joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43babc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x43baeb
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x43bb6a
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0043a38c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x43bb38
mov cx, word [esp]
sub cx, si
jmp 0x43bb3a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x43bb21
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x43bb60
mov cx, word [esp]
sub cx, si
jmp 0x43bb62
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x43bb49
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x43bbc7
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0043b790
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x43bbb2
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x43bbc7
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x43bac6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x451924
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, byte [0x451960]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45193b
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45194a
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x451959
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x459c8c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405864
xor eax, eax
push ebp
push 0x459e21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x459def
xor edx, edx
push ebp
push 0x459de8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004058d0
mov eax, dword [ebp - 8]
test eax, eax
je 0x459cfb
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x459cfb
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004050b0
test eax, eax
je 0x459d04
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x459dbd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x459dac
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004058d0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x459d66
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x459d66
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004050b0
test eax, eax
je 0x459d6f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00405908
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004031a0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459db3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x56ad90]
mov dl, 1
mov eax, dword [0x409ca8]
call fcn.00410760
call fcn.00404724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e28
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405874
ret

Function at 0x45c564
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040587c
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x45c5ab
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405a7c
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x461b08
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461c41
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x42d5f8]
call fcn.0042d734
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x461c17
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042d7d4
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00405a7c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x461c5c
call fcn.00405c50
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0042d960
test al, al
je 0x461c01
lea ecx, [ebp - 4]
mov edx, 0x461cd0
mov eax, dword [ebp - 0xc]
call fcn.0042dbac
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00412da0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x461bfa
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x461ce8
mov eax, dword [ebp - 8]
push eax
call fcn.0040845c
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x566560]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c01
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c1e
mov eax, dword [ebp - 0xc]
call fcn.00403d30
ret

Function at 0x461d4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x461d93
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x461d76
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x461d87
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x461d93
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x467ab8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x57116c], 0
je 0x467bf9
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x56b194]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x467bf9
mov eax, dword [0x571170]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x57116c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x467bc8
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x57116c]
call fcn.0041fa70
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x467bc0
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x467bc0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x467bc0
mov eax, dword [ebp - 0x14]
call fcn.00472ce0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x467bc0
push ebp
call fcn.00467a74
pop ecx
test al, al
jne 0x467bc0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403f40
test al, al
je 0x467bc0
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403f40
cmp byte [ebp - 1], 0
je 0x467bc0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040810c
test al, al
je 0x467bc0
mov edx, dword [ebp - 0x14]
mov eax, dword [0x571170]
call fcn.004671ec
inc edi
dec ebx
jne 0x467b1d
mov eax, dword [0x571170]
cmp dword [eax + 8], 0
jle 0x467be0
mov eax, dword [0x571170]
call fcn.004672a4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x467bf9
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004678d8
pop ecx
test al, al
jne 0x467bf9
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f9cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004080f4
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00469f34
test ebx, ebx
jne 0x46fa1f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0046f860
mov ebx, eax
test ebx, ebx
je 0x46fb0a
cmp esi, ebx
je 0x46fa48
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x46fa5d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x46fa95
add eax, 0xffffff5f
sub eax, 2
jb 0x46faad
dec eax
sub eax, 2
jb 0x46fac1
dec eax
sub eax, 2
jb 0x46fab7
jmp 0x46facb
add eax, 0xfffffdff
sub eax, 2
jb 0x46faad
dec eax
sub eax, 2
jb 0x46fac1
dec eax
sub eax, 2
jb 0x46fab7
jmp 0x46facb
mov byte [esp + 0x120], 0
jmp 0x46fad3
mov byte [esp + 0x120], 2
jmp 0x46fad3
mov byte [esp + 0x120], 1
jmp 0x46fad3
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00480888
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0046b73c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x46fb0c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x480390
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x4803b1
test edi, 0x40000
je 0x4803cb
test bl, bl
jne 0x48044c
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x48044c
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4803fe
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x480413
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x480422
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x480433
cmp byte [esp + 2], 0
je 0x48044c
cmp byte [esp + 2], 0
je 0x480444
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x48044c
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4806f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x48071a
mov eax, esp
push eax
push 0x4806bc
call sub.user32.dll_EnumWindows
jmp 0x48072d
mov eax, esp
push eax
push 0x48069c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4807f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x480844]
test si, 4
je 0x480805
or bl, 1
test si, 8
je 0x48080f
or bl, 4
test si, 1
je 0x480819
or bl, 8
test si, 2
je 0x480823
or bl, 0x10
test si, 0x10
je 0x48082d
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48083c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x480848
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x480884]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x480862
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x480871
or bl, 4
test esi, 0x20000000
je 0x48087c
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x488bbc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x488bce
add esp, 0xfffffff0
call fcn.00404180
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427484
mov eax, dword [0x56ae44]
mov dword [eax + 4], ebx
mov dword [eax], 0x488fd0
mov eax, dword [0x56ae50]
mov dword [eax + 4], ebx
mov dword [eax], 0x488fdc
mov eax, ebx
call fcn.00488fe8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x48400c
push eax
push 0
push 0
mov eax, dword [0x56b090]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42e2c4]
call fcn.00430110
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x42e2c4]
call fcn.00430110
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x42e2c4]
call fcn.00430110
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x42e2c4]
call fcn.00430110
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0048957c
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x489404
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x489404
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x489404
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x489404
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x488d21
call fcn.004041d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4891a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x489351
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x489332
mov dl, 1
mov eax, dword [0x41d814]
call fcn.004226a8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.0040587c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x489321
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00478818
test al, al
je 0x489314
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x489360
lea eax, [ebp - 0x394]
call fcn.0040cf2c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x489314
xor eax, eax
push ebp
push 0x48930d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4893d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4892f6
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405a7c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4892f6
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00405a7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489314
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x489217
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00422494
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489358
lea eax, [ebp - 0x3a0]
call fcn.0040586c
ret
Function at 0x48a018
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x48a02f
add esp, 0xfffffff0
call fcn.00404180
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427484
mov eax, dword [0x56ad10]
cmp byte [eax], 0
jne 0x48a05c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x56b064]
cmp word [eax + 2], 0
jne 0x48a076
mov eax, dword [0x56b064]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048bf94
mov eax, dword [0x56b1bc]
cmp word [eax + 2], 0
jne 0x48a090
mov eax, dword [0x56b1bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048c1a4
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x42e2c4]
call fcn.00430110
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x48c638
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x42eee8]
call fcn.00437934
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x48a26c
mov eax, dword [0x56aee4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00437d74
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x48c8e8
mov dl, 1
mov eax, dword [0x41d130]
call fcn.00403d00
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x56aee4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040cd64
test eax, eax
je 0x48a19e
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040cb64
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040cd4c
test eax, eax
je 0x48a1b6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405a7c
push ebx
push 0x48b990
call fcn.004807d4
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x56ad10]
cmp byte [eax], 0
jne 0x48a207
mov eax, ebx
call fcn.0048a3e0
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.0048cb10
mov eax, ebx
call fcn.0048d6d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48a264
call fcn.004041d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a688
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x48a72a
cmp dword [ebx + 0x90], 0
jne 0x48a724
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48a600
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x48a724
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x48a6ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x48a724
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.0041fa70
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48a6f9
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48a948
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5711c4]
cmp dword [eax + 0x170], 0
je 0x48aaad
test bl, bl
jne 0x48a9fb
cmp dword [esi + 0x98], 0
jne 0x48a9f0
mov eax, esi
call fcn.0048d524
push eax
push 0x48a854
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x48a9c1
mov eax, dword [0x5711c4]
cmp byte [eax + 0xcf], 0
je 0x48a9c1
mov eax, dword [esi + 0xd4]
call fcn.00406d84
mov edi, eax
cmp edi, 0
jl 0x48a9c1
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x48a9aa
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x48a9f0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041fa70
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x48a9d0
inc dword [esi + 0x98]
jmp 0x48aaad
cmp dword [esi + 0x98], 0
jle 0x48aaad
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x48aaad
cmp dword [esi + 0x40], 0
je 0x48aa58
mov eax, dword [0x5711c4]
cmp byte [eax + 0xcf], 0
je 0x48aa58
mov eax, dword [esi + 0xd4]
call fcn.00406d84
mov edi, eax
cmp edi, 0
jl 0x48aa58
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x48aa41
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x48aa87
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041fa70
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x48aa67
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x4801e0]
call fcn.00406f44
add esp, 4
pop edi
pop esi
pop ebx
ret