joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3920
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590bb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
push ebx
mov dword [ebp - 0x18], esi
call fcn.004c1d40
mov dword [ebp - 4], ebx
lea eax, [esi + 0x124]
mov dword [ebp - 0x14], eax
mov dword [eax + 0x10], ebx
mov byte [ebp - 4], 1
lea ecx, [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 4], 3
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x1c], 0xc0c0c0
mov dword [eax], 0x10
mov dword [eax + 4], 0xf
mov dword [eax + 8], 0x16
mov dword [eax + 0xc], 0x15
mov byte [ebp - 4], 4
lea ecx, [esi + 0x154]
mov dword [esi], vtable.CSpyChildFrame.0
call fcn.004bb2f0
mov byte [ebp - 4], 5
lea ecx, [esi + 0x19c]
push ebx
mov dword [esi + 0x194], ebx
mov byte [esi + 0x198], 1
mov dword [ebp - 0x10], ecx
call fcn.004fbd90
mov byte [ebp - 4], 7
lea ecx, [esi + 0x1a4]
call fcn.0050fb70
mov byte [ebp - 4], 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
or edi, 0xffffffff
mov dword [esi + 0x2cc8], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x2ccc], edx
mov edx, dword [ebp + 8]
mov dword [esi + 0x2cc4], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x2cd0], eax
mov dword [esi + 0x2cd4], ecx
mov dword [esi + 0x2d0c], ebx
mov dword [esi + 0x2d10], edi
mov dword [esi + 0x2d14], edi
mov dword [esi + 0x2d18], edi
mov dword [esi + 0x2d1c], edi
mov dword [esi + 0x2d20], edi
mov dword [esi + 0x2d24], edi
mov dword [esi + 0x2d28], edi
mov dword [esi + 0x2d2c], edi
mov dword [esi + 0x2d30], edi
mov dword [esi + 0x2d34], edi
mov dword [esi + 0x2d38], edi
mov dword [esi + 0x2d3c], edi
mov dword [esi + 0x2d40], edi
mov dword [esi + 0x2d48], edx
mov dword [esi + 0x2d60], edi
mov dword [esi + 0x2d64], ebx
mov byte [ebp - 0x118], bl
push 0xfe
lea eax, [ebp - 0x117]
push ebx
push eax
call fcn.00555020
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0xff
lea ecx, [ebp - 0x118]
push ecx
push 0x1001
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [ebp - 0x118]
push edx
push ebx
call fcn.00559ec8
add esp, 8
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x28

Function at 0x4c71a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0xf060
push esi
mov esi, ecx
jne 0x4c71f8
cmp dword [esi + 0x2d64], 0
jle 0x4c71f8
push 8
call fcn.0055549a
push 0
push 0
push eax
push 0x4c7170
push 0
push 0
mov dword [eax + 4], 5
mov dword [eax], esi
call fcn.00556b34
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x4c7480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
mov dword [eax], 1
cmp byte [esi + 0x198], 0
jne 0x4c74c5
push 8
call fcn.0055549a
push 0
push 0
push eax
push 0x4c7170
push 0
push 0
mov dword [eax + 4], 1
mov dword [eax], esi
call fcn.00556b34
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4c74d0
Capabilities:
Create thread

Disassembly:
push esi
push 8
mov esi, ecx
call fcn.0055549a
push 0
push 0
push eax
push 0x4c7170
push 0
push 0
mov dword [eax + 4], 3
mov dword [eax], esi
call fcn.00556b34
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x10

Function at 0x4c7510
Capabilities:
Create thread

Disassembly:
push esi
push 8
mov esi, ecx
call fcn.0055549a
push 0
push 0
push eax
push 0x4c7170
push 0
push 0
mov dword [eax + 4], 4
mov dword [eax], esi
call fcn.00556b34
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x10
Function at 0x4cb1e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov edx, dword [ebp + 8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push esi
push edx
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x4cb2dc
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, esi
je 0x4cb24b
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x20]
mov edi, eax
mov dword [ebp - 0x18], ecx
cmp eax, esi
jne 0x4cb2dc
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x22c]
push eax
push esi
push ecx
mov dword [ebp - 0x1c], pe_nt_image_headers32
call edi
test eax, eax
jne 0x4cb2be
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004cb1e0
mov ebx, eax
cmp ebx, esi
jne 0x4cb309
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x18]
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push esi
push edx
mov dword [ebp - 0x1c], pe_nt_image_headers32
call edi
test eax, eax
je 0x4cb282
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x4cb2cf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.004cab70
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x4cb2f4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x4cb321
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cd0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5914ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 8]
mov dword [esi + 4], ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], ebx
mov dword [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
lea edi, [esi + 0x24]
push edi
mov byte [edi + 0x10], bl
mov dword [edi + 0x14], ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [edi + 0x18], vtable.dockwins::CVC7LikeExCaption::CPinButton.0
mov dword [edi + 0x2c], 1
mov dword [edi + 0x30], vtable.dockwins::CVC7LikeExCaption::CCloseButton.0
mov al, byte [edi + 0x10]
cmp al, bl
sete cl
cmp al, cl
je 0x4cd134
mov byte [edi + 0x10], cl
mov ecx, dword [0x5f7a74]
add ecx, 5
mov dword [edi + 0x14], ecx
lea eax, [esi + 0x68]
push eax
mov byte [eax + 0x10], 1
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esi + 0x7c], 8
mov dword [esi + 0x50], ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4cd820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5915f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x420], ebx
mov byte [ebp - 4], 1
push 2
push ebx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, ebx
jne 0x4cd87e
call fcn.00401490
mov esi, eax
jmp 0x4cd991
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4cd89d
call fcn.00401490
jmp 0x4cd988
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp + 0x10], ebx
test ebx, ebx
jne 0x4cd8b8
call fcn.00401490
jmp 0x4cd988
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp + 0xc], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4cd910
mov byte [ebp - 4], 0
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x4cd8e9
lea ecx, [ebp - 0x420]
call fcn.004021b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004399a0
mov eax, 0x8007000e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x420]
call fcn.004cbc60
mov dword [ebp - 4], 1
jmp 0x4cd93f
mov eax, dword [ebp - 0x420]
test eax, eax
jne 0x4cd950
mov esi, 0x8007000e
jmp 0x4cd98a
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4cd969
call fcn.00401490
jmp 0x4cd988
xor ecx, ecx
mov edx, dword [ebp - 0x420]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004cd350
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea edx, [ebp - 0x41c]
cmp dword [ebp - 0x420], edx
je 0x4cd9ae
lea ecx, [ebp - 0x420]
call fcn.004021b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4cf550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
sete al
test al, al
jne 0x4cf5ba
mov eax, dword [esi + 4]
push edi
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x84]
mov edx, dword [ecx + 4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call edi
cmp byte [ebp + 8], 0
mov dword [esi + 0x84], 0
je 0x4cf5ac
mov eax, dword [0x5f79e0]
shr eax, 2
test al, 1
je 0x4cf5ac
push 0
push 0x64
mov ecx, esi
call fcn.004cf200
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
test eax, eax
setne al
pop edi
pop esi
pop ebp
ret 4
Function at 0x4cf8c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
mov dword [eax], 0
cmp dword [esi + 0x84], 0
je 0x4cf90c
mov ecx, dword [esi + 4]
push edi
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0x84]
mov eax, dword [edx + 4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push ecx
mov dword [esi + 0x84], 0
call edi
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4d0c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0c
push 0x7ff
lea eax, [ebp - 0xc0b]
push 0
push eax
mov byte [ebp - 0xc0c], 0
call fcn.00555020
push 0x3ff
lea ecx, [ebp - 0x40b]
push 0
push ecx
mov byte [ebp - 0x40c], 0
call fcn.00555020
add esp, 0x18
lea edx, [ebp - 4]
push edx
push 1
push 0
push str.SOFTWAREStaffCopLic
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d0cd2
xor al, al
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.skey
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x400
call esi
test eax, eax
je 0x4d0d18
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.lkey
push edx
mov dword [ebp - 8], 0x800
call esi
test eax, eax
je 0x4d0d50
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0d60
sub eax, edx
push eax
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040a960
lea eax, [ebp - 0xc0c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0d82
mov ecx, dword [ebp + 0xc]
sub eax, edx
push eax
lea edx, [ebp - 0xc0c]
push edx
call fcn.0040a960
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d1960
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x104], 0
je 0x4d19a0
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x4d19a0
push 0
push 0
push 0x229
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4d199e
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x4d199e
push 0
mov ecx, esi
call fcn.004d1920
pop esi
ret
cmp byte [esi + 0xf8], 0
je 0x4d199e
lea ecx, [esi + 0x24]
mov byte [esi + 0xf8], 0
call fcn.004780b0
cmp byte [esi + 0xf8], 0
mov ecx, esi
pop esi
je 0x4d19c9
jmp fcn.004d1640
jmp fcn.004d15c0
Function at 0x4d1d30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], ebx
call fcn.004bb0f0
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0x10
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, esi
mov dword [ebp - 0x18], eax
call fcn.004c2d20
cmp eax, ebx
jl 0x4d1e83
cmp eax, dword [esi + 0x34]
jae 0x4d1d8a
mov edx, dword [esi + 0x30]
mov ebx, dword [edx + eax*4]
lea eax, [edx + eax*4]
push edi
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.004bb000
mov byte [ebp - 4], 1
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4d1dde
lea ecx, [ebp - 0x10]
push edi
push ecx
call fcn.00416b60
add esp, 8
test al, al
je 0x4d1e5f
push edi
mov ecx, ebx
call fcn.004c38d0
movzx edx, al
mov ecx, esi
mov dword [ebp - 0x14], edx
call fcn.004be020
mov eax, dword [esi + 4]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4d1e5f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4d1e5f
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [ebp + 0xc], edi
neg ecx
or ecx, eax
push ecx
call fcn.0053f875
mov edi, eax
add esp, 4
test edi, edi
je 0x4d1e5f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [ebp - 0x10]
push edi
push edx
call fcn.00416b60
add esp, 8
test al, al
je 0x4d1e56
push edi
mov ecx, ebx
call fcn.004c38d0
movzx eax, al
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.004be020
mov ecx, dword [esi + 4]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
call fcn.005559df
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
test ecx, ecx
jg 0x4d1e83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], vtable.CTabViewTabItem.0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x3c]
call fcn.004baf70
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d61f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov dword [edi], 0
mov eax, dword [esi + 0xa8]
cmp eax, 0x12
je 0x4d6229
cmp eax, 0x79
jne 0x4d621c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4d6229
cmp dword [esi + 0xa8], 0x20
jne 0x4d62a9
cmp dword [ebp + 0xc], 0xf100
jne 0x4d62a9
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x4d6266
mov ecx, esi
call fcn.004d50f0
mov eax, dword [esi + 4]
push 0
push 0xffffffffffffffff
push 0x448
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
and byte [esi + 0x84], 0xbf
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x4d62a9
test byte [esi + 0x84], 0x40
jne 0x4d629e
mov al, byte [esi + 0x85]
test al, 2
je 0x4d6295
test al, 4
jne 0x4d6295
test al, 8
je 0x4d6295
push 1
mov ecx, esi
call fcn.004d3b50
mov ecx, esi
call fcn.004d2db0
jmp 0x4d62a3
cmp eax, 0x20
je 0x4d62a9
mov dword [edi], 1
and byte [esi + 0x84], 0xbf
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x4d8070
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
push esi
mov esi, ecx
cmp eax, dword [esi + 4]
je 0x4d8095
mov ecx, dword [ebp + 0x10]
pop esi
mov dword [ecx], 0
mov eax, 1
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
cmp eax, dword [esi + 4]
je 0x4d80c4
test byte [esi + 0x58], 4
je 0x4d80ba
cmp dword [esi + 0xac], 0
jne 0x4d80ba
call edi
mov dword [esi + 0xac], eax
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0xc]
push 0
push eax
mov eax, dword [esi + 4]
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x84], 0xcf
push 1
push eax
mov ecx, esi
call fcn.004d7d00
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x4d9500
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
or eax, 0xffffffff
mov dword [ebp - 0x10], ebx
test esi, esi
je 0x4d9648
push edi
lea ecx, [ebp - 0x38]
call fcn.004bb0f0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push 0x10
lea eax, [ebp - 0x38]
push eax
mov ecx, ebx
mov dword [ebp - 0x14], esi
call fcn.004c2d20
cmp dword [ebp + 0xc], 1
mov edi, eax
jne 0x4d961f
test edi, edi
jns 0x4d9623
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4d960a
inc eax
xor ecx, ecx
mov dword [ebp + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053f875
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d9607
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0x10], 0
je 0x4d95e3
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x7f
push esi
call edi
test eax, eax
jne 0x4d95f1
push 0xffffffffffffffde
push esi
call dword [sym.imp.USER32.dll_GetClassLongW]
test eax, eax
jne 0x4d95f1
push eax
push 1
push 0x7f
push esi
call edi
test eax, eax
jne 0x4d95f1
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_GetClassLongW]
test eax, eax
jne 0x4d95f1
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
push ebx
push esi
call fcn.004d1fb0
jmp 0x4d95fc
mov ecx, dword [ebp - 0x10]
push eax
push ebx
push esi
call fcn.004d2240
push ebx
mov edi, eax
call fcn.005559df
add esp, 4
mov ebx, dword [ebp - 0x10]
test edi, edi
jns 0x4d9623
push 0xffffffffffffffff
push str.Untitled
push esi
mov ecx, ebx
call fcn.004d1fb0
mov edi, eax
test edi, edi
js 0x4d962d
push 1
push edi
mov ecx, ebx
call fcn.004bfb00
or eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], vtable.CTabViewTabItem.0
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x38]
call fcn.004baf70
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d9db0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4d9ddc
push 0x17c
push str.d:_work_current_staffcop_standart_sdkcontrolswtldockingwindows_sstate.h
push 0x5a56a4
call fcn.0055640a
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 4]
push edx
push eax
push ecx
call fcn.004d98d0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
add esp, 0xc
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d9ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
xor eax, eax
push esi
mov esi, ecx
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], 2
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x28], ecx
mov dword [ebp - 4], 3
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ebp - 4], 5
push eax
lea ecx, [esi + 0x40]
call fcn.004d9420
mov byte [ebp - 4], 6
push 1
lea ecx, [esi + 0x78]
call fcn.004d9420
mov byte [ebp - 4], 7
lea ecx, [esi + 0xc0]
call fcn.004cef80
mov byte [ebp - 4], 8
lea ecx, [esi + 0x20c]
call fcn.004d9140
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4da880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4da8af
push 0x14e
push str.d:_work_current_staffcop_standart_sdkcontrolswtldockingwindows_sstate.h
push 0x5a56a4
call fcn.0055640a
add esp, 0xc
mov edx, dword [esi + 0x1c]
lea ecx, [ebp - 0x34]
push ecx
push edx
mov dword [ebp - 0x34], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x4da90c
mov eax, dword [esi + 0x1c]
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, 2
test eax, eax
je 0x4da8e8
or dword [ebp - 0x30], ecx
cmp dword [ebp - 0x2c], ecx
jne 0x4da8f4
mov dword [ebp - 0x2c], 1
mov edx, dword [edi]
push 0x2c
lea ecx, [ebp - 0x34]
push ecx
push 3
push 0
push 0x5a4e20
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
push edi
push ecx
push eax
push edx
lea eax, [ebp - 8]
push eax
call fcn.004da120
add esp, 0x14
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8