joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488e74
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x5af584
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d57f0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x488ea7
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x488f05
push 0xffffffffffffffeb
push ebx
call sub.USER32.dll_GetWindowLongA
push eax
push 0xfffffffffffffff4
push ebx
call sub.USER32.dll_SetWindowLongA
push 0x5f3e07
push ebx
call sub.USER32.dll_SetWindowTextA
push 0
push ebx
call sub.USER32.dll_ShowWindow
mov word [ebp - 0x14], 0
jmp 0x488ef6
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
pop ebp
ret

Function at 0x4893bc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov eax, 0x5af9ac
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.004d57f0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
push esi
lea edi, [ebp - 0x228]
mov esi, 0x5af5ac
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x428]
mov word [ebp - 0x14], 8
push esi
mov esi, 0x5af7ac
mov ecx, 0x80
lea eax, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
pop esi
push eax
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00418b70
add esp, 0xc
test eax, eax
je 0x48950f
lea ecx, [ebp - 0x228]
push ecx
call fcn.004d2f1c
pop ecx
mov ebx, eax
lea eax, [ebp + ebx - 0x228]
movsx edx, byte [eax]
cmp edx, 0x29
jne 0x48944b
mov byte [eax], 0
movsx edx, byte [eax]
cmp edx, 0x2e
je 0x489482
cmp edx, 0x2a
jne 0x489469
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x489546
test ebx, ebx
jne 0x48947e
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x489546
dec ebx
dec eax
jmp 0x489440
lea ecx, [ebp - 0x428]
push ecx
push 0x200
push 0xd
mov eax, dword [ebp + 0x10]
push eax
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
lea edx, [ebp - 0x428]
push edx
call fcn.004d2f1c
pop ecx
mov edx, eax
lea eax, [ebp + edx - 0x428]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x4894c3
mov byte [eax], 0
jmp 0x4894cb
test edx, edx
je 0x4894cb
dec edx
dec eax
jmp 0x4894b6
mov al, byte [ebp - 0x428]
test al, al
jne 0x4894e6
push esi
lea edi, [ebp - 0x428]
mov eax, edi
mov esi, 0x5f3ecf
movsw word es:[edi], word [esi]
pop esi
lea edx, [ebp - 0x228]
add ebx, edx
push ebx
lea ecx, [ebp - 0x428]
push ecx
call fcn.004d2e40
add esp, 8
lea eax, [ebp - 0x428]
push eax
mov edx, dword [ebp + 0x10]
push edx
push esi
call sub.USER32.dll_SetDlgItemTextA
mov word [ebp - 0x14], 0
jmp 0x48953a
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x434]
mov esi, dword [ebp - 0x430]
mov ebx, dword [ebp - 0x42c]
pop ebp
ret
Function at 0x48b67c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
mov ebx, 1
push 3
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0048b148
add esp, 0x24
test eax, eax
je 0x48b730
push ebx
lea ecx, [ebp - 0x200]
push ecx
push 0x5f3fb7
lea eax, [ebp - 0x400]
push eax
call fcn.004d75f8
add esp, 0x10
push 0x200
lea edx, [ebp - 0x400]
push edx
call fcn.00405c58
add esp, 8
test eax, eax
je 0x48b6f6
inc ebx
cmp ebx, 0x20
jle 0x48b6bc
test byte [0x528c3c], 0x20
je 0x48b718
lea ecx, [ebp - 0x400]
push ecx
push 0x5f3fc5
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
dec eax
jne 0x48b730
mov eax, 1
jmp 0x48b739
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e2a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
mov eax, 0x5afd58
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.004d57f0
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
mov word [ebp - 0x14], 8
xor edi, edi
xor ebx, ebx
push 0
push 0x5f4317
push ebx
push esi
call fcn.00487e60
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x48e3b1
lea eax, [ebp - 0x12c]
push eax
push pe_nt_image_headers32
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
lea eax, [ebp - 0x12c]
mov edx, 0x5f431e
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48e323
test cl, cl
je 0x48e323
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48e323
add eax, 2
add edx, 2
test cl, cl
jne 0x48e307
lea eax, [ebp - 0x12c]
mov edx, 0x5f432a
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48e34a
test cl, cl
je 0x48e34a
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48e34a
add eax, 2
add edx, 2
test cl, cl
jne 0x48e32e
lea eax, [ebp - 0x12c]
mov edx, 0x5f4331
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48e375
test cl, cl
je 0x48e371
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48e375
add eax, 2
add edx, 2
test cl, cl
jne 0x48e355
jne 0x48e375
mov edi, ebx
lea eax, [ebp - 0x12c]
mov edx, 0x5f433c
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48e2cd
test cl, cl
je 0x48e3a4
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48e2cd
add eax, 2
add edx, 2
test cl, cl
jne 0x48e380
jne 0x48e2cd
mov edi, ebx
jmp 0x48e2cd
test edi, edi
jne 0x48e3c9
mov eax, 0x1392
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48e4b2
push 0
push 0x5f434a
push 0
push esi
call fcn.00487e60
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x48e3f5
mov eax, 0x139c
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48e4b2
push 0
push 0x5f4352
push 0
push esi
call fcn.00487e60
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x48e44e
push 0
push 0x5f4357
push 0
push esi
call fcn.00487e60
add esp, 0x10
mov ebx, eax
push 0
push 0x5f4360
push 0
push ebx
call fcn.00487e60
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x48e44e
mov eax, 0x13b0
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48e4b2
push 0
push ebx
push esi
call fcn.004889f4
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x48e464
mov ebx, dword [ebp - 0x28]
push 0
push 0
push ebx
push esi
call fcn.0048dd10
add esp, 0x10
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48e4b2
mov esp, ebp
mov edi, dword [ebp - 0x138]
mov esi, dword [ebp - 0x134]
mov ebx, dword [ebp - 0x130]
pop ebp
ret
Function at 0x49026c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_ShowWindow
pop ebp
ret

Function at 0x4911bc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov ecx, 4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
push edi
lea edi, [ebp - 0x98]
mov esi, 0x5b00f0
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x5b0100]
mov dword [ebp - 8], eax
mov eax, dword [0x5b0104]
mov dword [ebp - 4], eax
push esi
call sub.USER32.dll_GetDC
mov ebx, eax
test ebx, ebx
je 0x491331
push 0x80
lea eax, [ebp - 0x88]
push eax
push esi
call sub.USER32.dll_GetWindowTextA
mov eax, dword [0x5b00ec]
test eax, eax
je 0x491227
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
push 0
push 0x400
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0x88]
push edx
call fcn.004d2f1c
pop ecx
push eax
lea ecx, [ebp - 0x88]
push ecx
push ebx
call sub.USER32.dll_DrawTextExA
mov eax, dword [0x5b00ec]
test eax, eax
je 0x491260
push edi
push ebx
call sub.GDI32.dll_SelectObject
push ebx
push esi
call sub.USER32.dll_ReleaseDC
mov ebx, 8
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
add dword [ebp - 4], 0x19
push 1
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x8c]
add edx, ecx
mov ecx, dword [ebp - 0x94]
sub edx, ecx
add edx, ebx
cmp eax, edx
jge 0x4912b8
push 1
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
sub edx, ecx
add edx, ebx
add edx, 0x21
sub eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 0xa
push 0
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x90]
add edx, ecx
mov ecx, dword [ebp - 0x98]
sub edx, ecx
mov edi, ebx
add edi, edi
add edx, edi
cmp eax, edx
jge 0x4912ff
push 0
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
sub edx, ecx
add edx, ebx
add edx, 0xa
sub eax, edx
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x94]
sub eax, edx
add eax, ebx
push eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
sub eax, ecx
add eax, edi
push eax
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp - 8]
push edx
push esi
call sub.USER32.dll_MoveWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491338
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push esi
call sub.USER32.dll_ValidateRect
lea eax, [ebp - 0x10]
push eax
push esi
call sub.USER32.dll_GetClientRect
push esi
call sub.USER32.dll_GetDC
mov ebx, eax
test ebx, ebx
je 0x491418
push 0x80
lea eax, [ebp - 0x90]
push eax
push esi
call sub.USER32.dll_GetWindowTextA
push 0
push 0
push 0
push ebx
call sub.GDI32.dll_MoveToEx
push 0
mov edx, dword [ebp - 8]
dec edx
push edx
push ebx
call sub.GDI32.dll_LineTo
mov ecx, dword [ebp - 4]
dec ecx
push ecx
mov eax, dword [ebp - 8]
dec eax
push eax
push ebx
call sub.GDI32.dll_LineTo
mov edx, dword [ebp - 4]
dec edx
push edx
push 0
push ebx
call sub.GDI32.dll_LineTo
push 0
push 0
push ebx
call sub.GDI32.dll_LineTo
mov eax, dword [0x5b00ec]
test eax, eax
je 0x4913cf
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
jmp 0x4913df
push 0xc
call sub.GDI32.dll_GetStockObject
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
push 1
push ebx
call sub.GDI32.dll_SetBkMode
push 0
push 0x25
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x90]
push edx
call fcn.004d2f1c
pop ecx
push eax
lea ecx, [ebp - 0x90]
push ecx
push ebx
call sub.USER32.dll_DrawTextExA
push edi
push ebx
call sub.GDI32.dll_SelectObject
push ebx
push esi
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49202c
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x492064
mov eax, dword [0x5b00e8]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4920d6
mov edx, dword [0x5b00e8]
push edx
call sub.USER32.dll_DestroyWindow
xor ecx, ecx
mov dword [0x5b00e8], ecx
jmp 0x4920d6
push 0x80
lea edx, [ebp - 0x80]
push edx
push eax
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x80]
push eax
call fcn.00491190
pop ecx
mov ebx, eax
mov eax, dword [0x5b00e8]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x49209d
push ebx
mov edx, dword [0x5b00e8]
push edx
call sub.USER32.dll_SetWindowTextA
jmp 0x4920d6
push 0
call fcn.00401288
push eax
push 0
push 0
push 0x64
push 0
push 0x64
push 0
push 0x88000000
push ebx
push 0x5f4c24
push 0x88
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [0x5b00e8], esi
push 4
push esi
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49373c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push 0x13df
push 0x215
call fcn.00401898
add esp, 8
mov ebx, eax
xor eax, eax
mov dword [ebx], eax
push ebx
push 0x49358c
call sub.USER32.dll_EnumWindows
mov edx, dword [ebx]
test edx, edx
jne 0x49377a
push 0x13df
push ebx
call fcn.0040195c
add esp, 8
test al, al
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret

Function at 0x494114
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x52eac3]
cmp eax, 0x32
jne 0x49412a
mov eax, 1
pop ebp
ret
mov dl, byte [ebp + 8]
mov byte [0x52eac8], dl
mov ecx, dword [0x529078]
push ecx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x494186
push 0
push 0xc8
push 0x7c7
mov eax, dword [0x529078]
push eax
call sub.USER32.dll_SetTimer
push 0
push 0x7d0
push 0x7c8
mov edx, dword [0x529078]
push edx
call sub.USER32.dll_SetTimer
mov ecx, dword [0x529078]
push ecx
call fcn.00493394
pop ecx
mov eax, 1
pop ebp
ret
push 0
mov edx, dword [0x529090]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [0x529070]
push 0
push ecx
push 0x5b0228
call fcn.0040de38
add esp, 0x10
mov eax, 1
pop ebp
ret

Function at 0x494264
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
call fcn.004da860
pop ecx
mov ebx, eax
push 0
mov edi, ebx
and edi, 0xff
push edi
call sub.USER32.dll_MapVirtualKeyA
mov byte [ebp - 1], al
push 5
push esi
call sub.USER32.dll_ShowWindow
push esi
call sub.USER32.dll_SetForegroundWindow
push esi
call sub.USER32.dll_SetFocus
push esi
call sub.USER32.dll_IsWindow
test eax, eax
jne 0x4942b4
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
mov al, byte [ebp + 0xc]
test byte [eax*2 + 0x604bb7], 1
je 0x4942e7
xor edx, edx
mov dl, byte [ebp + 0xc]
test byte [edx*2 + 0x604bb6], 2
jne 0x4942e7
push 0
push 0
push 0
push 0x10
call sub.USER32.dll_MapVirtualKeyA
push eax
push 0x10
call sub.USER32.dll_keybd_event
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push pe_nt_image_headers32
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push 0x101
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor edx, edx
mov dl, byte [ebp + 0xc]
test byte [edx*2 + 0x604bb7], 1
je 0x494393
xor ecx, ecx
mov cl, byte [ebp + 0xc]
test byte [ecx*2 + 0x604bb6], 2
jne 0x494393
push 0
push 2
push 0
push 0x10
call sub.USER32.dll_MapVirtualKeyA
push eax
push 0x10
call sub.USER32.dll_keybd_event
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49449c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
push 0x5f5080
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4944cf
push 0x5f508b
push 0
push 0xc
push ebx
call sub.USER32.dll_PostMessageA
push 0
push 0x5f509d
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x5f50a7
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
je 0x4944f5
push 0
push 0x5f50b4
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
jmp 0x49452c
push 0
push 0x5f50c1
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
je 0x49451b
push 0
push 0x5f50ce
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
jmp 0x49452c
push 0x5f50db
push 0
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x494541
push 0
push 0x5f50dc
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x494556
push 0
push 0x5f50e8
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x494562
push 0
push ebx
call sub.USER32.dll_ShowWindow
pop ebx
ret
Function at 0x494664
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4946a9
push 0
call fcn.00401288
push eax
push 0
push 0
push 0x270f
push 0x270f
push 0
push 0
push 0x19cf0000
push 0x5f518f
push 0x5f518a
push 8
call sub.USER32.dll_CreateWindowExA
mov edi, eax
call fcn.00494460
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100]
push eax
push 0x5f51a0
push edx
call fcn.004d75f8
add esp, 0xc
lea ecx, [ebp - 0x100]
push 0
push 0
push ecx
call fcn.0043fac8
add esp, 0xc
test eax, eax
jne 0x4946f4
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4946ed
push edi
call sub.USER32.dll_DestroyWindow
xor eax, eax
jmp 0x494883
test esi, esi
je 0x494711
push 0
push 0
push 0x5f51b3
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
call fcn.0049449c
push 0x5f51be
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x494731
push 0x5f51c9
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x49475b
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
jmp 0x4946f4
push 0x5f51d4
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x49477b
push 0x5f51df
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x4947f8
test esi, esi
je 0x4947a4
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0x5f51ea
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
call fcn.0049449c
push 1
call fcn.004dee84
pop ecx
push 0x5f51f5
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x4947cc
push 0x5f5211
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x49475b
push 0
push 0
push 0x10
push ebx
call sub.USER32.dll_SendMessageA
call fcn.00494460
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4947f1
push edi
call sub.USER32.dll_DestroyWindow
xor eax, eax
jmp 0x494883
test esi, esi
je 0x49483a
push 2
call fcn.004dee84
pop ecx
call fcn.0049449c
push 1
call fcn.004dee84
pop ecx
call fcn.0049449c
push 5
push 0
push 0x5f5230
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x49483a
push edi
call sub.USER32.dll_DestroyWindow
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x49487e
push 2
call fcn.004dee84
pop ecx
call fcn.0049439c
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x49487e
mov edx, dword [ebp + 0x10]
lea esi, [edx + eax]
mov al, byte [esi]
test al, al
jne 0x49486f
push 0xd
push ebx
call fcn.00494264
add esp, 8
jmp 0x49487e
mov dl, byte [esi]
push edx
push ebx
call fcn.00494264
add esp, 8
inc esi
jmp 0x49485c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497ee4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x497eed
add esp, 0xffffffe0
mov eax, dword [ebp - 4]
mov eax, 0x5b04ea
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d57f0
mov word [ebp - 0x14], 8
test byte [0x528c3c], 0x40
je 0x497f2f
push ebx
push 0x5f5de7
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov dl, byte [ebx]
test dl, dl
jne 0x497f49
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x49819d
lea ecx, [ebp - 0x4024]
push ecx
call fcn.00472ff4
pop ecx
test eax, eax
je 0x497f97
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x497f97
test byte [0x528c3c], 0x40
je 0x497f83
lea edx, [ebp - 0x4024]
push edx
push 0x5f5dfa
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x49819d
mov byte [0x52ede2], 1
mov cl, byte [ebx]
sub cl, 0x3a
je 0x497faf
sub cl, 0x19
je 0x497ff4
jmp 0x49803c
call fcn.0047d3c8
mov al, byte [eax]
test al, al
je 0x497fd7
push ebx
call fcn.0047d3c8
push eax
push 0x5f5e0e
lea edx, [ebp - 0x4024]
push edx
call fcn.004d75f8
add esp, 0x10
jmp 0x498051
push ebx
call fcn.0047cae8
push eax
push 0x5f5e1a
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004d75f8
add esp, 0x10
jmp 0x498051
mov byte [ebx], 0x3a
call fcn.0047d3c8
mov al, byte [eax]
test al, al
je 0x49801f
push ebx
call fcn.0047d3c8
push eax
push 0x5f5e26
lea edx, [ebp - 0x4024]
push edx
call fcn.004d75f8
add esp, 0x10
jmp 0x498051
push ebx
call fcn.0047cae8
push eax
push 0x5f5e33
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004d75f8
add esp, 0x10
jmp 0x498051
push ebx
push 0x5f5e40
lea eax, [ebp - 0x4024]
push eax
call fcn.004d75f8
add esp, 0xc
lea edx, [ebp - 0x4024]
push edx
call fcn.00472f9c
pop ecx
lea eax, [ebp - 0x6024]
mov ecx, dword [0x52e404]
push ecx
push 0x5f5e43
push eax
call fcn.004d75f8
add esp, 0xc
lea edx, [ebp - 0x6024]
push edx
push 0x5f5e47
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004237a0
add esp, 0xc
test byte [0x528c3c], 0x40
je 0x4980b6
lea eax, [ebp - 0x4024]
push eax
push 0x5f5e4a
push 0x528c40
call fcn.004541dc
add esp, 0xc
lea edx, [ebp - 0x4024]
lea ecx, [ebp - 0x2024]
push edx
push 0x5f5e60
push ecx
call fcn.004d75f8
add esp, 0xc
test byte [0x528c3c], 0x40
je 0x4980f3
lea eax, [ebp - 0x2024]
push eax
push 0x5f5ed0
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 5
lea edx, [ebp - 0x2024]
push edx
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
ja 0x498123
push 0
call fcn.00472f9c
pop ecx
mov byte [0x52ede2], 0
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x49819d
call fcn.0048ff88
mov byte [0x52e3f7], 1
push 0x65
call fcn.0049be08
pop ecx
call fcn.0045f76c
push pe_nt_image_headers32
call fcn.0045f480
test byte [0x528c3c], 0x40
pop ecx
je 0x498167
push 0x5f5efa
push 0x5f5ee7
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov word [ebp - 0x14], 0
jmp 0x49818e
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x6030]
mov esi, dword [ebp - 0x602c]
mov ebx, dword [ebp - 0x6028]
pop ebp
ret
Function at 0x49b23c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x49b245
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x49b436
push 5
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
call fcn.00401424
lea eax, [ebp - 0x2000]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.0041872c
add esp, 0xc
test eax, eax
jne 0x49b313
call fcn.00401428
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
push ebx
push 0x49b224
call fcn.00401c40
add esp, 8
jmp 0x49b436
push 0x7c
push 3
lea ecx, [ebp - 0x4000]
push ecx
lea eax, [ebp - 0x2000]
push eax
call fcn.0041f4fc
add esp, 0x10
test eax, eax
jne 0x49b384
call fcn.00401428
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
push ebx
push 0x49b224
call fcn.00401c40
add esp, 8
jmp 0x49b436
mov esi, 0x40
push 0x7c
push 4
lea eax, [ebp - 0x6000]
push eax
lea edx, [ebp - 0x2000]
push edx
call fcn.0041f4fc
add esp, 0x10
test eax, eax
je 0x49b3b9
movsx ecx, byte [ebp - 0x6000]
cmp ecx, 0x31
jne 0x49b3b9
or esi, 0x100000
push esi
lea eax, [ebp - 0x2000]
push eax
push 0
lea edx, [ebp - 0x4000]
push edx
call fcn.00498820
add esp, 0x10
test eax, eax
jne 0x49b424
call fcn.00401428
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
push ebx
push 0x49b224
call fcn.00401c40
add esp, 8
push 0
push 0x4e20
push 0x7c8
push ebx
call sub.USER32.dll_SetTimer
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret