joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4901e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
xor esi, esi
lea eax, [esp + 0x2c]
push ebp
push esi
push 0x1a8c
push 0x1e
push eax
call fcn.004c8000
lea eax, [esp + 0x20]
add esp, 0x10
push 0xc
push 0x1a8c
push 0x1e
push eax
call fcn.004c8000
lea eax, [esp + 0x20]
lea ecx, [esp + 0x40]
mov ebx, dword [esp + 0x64]
add esp, 0x10
movsx edi, word [esp + 0x58]
push 0x5050cc
push eax
push ecx
push edi
push ebx
call fcn.00479f10
add esp, 0x14
cmp byte [ebx], 0
jne 0x490281
mov esi, 0xffffffff
call fcn.00470800
mov ebp, eax
test ebp, ebp
je 0x49026c
push 1
push ebp
call fcn.0047a140
add esp, 8
push edi
push ebx
push ebp
call fcn.00470a10
add esp, 0xc
mov esi, eax
push ebp
call fcn.00470990
add esp, 4
test esi, esi
je 0x490281
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x490281
mov esi, 0xffffffff
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x4a2440
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.004a22a0
test eax, eax
je 0x4a2459
push 0x28
add esi, 0x10
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop esi
ret

Function at 0x4a5be0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov esi, dword [edi + 0x14]
mov ebx, dword [ebp]
test ebx, ebx
jne 0x4a5c20
mov eax, dword [esi + 6]
cmp eax, 0x100
jg 0x4a5c05
mov eax, 0x100
push 2
lea eax, [eax*4 + 0x28]
push eax
call fcn.00488d30
mov dword [ebp], eax
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4a5c65
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [eax], 0x28
mov word [eax + 0xc], 1
mov word [eax + 0xe], 8
mov ecx, dword [esi + 6]
mov dword [eax + 0x20], ecx
mov ecx, dword [esi + 6]
shl ecx, 2
mov esi, dword [edi + 0x5c]
shr ecx, 2
mov edx, dword [edi + 0xc]
lea edi, [eax + 0x28]
push ebx
lea esi, [esi + edx + 0xa]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4abbf0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x50e88c]
test eax, eax
je 0x4abc1d
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x50e88c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov ecx, dword [0x50e324]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
ret

Function at 0x4ac250
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xc
mov dword [esp], 0
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x20]
push 0
mov ebp, dword [edi + 8]
mov eax, dword [edi + 0xc]
sub ebp, dword [edi]
sub eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4ac312
mov eax, dword [esp + 0x18]
push eax
push ebp
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4ac309
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x4ac2fe
mov eax, dword [esp + 0x14]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov ecx, dword [edi]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
push eax
push ecx
push esi
push edx
push ebp
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x14]
push 0
push 4
push 0
push ecx
call fcn.00415a80
mov dword [esp + 0x20], eax
add esp, 0x10
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4ac5f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
test byte [0x508abc], 8
push ebx
push esi
push edi
jne 0x4ac69f
or dword [0x508abc], 8
push 0x508ac0
lea eax, [ebp - 0x10]
and dword [0x508abc], 0xffffffef
push 0x16
push 0x15
push 0x5f0
push 9
push eax
call fcn.00479cc0
add esp, 0x18
cmp byte [ebp - 0x10], 0x30
je 0x4ac63a
mov byte [ebp - 0x10], 0x31
mov byte [ebp - 0xf], 0
lea eax, [ebp - 0x10]
push eax
push 0x16
push 0x15
push 0x5f0
call fcn.00479d40
add esp, 0x10
cmp byte [ebp - 0x10], 0x30
je 0x4ac69f
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1c], 0x1e6
jbe 0x4ac69f
mov dword [ebp - 4], 0
pushaw
mov edx, 0
mov eax, 0
cpuid
cmp eax, 1
jl 0x4ac690
mov eax, 1
cpuid
mov dword [ebp - 4], edx
popaw
test byte [ebp - 2], 0x80
je 0x4ac69f
or dword [0x508abc], 0x10
mov eax, dword [0x508abc]
pop edi
and eax, 0x10
pop esi
shr eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0950
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x10]
mov eax, esi
shr eax, 0x10
movsx ecx, ax
lea eax, [ecx + ecx*8]
shl eax, 4
lea edi, [eax + 0x50e8b0]
test byte [edi + 0x50], 2
je 0x4b097e
mov eax, 0x1396
pop edi
pop esi
add esp, 4
ret
mov eax, dword [edi + 0x64]
push eax
push esi
push edi
call fcn.004b0f40
mov dword [esp + 0x14], eax
add esp, 0xc
test eax, eax
jge 0x4b09ab
lea eax, [esp + 8]
mov ecx, dword [esp + 8]
push eax
push ecx
push edi
call fcn.004b0e10
add esp, 0xc
test eax, eax
jne 0x4b0a01
mov eax, dword [edi + 0x64]
mov ecx, dword [esp + 8]
add ecx, ecx
mov edx, dword [eax]
lea eax, [ecx + ecx*2]
lea ecx, [eax + eax*4]
add ecx, edx
mov edx, dword [esp + 0x14]
movzx eax, si
mov dword [ecx], eax
mov si, word [edx + 0x1c]
mov word [ecx + 0x1c], si
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov si, word [edx + 4]
mov word [ecx + 4], si
mov ax, word [edx + 6]
mov word [ecx + 6], ax
mov al, byte [edx + 0x12]
mov byte [ecx + 0x12], al
xor eax, eax
mov si, word [edx + 0x10]
mov word [ecx + 0x10], si
mov edx, dword [edx + 0xc]
mov dword [ecx + 0xc], edx
pop edi
pop esi
add esp, 4
ret

Function at 0x4b1700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push esi
and eax, 0xffff
mov esi, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
and eax, 0xffff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4b172e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4b95c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
mov edi, dword [esi + 0x14]
mov ebp, dword [esp + 0x18]
mov ebx, dword [ebp]
test ebx, ebx
jne 0x4b9600
mov eax, dword [edi + 6]
cmp eax, 0x100
jg 0x4b95e5
mov eax, 0x100
push 2
lea eax, [eax*4 + 0x28]
push eax
call fcn.00488d30
mov dword [ebp], eax
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4b9645
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [eax], 0x28
mov word [eax + 0xc], 1
mov word [eax + 0xe], 8
mov ecx, dword [edi + 6]
mov dword [eax + 0x20], ecx
mov ecx, dword [edi + 6]
shl ecx, 2
mov ebp, dword [esi + 0x5c]
shr ecx, 2
mov edx, dword [esi + 0xc]
lea edi, [eax + 0x28]
push ebx
lea esi, [ebp + edx + 0xa]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c5180
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x4c51da
lea eax, [esp + 4]
push 2
push 0x203
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0x201
push 0
push eax
call esi
test eax, eax
jne 0x4c51d3
lea eax, [esp + 4]
push 2
push 0xa3
push 0xa1
push 0
push eax
call esi
test eax, eax
jne 0x4c51d3
mov eax, 1
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x4c5520
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x2c
lea eax, [esp + 0xc]
push ebx
push esi
push edi
mov esi, dword [esp + 0x3c]
push ebp
push eax
push esi
call fcn.004c5f80
lea ecx, [esp + 0x34]
add esp, 8
push ecx
push esi
call fcn.004c5f30
add esp, 8
mov edi, dword [sym.imp.USER32.dll_PtInRect]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esi + 0x2e]
jle 0x4c56b2
cmp dword [esi + 0x2e], 0
jne 0x4c5570
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xc8
mov dword [esi + 0x2e], eax
mov bx, 1
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c60c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x24]
add esp, 8
mov dword [esi + 0x3c], 1
push ecx
push eax
push edx
call edi
test eax, eax
jne 0x4c55be
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push ecx
push eax
mov ebx, 0
push edx
call edi
cmp eax, 1
adc ebx, 0xffffffff
and bx, 2
cmp dword [esi + 0x34], 0
je 0x4c5661
