joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9998
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4e9a3a
cmp dword [ebx + 0x94], 0
jne 0x4e9a34
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4e98e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4e9a34
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4e99fa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4e9a34
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0043fc64
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4e9a09
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4e9c58
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x66f2b4]
cmp dword [eax + 0x170], 0
je 0x4e9dbd
test bl, bl
jne 0x4e9d0b
cmp dword [esi + 0x9c], 0
jne 0x4e9d00
mov eax, esi
call fcn.004ecad8
push eax
push 0x4e9b64
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4e9cd1
mov eax, dword [0x66f2b4]
cmp byte [eax + 0xd3], 0
je 0x4e9cd1
mov eax, dword [esi + 0xd8]
call fcn.00408930
mov edi, eax
cmp edi, 0
jl 0x4e9cd1
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4e9cba
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4e9d00
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043fc64
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4e9ce0
inc dword [esi + 0x9c]
jmp 0x4e9dbd
cmp dword [esi + 0x9c], 0
jle 0x4e9dbd
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4e9dbd
cmp dword [esi + 0x44], 0
je 0x4e9d68
mov eax, dword [0x66f2b4]
cmp byte [eax + 0xd3], 0
je 0x4e9d68
mov eax, dword [esi + 0xd8]
call fcn.00408930
mov edi, eax
cmp edi, 0
jl 0x4e9d68
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4e9d51
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4e9d97
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0043fc64
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4e9d77
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4dcd68]
call fcn.00408af0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4eaa00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4eaa6b
cmp byte [ebx + 0xd3], 0
jne 0x4eaa6b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406c6c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4eaa58
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4eaa78
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406ec4
jmp 0x4eaa78
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406ec4
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ec240
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4ec2ae
mov eax, esi
call fcn.00485fb4
test al, al
je 0x4ec2ae
mov eax, dword [ebx + 0x84]
call fcn.00485c08
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ec2ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4ec2a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00485c08
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047cb84
jmp 0x4ec2ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004ec078
pop esi
pop ebx
ret

Function at 0x4ed4bc
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
mov al, byte [ebp - 2]
and al, 0x20
mov dl, byte [ebp - 2]
and dl, 0x1e
and edx, 0xff
shr edx, 1
or al, dl
mov dl, byte [ebp - 2]
and dl, 1
shl edx, 4
or al, dl
mov byte [ebp - 4], al
xor eax, eax
mov al, byte [ebp - 4]
xor edx, edx
mov dl, byte [ebp - 1]
shl edx, 3
lea edx, [edx*8 + 0x661be4]
mov al, byte [edx + eax]
and al, 0xf
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret

Function at 0x4ed50c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4ed524
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4ed51d
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00404a24
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x661de4]
and al, 7
and eax, 0xff
mov ecx, 7
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x661de4]
shr edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
and eax, edx
je 0x4ed596
mov eax, dword [ebp - 0xc]
and eax, 7
mov ecx, 7
sub ecx, eax
mov al, 1
shl al, cl
mov edx, dword [ebp - 0xc]
shr edx, 3
mov ecx, dword [ebp - 8]
or byte [ecx + edx], al
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x38
jne 0x4ed543
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x4ed844
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4ed85d
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4ed856
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4ed86f
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4ed868
mov eax, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 5
lea ecx, [ebp - 0x12]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004ed384
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0x20]
xor byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
jne 0x4ed88f
xor eax, eax
mov al, byte [ebp - 0x12]
shr eax, 2
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x12]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x11]
shr edx, 4
or al, dl
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x10]
shr edx, 6
or al, dl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x10]
and al, 0x3f
mov byte [ebp - 0x17], al
xor eax, eax
mov al, byte [ebp - 0xf]
shr eax, 2
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xf]
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0xe]
shr edx, 4
or al, dl
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0xe]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0xd]
shr edx, 6
or al, dl
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xd]
and al, 0x3f
mov byte [ebp - 0x13], al
xor eax, eax
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov dl, byte [ebp + edx - 0x1a]
call fcn.004ed4bc
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x1a], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jne 0x4ed927
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, eax
mov al, byte [ebp + eax - 0x1a]
shl eax, 4
mov edx, dword [ebp - 0x20]
add edx, edx
or al, byte [ebp + edx - 0x19]
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x12], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x4ed94b
lea eax, [ebp - 0x12]
mov edx, 5
call fcn.004ed420
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov al, byte [ebp + eax - 0x12]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jne 0x4ed982
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x501d6c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x501e94
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00501c58
mov eax, dword [esi]
call fcn.00408928
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4172d4]
call fcn.00408af0
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004045a4
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004045a4
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408928
mov dword [ebp - 0xc], eax
mov eax, dword [0x6693c0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004f1a48
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404a24
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408928
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004f1a24
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004f17dc
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004f1a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501e9b
lea eax, [ebp - 4]
mov edx, dword [0x4172d4]
call fcn.00408afc
ret

Function at 0x519c78
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0
push 0
push 0
push 1
push 2
call sub.ws2_32.dll_WSASocketW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x519c9b
call fcn.00424584
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x519da4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
lea eax, [ebp - 0x194]
push eax
push 0x202
call sub.ws2_32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x519dcc
call fcn.00424584
mov esp, ebp
pop ebp
ret

Function at 0x51b0bc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
cmp dword [0x66f3e4], 0
jne 0x51b0dc
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x51b0e4
mov eax, dword [0x66f3e4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5333e8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.004078fc
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x53340d
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00407770
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x53342c
mov eax, ebx
mov edx, dword [esp]
call fcn.004078fc
pop ecx
pop edx
pop ebx
ret
Function at 0x579394
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5793c2
mov eax, ebx
call fcn.00579e48
cmp dword [ebx + 0x40], 0
je 0x5793bb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x579433
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x579425
cmp dword [ebx + 8], 0
je 0x5793e4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5793f6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x579425
cmp dword [ebx + 8], 0
je 0x5793d7
cmp eax, 3
je 0x579409
dec eax
jne 0x5793d7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5793d7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5793d7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x579451
cmp dword [ebx + 0x14], 0xcc
je 0x579451
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0057945c
pop ebx
ret
Function at 0x5a77e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x66f8b4
test esi, esi
jne 0x5a77fa
xor eax, eax
jmp 0x5a78eb
cmp dword [ebp], 0
jne 0x5a7805
call fcn.005a7770
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5a78c5
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x5a7811
test edi, edi
jbe 0x5a78e6
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5a78c9
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b9f98
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ba052
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b4c
mov eax, dword [0x66956c]
cmp dword [eax], 2
jne 0x5ba007
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.0040771c
mov eax, dword [ebx]
call fcn.00406fe0
push eax
mov eax, dword [ebx]
call fcn.00407630
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00406fe0
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040771c
jmp 0x5ba039
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.0041ea44
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.00407874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba059
lea eax, [ebp - 0x7d8]
call fcn.00406b04
ret
Function at 0x5e4870
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005e485c
test eax, eax
jne 0x5e4891
mov eax, esi
call fcn.00406b04
jmp 0x5e4922
mov eax, ebx
call fcn.005e49b8
test al, al
je 0x5e48d7
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00406c6c
test edi, edi
je 0x5e48ce
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
jmp 0x5e4922
mov eax, esi
call fcn.00406b04
jmp 0x5e4922
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x5e491b
mov eax, dword [ebp + 0x270]
call fcn.004411cc
test eax, eax
jle 0x5e4909
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x270]
mov edx, edi
call fcn.004ca0a8
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00406ec4
jmp 0x5e4922
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x278]
call fcn.00406ec4
jmp 0x5e4922
mov eax, esi
call fcn.00406b04
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5e65ec
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040af00
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
pop esi
pop ebx
ret

Function at 0x5eb048
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov ebx, eax
mov eax, dword [ebx + 0x5c]
mov esi, dword [eax + 0x38]
call fcn.005ff1c8
lea edx, [esp + 4]
mov eax, dword [ebx + 0x5c]
call fcn.005ff2d8
cmp byte [esp + 0x24], 0
jne 0x5eb089
cmp dword [esp + 0x10], 0xff00ff
jne 0x5eb089
mov eax, dword [ebx + 0x5c]
mov byte [eax + 0x1c], 1
mov byte [esp], 0
jmp 0x5eb142
mov byte [esp], 1
mov edi, dword [ebx + 0x5c]
cmp byte [edi + 9], 0
je 0x5eb0ce
mov ebp, dword [ebx + 0x78]
mov eax, dword [ebp + 0x4c]
push eax
lea eax, [esp + 0x3c]
push eax
mov ecx, dword [ebp + 0x48]
xor edx, edx
xor eax, eax
call fcn.0040af00
lea eax, [esp + 0x38]
push eax
mov eax, dword [edi + 0x40]
call fcn.00466d2c
call fcn.00461430
mov edx, dword [ebx + 0x78]
mov ecx, dword [edx + 0x6c]
pop edx
call fcn.005f5a48
jmp 0x5eb118
push 0
mov eax, dword [esi + 0x4c]
push eax
lea eax, [esp + 0x40]
push eax
mov ecx, dword [esi + 0x48]
xor edx, edx
xor eax, eax
call fcn.0040af00
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x50]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
call fcn.0040af30
lea eax, [esp + 0x50]
push eax
mov eax, dword [ebx + 0x5c]
mov eax, dword [eax + 0x40]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x20]
xor ecx, ecx
mov eax, edi
call fcn.005f4644
lea edx, [esp + 0x28]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebx + 0x5c]
mov eax, dword [eax + 0x40]
call fcn.00466d2c
mov ecx, eax
lea edx, [esp + 0x28]
mov eax, ebx
call fcn.005eb150
mov eax, dword [ebx + 0x5c]
mov byte [eax + 0x35], 0
movzx eax, byte [esp]
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x605e44
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x70], 0
jne 0x605e5c
mov eax, ebx
call fcn.00605bb0
cmp dword [ebx + 0x68], 0
jne 0x605e69
mov eax, ebx
call fcn.00605b08
mov esi, dword [ebx + 0x70]
test esi, esi
je 0x606010
cmp dword [ebx + 0x68], 0
je 0x606010
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x70]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00605a8c
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x605edc
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x605ec5
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x605ed1
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x605ef2
call fcn.00485c08
mov esi, eax
jmp 0x605ef5
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x605f0a
or esi, 0xffffffff
jmp 0x605f14
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.004e72c4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.004e7300
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0047c2a4
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0047c2d8
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040af30
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00485c08
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00485c08
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00485c08
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x70]
call fcn.00466d2c
call fcn.00461430
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00485c08
push eax
mov eax, dword [0x6689a8]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00485c08
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x60b0ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4da378]
call fcn.004e08a8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0xffffff9e
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.00485c08
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.00485c08
push eax
call sub.user32.dll_SetWindowLongW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004e18f4
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004e2820
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00637db8
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00637dcc
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.005fa514
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x60b1f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00466d2c
call fcn.00461430
push eax
call sub.gdi32.dll_BitBlt
push 0x1fffffff
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0040af00
lea edx, [ebp - 0x30]
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.005967d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b1f8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret

Function at 0x60b240
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x60b250
call sub.user32.dll_FindWindowW
ret