joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4871b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407d14
xor eax, eax
push ebp
push 0x487263
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x48723b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e640
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00408058
cmp dword [ebp - 4], 0
jne 0x48720f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487245
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push 0x487278
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487245
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48726a
lea eax, [ebp - 0xc]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret

Function at 0x48bd18
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0040502c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x495a58
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x495b34
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004088d8
mov eax, dword [ebp - 0x18]
push eax
call fcn.00498044
pop edx
call fcn.00494e88
test al, al
je 0x495aa0
mov ebx, 1
jmp 0x495b1e
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x495acd
call sub.kernel32.dll_GetLastError_2
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor ebx, ebx
jmp 0x495b1e
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x495b01
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x495b01
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
movzx eax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495b3b
lea eax, [ebp - 0x18]
call fcn.00407c30
ret
Function at 0x495b48
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x495b93
lea eax, [esp + 0x105]
push eax
push 0
push 0x495bc4
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x495b93
lea eax, [esp + 0x105]
call fcn.00408138
cmp ebx, eax
setg al
jmp 0x495b95
xor eax, eax
mov ebx, eax
test bl, bl
je 0x495baf
lea edx, [esp + 0x105]
mov eax, esi
call fcn.004203c8
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x532c54]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x496590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x496599
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x496716
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00496410
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00408568
lea eax, [ebx + 0x22]
mov edx, dword [ebp - 4]
call fcn.004204a8
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00496270
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00408568
lea eax, [ebx + 0x122]
mov edx, dword [ebp - 4]
call fcn.004204a8
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00496354
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00408568
lea eax, [ebx + 0x222]
mov edx, dword [ebp - 4]
call fcn.004204a8
cmp word [esi + 0x4a], 0
je 0x496656
push edi
lea eax, [ebp - 9]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x4c]
call dword [esi + 0x48]
cmp byte [ebp - 9], 0
jne 0x4966c7
lea eax, [ebp - 8]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408944
mov eax, dword [ebp - 8]
call fcn.0041f900
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408944
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00408944
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 8]
mov edx, 1
call fcn.00495430
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [esi + 0x3ac], eax
xor eax, eax
mov dword [esi + 0x3b0], eax
movzx ebx, byte [ebp - 9]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49671d
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00407c90
lea eax, [ebp - 8]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x499700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407d14
xor eax, eax
push ebp
push 0x499947
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00408010
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x49991f
cmp dword [0x5323dc], 0
jne 0x499765
call fcn.0049c000
cmp dword [0x5323dc], 0
je 0x49991f
xor eax, eax
push ebp
push 0x499915
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x499904
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x499968
call fcn.00408058
mov edx, dword [ebp - 4]
mov eax, 0x499980
call fcn.00408e88
mov esi, eax
test esi, esi
jle 0x4997c4
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408cdc
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00408d24
cmp dword [ebp - 4], 0
jne 0x4997e4
mov dl, 1
mov eax, ebx
call fcn.00471da0
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.0041f0dc
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5323dc]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0048eb08
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00408010
mov eax, dword [0x5323dc]
cmp byte [eax + 0x13], 0
je 0x499851
push 0x499990
push dword [ebp - 4]
push 0x4999b4
push ebx
push 0x4999b4
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00408b94
mov eax, dword [ebp - 0x1c]
call fcn.004088b0
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x49989e
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00408010
mov eax, dword [0x5323dc]
cmp byte [eax + 0x11], 0
je 0x499888
push dword [ebp - 4]
push 0x4999c8
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408b94
mov byte [ebp - 0xd], 0
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49991f
mov byte [ebp - 0xd], 1
mov eax, dword [0x5323dc]
cmp byte [eax + 0x11], 0
je 0x4998c7
push dword [ebp - 4]
push 0x4999d8
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408b94
lea eax, [ebp - 8]
call fcn.00407c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49990b
mov eax, dword [0x5323dc]
cmp dword [eax + 0x18], 0
je 0x499903
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x5323dc]
call dword [ebx + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00408010
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49994e
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00407c90
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x49ae14
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49af14
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x49af30
call fcn.00408058
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x49ae7a
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x49ae7e
xor eax, eax
jmp 0x49ae80
mov al, 1
mov ebx, eax
test bl, bl
je 0x49ae9b
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.00408908
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.00408908
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041e2b4
mov eax, dword [ebp - 0x1c]
mov edx, 0x49af44
call fcn.00408ca4
jne 0x49aee2
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041e2b4
mov eax, dword [ebp - 0x20]
mov edx, 0x49af58
call fcn.00408ca4
jne 0x49aee2
mov eax, edi
mov edx, dword [0x5323e0]
mov ecx, 0
call fcn.00408568
jmp 0x49aef1
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00408568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49af1b
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x4b18dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b1a1f
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4b1933
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x536c50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00407db8
jmp 0x4b1a06
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.004b1878
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004b18a0
mov ebx, eax
test esi, esi
je 0x4b195b
dec esi
test esi, esi
jl 0x4b195b
cmp edi, ebx
jne 0x4b193a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.00408908
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x4b197d
adc ecx, 0
mov edx, 1
call fcn.00408cdc
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4b19a3
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x4b1a06
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x4b1a06
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4b19ca
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x4b1a06
mov eax, edx
mov dword [ebp - 0x218], eax
mov ebx, dword [ebp - 0x218]
test ebx, ebx
je 0x4b19ee
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00408cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1a26
lea eax, [ebp - 0x214]
call fcn.00407c30
ret
Function at 0x4b6410
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4b65f0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4b646d
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x4b6480
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x4b6480
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b64d0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x4b64d0
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x4b64e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x4b64e0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4b65df
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.004bbd4c
cmp dword [0x539268], 0
je 0x4b6522
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x539268]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.004bbd4c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x4b6547
xor edx, edx
call fcn.004b1080
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x4b6573
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x4b658c
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b65e6
cmp dword [ebp - 0x10], 0
je 0x4b65cb
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x4b65de
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x4b65de
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x4b72d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x4b7333
cmp byte [ebx + 0x44d], 0
jne 0x4b7333
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x4b7301
xor esi, esi
jmp 0x4b731d
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.004045e8
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.00408908
test esi, esi
je 0x4b7340
mov eax, esi
call fcn.00404604
jmp 0x4b7340
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.00408908
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c3d88
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4c3dc5
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x4c3db3
mov al, 7
jmp 0x4c3dfe
cmp edx, 5
jb 0x4c3dfe
mov al, 5
cmp dword [esp + 8], 1
jb 0x4c3dfe
mov al, 6
jmp 0x4c3dfe
cmp eax, 1
jne 0x4c3dfc
mov al, 1
cmp dword [esp + 4], 4
ja 0x4c3de1
cmp dword [esp + 4], 4
jne 0x4c3de3
cmp dword [esp + 8], 0xa
jb 0x4c3de3
mov al, 2
cmp dword [esp + 4], 4
ja 0x4c3df8
cmp dword [esp + 4], 4
jne 0x4c3dfe
cmp dword [esp + 8], 0x5a
jb 0x4c3dfe
mov al, 3
jmp 0x4c3dfe
xor eax, eax
add esp, 0x11c
ret

Function at 0x4d1454
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x4d14ec
call sub.user32.dll_RegisterWindowMessageW
mov edi, eax
mov dl, 1
mov eax, dword [0x438adc]
call fcn.00405f8c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4d14db
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push fcn.004d12f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4d14c5
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00444558
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageW
inc esi
dec ebx
jne 0x4d14a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d14e2
mov eax, dword [ebp - 0xc]
call fcn.00405fbc
ret
Function at 0x4d1560
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dl, 1
call fcn.00471da0
mov dword [ebp - 8], eax
push 0x4d1658
call sub.user32.dll_RegisterWindowMessageW
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x438adc]
call fcn.00405f8c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d1648
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
call fcn.004d1510
mov ebx, eax
test ebx, ebx
je 0x4d15b7
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004d12f0
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4d15ce
mov eax, dword [ebp - 4]
push eax
push fcn.004d12f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4d160d
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00444558
mov ebx, eax
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4d1609
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
call fcn.0040741c
jmp 0x4d164f
inc edi
dec esi
jne 0x4d15dc
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jle 0x4d1632
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00444558
mov ebx, eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d164f
mov eax, dword [ebp - 4]
call fcn.00405fbc
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ee880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4eea78
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4ee8ba
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4eea5d
mov eax, dword [ebx + 0x4c]
call fcn.004f07e0
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004f06f8
xor edx, edx
push ebp
push 0x4eea56
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4eea88]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4eea98
mov eax, 0x4eeae0
call fcn.0048d654
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4eeb04
call fcn.00426868
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.004b7348
lea ecx, [ebp - 0x10]
mov edx, 0x4eeb24
mov eax, 0x4eeb40
call fcn.0048d654
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.004b7348
mov eax, dword [ebx + 0x14]
call fcn.004b7cf4
lea ecx, [ebp - 0x14]
mov edx, 0x4eeb6c
mov eax, 0x4eeb88
call fcn.0048d654
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.004b7348
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.004b5ca0
mov eax, dword [ebx + 0x18]
call fcn.004b7cf4
mov eax, dword [ebx + 0x1c]
call fcn.004b7d3c
mov eax, dword [ebx + 0x20]
call fcn.004b7d3c
mov eax, dword [ebx + 0x14]
call fcn.004b7cf4
lea ecx, [ebp - 0x18]
mov edx, 0x4eebb4
mov eax, 0x4eebf4
call fcn.0048d654
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.004b7348
mov eax, dword [ebx + 0x24]
call fcn.004b7cf4
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.004b7348
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.004b84a8
mov eax, dword [ebx + 0x28]
call fcn.004b7cf4
lea ecx, [ebp - 4]
mov edx, 0x4eec24
mov eax, 0x4eecb4
call fcn.0048d654
movzx eax, byte [0x4eecd0]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4eeb04
mov eax, dword [ebp - 4]
call fcn.00426868
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00408058
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.004b7348
mov eax, dword [ebx + 0x2c]
call fcn.004b7cf4
lea ecx, [ebp - 0x20]
mov edx, 0x4eece0
mov eax, 0x4eee08
call fcn.0048d654
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.004b7cf4
mov eax, dword [ebx + 0xc]
call fcn.004b7d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea5d
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea7f
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407c90
ret
Function at 0x519930
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x51995a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x519a18
call fcn.0050ad9c
mov dword [ebp - 8], eax
jmp 0x51996d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x519a88
call fcn.0050ad9c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5199fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0050ca10
test al, al
je 0x5199ad
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x5199ad
mov eax, dword [ebp - 8]
call fcn.00405fbc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x519af8
call fcn.0050ad9c
mov dword [ebp - 8], eax
jmp 0x5199b0
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.0050ca10
test al, al
je 0x5199d7
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x5199ce
mov dword [ebp - 4], 0xffffffff
jmp 0x5199e4
mov dword [ebp - 4], 1
jmp 0x5199e4
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0050ced4
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519a01
mov eax, dword [ebp - 8]
call fcn.00405fbc
ret

Function at 0x519b38
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x519bf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x519c0c
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041ef00
push dword [ebp - 0x10]
push 0x519c5c
push 0x519c8c
push 0x519ca4
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408b94
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050ad9c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x519bcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0050ca10
test al, al
jne 0x519bb9
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519bd6
mov eax, dword [ebp - 8]
call fcn.00405fbc
ret