joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513e00
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x513ea2
cmp dword [ebx + 0x90], 0
jne 0x513e9c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x513d4c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x513e9c
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongW
test al, 8
je 0x513e62
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x513e9c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.004951bc
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x513e71
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5140c0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x7bf110]
cmp dword [eax + 0x170], 0
je 0x514225
test bl, bl
jne 0x514173
cmp dword [esi + 0x98], 0
jne 0x514168
mov eax, esi
call fcn.00516cc8
push eax
push 0x513fcc
call sub.USER32.DLL_EnumWindows
cmp dword [esi + 0x40], 0
je 0x514139
mov eax, dword [0x7bf110]
cmp byte [eax + 0xcf], 0
je 0x514139
mov eax, dword [esi + 0xd4]
call fcn.004c44bc
mov edi, eax
cmp edi, 0
jl 0x514139
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.USER32.DLL_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x514122
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x514168
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.004951bc
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x514148
inc dword [esi + 0x98]
jmp 0x514225
cmp dword [esi + 0x98], 0
jle 0x514225
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x514225
cmp dword [esi + 0x40], 0
je 0x5141d0
mov eax, dword [0x7bf110]
cmp byte [eax + 0xcf], 0
je 0x5141d0
mov eax, dword [esi + 0xd4]
call fcn.004c44bc
mov edi, eax
cmp edi, 0
jl 0x5141d0
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.USER32.DLL_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5141b9
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5141ff
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.004951bc
push eax
call sub.USER32.DLL_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5141df
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x50923c]
call fcn.004c467c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x514df8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x514e63
cmp byte [ebx + 0xcf], 0
jne 0x514e63
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.USER32.DLL_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004c2b34
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x514e50
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x514e70
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.004c29f8
jmp 0x514e70
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.004c29f8
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x516488
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x5164f6
mov eax, esi
call fcn.005337a4
test al, al
je 0x5164f6
mov eax, dword [ebx + 0x80]
call fcn.005333f8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5164f6
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x5164ea
push 0
mov eax, dword [ebx + 0x80]
call fcn.005333f8
push eax
call sub.USER32.DLL_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0052a974
jmp 0x5164f6
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.005162d4
pop esi
pop ebx
ret
Function at 0x52212c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004c29e0
xor eax, eax
push ebp
push 0x5222c1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x52228f
xor edx, edx
push ebp
push 0x522288
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004c2a4c
mov eax, dword [ebp - 8]
test eax, eax
je 0x52219b
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x52219b
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004c1d4c
test eax, eax
je 0x5221a4
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x52225d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x52224c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004c2a4c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x522206
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x522206
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004c1d4c
test eax, eax
je 0x52220f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.004c2a84
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004bfce0
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522253
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
mov ecx, dword [0x7b96fc]
mov dl, 1
mov eax, dword [0x4a89e0]
call fcn.004afe50
call fcn.004c1444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5222c8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004c29f0
ret
Function at 0x5280e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x7bf1d4], 0
je 0x528221
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x7b9688]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x528221
mov eax, dword [0x7bf1d8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x7bf1d4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5281f0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x7bf1d4]
call fcn.004951bc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x5281e8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x5281e8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x5281e8
