joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484ff0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x5965d0
push ebx
push esi
push edi
call fcn.004d08c0
xor edx, edx
mov dword [0x596574], 1
mov dword [ebp - 0x28], edx
mov ecx, dword [0x596570]
mov word [ebp - 0x14], 8
test ecx, ecx
je 0x485078
xor esi, esi
mov ebx, 0x596424
mov eax, dword [ebx]
test eax, eax
je 0x48506f
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x485051
push 0
mov edx, dword [ebx]
push edx
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0x10
mov ecx, dword [ebx]
push ecx
call sub.USER32.dll_PostMessageA
xor eax, eax
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ecx, ecx
xor eax, eax
mov dword [ebx + 8], ecx
xor edx, edx
mov dword [ebx - 8], eax
mov dword [ebx - 4], edx
dec dword [0x596570]
inc esi
add ebx, 0x14
cmp esi, 0x10
jne 0x485029
mov word [ebp - 0x14], 0
xor ecx, ecx
mov dword [0x596574], ecx
jmp 0x4850ab
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
pop ebp
ret

Function at 0x485208
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0x5969f4
call fcn.004d08c0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
push edi
push esi
call sub.USER32.dll_GetDlgItem
mov ebx, eax
test ebx, ebx
je 0x48524a
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x485302
push 0x1f8
push esi
call sub.USER32.dll_GetDlgItem
mov ebx, eax
test ebx, ebx
jne 0x485268
push 0x1f7
push esi
call sub.USER32.dll_GetDlgItem
mov ebx, eax
test ebx, ebx
jne 0x485279
push 0x1f6
push esi
call sub.USER32.dll_GetDlgItem
mov ebx, eax
test ebx, ebx
jne 0x48528a
push 0x1f5
push esi
call sub.USER32.dll_GetDlgItem
mov ebx, eax
test ebx, ebx
jne 0x48529c
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x485302
push 0xfffffffffffffff4
push ebx
call sub.USER32.dll_GetWindowLongA
push eax
push 0xffffffffffffffeb
push ebx
call sub.USER32.dll_SetWindowLongA
push edi
push 0xfffffffffffffff4
push ebx
call sub.USER32.dll_SetWindowLongA
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
call sub.USER32.dll_SetWindowTextA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov word [ebp - 0x14], 0
jmp 0x4852f3
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
pop ebp
ret
Function at 0x485310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x596a08
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d08c0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x485343
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4853a1
push 0xffffffffffffffeb
push ebx
call sub.USER32.dll_GetWindowLongA
push eax
push 0xfffffffffffffff4
push ebx
call sub.USER32.dll_SetWindowLongA
push 0x5da4e7
push ebx
call sub.USER32.dll_SetWindowTextA
push 0
push ebx
call sub.USER32.dll_ShowWindow
mov word [ebp - 0x14], 0
jmp 0x485392
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
pop ebp
ret

Function at 0x485858
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov eax, 0x596e30
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.004d08c0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
push esi
lea edi, [ebp - 0x228]
mov esi, 0x596a30
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x428]
mov word [ebp - 0x14], 8
push esi
mov esi, 0x596c30
mov ecx, 0x80
lea eax, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
pop esi
push eax
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00418288
add esp, 0xc
test eax, eax
je 0x4859ab
lea ecx, [ebp - 0x228]
push ecx
call fcn.004cdfec
pop ecx
mov ebx, eax
lea eax, [ebp + ebx - 0x228]
movsx edx, byte [eax]
cmp edx, 0x29
jne 0x4858e7
mov byte [eax], 0
movsx edx, byte [eax]
cmp edx, 0x2e
je 0x48591e
cmp edx, 0x2a
jne 0x485905
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x4859e2
test ebx, ebx
jne 0x48591a
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4859e2
dec ebx
dec eax
jmp 0x4858dc
lea ecx, [ebp - 0x428]
push ecx
push 0x200
push 0xd
mov eax, dword [ebp + 0x10]
push eax
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
lea edx, [ebp - 0x428]
push edx
call fcn.004cdfec
pop ecx
mov edx, eax
lea eax, [ebp + edx - 0x428]
movsx ecx, byte [eax]
cmp ecx, 0x2e
jne 0x48595f
mov byte [eax], 0
jmp 0x485967
test edx, edx
je 0x485967
dec edx
dec eax
jmp 0x485952
mov al, byte [ebp - 0x428]
test al, al
jne 0x485982
push esi
lea edi, [ebp - 0x428]
