joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a5d1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov byte [ebp - 1], 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x40a626
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40a680
shr eax, 2
test al, 1
je 0x40a64f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
jmp 0x40a61d
xor ebx, ebx
push 1
push ebx
push ebx
push dword [esi + 0x24]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x40a680
or byte [esi + 0x54], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b37c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and byte [ebp - 0xc], 0
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
push eax
lea ecx, [ebp - 8]
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x72
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
call fcn.00403927
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call edi
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.004038fb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test ebx, ebx
je 0x40b43c
and byte [ebp - 0x1b], 0
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x2c], 0x49
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x44
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x62
mov byte [ebp - 0x27], 0x75
mov byte [ebp - 0x26], 0x67
mov byte [ebp - 0x25], 0x67
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x50
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x74
call esi
test eax, eax
je 0x40b43c
call eax
test eax, eax
jne 0x40b475
and dword [ebp - 4], 0
push str.ntdll.dll
call edi
test eax, eax
je 0x40b47a
push str.NtQueryInformationProcess
push eax
call esi
mov esi, eax
test esi, esi
je 0x40b47a
push 0
lea eax, [ebp - 4]
push 4
push eax
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x40b47a
cmp dword [ebp - 4], eax
je 0x40b47a
push 1
pop eax
jmp 0x40b47c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4ed
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
call fcn.0040b4d7
push 0x11
xor edx, edx
pop ecx
xor edi, edi
div ecx
mov esi, edx
add esi, ecx
test esi, esi
jle 0x40b52e
call fcn.0049d7be
test eax, eax
je 0x40b51c
push 0x10
cdq
pop ecx
idiv ecx
mov eax, edx
mov ecx, dword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
inc edi
cmp edi, esi
mov al, byte [ecx + eax]
mov byte [ebp + edi - 0x41], al
jl 0x40b50b
lea eax, [ebp - 0x40]
mov byte [ebp + esi - 0x40], 0xd
mov byte [ebp + esi - 0x3f], 0xa
and byte [ebp + esi - 0x3e], 0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
leave
ret
Function at 0x40c305
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
mov esi, ecx
push 0x425
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ebx, ebx
push ebx
push ebx
push 0x130b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xc], edi
mov dword [esi + 0x24], edi
je 0x40c3f5
call fcn.0043a317
test eax, eax
jne 0x40c3f5
lea eax, [ebp - 0x250]
push 0x104
push eax
push dword [0x4c7a90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x250]
lea ecx, [ebp - 8]
push eax
mov dword [ebp - 0x48], 0x3c
call fcn.0040a4e8
push ebx
lea ecx, [ebp - 8]
mov dword [ebp - 0x44], ebx
call fcn.00403c58
push 1
mov dword [ebp - 0x38], eax
mov eax, dword [0x4b0550]
pop edi
push dword [esi + 0x24]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x20], ebx
push str.RegisterAdminKey4_EEETWETRFSD_d
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], edi
call fcn.00403d66
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x3c], 0x4b1138
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40c40b
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
mov edi, dword [ebp - 0xc]
mov ecx, esi
mov dword [0x4bd894], edi
call fcn.0040bd68
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
mov dword [esi + 0x24], ebx
push 0x425
mov dword [0x4bd894], ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
jmp 0x40c402

Function at 0x410308
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov esi, ecx
push 0xa775
push 0x419
push dword [esi + 0xb4]
call edi
push ebx
push 0xa770
push 0x40c
mov dword [ebp - 4], eax