mov eax, dword [ebp - 0x14]
call fcn.005333f8
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5281e8
push ebp
call fcn.0052809c
pop ecx
test al, al
jne 0x5281e8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004c0c04
test al, al
je 0x5281e8
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004c0c04
cmp byte [ebp - 1], 0
je 0x5281e8
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.004a7b9c
test al, al
je 0x5281e8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x7bf1d8]
call fcn.00527810
inc edi
dec ebx
jne 0x528145
mov eax, dword [0x7bf1d8]
cmp dword [eax + 8], 0
jle 0x528208
mov eax, dword [0x7bf1d8]
call fcn.005278c8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x528221
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00527f00
pop ecx
test al, al
jne 0x528221
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x530084
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.USER32.DLL_GetMessagePos
call fcn.004a7b84
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0052a584
test ebx, ebx
jne 0x5300d7
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0052ff18
mov ebx, eax
test ebx, ebx
je 0x5301c2
cmp esi, ebx
je 0x530100
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x530115
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x53014d
add eax, 0xffffff5f
sub eax, 2
jb 0x530165
dec eax
sub eax, 2
jb 0x530179
dec eax
sub eax, 2
jb 0x53016f
jmp 0x530183
add eax, 0xfffffdff
sub eax, 2
jb 0x530165
dec eax
sub eax, 2
jb 0x530179
dec eax
sub eax, 2
jb 0x53016f
jmp 0x530183
mov byte [esp + 0x120], 0
jmp 0x53018b
mov byte [esp + 0x120], 2
jmp 0x53018b
mov byte [esp + 0x120], 1
jmp 0x53018b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.USER32.DLL_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.005098e8
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0052bdd4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5301c4
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x55cae0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x55cbb2
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x55cb84
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
xor edx, edx
push ebp
push 0x55cb73
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004bfce0
mov eax, dword [ebp - 4]
call fcn.0055c9c4
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cb7a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
Function at 0x55cbc4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55cc38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x55cc0a
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.004c2bb4
jmp 0x55cc13
mov eax, ebx
xor edx, edx
call fcn.004c29f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cc3f
cmp dword [ebp - 8], 0
je 0x55cc2f
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x55ccd0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x55cd78
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x55cd4b
mov edx, ebx
mov eax, dword [0x4facb8]
call fcn.005003f8
test al, al
je 0x55cd3b
movzx eax, bx
push eax
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00500310
call fcn.004c1538
jmp 0x55cd7f
movzx eax, bx
push eax
call sub.USER32.DLL_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x55cd03
mov ecx, dword [0x7b9788]
mov dl, 1
mov eax, dword [0x55c90c]
call fcn.004afe50
call fcn.004c1444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cd7f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x55cd88
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x55cde4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.USER32.DLL_GetClipboardData
mov esi, eax
push 9
call sub.USER32.DLL_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cdeb
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x55cdf4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x55ce49
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.USER32.DLL_GetClipboardData
mov ebx, eax
push 9
call sub.USER32.DLL_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ce50
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x55cec0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x55cf35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0055c9c4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.005003d4
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x55cf1f
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cf3c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x55cf44
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x55cfb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0055c9c4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x55cfa3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cfc0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x5a1ac4
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0052c6cc
cmp dword [ebx + 0x200], 0
je 0x5a1b07
movzx eax, byte [ebx + 0x204]
push eax
push 0
push 0
mov eax, dword [ebx + 0x200]
call fcn.004c2a84
push eax
push 0x5a1b0c
mov eax, dword [0x7b9688]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.SHELL32.DLL_ShellExecuteW
