joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483f40
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4840eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4840cc
mov dl, 1
mov eax, dword [0x41a97c]
call fcn.00403f4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404e08
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4840bb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004712a8
test al, al
je 0x4840ae
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4840fc
lea eax, [ebp - 0x254]
call fcn.0040b47c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4840ae
xor eax, eax
push ebp
push 0x4840a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x484134
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x484090
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405088
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x484090
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4840ae
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x483fb1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041f2ac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4840f2
lea eax, [ebp - 0x260]
call fcn.00404e08
ret

Function at 0x484a34
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x591bf4]
cmp byte [eax + 0xa5], 0
jne 0x484aa5
cmp dword [0x591c0c], 0
jne 0x484a66
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4849f0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x591c0c], eax
cmp dword [0x591c08], 0
jne 0x484a81
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x591c08], eax
cmp dword [0x591c10], 0
jne 0x484aa5
push esp
push 0
push 0
push 0x484994
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x591c10], eax
pop edx
ret
Function at 0x485138
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x591bf4]
cmp dword [eax + 0x30], 0
je 0x4851e2
cmp dword [ebx + 0x94], 0
jne 0x4851dc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4850c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4851dc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4851a2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4851dc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cc4c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4851b1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x485d40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x485d75
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ef8
jmp 0x485d82
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e5c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x486f4c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x486f8d
mov eax, esi
call fcn.0046c82c
test al, al
je 0x486f8d
mov eax, dword [ebx + 0x84]
call fcn.0046c528
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x486f8d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046c528
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x487c94
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4196d4]
call fcn.00405b54
xor eax, eax
push ebp
push 0x487dd8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x58b268], 0
jne 0x487ce7
mov ecx, dword [0x58faf0]
mov dl, 1
mov eax, dword [0x408cb0]
call fcn.0040f164
call fcn.0040475c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040379c
mov eax, ebx
call fcn.00405774
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x487de8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406cc4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405784
test eax, eax
jle 0x487d7f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x487d78
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004050a0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405088
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409c98
test eax, eax
jne 0x487d78
mov ebx, 0x15
jmp 0x487d84
mov ebx, 0x10
jmp 0x487d84
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x58b268]
call fcn.00487bec
mov eax, dword [ebp - 8]
call fcn.00487bec
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487ddf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404e2c
lea eax, [ebp - 0x10]
mov edx, dword [0x4196d4]
call fcn.00405c24
ret

Function at 0x48900c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x489066
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58fbb4]
cmp byte [eax], 0
je 0x489036
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x489050
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405040
mov eax, dword [ebp - 4]
call fcn.004052d8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48906d
lea eax, [ebp - 4]
call fcn.00404e08
ret
Function at 0x4890e4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48915c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58fbb4]
cmp byte [eax], 0
je 0x489114
push esi
push ebx
call sub.kernel32.dll_MoveFileW
mov ebx, eax
jmp 0x489141
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405040
mov eax, dword [ebp - 4]
call fcn.004052d8
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405040
mov eax, dword [ebp - 8]
call fcn.004052d8
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489163
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e2c
ret

Function at 0x48916c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4891e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58fbb4]
cmp byte [eax], 0
je 0x4891a0
push edi
push esi
push ebx
call sub.kernel32.dll_CopyFileW
mov ebx, eax
jmp 0x4891ce
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405040
mov eax, dword [ebp - 4]
call fcn.004052d8
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405040
mov eax, dword [ebp - 8]
call fcn.004052d8
push eax
call sub.kernel32.dll_CopyFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4891f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e2c
ret

Function at 0x48950c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.004085d0
cmp ax, 0xffff
jne 0x48952d
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4895ae
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4895ae
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x489574
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x489567
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4895ae
cmp dword [ebp + 8], 0
jle 0x4895ae
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00430ee8
mov esi, eax
test esi, esi
jle 0x4895a5
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004085e4
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x494af8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x494c7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x494c61
cmp byte [ebx + 0x268], 0
je 0x494c61
mov eax, dword [ebp - 4]
call fcn.0049b35c
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x494c5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x494b9e
dec ax
je 0x494b74
sub ax, 0x12
jne 0x494bb8
call fcn.00404808
jmp 0x494c61
cmp byte [ebx + 0x269], 0
je 0x494c40
mov eax, ebx
call fcn.0045cb40
test al, al
je 0x494c40
xor edx, edx
mov eax, ebx
call fcn.0045cb64
jmp 0x494c40
mov eax, dword [esi]
call fcn.00405784
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405970
jmp 0x494c40
cmp byte [ebx + 0x269], 0
je 0x494bd5
mov eax, ebx
call fcn.0045cb40
test al, al
jne 0x494bd5
mov dl, 1
mov eax, ebx
call fcn.0045cb64
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x494bed
mov eax, esi
call fcn.00405524
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.0040563c
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.004057f0
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.00494928
test al, al
je 0x494c40
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.0040563c
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405790
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494c61
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.0049b390
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494c83
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040553c
ret

Function at 0x498d74
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x58fbb4]
cmp byte [eax], 0
jne 0x498da2
mov ecx, 0xaf
mov edx, 0x498df0
mov eax, 0x498e2c
call fcn.00404d64
mov eax, ebx
call fcn.00405524
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x498de1
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004056dc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498e40
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x58fbb4]
cmp byte [eax], 0
jne 0x498e63
mov ecx, 0xbd
mov edx, 0x498ea4
mov eax, 0x498ee0
call fcn.00404d64
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x498e96
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x498e96
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x498e96
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x49d33c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x49d3a0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405088
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040a5c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d3a7
lea eax, [ebp - 0xc]
call fcn.00404e08
ret

Function at 0x49d444
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x49d4a0
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x49d46f
call fcn.004106e8
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402e50
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x49d4a0
call fcn.004106e8
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4a48f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a49aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405524
mov eax, dword [0x58fbb0]
cmp byte [eax], 0
je 0x4a495f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405aec
mov eax, dword [ebx]
call fcn.00405784
push eax
mov eax, dword [ebx]
call fcn.00405774
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405784
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405aec
jmp 0x4a4991
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040affc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004056f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a49b1
lea eax, [ebp - 0x3f0]
call fcn.00404e08
ret
Function at 0x4a49b8
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040affc
add esp, 0x3ec
pop ebx
ret

Function at 0x4aaff8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x59006c]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x4ab09e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4ab03d
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4ab079
jmp 0x4ab041
pop edx
pop eax
jge 0x4ab079
mov eax, dword [0x59006c]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004a596c
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x4ab09e
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4ab09e
cmp dword [ebx + 0x11c], 0
je 0x4ab09e
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00437edc
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4b227c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b2336
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405524
mov eax, dword [0x58fbb0]
cmp byte [eax], 0
je 0x4b22eb
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405aec
mov eax, dword [ebx]
call fcn.00405784
push eax
mov eax, dword [ebx]
call fcn.00405774
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405784
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405aec
jmp 0x4b231d
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040affc
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004056f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b233d
lea eax, [ebp - 0x3f0]
call fcn.00404e08
ret

Function at 0x4b5590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4b55ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004b55f4
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b55f1
ret
Function at 0x4be6ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.0046c528
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.00465adc
pop ebx
ret
Function at 0x4c90d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x4c90fa
push 0
mov eax, dword [ebx + 0x94]
call fcn.0046c528
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x4c91b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c9325
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4c930a
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040affc
mov dl, 1
mov eax, dword [0x49ed9c]
call fcn.0049edf4
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x41ac6c]
call fcn.00403f4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0049ee70
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c9307
mov dl, 1
mov eax, dword [0x4a037c]
call fcn.004a03e4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, 0x4c933c
call fcn.0049f5d8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405124
xor eax, eax
push ebp
push 0x4c9300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004a06e4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004c9344
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9307
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00403f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403f7c
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c932c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404e2c
ret

Function at 0x4d7c10
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004d87e0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4d86dc
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4d8721
lea eax, [ebp - 0x60]
call fcn.004d7c10
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004d7c38
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d7d08
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4d8723
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4d874a
mov bl, byte [esi]
xor bl, 0x36
mov byte [eax], bl
mov bl, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4d8750
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4d8731
lea eax, [ebp - 0x60]
call fcn.004d7c10
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d7c38
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004d85bc
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d7d08
lea eax, [ebp - 0x60]
call fcn.004d7c10
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d7c38
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004d7c38
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d7d08
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8