joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d584
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d72f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45d710
mov dl, 1
mov eax, dword [0x414b94]
call fcn.004038ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040470c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45d6ff
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00449d40
test al, al
je 0x45d6f2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45d740
lea eax, [ebp - 0x254]
call fcn.00409c84
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45d6f2
xor eax, eax
push ebp
push 0x45d6eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45d778
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45d6d4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404974
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45d6d4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404974
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d6f2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45d5f5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419278
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d736
lea eax, [ebp - 0x260]
call fcn.0040470c
ret

Function at 0x45e064
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x52ec34]
cmp byte [eax + 0xa5], 0
jne 0x45e0d5
cmp dword [0x52ec4c], 0
jne 0x45e096
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x45e020
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x52ec4c], eax
cmp dword [0x52ec48], 0
jne 0x45e0b1
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x52ec48], eax
cmp dword [0x52ec50], 0
jne 0x45e0d5
push esp
push 0
push 0
push 0x45dfc4
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x52ec50], eax
pop edx
ret
Function at 0x45e1fc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45e213
add esp, 0xfffffff0
call fcn.00403c80
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f348
mov eax, dword [0x52db60]
cmp word [eax + 2], 0
jne 0x45e23b
mov eax, dword [0x52db60]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f8d8
mov eax, dword [0x52dc58]
cmp word [eax + 2], 0
jne 0x45e255
mov eax, dword [0x52dc58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045fad0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x414530]
call fcn.004038ec
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x414530]
call fcn.004038ec
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4218b8]
call fcn.00429404
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45e3dc
mov eax, dword [0x52da4c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429810
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x460050
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x52da4c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d25c
test eax, eax
je 0x45e34a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004095cc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d284
test eax, eax
je 0x45e35e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404974
mov eax, dword [0x52d8bc]
cmp byte [eax], 0
jne 0x45e392
mov eax, ebx
call fcn.0045e504
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0046022c
mov eax, ebx
call fcn.00460b6c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45e3d2
call fcn.00403cd8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e778
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x52ec34]
cmp dword [eax + 0x30], 0
je 0x45e822
cmp dword [ebx + 0x94], 0
jne 0x45e81c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e708
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e81c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45e7e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e81c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416e2c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e7f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f300
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f335
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047fc
jmp 0x45f342
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404760
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460408
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460449
mov eax, esi
call fcn.00445434
test al, al
je 0x460449
mov eax, dword [ebx + 0x84]
call fcn.00445130
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460449
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445130
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x466830
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x466999
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004047a4
mov eax, dword [ebp - 0x10]
call fcn.00466598
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x466882
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404c5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00466c4c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x466957
xor eax, eax
push ebp
push 0x466950
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00466708
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004669a8
test al, al
je 0x46692e
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004047fc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46692e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404bbc
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x466928
mov eax, dword [ebp - 0x14]
call fcn.00404bbc
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004048fc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00466830
dec ebx
cmp ebx, 0xffffffff
jne 0x4668e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466957
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00466708
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 0x10]
call fcn.00404bbc
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004666f4
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4669a0
lea eax, [ebp - 0x3c]
call fcn.0040470c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404730
ret

Function at 0x4669a8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004031d0
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x52de10]
cmp byte [edx + 0xc], 0
je 0x466a0c
mov edx, dword [0x52de04]
cmp dword [edx], 2
jne 0x466a0c
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x466b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004665ac
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404bbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x466bce
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52db84]
mov dl, 1
mov eax, dword [0x4664a4]
call fcn.0040c6bc