pop ebx
ret

Function at 0x5a41ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a4252
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
lea eax, [ebp - 4]
lea edx, [esi + esi*2]
mov ecx, dword [ebx + 0x204]
mov edx, dword [ecx + edx*8 + 0x14]
call fcn.004c2a4c
cmp word [ebx + 0x212], 0
je 0x5a4203
lea eax, [ebp - 5]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x214]
call dword [ebx + 0x210]
cmp dword [ebp - 4], 0
setne al
and al, byte [ebp - 5]
je 0x5a423c
movzx eax, byte [ebx + 0x208]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
push 0x5a4260
mov eax, dword [0x7b9688]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.SHELL32.DLL_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4259
lea eax, [ebp - 4]
call fcn.004c29e8
ret
Function at 0x5adda0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 6]
lea eax, [ebp - 4]
call fcn.004ad8a4
push 4
lea eax, [ebp - 0x14]
push eax
push 0x100d
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoW
movzx eax, word [ebp - 0x14]
sub eax, 0x30
jne 0x5ade24
mov cx, 1
mov dx, 1
movzx eax, word [ebp - 4]
call fcn.004ad728
fstp qword [ebp - 0x10]
wait
push 0
push 7
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004ad8c4
movzx eax, ax
dec eax
cdq
push edx
push eax
fld qword [ebp + 8]
fsub qword [ebp - 0x10]
call fcn.004c008c
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
call fcn.004c3f50
inc eax
mov word [ebp - 2], ax
jmp 0x5ade38
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 2]
lea eax, [ebp - 4]
call fcn.004a64bc
cmp word [ebp - 2], 0
je 0x5ade43
dec word [ebp - 2]
movzx eax, word [ebp - 2]
mov esp, ebp
pop ebp
ret 8
Function at 0x5e8b18
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0
push esi
xor ecx, ecx
mov edx, 1
mov eax, 1
call sym.StartupControl.exe__Acntutils_MkRect_qqriiii
push esi
push 0
push 0x419
mov eax, ebx
call fcn.005333f8
push eax
call sub.USER32.DLL_SendMessageW
mov eax, esi
mov ecx, dword [ebx + 0x2c8]
mov edx, dword [ebx + 0x2c4]
call fcn.004a7ca8
pop esi
pop ebx
ret

Function at 0x5ec3d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
lea eax, [ebp - 0x100]
push eax
call sub.USER32.DLL_GetKeyboardState
test byte [ebp - 0xef], 0x80
jne 0x5ec445
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x2c0], 0
jne 0x5ec425
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x280]
add ecx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call sym.StartupControl.exe__Strackbar_TsRangeSelector_SetPosition_qqrxixi
jmp 0x5ec475
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x27c]
add ecx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 1
call sym.StartupControl.exe__Strackbar_TsRangeSelector_SetPosition_qqrxixi
jmp 0x5ec475
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2c0]
xor al, 1
and eax, 0x7f
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x2c0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x288]
xor edx, edx
call sym.StartupControl.exe__Scommondata_TsCommonData_Invalidate_qqrxo
mov eax, dword [ebp + 8]
mov byte [eax - 5], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ed0b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffef0
mov esi, edx
mov ebx, eax
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
push esp
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
sub eax, 0x201
je 0x5ed12d
dec eax
jne 0x5ed179
cmp word [ebx + 0xd2], 0
je 0x5ed179
call sym.StartupControl.exe__Svclutils_GetShiftState_qqrv
push eax
lea edx, [esp + 0x104]
xor eax, eax
call sym.StartupControl.exe__Svclutils_acMousePos_qqrp17Controls_TControl
mov eax, dword [esp + 0x104]
push eax
lea edx, [esp + 0x110]
xor eax, eax
call sym.StartupControl.exe__Svclutils_acMousePos_qqrp17Controls_TControl
mov eax, dword [esp + 0x114]
push eax
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebx + 0xd4]
call dword [ebx + 0xd0]
jmp 0x5ed179
cmp word [ebx + 0xc2], 0
je 0x5ed179
call sym.StartupControl.exe__Svclutils_GetShiftState_qqrv
push eax
lea edx, [esp + 0x104]
xor eax, eax
call sym.StartupControl.exe__Svclutils_acMousePos_qqrp17Controls_TControl
mov eax, dword [esp + 0x104]
push eax
lea edx, [esp + 0x110]
xor eax, eax
call sym.StartupControl.exe__Svclutils_acMousePos_qqrp17Controls_TControl
mov eax, dword [esp + 0x114]
push eax
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebx + 0xc4]
call dword [ebx + 0xc0]
add esp, 0x110
pop esi
pop ebx
ret
Function at 0x5f0bfc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x5f0c28
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x5f0c50
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x5f0c78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f0cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004c2bb4
mov eax, dword [ebp - 0xc]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0cda
lea eax, [ebp - 0xc]
call fcn.004c29e8
ret

Function at 0x5f0ce4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [ebp - 9], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret

Function at 0x5f0d24
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
jne 0x5f0d53
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret