joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f05b
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x4f8db7
call fcn.004de80b
xor ebx, ebx
push 0x238
mov dword [ebp - 0x10], ebx
call fcn.004d6661
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x46f08c
mov edi, eax
call fcn.0046ec3f
mov esi, eax
jmp 0x46f08e
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], esi
cmp esi, ebx
jne 0x46f0a1
xor eax, eax
inc eax
jmp 0x46f1b4
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [esi], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x46f0ae
sub eax, ecx
sar eax, 1
mov ecx, 0x103
cmp eax, ecx
jbe 0x46f0c9
mov eax, ecx
jmp 0x46f0dd
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x46f0cf
sub eax, edx
sar eax, 1
push eax
push dword [ebp + 0xc]
lea eax, [esi + 4]
push eax
call fcn.004d6323
mov esi, dword [esi]
add esp, 0xc
cmp esi, 2
je 0x46f1b1
xor edi, edi
inc edi
cmp esi, edi
jne 0x46f110
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46f1b1
push ebx
push 0x20
push 3
push ebx
push edi
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x46f132
mov dword [ebp - 0x10], edi
jmp 0x46f191
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jbe 0x46f1a2
lea eax, [esi + 2]
push eax
call fcn.004d4f20
mov ebx, eax
pop ecx
test ebx, ebx
je 0x46f18f
and dword [ebp - 0x18], 0
xor eax, eax
push eax
lea edi, [ebx + esi]
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46f182
cmp esi, dword [ebp - 0x18]
jne 0x46f182
push dword [ebp + 8]
mov ecx, ebx
call fcn.0046ecd5
pop ecx
mov dword [ebp - 0x10], eax
push ebx
call fcn.004d5e58
cmp dword [ebp - 0x10], 0
pop ecx
je 0x46f1a2
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0046f1ba
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0xffffffff
je 0x46f1b1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
call fcn.004de8e3
ret
Function at 0x470655
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea esi, [edi + 0x10]
push esi
call fcn.00469e20
mov ebx, eax
call fcn.0046a08c
test eax, eax
je 0x4706ba
mov eax, dword [ebp - 4]
mov dword [edi + 0x22c], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [edi + 0x230], eax
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x4706ad
lea ecx, [edi + 0x220]
push ecx
mov esi, eax
call fcn.00439ff8
jmp 0x4706af
xor eax, eax
mov dword [edi + 0x21c], eax
jmp 0x4707e3
mov eax, dword [edi + 0xc]
test eax, eax
je 0x47073f
push 0x83e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4707e3
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x470731
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x470731
push 0x10
mov dword [edi + 0x230], eax
mov dword [edi + 0x22c], esi
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x470729
lea ecx, [edi + 0x220]
push ecx
mov esi, eax
call fcn.00439ff8
jmp 0x47072b
xor eax, eax
mov dword [edi + 0x21c], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4707e3
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4707e3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jbe 0x4707da
push esi
call fcn.004d4f20
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4707da
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4707d3
cmp esi, dword [ebp - 8]
jne 0x4707d3
push 0x10
mov dword [edi + 0x230], ebx
mov dword [edi + 0x22c], esi
mov byte [edi + 0x224], 1
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x4707c9
lea ecx, [edi + 0x220]
push ecx
mov esi, eax
call fcn.00439ff8
jmp 0x4707cb
xor eax, eax
mov dword [edi + 0x21c], eax
jmp 0x4707da
push ebx
call fcn.004d5e58
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi + 0xc], 0
lea ebx, [edi + 0x21c]
mov esi, dword [ebx]
xor eax, eax
mov word [edi + 0x10], ax
test esi, esi
je 0x470815
call fcn.004704dd
mov esi, dword [ebx]
mov dword [edi + 4], eax
call fcn.004704fd
mov dword [edi + 8], eax
xor eax, eax
cmp dword [edi + 4], eax
setg al
jmp 0x470817
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x470883
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x5473cc]
push edi
call fcn.004705f8
push 0x17
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x47090f
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x470906
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x470906
push 0x10
mov dword [edi + 0x230], eax
mov dword [edi + 0x22c], esi
mov byte [edi + 0x224], 0
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x4708fe
lea ecx, [edi + 0x220]
push ecx
mov esi, eax
call fcn.00439ff8
jmp 0x470900
xor eax, eax
mov dword [edi + 0x21c], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [edi + 0xc], 0
lea ebx, [edi + 0x21c]
mov esi, dword [ebx]
xor eax, eax
mov word [edi + 0x10], ax
test esi, esi
je 0x470941
call fcn.004704dd
mov esi, dword [ebx]
mov dword [edi + 4], eax
call fcn.004704fd
mov dword [edi + 8], eax
xor eax, eax
cmp dword [edi + 4], eax
setg al
jmp 0x470943
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4726d5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1050], 0
push esi
lea esi, [edi + 0xb0]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472759
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x472759
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x104c], ax
lea eax, [ebp - 0x104a]
push eax
call fcn.004dbcc0
add esp, 0xc
push 0x824
lea eax, [ebp - 0x104c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x104c]
push eax
je 0x47277a
lea eax, [edi + 0x1c]
push eax
call fcn.00406723
mov eax, dword [edi + 0x1c]
sub eax, 0x10
call fcn.004065f5
add eax, 0x10
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.004d5a7d
leave
ret 4
push ebx
call fcn.00407c9b
jmp 0x472769
Function at 0x478414
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
neg ecx
add dword [ebp + 0xc], ecx
push edi
push dword [ebp + 0xc]
neg eax
add dword [ebp + 8], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x44]
mov edi, eax
cmp edi, 0xffffffff
je 0x478583
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x40]
test eax, eax
je 0x478583
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x38]
mov ecx, dword [esi + 0x24]
mov ebx, eax
mov dword [esp + 0xc], ebx
test ecx, ecx
je 0x478474
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push dword [ebp + 8]
mov ecx, ebx
call dword [eax + 0x10]
test eax, eax
je 0x4784bc
cmp dword [esi + 0x60], edi
jne 0x47849e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x64]
cmp eax, 0xc8
jbe 0x478583
push 1
push edi
push dword [esi + 0x58]
call fcn.0047802e
push edi
mov ecx, esi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
call fcn.00478b34
jmp 0x478583
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x8c], 1
cmp dword [esi + 0x60], edi
jne 0x4784df
call ebx
sub eax, dword [esi + 0x64]
cmp eax, 0x32
jbe 0x47857c
push 1
push edi
push dword [esi + 0x58]
call fcn.0047802e
push dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
push dword [ebp + 8]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
jne 0x47851c
or dword [esi + 0x5c], 0xffffffff
or dword [esi + 0x54], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [esi + 0x58]
call fcn.0047802e
or dword [esi + 0x58], 0xffffffff
jmp 0x47853f
cmp eax, 1
jne 0x478526
push dword [esi + 0x14]
jmp 0x47856b
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x478549
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x74]
mov edx, dword [ecx]
push eax
push esi
call dword [edx + 8]
test eax, eax
je 0x478549
mov dword [esi + 0x60], edi
call ebx
mov dword [esi + 0x64], eax
jmp 0x47857c
mov dword [0x5498ec], esi
call ebx
push 0
push 0x32
push 0x12345678
push dword [esi + 0x14]
mov dword [0x5498e8], eax
call dword [sym.imp.USER32.dll_SetTimer]
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [0x5498e0], esi
call fcn.0047a905
and dword [esi + 0x8c], 0
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x478e50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x1c], 0
push esi
push edi
je 0x478fc6
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp eax, 0x104
je 0x478e87
cmp eax, 0x105
je 0x478e87
cmp eax, 0x100
jne 0x478fc6
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
cwde
test eax, eax
js 0x478ebb
push 0x10
call esi
cwde
test eax, eax
js 0x478ebb
mov cx, word [edi + 0xe]
mov eax, 0x2000
mov edx, eax
and cx, dx
cmp cx, ax
jne 0x478ebb
xor esi, esi
inc esi
mov dword [esp + 0x10], esi
jmp 0x478ec3
and dword [esp + 0x10], 0
xor esi, esi
inc esi
movzx ecx, word [edi + 8]
mov edi, dword [edi + 4]
cmp edi, 0x104
je 0x478ede
cmp edi, 0x100
jne 0x478fc6
cmp dword [ebx + 0x8c], esi
jne 0x478f09
movzx eax, cx
sub eax, 0x1b
je 0x478f86
sub eax, 5
je 0x478f81
sub eax, 5
je 0x478f4a
dec eax
je 0x478f81
dec eax
je 0x478f4a
dec eax
je 0x478f81
movzx eax, cx
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [esp + 0x10], 0
mov edi, eax
jne 0x478f2a
cmp dword [ebx + 0x8c], esi
jne 0x478faa
push edi
call fcn.004da887
pop ecx
test eax, eax
je 0x478faa
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004790ab
test eax, eax
je 0x478f9b
push dword [esp + 0x14]
jmp 0x478f76
mov eax, dword [ebx]
xor edx, edx
cmp cx, 0x25
sete dl
mov ecx, ebx
push edx
push dword [ebx + 0x54]
call dword [eax + 0x98]
mov edi, eax
push 2
mov eax, ebx
call fcn.00479180
cmp dword [ebx + 0x90], 0xffffffff
je 0x478f7d
push edi
mov ecx, ebx
call fcn.00478b34
mov eax, esi
jmp 0x478fc8
push dword [ebx + 0x54]
jmp 0x478f76
push 2
or edi, 0xffffffff
mov eax, ebx
call fcn.00479180
and dword [ebx + 0x8c], 0
jmp 0x478f7d
cmp dword [ebx + 0x8c], esi
jne 0x478faa
cmp dword [esp + 0x10], 0
je 0x478f7d
cmp dword [ebx + 0x8c], 0
jle 0x478fc6
push 2
or edi, 0xffffffff
mov eax, ebx
call fcn.00479180
and dword [ebx + 0x8c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47a040
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edi, edi
cmp dword [esi + 0x1c], edi
je 0x47a150
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 8]
push ebx
mov ebx, dword [esi + 0xc]
push dword [esi + 0x14]
sub ebx, dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esi + 0x6c], edi
je 0x47a0b5
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x47a0b5
push 0xcc0020
push edi
push edi
push eax
push dword [ebp - 0xc]
push ebx
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi]
push edi
push edi
push dword [ebp - 4]
mov ecx, esi
call dword [eax + 0x18]
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], edi
je 0x47a0ef
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_OffsetRgn]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xcc0020
push edi
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
push ebx
push dword [esi + 8]
mov ebx, dword [ebp - 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0x14], 1
jne 0x47a124
push dword [ebp - 0x10]
jmp 0x47a125
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x18]
call edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
pop edi
leave
ret 4
Function at 0x47bdac
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
test esi, esi
je 0x47bef6
cmp dword [esi + 0x4c], 0
je 0x47bef6
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 4]
mov dword [ebp - 8], eax
sub ebx, eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
push edi
push 0
push 0
push dword [ebp - 4]
call fcn.0047a4c9
mov eax, dword [ebp + 8]
push dword [eax + 0x64]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 8]
neg ecx
push ecx
mov ecx, dword [ebp - 0xc]
neg ecx
push ecx
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
push eax
push eax
push eax
push eax
call esi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebx + ecx]
push eax
mov eax, dword [ebp - 0xc]
lea edx, [edi + eax]
push edx
push ecx
push eax
call esi
mov esi, dword [sym.imp.GDI32.dll_SelectClipRgn]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
call esi
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
push ebx
mov ebx, dword [ebp - 0x10]
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
cmp dword [ebp - 0x1c], 1
jne 0x47becf
push dword [ebp - 0x14]
jmp 0x47bed1
push 0
push ebx
call esi
push dword [ebp - 0x14]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x47c4da
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [edi + 8]
mov dword [edi + 0x2c], 1
mov dword [0x549918], eax
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 0x28]
jne 0x47c662
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x47c662
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [ebp - 0x20]
mov ecx, 0x105
cmp eax, ecx
ja 0x47c5cf
je 0x47c658
add ecx, 0xffffffa4
cmp eax, ecx
ja 0x47c5a3
je 0x47c584
cmp eax, 0x1f
je 0x47c59b
cmp eax, 0x86
je 0x47c58c
cmp eax, 0xa1
je 0x47c584
cmp eax, 0xa2
jbe case.default.0x47c5d9
cmp eax, 0xa4
jbe 0x47c584
cmp eax, 0xa5
jbe case.default.0x47c5d9
cmp eax, 0xa7
ja case.default.0x47c5d9
mov dword [edi + 0x2c], esi
jmp 0x47c658
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [edi + 0x28]
je case.default.0x47c5d9
mov dword [edi + 0x2c], esi
jmp case.default.0x47c5d9
sub eax, 0x100
je 0x47c5c0
dec eax
je 0x47c658
dec eax
je case.default.0x47c5d9
dec eax
dec eax
jne case.default.0x47c5d9
lea ecx, [ebp - 0x24]
mov eax, edi
call fcn.0047c24c
jmp 0x47c658
add eax, 0xfffffe00
cmp eax, 9
ja case.default.0x47c5d9
jmp dword [eax*4 + 0x47c6ba]
lea ebx, [ebp - 0x24]
mov eax, edi
call fcn.0047c8d0
jmp 0x47c658
push edi
lea eax, [ebp - 0x24]
call fcn.0047c28d
jmp 0x47c658
lea eax, [ebp - 0x24]
mov ebx, edi
call fcn.0047c30d
jmp 0x47c658
push edi
lea eax, [ebp - 0x24]
call fcn.0047c377
jmp 0x47c658
lea eax, [ebp - 0x24]
mov ebx, edi
call fcn.0048afad
jmp 0x47c658
mov eax, dword [ebp - 0x18]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
call fcn.0047bfe6
test eax, eax
jne 0x47c658
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [edi + 0x2c], 0
jne 0x47c4fa
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 0x28]
jne 0x47c673
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [edi + 8]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x47c68f
push 0
push dword [edi + 8]
call esi
push dword [edi + 0x78]
call ebx
test eax, eax
je 0x47c69f
push 0
push dword [edi + 0x78]
call esi
push edi
lea eax, [ebp - 0x24]
call fcn.0047c772
mov esi, edi
call fcn.0047bfb5
and dword [0x549918], 0
pop esi
pop ebx
leave
ret
Function at 0x47e82f
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1b0]
push edi
test ecx, ecx
je 0x47e844
call fcn.0047e82f
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
lea edi, [esi + 0x240]
push dword [edi]
call ebp
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x47e864
push 0
push dword [edi]
call ebx
push dword [esi + 8]
call ebp
test eax, eax
je 0x47e874
push 0
push dword [esi + 8]
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48091f
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], eax
je 0x4809b6
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov ecx, dword [esi + 8]
sub ecx, dword [esi]
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [edi + 0x1f4], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push 0xcc0020
push eax
push ecx
push dword [ebp - 8]
sub edx, eax
mov eax, dword [esi + 8]
push edx
sub eax, ecx
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [edi + 0xd0]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_FillRect]
push dword [ebp + 8]
call ebx
jmp 0x480a10
mov eax, dword [edi + 0x1f4]
test eax, eax
je 0x480a10
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [edi + 0x1f4]
call ebx
and dword [edi + 0x1f4], 0
push dword [ebp - 4]
call ebx
push dword [ebp - 8]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
leave
ret 4
Function at 0x4876a1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
neg ecx
add dword [ebp + 0xc], ecx
push edi
push dword [ebp + 0xc]
neg eax
add dword [ebp + 8], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x44]
mov edi, eax
cmp edi, 0xffffffff
je 0x4877b0
push edi
mov eax, esi
call fcn.0047a6c1
test eax, eax
je 0x487728
cmp dword [esi + 0x60], edi
jne 0x4876f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x64]
cmp eax, 0x32
jbe 0x4877b0
xor ebx, ebx
inc ebx
push ebx
push edi
push dword [esi + 0x58]
call fcn.0047802e
mov eax, dword [ebp + 8]
mov dword [esi + 0x384], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x388], eax
mov dword [esi + 0x380], ebx
mov dword [esi + 0x3b4], edi
mov dword [esi + 0x5c], edi
jmp 0x487799
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x40]
test eax, eax
je 0x4877b0
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x38]
mov ecx, dword [esi + 0x24]
mov ebx, eax
test ecx, ecx
je 0x48774c
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
mov eax, dword [ebx]
push dword [ebp + 8]
mov ecx, ebx
call dword [eax + 0x10]
test eax, eax
je 0x48778b
cmp dword [esi + 0x60], edi
jne 0x487770
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x64]
cmp eax, 0x32
jbe 0x4877b0
push 1
push edi
push dword [esi + 0x58]
call fcn.0047802e
push edi
mov ecx, esi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
call fcn.00478b34
jmp 0x4877b0
push 1
push edi
push dword [esi + 0x58]
mov dword [esi + 0x5c], edi
call fcn.0047802e
push dword [esi + 0x14]
mov dword [esi + 0x58], edi
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [0x5498e0], esi
call fcn.0047a905
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8