mov eax, edi
mov esi, 0x5da5af
movsw word es:[edi], word [esi]
pop esi
lea edx, [ebp - 0x228]
add ebx, edx
push ebx
lea ecx, [ebp - 0x428]
push ecx
call fcn.004cdf10
add esp, 8
lea eax, [ebp - 0x428]
push eax
mov edx, dword [ebp + 0x10]
push edx
push esi
call sub.USER32.dll_SetDlgItemTextA
mov word [ebp - 0x14], 0
jmp 0x4859d6
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x434]
mov esi, dword [ebp - 0x430]
mov ebx, dword [ebp - 0x42c]
pop ebp
ret
Function at 0x487b18
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
mov ebx, 1
push 3
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004875e4
add esp, 0x24
test eax, eax
je 0x487bcc
push ebx
lea ecx, [ebp - 0x200]
push ecx
push 0x5da697
lea eax, [ebp - 0x400]
push eax
call fcn.004d26c8
add esp, 0x10
push 0x200
lea edx, [ebp - 0x400]
push edx
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x487b92
inc ebx
cmp ebx, 0x20
jle 0x487b58
test byte [0x516434], 0x20
je 0x487bb4
lea ecx, [ebp - 0x400]
push ecx
push 0x5da6a5
push 0x516438
call fcn.00451598
add esp, 0xc
push 0
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
dec eax
jne 0x487bcc
mov eax, 1
jmp 0x487bd5
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a73c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
mov eax, 0x5971dc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
call fcn.004d08c0
xor eax, eax
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
mov word [ebp - 0x14], 8
xor edi, edi
xor ebx, ebx
push 0
push 0x5da9f7
push ebx
push esi
call fcn.00484300
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x48a84d
lea eax, [ebp - 0x12c]
push eax
push pe_nt_image_headers32
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
lea eax, [ebp - 0x12c]
mov edx, 0x5da9fe
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48a7bf
test cl, cl
je 0x48a7bf
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48a7bf
add eax, 2
add edx, 2
test cl, cl
jne 0x48a7a3
lea eax, [ebp - 0x12c]
mov edx, 0x5daa0a
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48a7e6
test cl, cl
je 0x48a7e6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48a7e6
add eax, 2
add edx, 2
test cl, cl
jne 0x48a7ca
lea eax, [ebp - 0x12c]
mov edx, 0x5daa11
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48a811
test cl, cl
je 0x48a80d
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48a811
add eax, 2
add edx, 2
test cl, cl
jne 0x48a7f1
jne 0x48a811
mov edi, ebx
lea eax, [ebp - 0x12c]
mov edx, 0x5daa1c
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48a769
test cl, cl
je 0x48a840
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48a769
add eax, 2
add edx, 2
test cl, cl
jne 0x48a81c
jne 0x48a769
mov edi, ebx
jmp 0x48a769
test edi, edi
jne 0x48a865
mov eax, 0x1392
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48a94e
push 0
push 0x5daa2a
push 0
push esi
call fcn.00484300
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x48a891
mov eax, 0x139c
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48a94e
push 0
push 0x5daa32
push 0
push esi
call fcn.00484300
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x48a8ea
push 0
push 0x5daa37
push 0
push esi
call fcn.00484300
add esp, 0x10
mov ebx, eax
push 0
push 0x5daa40
push 0
push ebx
call fcn.00484300
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x48a8ea
mov eax, 0x13b0
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48a94e
push 0
push ebx
push esi
call fcn.00484e90
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x48a900
mov ebx, dword [ebp - 0x28]
push 0
push 0
push ebx
push esi
call fcn.0048a1ac
add esp, 0x10
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x48a94e
mov esp, ebp
mov edi, dword [ebp - 0x138]
mov esi, dword [ebp - 0x134]
mov ebx, dword [ebp - 0x130]
pop ebp
ret
Function at 0x48c708
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_ShowWindow
pop ebp
ret

Function at 0x48d658
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov ecx, 4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
push edi
lea edi, [ebp - 0x98]
mov esi, 0x597574
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x597584]
mov dword [ebp - 8], eax
mov eax, dword [0x597588]
mov dword [ebp - 4], eax
push esi
call sub.USER32.dll_GetDC
mov ebx, eax
test ebx, ebx
je 0x48d7cd
push 0x80
lea eax, [ebp - 0x88]
push eax
push esi
call sub.USER32.dll_GetWindowTextA
mov eax, dword [0x597570]
test eax, eax
je 0x48d6c3
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
push 0
push 0x400
lea eax, [ebp - 0x98]
push eax
lea edx, [ebp - 0x88]
push edx
call fcn.004cdfec
pop ecx
push eax
lea ecx, [ebp - 0x88]
push ecx
push ebx
call sub.USER32.dll_DrawTextExA
mov eax, dword [0x597570]
test eax, eax
je 0x48d6fc
push edi
push ebx
call sub.GDI32.dll_SelectObject
push ebx
push esi
call sub.USER32.dll_ReleaseDC
mov ebx, 8
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
add dword [ebp - 4], 0x19
push 1
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x8c]
add edx, ecx
mov ecx, dword [ebp - 0x94]
sub edx, ecx
add edx, ebx
cmp eax, edx
jge 0x48d754
push 1
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
sub edx, ecx
add edx, ebx
add edx, 0x21
sub eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 0xa
push 0
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x90]
add edx, ecx
mov ecx, dword [ebp - 0x98]
sub edx, ecx
mov edi, ebx
add edi, edi
add edx, edi
cmp eax, edx
jge 0x48d79b
push 0
call sub.USER32.dll_GetSystemMetrics
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
sub edx, ecx
add edx, ebx
add edx, 0xa
sub eax, edx
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x94]
sub eax, edx
add eax, ebx
push eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
sub eax, ecx
add eax, edi
push eax
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp - 8]
push edx
push esi
call sub.USER32.dll_MoveWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d7d4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push esi
call sub.USER32.dll_ValidateRect
lea eax, [ebp - 0x10]
push eax
push esi
call sub.USER32.dll_GetClientRect
push esi
call sub.USER32.dll_GetDC
mov ebx, eax
test ebx, ebx
je 0x48d8b4
push 0x80
lea eax, [ebp - 0x90]
push eax
push esi
call sub.USER32.dll_GetWindowTextA
push 0
push 0
push 0
push ebx
call sub.GDI32.dll_MoveToEx
push 0
mov edx, dword [ebp - 8]
dec edx
push edx
push ebx
call sub.GDI32.dll_LineTo
mov ecx, dword [ebp - 4]
dec ecx
push ecx
mov eax, dword [ebp - 8]
dec eax
push eax
push ebx
call sub.GDI32.dll_LineTo
mov edx, dword [ebp - 4]
dec edx
push edx
push 0
push ebx
call sub.GDI32.dll_LineTo
push 0
push 0
push ebx
call sub.GDI32.dll_LineTo
mov eax, dword [0x597570]
test eax, eax
je 0x48d86b
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
jmp 0x48d87b
push 0xc
call sub.GDI32.dll_GetStockObject
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
push 1
push ebx
call sub.GDI32.dll_SetBkMode
push 0
push 0x25
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x90]
push edx
call fcn.004cdfec
pop ecx
push eax
lea ecx, [ebp - 0x90]
push ecx
push ebx
call sub.USER32.dll_DrawTextExA
push edi
push ebx
call sub.GDI32.dll_SelectObject
push ebx
push esi
call sub.USER32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e4c8
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x48e500
mov eax, dword [0x59756c]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x48e572
mov edx, dword [0x59756c]
push edx
call sub.USER32.dll_DestroyWindow
xor ecx, ecx
mov dword [0x59756c], ecx
jmp 0x48e572
push 0x80
lea edx, [ebp - 0x80]
push edx
push eax
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x80]
push eax
call fcn.0048d62c
pop ecx
mov ebx, eax
mov eax, dword [0x59756c]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x48e539
push ebx
mov edx, dword [0x59756c]
push edx
call sub.USER32.dll_SetWindowTextA
jmp 0x48e572
push 0
call fcn.00401260
push eax
push 0
push 0
push 0x64
push 0
push 0x64
push 0
push 0x88000000
push ebx
push 0x5db304
push 0x88
call sub.USER32.dll_CreateWindowExA
mov esi, eax
mov dword [0x59756c], esi
push 4
push esi
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48fbd8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push 0x13df
push 0x215
call fcn.00401890
add esp, 8
mov ebx, eax
xor eax, eax
mov dword [ebx], eax
push ebx
push 0x48fa28
call sub.USER32.dll_EnumWindows
mov edx, dword [ebx]
test edx, edx
jne 0x48fc16
push 0x13df
push ebx
call fcn.00401954
add esp, 8
test al, al
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret

Function at 0x4905b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x51a2bb]
cmp eax, 0x32
jne 0x4905c6
mov eax, 1
pop ebp
ret
mov dl, byte [ebp + 8]
mov byte [0x51a2c0], dl
mov ecx, dword [0x516870]
push ecx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x490622
push 0
push 0xc8
push 0x7c7
mov eax, dword [0x516870]
push eax
call sub.USER32.dll_SetTimer
push 0
push 0x7d0
push 0x7c8
mov edx, dword [0x516870]
push edx
call sub.USER32.dll_SetTimer
mov ecx, dword [0x516870]
push ecx
call fcn.0048f830
pop ecx
mov eax, 1
pop ebp
ret
push 0
mov edx, dword [0x516888]
push edx
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [0x516868]
push 0
push ecx
push 0x5976ac
call fcn.0040d780
add esp, 0x10
mov eax, 1
pop ebp
ret

Function at 0x490700
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
call fcn.004d5930
pop ecx
mov ebx, eax
push 0
mov edi, ebx
and edi, 0xff
push edi
call sub.USER32.dll_MapVirtualKeyA
mov byte [ebp - 1], al
push 5
push esi
call sub.USER32.dll_ShowWindow
push esi
call sub.USER32.dll_SetForegroundWindow
push esi
call sub.USER32.dll_SetFocus
push esi
call sub.USER32.dll_IsWindow
test eax, eax
jne 0x490750
push 0
call sub.USER32.dll_MessageBeep
xor eax, eax
mov al, byte [ebp + 0xc]
test byte [eax*2 + 0x5eaecf], 1
je 0x490783
xor edx, edx
mov dl, byte [ebp + 0xc]
test byte [edx*2 + 0x5eaece], 2
jne 0x490783
push 0
push 0
push 0
push 0x10
call sub.USER32.dll_MapVirtualKeyA
push eax
push 0x10
call sub.USER32.dll_keybd_event
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push pe_nt_image_headers32
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push 0x102
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor eax, eax
mov al, byte [ebp - 1]
and ax, 0xffff
movzx eax, ax
shl eax, 0x10
or eax, 1
push eax
push edi
push 0x101
push esi
call sub.USER32.dll_PostMessageA
push 0x1e
call sub.KERNEL32.dll_Sleep
xor edx, edx
mov dl, byte [ebp + 0xc]
test byte [edx*2 + 0x5eaecf], 1
je 0x49082f
xor ecx, ecx
mov cl, byte [ebp + 0xc]
test byte [ecx*2 + 0x5eaece], 2
jne 0x49082f
push 0
push 2
push 0
push 0x10
call sub.USER32.dll_MapVirtualKeyA
push eax
push 0x10
call sub.USER32.dll_keybd_event
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x490938
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
push 0x5db760
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x49096b
push 0x5db76b
push 0
push 0xc
push ebx
call sub.USER32.dll_PostMessageA
push 0
push 0x5db77d
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x5db787
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
je 0x490991
push 0
push 0x5db794
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
jmp 0x4909c8
push 0
push 0x5db7a1
push 0
push ebx
call sub.USER32.dll_FindWindowExA
test eax, eax
je 0x4909b7
push 0
push 0x5db7ae
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
jmp 0x4909c8
push 0x5db7bb
push 0
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4909dd
push 0
push 0x5db7bc
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4909f2
push 0
push 0x5db7c8
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4909fe
push 0
push ebx
call sub.USER32.dll_ShowWindow
pop ebx
ret
Function at 0x490b00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x490b45
push 0
call fcn.00401260
push eax
push 0
push 0
push 0x270f
push 0x270f
push 0
push 0
push 0x19cf0000
push 0x5db86f
push 0x5db86a
push 8
call sub.USER32.dll_CreateWindowExA
mov edi, eax
call fcn.004908fc
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100]
push eax
push 0x5db880
push edx
call fcn.004d26c8
add esp, 0xc
lea ecx, [ebp - 0x100]
push 0
push 0
push ecx
call fcn.0043db98
add esp, 0xc
test eax, eax
jne 0x490b90
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x490b89
push edi
call sub.USER32.dll_DestroyWindow
xor eax, eax
jmp 0x490d1f
test esi, esi
je 0x490bad
push 0
push 0
push 0x5db893
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
call fcn.00490938
push 0x5db89e
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x490bcd
push 0x5db8a9
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x490bf7
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x490b90
push 0x5db8b4
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x490c17
push 0x5db8bf
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x490c94
test esi, esi
je 0x490c40
push 0
push ebx
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0x5db8ca