push dword [esi + 0xb4]
call edi
test eax, eax
jne 0x41034c
add dword [ebp - 4], 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
push 0x41d
push dword [esi + 0xb4]
call edi
push ebx
push ebx
push 0x43a
push dword [esi + 0xb4]
call edi
mov eax, dword [ebp - 8]
push ebx
sub eax, dword [ebp - 0x10]
inc eax
inc eax
push eax
mov eax, dword [ebp - 0xc]
add eax, 2
push eax
push ebx
push ebx
push ebx
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41089d
Capabilities:
Capture webcam image

Disassembly:
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ebp, 0x454
mov esi, ecx
push ebx
push ebp
push dword [esi + 0xb8]
call edi
lea eax, [ebx + 0xb28f]
push 0
push eax
push 0x419
push dword [esi + 0xb8]
call edi
cmp eax, 0xffffffff
je 0x4108e6
push 0
push eax
push 0x416
push dword [esi + 0xb8]
call edi
inc ebx
cmp ebx, 0x1b
jl 0x4108bb
cmp dword [esi + 0x2c], 0
je 0x4108f9
mov ecx, esi
call fcn.00410918
push 1
push 0
push ebp
push dword [esi + 0xb8]
call edi
push dword [esi + 0xd0]
mov ecx, esi
call fcn.00410cb5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410918
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov ebx, ecx
cmp dword [ebx + 0x2c], 0
je 0x410aaf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x14], eax
xor eax, eax
lea edi, [ebp - 0x40]
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
pop ecx
and dword [ebp - 0x38], 0
or dword [ebp - 0x34], 0xffffffff
or dword [ebp - 0x44], 0xffffffff
lea eax, [ebp - 0x44]
push eax
push ecx
push 0x444
mov dword [ebp - 0x10], ecx
push dword [ebx + 0xb8]
mov byte [ebp - 0x3c], 4
mov byte [ebp - 0x3b], cl
mov dword [ebp - 0x40], 0xb2a9
call esi
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test dword [ebp - 0x10], eax
je 0x410a9d
mov eax, dword [0x4b0550]
push 1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.004039ab
test eax, eax
je 0x4109b3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add eax, 0x41
mov word [ecx], ax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
call fcn.004038b5
mov edi, 0x4b1994
mov eax, edi
test eax, eax
je 0x4109d1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
lea ecx, [ebp - 8]
call fcn.00403bd8
and dword [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2c]
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00489f86
mov eax, dword [ebp - 4]
and dword [ebp - 0x24], 0
or dword [ebp - 0x20], 0xffffffff
add eax, 0xb28f
push 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x28], 4
mov byte [ebp - 0x27], 0x10
mov dword [ebp - 0x2c], eax
call fcn.0048a159
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 1
push 0x444
push dword [ebx + 0xb8]
call esi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
mov dword [ebp - 0x64], 0x20
mov dword [ebp - 0x60], 2
call fcn.00403a8c
push 0
lea ecx, [ebp - 8]
call fcn.00403c58
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
add eax, 0xb28f
push eax
push 0x440
push dword [ebx + 0xb8]
call esi
lea ecx, [ebp - 0x1c]
call fcn.0048996a
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
shl dword [ebp - 0x10], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jl 0x410985
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x2c], ebx
jne 0x410b08
xor eax, eax
jmp 0x410bcc
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 4]
cmp dword [esi + 0xc0], ebx
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], eax
jne 0x410b97
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xb
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
mov edi, str.NotifyWnd_123
push eax
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x38], 0x410ab2
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
push ebx
push dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push SHChangeNotifyRegister
push ebx
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push eax
mov dword [esi + 0xc0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push 0xffffffffffffffeb
push dword [esi + 0xc0]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x410ba8
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [esi + 0x3c], ebx
lea eax, [ebp - 0x10]
push eax
push 1
push 0x400
push 0x201ff
push 2
push dword [esi + 0xc0]
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
push 1
mov dword [esi + 0x3c], eax
pop eax
pop esi
pop ebx
leave
ret

Function at 0x410f82
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x4c]
mov dword [esi + 0x2c], edi
call fcn.0048997e
lea ecx, [esi + 0x54]
call fcn.00486bf5
lea ecx, [esi + 0xf4]
mov dword [esi + 0xe8], edi
call fcn.0048997e
push 0x3c0
mov dword [esi], 0x4aae0c
mov dword [esi + 0x38], edi
mov dword [esi + 0x24], edi
call fcn.0049c851
mov ebx, 0xc4
mov dword [esi + 0xdc], eax
push ebx
call fcn.0049c851
pop ecx
cmp eax, edi
pop ecx
je 0x411011
push 0x30
pop ecx
mov dword [eax], ecx
add eax, 4
mov edx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [0x4b0550]
mov dword [edx], ecx
add edx, 4
dec dword [ebp - 4]
jne 0x410fff
jmp 0x411013
xor eax, eax
push ebx
mov dword [esi + 0xe0], eax
call fcn.0049c851
cmp eax, edi
pop ecx
je 0x41103e
push 0x30
pop ecx
mov dword [eax], ecx
add eax, 4
mov edx, eax
mov ebx, dword [0x4b0550]
mov dword [edx], ebx
add edx, 4
dec ecx
jne 0x41102e
jmp 0x411040
xor eax, eax
mov dword [esi + 0xe4], eax
lea eax, [esi + 0xf0]
push eax
push edi
push edi
mov dword [esi + 0xd8], edi
mov dword [eax], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esi + 0xd4]
push eax
mov dword [eax], edi
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411dbe
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov edx, dword [ebp + 0xc]
push ebx
push esi
cmp edx, 1
push edi
mov ebx, ecx
je 0x411f03
cmp edx, 0x6e
jle 0x411e9e
cmp edx, 0x7a
jle 0x411eb2
cmp edx, 0x463
je 0x411ea7
cmp edx, 0x84e5
jne 0x411e9e
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0x15e
cmp dword [ebx + 0x38], 0
mov dword [ebp - 0xc], eax
jne 0x411e5b
push 0x1b4
call fcn.0049c851
test eax, eax
pop ecx
je 0x411e37
mov ecx, eax
call fcn.00412bcb
jmp 0x411e39
xor eax, eax
mov ecx, dword [ebx + 4]
push 0x43
sub esp, 0x10
mov dword [ebx + 0x38], eax
lea esi, [ebp - 0x10]
mov edi, esp
mov dword [eax + 0x24], ecx
push dword [ebx + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00411f39
mov eax, dword [ebx + 0xd8]
test eax, eax
je 0x411e6d
mov ecx, dword [ebx + 0x38]
mov dword [ecx + 0x24], eax
jmp 0x411e76
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 4]
mov dword [eax + 0x24], ecx
lea eax, [ebx + 0xf4]
lea ecx, [ebx + 0xf8]
neg eax
sbb eax, eax
lea esi, [ebp - 0x10]
and eax, ecx
mov ecx, dword [ebx + 0x38]
push dword [eax]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00412348
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
push 0
mov ecx, ebx
call fcn.0041251e
jmp 0x411e9e
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
lea ecx, [ebp - 0x20]
push ecx
push edx
push 0x43f
push eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x411ef0
push 0
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.0041151f
jmp 0x411e9e
cmp dword [ebx + 0xd8], 0
je 0x411e9e
push 0
push dword [ebx + 0xf0]
jmp 0x411ee7
mov edi, dword [ebx + 0xe8]
lea esi, [ebx + 0xe8]
call dword [sym.imp.USER32.dll_GetFocus]
cmp edi, eax
jne 0x411e9e
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
pop eax
jmp 0x411ea0
Function at 0x4127ba
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ecx
push 0
push dword [esi + 0xe8]
call edi
push 5
push dword [esi + 0x28]
call edi
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
ret

Function at 0x41302d
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 0x403
test eax, eax
je 0x413076
push ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 4]
call ebp
push 0
push dword [esi + 0x28]
call ebp
mov eax, dword [esi + 0x1a8]
pop ebp
test eax, eax
je 0x413076
push 0
push dword [esi + 0x1ac]
push ebx
push eax
call edi
lea eax, [esi + 0x17c]
xor ecx, ecx
cmp dword [eax], ecx
je 0x413099
push ecx
push 0x84e1
push ebx
mov dword [eax], ecx
push dword [esi + 0x19c]
call edi
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x4130a1
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp dword [ebp + 0xc], 0x84e4
mov esi, ecx
mov dword [edi], ebx
jne 0x4130c7
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
cmp eax, 0x6f
jne 0x41312a
mov dword [edi], 1
cmp dword [esi + 0x24], ebx
mov dword [ebp + 0xc], ebx
je 0x41322e
lea eax, [ebp + 0xc]
push ebx
push eax
lea ecx, [esi + 0x5c]
call fcn.0048dcd2
test eax, eax
je 0x41322e
cmp dword [ebp + 0xc], ebx
je 0x41322e
push dword [esi + 4]
push dword [ebp + 0xc]
push 0x4e0
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_ILFree]
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x41322e
cmp eax, 0x456
jb 0x4131f9
cmp eax, 0x474
jae 0x4131f9
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push ebx
stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x419
push dword [esi + 0x198]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 0x417
push dword [esi + 0x198]
call edi
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x41322e
mov dword [ebp + 0x14], eax
mov eax, dword [0x4b0550]
push 1
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
call fcn.004039ab
test eax, eax
je 0x4131a3
mov eax, dword [ebp + 0xc]
mov cx, word [ebp + 0x14]
mov word [eax], cx
lea eax, [ebp + 0xc]
push 0x4b1994
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.0040a915
mov eax, dword [eax]
push ebx
push eax
lea ecx, [ebp - 8]
call fcn.00489f86
lea ecx, [ebp + 0x14]
call fcn.004038fb
push dword [esi + 4]
lea eax, [ebp - 8]
neg eax
mov ebx, dword [esi + 0x24]
lea ecx, [ebp - 4]
sbb eax, eax
and eax, ecx
push dword [eax]
push 0x4e0
push ebx
call edi
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 8]
call fcn.0048996a
lea ecx, [ebp + 0xc]
jmp 0x413229
cmp eax, 0x84e3
je 0x413207
cmp eax, 0x84e2
jne 0x41322e
push str.Wildcard_for_the_next_version___Vista_addressbar_and_____n_nPlatzhalter_f
lea ecx, [ebp + 0xc]
call fcn.00403927
mov eax, dword [eax]
push ebx
push 0x4bd5d8
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp + 0xc]
call fcn.004038fb
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4144d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
lea eax, [ebp - 0x28]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
sub ebx, dword [ebp - 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x414529
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call edi
lea eax, [ebp - 0x38]
push eax
push dword [esi + 0xb8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x38]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x41454f
lea eax, [ebp - 0x30]
push eax
push dword [esi + 4]
call edi
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
add ebx, eax
cmp ebx, 5
jge 0x414562
push 5
pop ebx
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebx, 0x50
jge 0x414585
xor ebx, ebx
push 0x5c
push ebx
push dword [ebp - 4]
push dword [ebp - 0x14]
push ebx
push ebx
push dword [esi + 0x60]
call edi
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov eax, dword [esi + 0xa0]
xor ecx, ecx
cmp eax, ecx
push 0x5c
jne 0x4145a3
push ecx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push ecx
push dword [esi + 0x60]
call edi
jmp 0x4145c2
mov edx, dword [ebp - 8]
add edx, 0xfffffffe
push edx
mov edx, dword [ebp - 0x14]
inc edx
push ebx
push edx
push dword [ebp - 0x10]
push ecx
push eax
call edi
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414d58
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 4]
cmp eax, 0x200
je 0x414de1
cmp eax, 0x100
jne 0x414de1
lea eax, [edi + 0x2c]
lea ecx, [edi + 0x30]
neg eax
sbb eax, eax
push ebx
and eax, ecx
mov ebx, dword [eax]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
pop ebx
jne 0x414de1
mov eax, dword [esi + 8]
cmp eax, 0xd
jne 0x414dc0
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x414de1
push dword [esi + 0xc]
call fcn.0048f019
cmp al, 1
pop ecx
jne 0x414de1
push 0
push 0x6f
push 0x111
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x414ddc
cmp eax, 0x1b
jne 0x414de1
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x414de1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
pop eax
jmp 0x414de3
xor eax, eax
pop edi
pop esi
ret 4