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004c6160
add esp, 8
mov ebp, eax
mov ax, word [esi + 0x32]
sub ax, 2
cmp ax, 1
lea eax, [ebx - 2]
sbb ecx, ecx
neg ecx
cmp ax, 1
sbb eax, eax
neg eax
cmp ecx, eax
je 0x4c5616
lea eax, [ebx - 2]
lea ecx, [esp + 0x2c]
cmp ax, 1
mov eax, 5
adc eax, 0xffffffff
push eax
push ecx
push ebp
push esi
call fcn.004c4f10
add esp, 0x10
mov ax, word [esi + 0x32]
dec ax
cmp ax, 1
lea eax, [ebx - 1]
sbb ecx, ecx
neg ecx
cmp ax, 1
sbb eax, eax
neg eax
cmp ecx, eax
je 0x4c5652
lea eax, [ebx - 1]
lea ecx, [esp + 0x1c]
cmp ax, 1
mov eax, 3
adc eax, 0xffffffff
push eax
push ecx
push ebp
push esi
call fcn.004c4f10
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push ebp
push esi
call fcn.004c61b0
add esp, 0xc
mov word [esi + 0x32], bx
cmp bx, 1
jne 0x4c567d
lea ebx, [esi + 0x24]
push esi
call fcn.004c6030
add esp, 4
mov ebp, dword [ebx]
add ebp, eax
jmp 0x4c5693
cmp bx, 2
lea ebx, [esi + 0x24]
mov ebp, dword [ebx]
jne 0x4c5693
push esi
call fcn.004c6030
add esp, 4
sub ebp, eax
mov eax, dword [esi + 0x28]
cmp eax, ebp
jl 0x4c569c
mov eax, ebp
test eax, eax
jg 0x4c56a2
xor eax, eax
cmp dword [ebx], eax
je 0x4c56b2
push 1
push eax
push esi
call fcn.004c5200
add esp, 0xc
call fcn.004c60a0
call fcn.004c5180
test eax, eax
jne 0x4c554d
cmp dword [esi + 0x34], 0
je 0x4c5719
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004c6160
add esp, 8
mov edi, eax
cmp word [esi + 0x32], 1
jne 0x4c56f2
lea eax, [esp + 0x1c]
push 2
push eax
push edi
push esi
call fcn.004c4f10
add esp, 0x10
cmp word [esi + 0x32], 2
jne 0x4c570a
lea eax, [esp + 0x2c]
push 4
push eax
push edi
push esi
call fcn.004c4f10
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push edi
push esi
call fcn.004c61b0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x4c5730
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x2c]
push ebp
push eax
push esi
call fcn.004c5ed0
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp eax, dword [esi + 0x2e]
jle 0x4c58d7
cmp dword [esi + 0x2e], 0
jne 0x4c576a
call edi
add eax, 0xc8
mov dword [esi + 0x2e], eax
lea eax, [esp + 0x24]
push eax
push esi
call fcn.004c60c0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x28]
add esp, 8
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [esi + 0x3c], ecx
jns 0x4c5797
mov bx, 2
jmp 0x4c57a2
mov bx, 1
test ecx, ecx
jg 0x4c57a2
xor bx, bx
cmp dword [esi + 0x54], 1
mov ecx, 9
je 0x4c57b7
call fcn.004d7a60
mov ecx, 0xf
mov eax, dword [esi + 0x3c]
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jg 0x4c57c8
mov dword [esi + 0x3c], eax
jmp 0x4c57e3
cmp dword [esi + 0x54], 1
jne 0x4c57d7
mov dword [esi + 0x3c], 9
jmp 0x4c57e3
call fcn.004d7a60
mov dword [esi + 0x3c], 0xf
cmp dword [esi + 0x34], 0
je 0x4c5886
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004c6160
add esp, 8
mov ebp, eax
mov ax, word [esi + 0x32]
sub ax, 2
cmp ax, 1
lea eax, [ebx - 2]
sbb ecx, ecx
neg ecx
cmp ax, 1
sbb eax, eax
neg eax
cmp ecx, eax
je 0x4c583b
lea eax, [ebx - 2]
lea ecx, [esp + 0x14]
cmp ax, 1
mov eax, 5
adc eax, 0xffffffff
push eax
push ecx
push ebp
push esi
call fcn.004c4f10
add esp, 0x10
mov ax, word [esi + 0x32]
dec ax
cmp ax, 1
lea eax, [ebx - 1]
sbb ecx, ecx
neg ecx
cmp ax, 1
sbb eax, eax
neg eax
cmp ecx, eax
je 0x4c5877
lea eax, [ebx - 1]
lea ecx, [esp + 0x14]
cmp ax, 1
mov eax, 3
adc eax, 0xffffffff
push eax
push ecx
push ebp
push esi
call fcn.004c4f10
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push ebp
push esi
call fcn.004c61b0
add esp, 0xc
mov word [esi + 0x32], bx
cmp bx, 1
jne 0x4c58a2
lea ebx, [esi + 0x24]
push esi
call fcn.004c6030
add esp, 4
mov ebp, dword [ebx]
add ebp, eax
jmp 0x4c58b8
cmp bx, 2
lea ebx, [esi + 0x24]
mov ebp, dword [ebx]
jne 0x4c58b8
push esi
call fcn.004c6030
add esp, 4
sub ebp, eax
mov eax, dword [esi + 0x28]
cmp eax, ebp
jl 0x4c58c1
mov eax, ebp
test eax, eax
jg 0x4c58c7
xor eax, eax
cmp dword [ebx], eax
je 0x4c58d7
push 1
push eax
push esi
call fcn.004c5200
add esp, 0xc
call fcn.004c60a0
call fcn.004c5180
test eax, eax
jne 0x4c574f
cmp dword [esi + 0x34], 0
je 0x4c593e
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004c6160
add esp, 8
mov edi, eax
cmp word [esi + 0x32], 1
jne 0x4c5917
lea eax, [esp + 0x14]
push 2
push eax
push edi
push esi
call fcn.004c4f10
add esp, 0x10
cmp word [esi + 0x32], 2
jne 0x4c592f
lea eax, [esp + 0x14]
push 4
push eax
push edi
push esi
call fcn.004c4f10
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push edi
push esi
call fcn.004c61b0
add esp, 0xc
push esi
call fcn.004c5950
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4c8c90
Capabilities:
Log keystrokes via polling

Disassembly:
lea eax, [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x100
lea edx, [esp]
push esi
push eax
push ecx
push 0x100
push edx
call fcn.00401920
lea ecx, [esp + 0x14]
add esp, 0x10
push ecx
push str.Internal_Error
call fcn.004c8d20
lea ecx, [esp + 0xc]
add esp, 8
push 0x2010
push str.Internal_Error
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x11
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
test ax, ax
jge 0x4c8cfa
push 0x12
call esi
test ax, ax
jge 0x4c8cfa
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 1
push 0x50f888
call fcn.004f3338
add esp, 8
pop esi
add esp, 0x100
ret
Function at 0x4cf6c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push esi
mov si, word [esp + 0x18]
movsx eax, si
sub eax, 0x2a
cmp eax, 0x94
ja case.0x4cf6de.54
xor ecx, ecx
mov cl, byte [eax + 0x4cf88c]
jmp dword [ecx*4 + 0x4cf858]
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.004cc310
add esp, 8
pop esi
add esp, 0x10
ret
cmp dword [0x50bfd0], 0
je 0x4cf73c
mov eax, dword [0x50bfd0]
push eax
call fcn.004dd110
mov dword [esp + 8], eax
add esp, 4
lea eax, [esp + 4]
mov dword [esp + 8], edx
push eax
call fcn.004b2700
add esp, 4
cmp si, 0x2a
jne 0x4cf733
mov eax, dword [esp + 4]
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 8]
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [0x50bfd0], 0
je 0x4cf771
lea eax, [esp + 4]
push eax
call fcn.004b2700
add esp, 4
push eax
mov eax, dword [0x50bfd0]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp si, 0x2e
jne 0x4cf780
mov eax, dword [esp + 4]
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 8]
pop esi
add esp, 0x10
ret
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
pop esi
mov cx, ax
add esp, 0x10
and ecx, 1
mov eax, ecx
ret
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, 1
jl 0x4cf851
pop esi
xor eax, eax
add esp, 0x10
ret
push 0
call fcn.00487150
pop esi
add esp, 0x10
ret
push 1
call fcn.00487150
pop esi
add esp, 0x10
ret

Function at 0x4d3910
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
mov eax, dword [0x50f910]
test eax, eax
push ebx
push esi
push edi
je 0x4d39a9
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4d39a9
mov edi, dword [esp + 0x30]
mov eax, 0
cmp edi, 1
adc eax, 0xffffffff
and eax, 5
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x4d39a9
lea eax, [esp + 0xc]
mov ecx, dword [0x50f910]
push eax
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
push ecx
call edi
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
mov edi, dword [esp + 0x14]
push 8
sub edi, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
mov ebx, eax
push 6
call esi
add ebx, eax
push 6
sub ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov edx, dword [0x50f910]
lea ecx, [ebx + eax + 4]
push ecx
push edi
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4d5c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [esp + 0x14]
push ebp
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x4d5ca7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov ebp, eax
je 0x4d5c9c
cmp byte [ebp], 0
je 0x4d5c9c
mov ebx, dword [esp + 0x1c]
push ebx
push ebp
push edi
call dword [esp + 0x2c]
add esp, 0xc
mov esi, eax
cmp esi, 1
je 0x4d5c9c
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x4d5c7a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4d5e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x2c
lea eax, [esp]
push ebx
mov bx, word [esp + 0x38]
push esi
push edi
xor esi, esi
mov edi, dword [esp + 0x3c]
push ebp
push 0x29
push eax
push ebx
push edi
call fcn.004d5dc0
add esp, 0x10
test eax, eax
je 0x4d5eed
push esi
push ebx
push edi
call fcn.004d6cf0
add esp, 0xc
mov edi, eax
cmp edi, esi
je 0x4d5eed
lea eax, [esp + 0x10]
push str.DLL_HEADER
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d5eed
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov edi, eax
je 0x4d5eed
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov ebx, eax
je 0x4d5ee6
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [ebx + eax + 1]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [ebp + eax + 1]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4d5ee6
add eax, 2
push eax
push 0x5050cc
call fcn.00488d50
add esp, 8
mov esi, eax
test esi, esi
je 0x4d5ee6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [ebp]
push ebx
mov byte [eax], cl
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x4d6900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x38
push esi
push edi
push 0x50f968
call fcn.004dae00
add esp, 4
test eax, eax
je 0x4d6a12
lea eax, [esp + 0x14]
push 0x29
mov ecx, dword [esp + 0x50]
push eax
mov edx, dword [esp + 0x50]
push ecx
push edx
call fcn.004d5a80
add esp, 0x10
test eax, eax
je 0x4d6a12
lea eax, [esp + 0x14]
push str.DLL_HEADER
mov esi, dword [esp + 0x48]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d6a16
push eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4d6a16
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4d6a09
cmp byte [eax], 0
je 0x4d6a09
lea ecx, [esp + 8]
push ecx
push eax
call fcn.00470850
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
add esp, 8
push 0
push eax
push ecx
push 0x50f968
call fcn.004db1a0
add esp, 0x10
test eax, eax
je 0x4d69b9
mov eax, dword [esp + 0x10]
mov dword [esi], eax
jmp 0x4d69f5
mov eax, dword [esp + 8]
push eax
call fcn.004d6bf0
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4d69f5
mov eax, dword [esp + 8]
push eax
call fcn.004708e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
add esp, 4
mov eax, dword [esi]
mov dword [esp + 0x10], eax
push ecx
push 0x50f968
call fcn.004daf00
add esp, 8
cmp dword [esp + 8], 0
je 0x4d6a09
mov eax, dword [esp + 8]
push eax
call fcn.00470990
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4d6a16
mov esi, dword [esp + 0x44]
pop edi
cmp dword [esi], 1
sbb eax, eax
pop esi
inc eax
add esp, 0x38
ret

Function at 0x4d7520
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
push edi
push 3
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
test ax, ax
jge 0x4d7542
push 0x11
call esi
test ax, ax
mov esi, 1
jl 0x4d7544
xor esi, esi
test esi, esi
je 0x4d7599
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [esp + 8]
push 3
push 0x108
push 0x100
push 0
push eax
call edi
test eax, eax
jne 0x4d754e
lea eax, [esp + 8]
push 3
push 0x209
push 0x200
push 0
push eax
call edi
test eax, eax
jne 0x4d7567
lea eax, [esp + 8]
push 3
push 0xa9
push 0xa0
push 0
push eax
call edi
test eax, eax
jne 0x4d7580
mov eax, esi
pop edi
pop esi
add esp, 0x1c
ret