004268cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dabb6
lea eax, [ebp - 4]
call fcn.004042d4
ret
Function at 0x4f14b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4f14d0
mov eax, ebx
call fcn.004f0d88
cmp dword [ebx + 0x68], 0
jne 0x4f14dd
mov eax, ebx
call fcn.004f0d10
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.004f0b90
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004f1e08
cmp eax, dword [esp]
je 0x4f154b
lea eax, [esp + 0x10]
xor edx, edx
call fcn.004f1e1c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f1527
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.004f1e08
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f1540
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x4f1566
push 3
mov eax, dword [esi + 0x10]
call fcn.00457184
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x4f1573
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.0045010c
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00450130
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00450158
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0045017c
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00418bb4
mov eax, ebp
mov edx, dword [0x50cc24]
mov byte [edx + 2], al
mov eax, dword [0x50cc24]
mov byte [eax], 0
mov eax, dword [0x50cc24]
mov byte [eax + 1], 0
mov eax, dword [0x50cc24]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00457184
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00457184
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00457184
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x50cc24]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042be2c
call fcn.0042799c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00457184
push eax
mov eax, dword [0x50cc00]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00457184
push eax
call sub.user32.dll_ShowWindow
push 0
push esi
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f21f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x50cef0]
mov eax, dword [eax]
call fcn.004706a0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x4f21fb
pop esi
pop ebx
ret
Function at 0x4f2730
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.004090f8
test al, al
je 0x4f27b7
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00402dd4
or esi, 0x100
test esi, esi
jns 0x4f276b
call fcn.00403300
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404794
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x4f27b7
mov dl, 1
mov eax, dword [0x425a64]
call fcn.0042d3f8
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0042d7c8
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4f27b7
mov eax, esp
call fcn.0040e448
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4fcbc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x50eff8
test esi, esi
jne 0x4fcbda
xor eax, eax
jmp 0x4fccdc
cmp dword [ebp], 0
jne 0x4fcbe5
call fcn.004fcb50
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4fccb5
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4fcbf1
test edi, edi
jbe 0x4fccd7
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4fccb9
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret