joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d110
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
push edi
je 0x42d13d
push 0
push eax
call ebx
mov eax, dword [esi + 8]
push 0
push eax
call ebp
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
push 0
push 0
push 0x130b
push 0x4b0
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42d1a4
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42d16f
mov eax, dword [esi + 0x14]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x42d174
call fcn.0049ed6a
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx + 4]
test eax, eax
mov dword [esi + 8], eax
je 0x42d196
push 1
push eax
call ebp
mov eax, dword [esi + 8]
push 5
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0
call ebx
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x42d560
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov ecx, dword [edi + 0x14]
add esi, 0x100
lea eax, [esi + 1]
cmp eax, ecx
ja 0x42d58c
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.00403250
jmp 0x42d598
sub eax, ecx
push 0
push eax
mov ecx, edi
call fcn.00406710
push esi
mov ecx, edi
call fcn.004020a0
push eax
call ebp
mov ebx, eax
mov eax, esi
sub eax, ebx
cmp eax, 5
ja 0x42d5b6
cmp esi, 0xfff00
jb 0x42d570
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.00403250
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x42dd00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b69db
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
push esi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x434]
mov dword fs:[0], eax
mov esi, dword [esp + 0x444]
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42ddcc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push ecx
push edx
mov byte [esp + 0x38], bl
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x42dd97
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x30]
mov byte [esp + 0x42f], bl
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42ddb2
sub eax, edx
push eax
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.004068a0
jmp 0x42de20
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x440], ebx
call fcn.0042d560
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004067c0
cmp dword [esp + 0x2c], 0x10
jb 0x42de20
mov eax, dword [esp + 0x18]
push eax
call fcn.0049ea7d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.0049ec31
add esp, 0x434
ret
Function at 0x42de50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b6a20
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
push ecx
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42df9b
xor edi, edi
xor ebp, ebp
xor esi, esi
nop
add edi, 0x100
cmp esi, ebx
je 0x42dec3
push esi
call fcn.0049ec02
add esp, 4
lea edx, [edi + 1]
push edx
call fcn.0049de14
mov esi, eax
add esp, 4
mov byte [esi], bl
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x42def5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42dee8
sub eax, edx
mov ebp, eax
mov ecx, edi
sub ecx, ebp
cmp ecx, 1
ja 0x42df06
cmp edi, 0xfff00
jb 0x42deb0
mov edi, 0xf
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp ebp, ebx
mov dword [esp + 0x64], ebx
jle 0x42df3d
mov eax, esi
mov byte [esi + ebp], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42df27
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.004068a0
push esi
call fcn.0049ec02
add esp, 4
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x42df72
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x28]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004067c0
cmp dword [esp + 0x38], 0x10
jb 0x42dfed
mov ecx, dword [esp + 0x24]
jmp 0x42dfe4
mov edi, 0xf
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x68], 1
call fcn.0042d560
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x44]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004067c0
cmp dword [esp + 0x54], 0x10
jb 0x42dfed
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0049ea7d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0049ec31
add esp, 0x54
ret
Function at 0x42e1d0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor esi, esi
xor edi, edi
lea esp, [esp]
add esi, 0x100
test edi, edi
je 0x42e1f3
push edi
call fcn.0049ec02
add esp, 4
lea eax, [esi + 1]
push eax
call fcn.0049de14
add esp, 4
push esi
mov edi, eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
mov ecx, esi
sub ecx, ebx
cmp ecx, 5
ja 0x42e21d
cmp esi, 0xfff00
jb 0x42e1e0
test ebx, ebx
jle 0x42e23c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42e226
mov ecx, dword [esp + 0x14]
sub eax, edx
push eax
push edi
call fcn.004068a0
push edi
call fcn.0049ec02
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x42e700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push edi
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [esp + 0x18]
push 0
call fcn.00403250
mov eax, dword [edi]
test eax, eax
jne 0x42e722
xor al, al
pop edi
add esp, 8
ret 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push ebx
push eax
mov dword [esp + 0x28], 0
call ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42e7b4
add eax, 1
push eax
call fcn.0049de14
mov edx, dword [edi]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
jne 0x42e7ab
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x42e784
cmp eax, 2
jne 0x42e7ab
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
push esi
mov byte [esi + eax], 0
call fcn.00407dc0
push esi
call fcn.0049ec02
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 8
ret 8
push esi
call fcn.0049ec02
add esp, 4
pop esi
pop ebp
pop ebx
xor al, al
pop edi
add esp, 8
ret 8

Function at 0x42f460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
movzx ecx, word [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x42f4ce
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42f4ce
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42f4ce
test edi, edi
jbe 0x42f4ce
mov ebx, dword [esp + 0x10]
lea edx, [edi + 0x10]
push edx
mov ecx, ebx
call fcn.0042ef90
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esi + edi]
push ecx
push esi
mov ecx, ebx
call fcn.0042f0d0
pop edi
pop esi
mov al, 1
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x42fc70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b6c40
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 0x30]
cmp dword [ebx + 0x2c], esi
lea ebp, [ebx + 0x28]
mov dword [esp + 0x1c], ebx
jbe 0x42fcb8
call fcn.0049ed6a
mov edi, dword [ebp + 4]
cmp edi, dword [ebp + 8]
jbe 0x42fcc5
call fcn.0049ed6a
push esi
push ebp
push edi
push ebp
lea eax, [esp + 0x34]
push eax
mov ecx, ebp
call fcn.00423680
cmp dword [ebx + 0x24], 0x10
jb 0x42fce0
mov eax, dword [ebx + 0x10]
jmp 0x42fce3
lea eax, [ebx + 0x10]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push eax
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x42fd0a
xor al, al
jmp 0x42fe2e
xor edi, edi
xor esi, esi
mov dword [esp + 0x20], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x74], ebx
push edi
lea ecx, [esp + 0x4c]
push 0x4c88b4
push ecx
call fcn.004a07a0
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x58]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42fe14
mov eax, dword [esp + 0x14]
add eax, 1
cmp dword [esp + 0x28], eax
jae 0x42fd78
push eax
lea ecx, [esp + 0x28]
call fcn.00402b50
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x28]
push ecx
push ebx
lea edx, [esp + 0x58]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x42fe14
cmp dword [esp + 0x20], 1
jne 0x42fe14
mov ecx, dword [esp + 0x14]
mov byte [esi + ecx], bl
mov ecx, dword [esp + 0x1c]
push esi
call fcn.0042f2a0
mov eax, esi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x42fdc5
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.004068a0
lea edx, [esp + 0x2c]
push edx
mov ecx, ebp
mov byte [esp + 0x78], 1
call fcn.004109b0
cmp dword [esp + 0x44], 0x10
mov byte [esp + 0x74], bl
jb 0x42fe04
mov eax, dword [esp + 0x30]
push eax
call fcn.0049ea7d
add esp, 4
mov ecx, dword [esp + 0x1c]
add edi, 1
cmp edi, dword [ecx + 4]
jb 0x42fd26
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x42fe2c
push esi
call fcn.0049ed7a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0049ec31
add esp, 0x64
ret
Function at 0x42fe50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b6c86
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 0xc]
mov dword [esi], vtable.wpf::MostRecentlyUsed.0
xor ebx, ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
mov dword [esp + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, edi
mov byte [esp + 0x20], 1
mov dword [esi + 8], edx
lea ebp, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x42fec0
sub eax, ebp
push eax
push edi
call fcn.004068a0
cmp byte [esp + 0x34], bl
je 0x42fedf
mov ecx, esi
call fcn.0042fc70
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4374b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
mov al, byte [esp + 0x84]
cmp al, 0x20
mov dword [esp], 0x4d2234
mov dword [esp + 4], 0x4d2230
mov dword [esp + 8], 0x4d222c
mov dword [esp + 0xc], 0x4d2228
mov dword [esp + 0x10], 0x4d2224
mov dword [esp + 0x14], 0x4d2220
mov dword [esp + 0x18], 0x4d221c
mov dword [esp + 0x1c], 0x4d2218
mov dword [esp + 0x20], 0x4d2214
mov dword [esp + 0x24], 0x4d2210
mov dword [esp + 0x28], 0x4c8898
mov dword [esp + 0x2c], 0x4d220c
mov dword [esp + 0x30], 0x4d2208
mov dword [esp + 0x34], 0x4c889c
mov dword [esp + 0x38], 0x4d2204
mov dword [esp + 0x3c], 0x4d2200
mov dword [esp + 0x40], 0x4d21fc
mov dword [esp + 0x44], 0x4d21f8
mov dword [esp + 0x48], 0x4d21f4
mov dword [esp + 0x4c], 0x4d21f0
mov dword [esp + 0x50], 0x4d21ec
mov dword [esp + 0x54], 0x4d21e8
mov dword [esp + 0x58], 0x4d21e4
mov dword [esp + 0x5c], 0x4d21e0
mov dword [esp + 0x60], 0x4d21dc
mov dword [esp + 0x64], 0x4d21d8
mov dword [esp + 0x68], 0x4d21d4
mov dword [esp + 0x6c], 0x4d21d0
mov dword [esp + 0x70], 0x4d21cc
mov dword [esp + 0x74], 0x4d21c8
mov dword [esp + 0x78], 0x4d21c4
mov dword [esp + 0x7c], 0x4d21c0
jae 0x4375cd
movzx eax, al
mov eax, dword [esp + eax*4]
add esp, 0x80
ret
mov eax, 0x4d21bc
add esp, 0x80
ret
Function at 0x477a70
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov eax, ebp
push edi
mov dword [esp + 0x10], 0
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x477a86
sub eax, esi
mov edx, ebp
mov esi, 0
je 0x477ab2
lea ebx, [ebx]
movsx edi, byte [edx]
shl esi, 4
sub eax, 1
xor esi, edi
add edx, 1
test eax, eax
jne 0x477aa0
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
mov edx, eax
shl edx, 5
sub edx, eax
mov eax, esi
sub eax, edx
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x477b10
cmp esi, dword [edi]
jne 0x477b09
mov eax, dword [edi + 4]
mov edx, ebp
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x477b00
test bl, bl
je 0x477afc
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x477b00
add eax, 2
add edx, 2
test bl, bl
jne 0x477ae0
xor eax, eax
jmp 0x477b05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x477b2f
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x477ad6
mov ecx, dword [ecx + 0x84]
test ecx, ecx
je 0x477b48
mov esi, dword [esp + 0x18]
push ebp
push esi
call fcn.00477a70
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [edi + 8]
mov esi, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004602f0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov esi, dword [esp + 0x18]
push 0x4c7b75
mov ecx, esi
call fcn.004602f0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x477d90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b7669
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x34]
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x30]
push ebx
push edi
mov dword [esp + 0x30], ebp
call fcn.00477a70
lea eax, [esp + 0x18]
push eax
push 0x64
push edi
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
call fcn.00477b70
add esp, 0x10
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x47d6c0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 4], 0
je 0x47d6d6
mov eax, dword [ecx + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov ecx, dword [ecx + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4

Function at 0x47f240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b7938
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0047da40
xor ebx, ebx
lea ecx, [esi + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.sci::ListBoxX.0
mov dword [esi + 0xc], 0xa
mov dword [esi + 0x10], ebx
call fcn.0047c2b0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], 5
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], 8
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x480050
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x10
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0xc], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0xa
lea ecx, [esp + 4]
push ecx
movzx edx, ax
push 0x1004
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x480092
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0049ec31
add esp, 0x10
ret
lea eax, [esp]
push eax
call fcn.004a1edd
mov ecx, dword [esp + 0x10]
add esp, 4
xor ecx, esp
call fcn.0049ec31
add esp, 0x10
ret
Function at 0x4802b0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x410
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x418]
test eax, 0x800
push esi
mov esi, ecx
je 0x4803db
push ebp
call fcn.0047ffb0
push eax
call sub.IMM32.dll_ImmGetContext
mov ebp, eax
test ebp, ebp
je 0x4803c0
push ebx
push edi
push 0x18e
lea eax, [esp + 0x38]
push eax
push 0x800
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
cdq
sub eax, edx
mov edi, eax
mov ecx, esi
sar edi, 1
call fcn.00439ec0
test al, al
lea ecx, [esp + 0x34]
je 0x48033a
push edi
push ecx
call fcn.0047ad30
mov ebx, eax
push ebx
lea edx, [esp + 0x1d0]
push edx
lea eax, [esp + 0x44]
push edi
push eax
call fcn.0047ad80
mov edx, dword [esi]
mov edx, dword [edx + 0x40]
add esp, 0x18
push 0
push ebx
lea eax, [esp + 0x1cc]
push eax
mov ecx, esi
mov byte [esp + ebx + 0x1d0], 0
call edx
jmp 0x48037a
push 0
push 0
push 0x18f
lea eax, [esp + 0x1d0]
push eax
push edi
push ecx
push 0
call fcn.00480050
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x48037a
movzx edx, byte [esp + edi + 0x1c4]
push edx
mov ecx, esi
call fcn.00439000
add edi, 1
cmp edi, ebx
jl 0x480363
mov eax, dword [esi + 0x3284]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0043e0a0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push ebp
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call sub.IMM32.dll_ImmSetCompositionWindow
push ebp
mov ecx, esi
call fcn.0047ffb0
push eax
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop ebx
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0049ec31
add esp, 0x410
ret 8
mov edx, dword [esp + 0x418]
push eax
push edx
push 0x10f
call fcn.0047ffb0
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov ecx, dword [esp + 0x410]
pop esi
xor ecx, esp
call fcn.0049ec31
add esp, 0x410
ret 8

Function at 0x480d10
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
jne 0x480d31
push 0x4db
push str..._source_scintillawin32ScintillaWin.cxx
push 0x4d525c
call fcn.0047e810
add esp, 0xc
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0xc]
push edi
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
ret 4
Function at 0x486370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b7bdb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.astyle::ASBeautifier.0
xor ebx, ebx
mov dword [esi + 0x54], 0xf
mov dword [esi + 0x50], ebx
mov byte [esi + 0x40], bl
mov dword [esp + 0x18], ebx
call fcn.00485cb0
push 4
mov ecx, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x7f], bl
mov byte [esi + 0x80], bl
call fcn.00484fc0
push 0x28
mov ecx, esi
call fcn.00483f20
push ebx
call fcn.00483f80
push ebx
call fcn.00483f90
push ebx
call fcn.00483fa0
push ebx
call fcn.00483f60
push ebx
call fcn.00483f50
push ebx
call fcn.00483fb0
push ebx
call fcn.00483fc0
push ebx
call fcn.00483fe0
call fcn.00483f00
push ebx
call fcn.00483fd0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x498860
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4b8686
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x10], ecx
mov ecx, edi
mov dword [esp + 0x1c], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edi
call fcn.0048ccc0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x44]
mov byte [esi + 0x3f], bl
lea ecx, [esi + 0x40]
mov dword [ecx], eax
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0x34]
push eax
push edi
mov ecx, esi
mov byte [esp + 0x24], 1
call fcn.00496ed0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x18