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
call fcn.00490938
push 1
call fcn.004d9f54
pop ecx
push 0x5db8d5
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x490c68
push 0x5db8f1
push 0
call sub.USER32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x490bf7
push 0
push 0
push 0x10
push ebx
call sub.USER32.dll_SendMessageA
call fcn.004908fc
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x490c8d
push edi
call sub.USER32.dll_DestroyWindow
xor eax, eax
jmp 0x490d1f
test esi, esi
je 0x490cd6
push 2
call fcn.004d9f54
pop ecx
call fcn.00490938
push 1
call fcn.004d9f54
pop ecx
call fcn.00490938
push 5
push 0
push 0x5db910
call sub.USER32.dll_FindWindowA
push eax
call sub.USER32.dll_ShowWindow
push edi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x490cd6
push edi
call sub.USER32.dll_DestroyWindow
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x490d1a
push 2
call fcn.004d9f54
pop ecx
call fcn.00490838
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x490d1a
mov edx, dword [ebp + 0x10]
lea esi, [edx + eax]
mov al, byte [esi]
test al, al
jne 0x490d0b
push 0xd
push ebx
call fcn.00490700
add esp, 8
jmp 0x490d1a
mov dl, byte [esi]
push edx
push ebx
call fcn.00490700
add esp, 8
inc esi
jmp 0x490cf8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49437c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x494385
add esp, 0xffffffe0
mov eax, dword [ebp - 4]
mov eax, 0x59796e
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d08c0
mov word [ebp - 0x14], 8
test byte [0x516434], 0x40
je 0x4943c7
push ebx
push 0x5dc4c7
push 0x516438
call fcn.00451598
add esp, 0xc
mov dl, byte [ebx]
test dl, dl
jne 0x4943e1
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x494635
lea ecx, [ebp - 0x4024]
push ecx
call fcn.0046fb88
pop ecx
test eax, eax
je 0x49442f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x49442f
test byte [0x516434], 0x40
je 0x49441b
lea edx, [ebp - 0x4024]
push edx
push 0x5dc4da
push 0x516438
call fcn.00451598
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x494635
mov byte [0x51a5da], 1
mov cl, byte [ebx]
sub cl, 0x3a
je 0x494447
sub cl, 0x19
je 0x49448c
jmp 0x4944d4
call fcn.00479bbc
mov al, byte [eax]
test al, al
je 0x49446f
push ebx
call fcn.00479bbc
push eax
push 0x5dc4ee
lea edx, [ebp - 0x4024]
push edx
call fcn.004d26c8
add esp, 0x10
jmp 0x4944e9
push ebx
call fcn.004792dc
push eax
push 0x5dc4fa
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004d26c8
add esp, 0x10
jmp 0x4944e9
mov byte [ebx], 0x3a
call fcn.00479bbc
mov al, byte [eax]
test al, al
je 0x4944b7
push ebx
call fcn.00479bbc
push eax
push 0x5dc506
lea edx, [ebp - 0x4024]
push edx
call fcn.004d26c8
add esp, 0x10
jmp 0x4944e9
push ebx
call fcn.004792dc
push eax
push 0x5dc513
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004d26c8
add esp, 0x10
jmp 0x4944e9
push ebx
push 0x5dc520
lea eax, [ebp - 0x4024]
push eax
call fcn.004d26c8
add esp, 0xc
lea edx, [ebp - 0x4024]
push edx
call fcn.0046fb30
pop ecx
lea eax, [ebp - 0x6024]
mov ecx, dword [0x519bfc]
push ecx
push 0x5dc523
push eax
call fcn.004d26c8
add esp, 0xc
lea edx, [ebp - 0x6024]
push edx
push 0x5dc527
lea ecx, [ebp - 0x4024]
push ecx
call fcn.004221f8
add esp, 0xc
test byte [0x516434], 0x40
je 0x49454e
lea eax, [ebp - 0x4024]
push eax
push 0x5dc52a
push 0x516438
call fcn.00451598
add esp, 0xc
lea edx, [ebp - 0x4024]
lea ecx, [ebp - 0x2024]
push edx
push 0x5dc540
push ecx
call fcn.004d26c8
add esp, 0xc
test byte [0x516434], 0x40
je 0x49458b
lea eax, [ebp - 0x2024]
push eax
push 0x5dc5b0
push 0x516438
call fcn.00451598
add esp, 0xc
push 5
lea edx, [ebp - 0x2024]
push edx
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
ja 0x4945bb
push 0
call fcn.0046fb30
pop ecx
mov byte [0x51a5da], 0
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x494635
call fcn.0048c424
mov byte [0x519bef], 1
push 0x65
call fcn.004982a0
pop ecx
call fcn.0045ca08
push pe_nt_image_headers32
call fcn.0045c71c
test byte [0x516434], 0x40
pop ecx
je 0x4945ff
push 0x5dc5da
push 0x5dc5c7
push 0x516438
call fcn.00451598
add esp, 0xc
mov word [ebp - 0x14], 0
jmp 0x494626
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x6030]
mov esi, dword [ebp - 0x602c]
mov ebx, dword [ebp - 0x6028]
pop ebp
ret