joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49c46e
push eax
mov dword fs:[0], esp
push esi
call fcn.0045e860
call fcn.00469020
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, 1
test byte [0x4d9334], al
jne 0x45a0f0
or dword [0x4d9334], eax
mov dword [esp + 0xc], 0
call esi
mov dword [0x4d9330], eax
mov dword [esp + 0xc], 0xffffffff
call esi
sub eax, dword [0x4d9330]
cmp eax, 0xea60
jbe 0x45a10b
call fcn.004680c0
call esi
mov dword [0x4d9330], eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0x45c190
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00419a10
mov esi, eax
test esi, esi
jne 0x45c1ba
push eax
push 0xa7
push 0x4af8e8
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
mov eax, dword [esp + 8]
mov eax, dword [eax]
add eax, 0xc
push esi
push eax
call dword [sym.imp.USER32.dll_UnregisterClassW]
pop esi
test eax, eax
jne 0x45c21d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe
je 0x45c214
cmp eax, 8
je 0x45c214
test eax, eax
jne 0x45c1ec
cmp dword [0x4d9404], eax
jg 0x45c214
push eax
push 0xaa
push 0x4af8e8
push str.::UnregisterClass_className__instanceHandle____0
push str.AWL::UnregisterWindowClass
push 1
call fcn.0041d410
add esp, 0x18
test al, al
je 0x45c21d
jmp fcn.0041dd60
mov dword [esp + 4], eax
jmp fcn.004656d0
ret

Function at 0x45f860
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x49ede1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x24]
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45f8af
push eax
push 0xd2
push 0x4af8e8
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
push edi
call fcn.0046a9b0
add esp, 4
test al, al
je 0x45f8ea
push edi
call fcn.0046b5b0
mov ecx, eax
call fcn.0045ed50
mov esi, dword [esp + 0x20]
push 1
push esi
mov ecx, eax
call fcn.0046b0a0
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x4d9f40
mov esi, eax
call ebp
mov dword [esp + 0xc], 0x4d9f40
lea eax, [esi + 1]
push eax
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 1
call fcn.00419ec0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, eax
jl 0x45f92d
mov esi, eax
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x24]
mov dword [ecx + 4], esi
mov eax, dword [esp + 0xc]
xor edx, edx
mov word [eax + esi*2 + 0xc], dx
mov eax, dword [esp + 0xc]
push eax
mov dword [edi], eax
call ebp
mov eax, dword [esp + 0xc]
push eax
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop ebp
test eax, eax
jg 0x45f972
mov ecx, esi
call fcn.00432560
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x461160
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49c670
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, dword [esp + 0x3c]
test esi, esi
jne 0x46119f
push esi
push 0x8d
push str.d:_build10_awl_srcuserobjectawl.cpp
push 0x4b84f0
push 0x4b84f0
push esi
call fcn.0041d410
add esp, 0x18
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
push 0
lea ecx, [esp + 0x10]
call fcn.0046fcc0
push 0
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0
call fcn.0046fcc0
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 8]
mov byte [esp + 0x34], 1
call fcn.0046f2f0
mov edx, dword [esp + 0x24]
push edx
lea ecx, [esp + 0x10]
call fcn.0046f2f0
mov esi, dword [esp + 0x38]
push esi
lea ecx, [esp + 8]
call fcn.0046f6b0
cmp dword [esp + 0x24], 0
jne 0x461220
mov eax, dword [esi + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 4], eax
lea ecx, [esp + 4]
mov byte [esp + 0x30], 0
call fcn.0046fd60
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0046fd60
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x462c10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49c75a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045cae0
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
push 0x4d9f40
mov dword [esp + 0x1c], ebx
mov dword [esi], vtable.AWL::CFrameWindow.0
mov byte [esi + 0x10], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call edi
mov dword [esi + 0x24], 0x4d9f40
push 0x4d9f30
mov byte [esp + 0x1c], 1
call edi
mov dword [esi + 0x28], 0x4d9f30
mov dword [esi + 0x2c], vtable.AWL::CMenu.0
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 3
call fcn.00474050
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 4
call fcn.00474050
push 0x4d9f40
mov byte [esp + 0x1c], 5
mov byte [esi + 0x54], bl
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call edi
mov dword [esi + 0x64], 0x4d9f40
push 0x4d9f40
mov byte [esp + 0x1c], 6
call edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x68], 0x4d9f40
mov byte [esi + 0x70], bl
mov byte [esi + 0x71], bl
pop edi
mov dword [esi + 0x6c], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x465210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49c9a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esp + 4], esi
mov dword [esi + 0x20], eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x34], ecx
shr ecx, 4
mov dword [esp + 0x10], eax
mov dword [esi], vtable.AWL::CModalMessageLoop.0
test cl, 1
je 0x46528e
push eax
push 0xfa
push str.d:_build10_awl_srcmessageloopawl.cpp
push 0x4b84f0
push 0x4b84f0
push eax
call fcn.0041d410
add esp, 0x18
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4656d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ca10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp byte [0x4d9414], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x46570b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov bl, 1
mov dword [ebp - 0x18], 0x4d9414
mov byte [0x4d9414], bl
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], bl
call fcn.00434bb0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4d9408
mov esi, eax
call fcn.004223e0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 4]
push edi
push edi
add eax, 0xc
push eax
push edi
mov ecx, esi
mov byte [ebp - 4], 2
call edx
mov eax, dword [ebp - 0x14]
push eax
mov byte [ebp - 4], bl
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, edi
jg 0x465767
mov ecx, esi
call fcn.00432560
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov byte [0x4d9414], 0
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49cfa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], vtable.AWL::CHandleMap_struct_HMENU_____class_AWL::CMenu_.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edx, 0x1f
mov dword [esi + 0x18], edx
mov ecx, 0x80
mov dword [esp + 4], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov dword [esp + 0x10], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], ecx
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46b0a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x49cf39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
mov ebx, ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
push ecx
mov dword [esp + 0x3c], ecx
mov eax, ebp
or eax, 0xa
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 4]
push 0x45f
push eax
mov dword [esp + 0x28], 0x4b0
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4d9f40
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, dword [esp + 0x40]
mov dword [edi], 0x4d9f40
mov ebx, dword [ebx + 4]
xor eax, eax
lea edx, [esi + esi + 2]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push esi
mov ecx, edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], 0x4b0
mov dword [esp + 0x24], ebp
call fcn.00419ec0
push eax
lea eax, [esp + 0x20]
push eax
push 0x45e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp ebx, esi
jle 0x46b184
push 0
push 0x1f1
push str.d:_build10_awl_src_richeditctrlawl.cpp
push 0x4b84f0
push 0x4b84f0
push 0
call fcn.0041d410
add esp, 0x18
cmp ebx, esi
jne 0x46b196
mov eax, dword [edi]
mov dword [eax + 4], ebx
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + ebx*2 + 0xc], dx
jmp 0x46b1bb
mov edx, dword [edi]
lea eax, [edx + 0xc]
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46b1a0
sub eax, esi
sar eax, 1
mov dword [edx + 4], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2 + 0xc], dx
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x46b490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49cfa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], vtable.AWL::CHandleMap_struct_HWND_____class_AWL::CWindow_.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edx, 0x1f
mov dword [esi + 0x18], edx
mov ecx, 0x80
mov dword [esp + 4], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov dword [esp + 0x10], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], ecx
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46c6d0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x49d096
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp eax, ebx
je 0x46c70c
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x46c70c
push eax
call ebp
test eax, eax
jne 0x46c727
push ebx
push 0x55
push 0x4b27f0
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
mov edi, dword [esp + 0x34]
cmp edi, esi
je 0x46c75c
cmp edi, ebx
je 0x46c741
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x46c741
push eax
call ebp
test eax, eax
jne 0x46c75c
push ebx
push 0x57
push 0x4b27f0
push 0x4b84f0
push 0x4b84f0
push ebx
call fcn.0041d410
add esp, 0x18
mov dword [esi + 0x2c], edi
cmp byte [0x4d9744], bl
jne 0x46c799
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x46c799
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0xd4]
cmp ecx, ebx
je 0x46c795
call fcn.00465380
test al, al
jne 0x46c795
mov eax, dword [esi + 0x2c]
cmp byte [eax + 0xdc], bl
jne 0x46c799
xor eax, eax
jmp 0x46c79e
mov eax, 1
or edi, 0xffffffff
test byte [0x4d972c], 1
mov byte [esi + 0x31], al
jne 0x46c7e9
or dword [0x4d972c], 1
push ebx
push ebx
push ebx
push 0x7f00
mov dword [esp + 0x38], ebx
call fcn.00461020
add esp, 4
push eax
push 0x8b
push 0x4d9728
call fcn.0045beb0
push 0x4aa9c0
call fcn.0044639e
add esp, 0x1c
mov dword [esp + 0x28], edi
push str.MenuWindow
lea ecx, [esp + 0x38]
call fcn.00419be0
mov eax, dword [esp + 0x30]
push ebx
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x56000000
lea edx, [esp + 0x44]
push edx
push 0x4d9728
mov ecx, esi
mov dword [esp + 0x40], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00460910
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x2c], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x46c84c
mov ecx, esi
call fcn.00432560
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x473910
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x49ef19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
push 0
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0xff
or eax, 0x200
shl eax, 0x10
push 0x4d9f40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esi], 0x4d9f40
push 0x100
push 0x100
mov ecx, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 1
call fcn.00419ec0
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2 + 0xc], dx
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x476900
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49d520
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push 0x402
mov esi, ecx
call fcn.004099a0
mov ebp, eax
mov eax, dword [esi + 0xd4]
xor ebx, ebx
push ebx
push eax
mov ecx, ebp
call fcn.00475590
cmp ebp, ebx
jne 0x475dd2
xor eax, eax
jmp 0x475dd5
mov eax, dword [ebp + 4]
push edi
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.004660a0
mov eax, dword [esi + 0xd4]
push eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x50], ebx
call fcn.0046fd80
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 0xdc]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x54], 1
call fcn.00475040
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
add esp, 0xc
push 0x47
call edi
mov ecx, dword [esp + 0x10]
lea edx, [ecx + eax*2]
push 0x48
mov dword [esp + 0x14], edx
call edi
mov ecx, dword [esp + 0x14]
cmp ecx, eax
pop edi
jg 0x475e41
mov ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
push ebx
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
call fcn.0045b9f0
xor edx, edx
cmp byte [esi + 0xd8], bl
mov ecx, ebp
setne dl
push edx
call fcn.00475650
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], bl
call fcn.0046fb80
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0xffffffff
call fcn.00465b20
mov ecx, dword [esp + 0x3c]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0xdc]
cmp dword [eax + 4], 0
je 0x47694e
push ebx
push edi
mov edi, dword [esi + 4]
push 0
lea ebx, [eax + 0xc]
call fcn.00419a10
push eax
push 0x402
push edi
push 0
push 0
push 0
push 0
push 0x50030003
push ebx
push str.Button
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
pop edi
pop ebx
test eax, eax
je 0x47694e
mov ecx, esi
pop esi
jmp 0x475d90
pop esi
ret
Function at 0x477c00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49d730
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x477ce0
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004776f0
push 0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0041bfe0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
push 2
inc ecx
add eax, 0xc
push ecx
push eax
mov byte [esp + 0x24], 1
call fcn.00431ba0
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
add esp, 0xc
push eax
push 1
call esi
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push 2
lea edx, [ecx + ecx + 2]
add eax, 0xc
push edx
push eax
call fcn.00431ba0
add esp, 0xc
push eax
push 0xd
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push eax
mov byte [esp + 0x1c], 0
mov edi, eax
call esi
test eax, eax
jg 0x477cc3
mov ecx, edi
call fcn.00432560
mov eax, dword [esp + 8]
push eax
mov dword [esp + 0x1c], 0xffffffff
mov edi, eax
call esi
test eax, eax
jg 0x477cdf
mov ecx, edi
call fcn.00432560
pop edi
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x478ca0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x478cc0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x478cd4
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x478d00
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x478d16
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x478d23
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x479380
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea edx, [esp + 0x18]
push edx
or eax, 0x2001f
push eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push eax
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
cmp esi, edi
jne 0x4793e4
xor eax, eax
cmp ecx, edi
je 0x4793d2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], edi
mov esi, eax
mov dword [esp + 0x10], ecx
cmp eax, edi
je 0x4793fe
cmp ecx, edi
je 0x479497
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x20]
push edx
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x3c]
push edx
push edi
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x479462
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00479380
mov dword [esp + 0x18], eax
cmp eax, edi
jne 0x4794a2
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x479426
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x479475
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
mov edx, dword [ebp + 8]
mov eax, dword [ebx]
push edx
push eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x479497
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x479499
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4