joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea5dc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407188
xor eax, eax
push ebp
push 0x4ea71b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4ea6ee
xor edx, edx
push ebp
push 0x4ea6e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x4ea629
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4ea6bc
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4ea6ab
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x4ea66e
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.0040804c
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004048dc
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea6b2
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x6a65ac]
mov dl, 1
mov eax, dword [0x41b5fc]
call fcn.00428528
call fcn.00406780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea722
lea eax, [ebp - 4]
call fcn.004070a4
ret

Function at 0x50f534
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0050f5e4
test eax, eax
je 0x50f56f
push 0x100
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0050f5e4
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040722c
jmp 0x50f57d
mov ecx, esi
mov edx, 0x50f59c
mov eax, ebx
call fcn.0050f47c
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.00407484
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x52c01c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004070a4
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x52c06e
push 0x100
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x52c067
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.00408108
jmp 0x52c06e
mov eax, esi
call fcn.004070a4
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x531810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53196f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x69a350], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x470134]
call fcn.00471280
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x531945
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00471368
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00408108
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x531988
call fcn.004082b8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004715f4
test al, al
je 0x53192f
lea ecx, [ebp - 4]
mov edx, 0x5319fc
mov eax, dword [ebp - 0xc]
call fcn.00471e7c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042ae4c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x53192f
xor edx, edx
push ebp
push 0x531928
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x531a14
mov eax, dword [ebp - 8]
push eax
call fcn.0040fa50
test eax, eax
je 0x531911
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x531911
call fcn.0053179c
test eax, eax
je 0x531901
mov eax, dword [ebx + 0x50]
jmp 0x531904
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x69a350]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53192f
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53194c
mov eax, dword [ebp - 0xc]
call fcn.00405308
ret

Function at 0x531a78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x531abf
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x531aa2
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x531ab3
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x531abf
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x53c058
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x53c07f
test edi, 0x40000
je 0x53c099
test bl, bl
jne 0x53c128
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x53c128
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x53c0cc
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x53c0e8
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0x40000
or ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
jmp 0x53c0fe
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0xfffbffff
and ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x53c10f
cmp byte [esp + 2], 0
je 0x53c128
cmp byte [esp + 2], 0
je 0x53c120
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x53c128
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x53c3dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x53c402
mov eax, esp
push eax
push 0x53c3a4
call sub.user32.dll_EnumWindows
jmp 0x53c415
mov eax, esp
push eax
push 0x53c384
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x53c4d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x53c528]
test bl, 4
je 0x53c4ec
or si, 1
test bl, 8
je 0x53c4f5
or si, 4
test bl, 1
je 0x53c4fe
or si, 8
test bl, 2
je 0x53c507
or si, 0x10
test bl, 0x10
je 0x53c510
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53c520
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x53c52c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x53c568]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53c547
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x53c557
or bx, 4
test esi, 0x20000000
je 0x53c563
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x545208
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x54521a
add esp, 0xfffffff0
call fcn.00405948
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00459a6c
mov eax, dword [0x6a67d8]
mov dword [eax + 4], ebx
mov dword [eax], 0x545648
mov eax, dword [0x6a67f8]
mov dword [eax + 4], ebx
mov dword [eax], 0x545654
mov eax, ebx
call fcn.00545660
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x53ffc4
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.00545c58
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x545a74
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x545a74
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x545a74
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x545a74
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x545a74
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x545397
call fcn.004059a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x545814
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5459bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x5459a0
mov dl, 1
mov eax, dword [0x441e88]
call fcn.004509f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004070a4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x54598f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004b393c
test al, al
je 0x545982
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5459d0
lea eax, [ebp - 0x394]
call fcn.0042390c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x545982
xor eax, eax
push ebp
push 0x54597b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x545a40
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x545964
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.00408108
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x545964
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.00408108
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x545982
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x545885
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.00450930
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5459c6
lea eax, [ebp - 0x3a0]
call fcn.004070a4
ret

Function at 0x546578
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6ad39c]
cmp byte [eax + 0xb1], 0
jne 0x5465ea
cmp dword [0x6ad3bc], 0
jne 0x5465aa
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x69a468]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6ad3bc], eax
cmp dword [0x6ad3b8], 0
jne 0x5465c5
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x6ad3b8], eax
cmp dword [0x6ad3c0], 0
jne 0x5465ea
push esp
push 0
push 0
mov eax, dword [0x69a464]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread_1
mov dword [0x6ad3c0], eax
pop edx
ret
Function at 0x546904
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x54691b
add esp, 0xfffffff0
call fcn.00405948
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00459a6c
mov eax, dword [0x6a6448]
cmp byte [eax], 0
jne 0x546948
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x6a6c84]
cmp word [eax + 2], 0
jne 0x546962
mov eax, dword [0x6a6c84]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00548af8
mov eax, dword [0x6a6f28]
cmp word [eax + 2], 0
jne 0x54697c
mov eax, dword [0x6a6f28]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00548cfc
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x475ea0]
call fcn.0047bea0
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x549274
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x47a780]
call fcn.004854ec
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x546b60
mov eax, dword [0x6a697c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0048597c
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x54955c
mov dl, 1
mov eax, dword [0x43e714]
call fcn.004052d8
mov dword [ebx + 0x9c], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6a697c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004236bc
test eax, eax
je 0x546a90
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00423380
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004236a0
test eax, eax
je 0x546aa8
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00408108
push ebx
push 0x5484d0
call fcn.0053c4bc
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x6a6448]
cmp byte [eax], 0
jne 0x546af9
mov eax, ebx
call fcn.00546d20
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.005497a4
mov eax, ebx
call fcn.0054a3d0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x546b56
call fcn.004059a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x547058
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x547104
cmp dword [ebx + 0x98], 0
jne 0x5470fe
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x546f90
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5470fe
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5470c4
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5470fe
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.0044c380
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5470d3
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x547324
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6ad39c]
cmp dword [eax + 0x178], 0
je 0x547489
test bl, bl
jne 0x5473d7
cmp dword [esi + 0xa0], 0
jne 0x5473cc
mov eax, esi
call fcn.0054a220
push eax
push 0x547230
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x54739d
mov eax, dword [0x6ad39c]
cmp byte [eax + 0xd7], 0
je 0x54739d
mov eax, dword [esi + 0xdc]
call fcn.00409368
mov edi, eax
cmp edi, 0
jl 0x54739d
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x547386
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5473cc
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.0044c380
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5473ac
inc dword [esi + 0xa0]
jmp 0x547489
cmp dword [esi + 0xa0], 0
jle 0x547489
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x547489
cmp dword [esi + 0x48], 0
je 0x547434
mov eax, dword [0x6ad39c]
cmp byte [eax + 0xd7], 0
je 0x547434
mov eax, dword [esi + 0xdc]
call fcn.00409368
mov edi, eax
cmp edi, 0
jl 0x547434
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x54741d
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x547463
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.0044c380
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x547443
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x538e5c]
call fcn.00409514
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5480dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x548147
cmp byte [ebx + 0xd7], 0
jne 0x548147
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040722c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x548134
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x548154
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407484
jmp 0x548154
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407484
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x54998c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x5499fa
mov eax, esi
call fcn.004ad914
test al, al
je 0x5499fa
mov eax, dword [ebx + 0x88]
call fcn.004ad560
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5499fa
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x5499ee
push 0
mov eax, dword [ebx + 0x88]
call fcn.004ad560
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.004a437c
jmp 0x5499fa
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.005497c4
pop esi
pop ebx
ret
Function at 0x561d98
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x561dfc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00408108
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00421c88
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561e03
lea eax, [ebp - 0x14]
call fcn.004070a4
ret

Function at 0x56315c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5631f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6a7434]
cmp dword [eax], 2
jne 0x56319c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
jmp 0x5631d4
lea eax, [ebp - 8]
mov edx, esi
call fcn.00407d14
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004078a4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00407b04
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5631f9
lea eax, [ebp - 8]
call fcn.004070ec
lea eax, [ebp - 4]
call fcn.004070c8
ret

Function at 0x5638f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040804c
mov edx, eax
mov eax, ebx
call fcn.00562fc8
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005630a4
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x563966
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040804c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4