call fcn.004040e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x466bd8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404bbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x466c30
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52de1c]
mov dl, 1
mov eax, dword [0x4664a4]
call fcn.0040c6bc
call fcn.004040e8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004665dc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46dadc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46dbb4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52ecb4], 0
jne 0x46db98
lea eax, [ebp - 4]
mov edx, 0x46dbcc
call fcn.004047a4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x46db98
mov eax, ebx
call fcn.0040273c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x46db91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46db7b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x46dbdc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46db7b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x52ecb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46db98
mov eax, dword [ebp - 0xc]
call fcn.0040275c
ret
mov ebx, dword [0x52ecb4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dbbb
lea eax, [ebp - 4]
call fcn.0040470c
ret
Function at 0x482f28
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x482f56
mov eax, ebx
call fcn.004839e0
cmp dword [ebx + 0x3c], 0
je 0x482f4f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x482fc7
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x482fb9
cmp dword [ebx + 8], 0
je 0x482f78
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x482f8a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x482fb9
cmp dword [ebx + 8], 0
je 0x482f6b
cmp eax, 3
je 0x482f9d
dec eax
jne 0x482f6b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x482f6b
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x482f6b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x482fe5
cmp dword [ebx + 0x10], 0xcc
je 0x482fe5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00482ff0
pop ebx
ret
Function at 0x498968
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x498bc8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4989cb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00498430
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ce48
cmp al, 1
jne 0x4989cb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00498748
test al, al
je 0x498b57
cmp dword [ebp - 8], 0
jge 0x4989e9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00498430
mov eax, dword [ebp - 0x210]
call fcn.004049c4
cmp ebx, eax
jge 0x498a33
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00498430
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x52ddf4]
and eax, 0xff
bt dword [edx], eax
jae 0x498a33
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x498a47
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00498944
cmp ebx, dword [ebp - 8]
je 0x498b49
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x498a73
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b18
and eax, 0x7f
movzx eax, word [eax*2 + 0x52d6e0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x498b36
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b18
and eax, 0x7f
movzx eax, word [eax*2 + 0x52d6e0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00445130
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403b18
and eax, 0x7f
movzx eax, word [eax*2 + 0x52d6e0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00445130
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498b3d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x498baa
cmp dword [ebp - 8], 0
jge 0x498b62
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00498430
mov eax, dword [ebp - 0x218]
call fcn.004049c4
cmp eax, dword [ebp - 8]
jg 0x498b9c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00498430
mov eax, dword [ebp - 0x21c]
call fcn.004049c4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00498944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498bcf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404730
ret
Function at 0x4aaf34
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4aafee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e28
mov eax, dword [0x52de04]
cmp dword [eax], 2
jne 0x4aafa3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004050d0
mov eax, dword [ebx]
call fcn.00404f94
push eax
mov eax, dword [ebx]
call fcn.00404f84
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404f94
mov edx, eax
dec edx
mov eax, ebx
call fcn.004050d0
jmp 0x4aafd5
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00409788
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaff5
lea eax, [ebp - 0x3f0]
call fcn.0040470c
ret
Function at 0x4cb5f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004cb5e0
test eax, eax
jne 0x4cb615
mov eax, esi
call fcn.0040470c
jmp 0x4cb6a6
mov eax, ebx
call fcn.004cb73c
test al, al
je 0x4cb65b
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004047fc
test edi, edi
je 0x4cb652
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4cb6a6
mov eax, esi
call fcn.0040470c
jmp 0x4cb6a6
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4cb69f
mov eax, dword [ebp + 0x208]
call fcn.00417b88
test eax, eax
jle 0x4cb68d
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.00470264
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404760
jmp 0x4cb6a6
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.00404760
jmp 0x4cb6a6
mov eax, esi
call fcn.0040470c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cd364
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00406cf8
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x4e28e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x52eeec
test esi, esi
jne 0x4e2902
xor eax, eax
jmp 0x4e2a04
cmp dword [ebp], 0
jne 0x4e290d
call fcn.004e2878
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4e29dd
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4e2919
test edi, edi
jbe 0x4e29ff
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4e29e1
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x502d6c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040922c
test al, al
je 0x502df3
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.004031d0
or esi, 0x100
test esi, esi
jns 0x502da7
call fcn.0040385c
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00404bbc
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x502df3
mov dl, 1
mov eax, dword [0x4218b8]
call fcn.00429404
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00429810
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x502df3
mov eax, esp
call fcn.0040e1a4
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret