joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56880c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040a360
xor eax, eax
push ebp
push 0x56894b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x56891c
xor edx, edx
push ebp
push 0x568915
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x568857
mov eax, dword [eax - 4]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5688e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x5688d7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x568898
mov ebx, dword [ebx - 4]
mov eax, dword [ebp - 4]
call fcn.0040accc
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.00407240
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5688de
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
pop eax
jmp eax
mov ecx, dword [0x5f24b4]
mov dl, 1
mov eax, dword [0x41dd44]
call fcn.0042cfa0
call fcn.00409954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568952
lea eax, [ebp - 4]
call fcn.0040a26c
pop eax
jmp eax

Function at 0x56dab8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x56dace
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x56dade
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x56daee
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x58ff70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageW
mov ebx, eax
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.0040a404
test ebx, ebx
je 0x58ffc2
mov eax, dword [esi]
call fcn.0040accc
push eax
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageW
sub ebx, eax
test ebx, ebx
jle 0x58ffc2
mov eax, dword [esi]
test eax, eax
je 0x58ffb7
mov eax, dword [eax - 4]
mov edx, eax
sub edx, ebx
mov eax, esi
call fcn.0040ae40
pop edi
pop esi
pop ebx
ret
Function at 0x599c8c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00599d54
test eax, eax
je 0x599cde
mov edi, dword [ebx + 8]
test edi, edi
je 0x599cba
test edi, edi
je 0x599cba
mov edx, esi
mov eax, edi
call fcn.00538cd0
jmp 0x599cec
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00599d54
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a404
jmp 0x599cec
mov ecx, esi
mov edx, 0x599d0c
mov eax, ebx
call fcn.00599c14
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a65c
add esp, 0x200
pop edi
pop esi
pop ebx
ret

Function at 0x5b22e8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040a26c
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5b233a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5b2333
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040ad68
jmp 0x5b233a
mov eax, esi
call fcn.0040a26c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5b8194
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b82f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5f21dc], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x500c24]
call fcn.00501f70
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5b82cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00502058
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040ad68
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5b8314
call fcn.0040af18
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.005022e8
test al, al
je 0x5b82b5
lea ecx, [ebp - 4]
mov edx, 0x5b8388
mov eax, dword [ebp - 0xc]
call fcn.00502c64
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0043059c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5b82b5
xor edx, edx
push ebp
push 0x5b82ae
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5b83a0
mov eax, dword [ebp - 8]
push eax
call fcn.00415c48
test eax, eax
je 0x5b8295
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5b8295
call fcn.005b8120
test eax, eax
je 0x5b8285
mov eax, dword [ebx + 0x50]
jmp 0x5b8288
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5f21dc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b82b5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b82d4
mov eax, dword [ebp - 0xc]
call fcn.00408494
pop eax
jmp eax
Function at 0x5b8404
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5b844b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b842e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5b843f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5b844b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x5c4388
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5c43a9
test edi, 0x40000
je 0x5c43c3
test bl, bl
jne 0x5c4444
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5c4444
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5c43f6
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5c440b
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5c441a
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5c442b
cmp byte [esp + 2], 0
je 0x5c4444
cmp byte [esp + 2], 0
je 0x5c443c
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5c4444
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5c46e8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5c470e
mov eax, esp
push eax
push 0x5c46b0
call sub.user32.dll_EnumWindows
jmp 0x5c4721
mov eax, esp
push eax
push 0x5c4690
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5c47e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x5c47f6
or si, 1
test bl, 8
je 0x5c47ff
or si, 4
test bl, 1
je 0x5c4808
or si, 8
test bl, 2
je 0x5c4811
or si, 0x10
test bl, 0x10
je 0x5c481a
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c482a
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5c4830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c4849
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5c4859
or bx, 4
test esi, 0x20000000
je 0x5c4865
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5d2f18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5d2f2a
add esp, 0xfffffff0
call fcn.00408a84
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c63b8
mov eax, dword [0x5f2570]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d3408
mov eax, dword [0x5f2580]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d3414
mov eax, ebx
call fcn.005d3420
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5cc61c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x8c], esi
mov byte [esi + 0x25], 1
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x90], esi
mov byte [esi + 0x25], 1
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x88], esi
mov byte [esi + 0x25], 1
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x94], esi
mov byte [esi + 0x25], 1
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x98], esi
mov byte [esi + 0x25], 1
mov eax, ebx
call fcn.005d3b80
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d3830
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d3830
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d3830
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d3830
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d3830
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d30c8
call fcn.00408adc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d35cc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d377c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5d375b
mov dl, 1
mov eax, dword [0x4899d0]
call fcn.004b57c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a26c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d374a
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.005498ec
test al, al
je 0x5d373d
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d378c
lea eax, [ebp - 0x394]
call fcn.00426718
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5d373d
xor eax, eax
push ebp
push 0x5d3736
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d37fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5d371d
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040ad68
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5d371d
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040ad68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d373d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d363d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b56f0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3783
lea eax, [ebp - 0x3a0]
call fcn.0040a26c
pop eax
jmp eax

Function at 0x5d4514
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5f9bf4]
cmp byte [eax + 0xc5], 0
jne 0x5d4586
cmp dword [0x5f9c18], 0
jne 0x5d4546
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5f239c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5f9c18], eax
cmp dword [0x5f9c14], 0
jne 0x5d4561
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5f9c14], eax
cmp dword [0x5f9c1c], 0
jne 0x5d4586
push esp
push 0
push 0
mov eax, dword [0x5f2398]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x5f9c1c], eax
pop edx
ret
Function at 0x5d4980
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d4997
add esp, 0xfffffff0
call fcn.00408a84
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c63b8
mov eax, dword [0x5f2418]
cmp byte [eax], 0
jne 0x5d49c4
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x5f278c]
cmp word [eax + 2], 0
jne 0x5d49de
mov eax, dword [0x5f278c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d6e44
mov eax, dword [0x5f28cc]
cmp word [eax + 2], 0
jne 0x5d49f8
mov eax, dword [0x5f28cc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d725c
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50824c]
call fcn.005107ec
mov esi, eax
mov dword [ebx + 0x54], esi
mov byte [esi + 0x25], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5d7808
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x50d5f4]
call fcn.0051b000
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5d4bec
mov eax, dword [0x5f2624]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051b5f8
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5d7af4
mov dl, 1
mov eax, dword [0x485b10]
call fcn.00408464
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5f2624]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426518
test eax, eax
je 0x5d4b0f
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042631c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004264fc
test eax, eax
je 0x5d4b27
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040ad68
push ebx
push 0x5d681c
call fcn.005c47c8
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5f2418]
cmp byte [eax], 0
jne 0x5d4b78
mov eax, ebx
call fcn.005d4db4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005d7e9c
mov eax, ebx
call fcn.005d89d4
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d4be3
call fcn.00408adc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d50e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5d5186
cmp dword [ebx + 0xac], 0
jne 0x5d5180
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d5024
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d5180
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d5146
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d5180
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004b060c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d5155
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d54bc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f9bf4]
cmp dword [eax + 0x190], 0
je 0x5d5621
test bl, bl
jne 0x5d5576
cmp dword [esi + 0xb4], 0
jne 0x5d556b
mov eax, esi
call fcn.005d8824
push eax
push 0x5d53c4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d553c
mov eax, dword [0x5f9bf4]
cmp byte [eax + 0xeb], 0
je 0x5d553c
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d551d
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d553c
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d5525
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d556b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b060c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d554b
inc dword [esi + 0xb4]
jmp 0x5d5621
cmp dword [esi + 0xb4], 0
jle 0x5d5621
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d5621
cmp dword [esi + 0x58], 0
je 0x5d55d6
mov eax, dword [0x5f9bf4]
cmp byte [eax + 0xeb], 0
je 0x5d55d6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d55b7
mov eax, dword [eax - 4]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d55d6
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d55bf
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d5605
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004b060c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d55e5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c11dc]
call fcn.0040d2f4
pop edi
pop esi
pop ebx
ret
Function at 0x5d6428
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d6483
cmp byte [ebx + 0xeb], 0
jne 0x5d6483
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a404
mov eax, dword [esi]
test eax, eax
je 0x5d6470
mov eax, dword [eax - 4]
test eax, eax
jne 0x5d6490
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a65c
jmp 0x5d6490
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a65c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d80b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d8121
mov eax, esi
call fcn.00543338
test al, al
je 0x5d8121
mov eax, dword [ebx + 0x98]
call fcn.00542ed0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d8121
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x17c]
test al, al
je 0x5d8112
push 0
mov eax, dword [ebx + 0x98]
call fcn.00542ed0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00538bd4
jmp 0x5d8121
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005d7ebc
pop esi
pop ebx
ret
Function at 0x5ddcf0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x98], 0
jne 0x5ddd76
mov eax, dword [ebx + 8]
call fcn.00542ed0
mov ecx, eax
mov dl, 1
mov eax, dword [0x5514e8]
call fcn.0053c7c0
mov dword [ebx + 0x98], eax
mov esi, dword [ebx + 0x98]
xor edx, edx
mov eax, esi
call fcn.00556cec
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x5dd5c0
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x98]
call fcn.00542ed0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x98]
call fcn.00542ed0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa8], 0
jne 0x5dddf8
mov eax, dword [ebx + 8]
call fcn.00542ed0
mov ecx, eax
mov dl, 1
mov eax, dword [0x5514e8]
call fcn.0053c7c0
mov dword [ebx + 0xa8], eax
mov esi, dword [ebx + 0xa8]
mov dl, 1
mov eax, esi
call fcn.00556cec
mov dword [esi + 0x2f4], ebx
mov dword [esi + 0x2f0], 0x5dd60c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00542ed0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa8]
call fcn.00542ed0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa0], 0
jne 0x5dde76
mov eax, dword [ebx + 8]
call fcn.00542ed0
mov ecx, eax
mov dl, 1
mov eax, dword [0x55202c]
call fcn.0053c7c0
mov dword [ebx + 0xa0], eax
mov esi, dword [ebx + 0xa0]
mov byte [esi + 0x2c8], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe8]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00542ed0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa0]
call fcn.00542ed0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x5de8f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff48
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov esi, 1
mov eax, dword [ebx + 8]
cmp byte [eax + 0x2f5], 0
jne 0x5de946
mov edi, dword [ebx + 0x80]
test edi, edi
je 0x5dec45
mov edx, esp
lea eax, [edi + 8]
call fcn.004136c0
test al, al
je 0x5dec45
mov esi, 5
jmp 0x5dec45
lea ecx, [esp + 8]
mov dl, 1
mov eax, ebx
call fcn.005de3f8
push esi
lea esi, [ebx + 0x30]
xor byte [ebp + 0x9c24bc], cl
add byte [eax], al