joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5068c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
xor esi, esi
mov eax, 1
push edi
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
push 0xa
mov dword [esp + 0x10], ecx
or ecx, 0xffffffff
push eax
push esi
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0xac], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, esi
je 0x5069ec
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esi + 5]
mov edi, eax
call fcn.004cf0e0
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp edi, esi
jne 0x506a09
lea ecx, [esp + 0x10]
call fcn.004d0c50
lea ecx, [esp + 0x68]
call fcn.004d0c50
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
cmp ecx, esi
jle 0x506a79
mov eax, dword [ebp + 0x10]
cmp eax, esi
jle 0x506a79
push eax
mov eax, dword [esp + 0x6c]
lea edi, [esp + 0x14]
call fcn.004ce820
cmp dword [esp + 0x50], esi
je 0x506a82
cmp dword [esp + 0x10], 0xffffffff
je 0x506a82
cmp dword [esp + 0x14], esi
jle 0x506a82
cmp dword [esp + 0x18], esi
jle 0x506a82
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x80]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x60], ecx
lea ecx, [esp + 0x60]
mov esi, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x64], edx
call fcn.004d0cb0
lea esi, [esp + 0x68]
mov eax, edi
call fcn.004d6b80
jmp 0x506a82
lea esi, [esp + 0x10]
call fcn.004d16d0
mov esi, dword [esp + 0xc]
push esi
lea eax, [esp + 0x14]
call fcn.00506360
test al, al
je 0x5069ec
push esi
call fcn.00506f10
lea ecx, [esp + 0x10]
call fcn.004d0c50
lea ecx, [esp + 0x68]
call fcn.004d0c50
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5076f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push 0
mov byte [esp + 7], 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 0x80010106
je 0x50770c
mov byte [esp + 3], 1
push ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi], 0
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
je 0x507739
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [0x734df4]
push 0x320
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x50776e
cmp byte [esp + 0xb], al
je 0x50785b
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop ebx
add esp, 8
ret 8
mov edx, dword [0x734df4]
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [0x734df4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x50784d
push ebp
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.006a4bd0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x14]
push ecx
push 0
push ebp
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x50781e
mov ecx, dword [edi]
test ecx, ecx
je 0x5077f8
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push ecx
call eax
mov eax, dword [esp + 0x14]
mov dword [edi], 0
push edi
push 0x6b910c
push 0
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x50781e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov dword [esp + 0x14], eax
mov edi, dword [edi]
test edi, edi
je 0x507835
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ecx
push edi
call edx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x507841
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test ebp, ebp
je 0x50784c
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
cmp byte [esp + 0xf], 0
je 0x50785a
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
pop ebx
add esp, 8
ret 8
Function at 0x507db0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x70afbc
push 1
push 0
push 0x6b8fec
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x507e88
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
cmp word [esi], 0
je 0x507e05
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push esi
push eax
call edx
cmp word [edi], 0
je 0x507e18
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
cmp word [ebx], 0
je 0x507e30
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
push 0x6b902c
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x507e78
mov esi, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
test eax, eax
mov eax, dword [esp + 0x10]
jge 0x507e8f
test eax, eax
je 0x507e78
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x507e88
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
xor al, al
pop ebx
ret 0x10
test eax, eax
je 0x507e9b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x507eab
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0
push esi
push 5
push 0x8000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop esi
mov al, 1
pop ebx
ret 0x10
Function at 0x5087b0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x410
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x17
push 0
mov word [esp + 0x1c], 0
call edi
cmp word [esp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x50882e
push 0x6bc0cc
push str.NCH_Software_Suite
lea ecx, [esp + 0x218]
push ecx
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea ecx, [esp + 0x210]
call fcn.004ad730
push str..lnk
push str.NCH_Software_Suite
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea eax, [esp + 0x210]
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 2
push 0
mov word [esp + 0x1c], 0
call edi
cmp word [esp + 8], 0
je 0x508898
push 0x6bc0cc
push str.NCH_Software_Suite
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea ecx, [esp + 0x210]
call fcn.004ad730
push str..lnk
push str.NCH_Software_Suite
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea ecx, [esp + 0x210]
push ecx
call esi
pop edi
pop esi
add esp, 0x410
ret

Function at 0x5088b0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
push ebx
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x17
push 0
mov word [esp + 0x1c], 0
call ebx
cmp word [esp + 8], 0
je 0x508951
push str..lnk
push str.NCH_Suite
lea ecx, [esp + 0x218]
push ecx
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5089cc
push 0xfffffc72
push esi
push esi
lea eax, [esp + 0x21c]
push eax
mov edi, str.NCH_Software_Suite
mov eax, str._extsuite
call fcn.00507db0
test al, al
je 0x508951
lea ecx, [esp + 0x210]
push ecx
call fcn.005083a0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 8]
push edx
push 0
push 0
push 2
push 0
mov word [esp + 0x1c], 0
call ebx
cmp word [esp + 8], 0
je 0x5089cc
push str..lnk
push str.NCH_Suite
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
call fcn.004ad3a0
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5089cc
push 0xfffffc72
push esi
push esi
lea edx, [esp + 0x21c]
push edx
mov edi, str.NCH_Software_Suite
mov eax, str._extsuite
call fcn.00507db0
test al, al
je 0x5089cc
lea eax, [esp + 0x210]
push eax
call fcn.005083a0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5089e0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x17
push 0
mov word [esp + 0x20], 0
call esi
cmp word [esp + 0xc], 0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
je 0x508a72
push str..lnk
push ebp
lea ecx, [esp + 0x21c]
push ecx
lea eax, [esp + 0x18]
call fcn.004ad3a0
call fcn.004014c0
test al, al
jne 0x508a64
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x508a64
push 0
push 0
push 0
lea eax, [esp + 0x220]
push eax
push str.startunpin
push 0
call ebx
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 2
push 0
mov word [esp + 0x20], 0
call esi
cmp word [esp + 0xc], 0
je 0x508ae8
push str..lnk
push ebp
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x18]
call fcn.004ad3a0
call fcn.004014c0
test al, al
jne 0x508ada
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x508ada
push 0
push 0
push 0
lea edx, [esp + 0x220]
push edx
push str.startunpin
push 0
call ebx
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 4

Function at 0x508b00
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x618
push ebp
mov ebp, dword [esp + 0x620]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x508bc7
push 0x6bc0cc
push str.NCH_Software_Suite
lea ecx, [esp + 0x214]
push ecx
lea eax, [esp + 0x10]
call fcn.004ad3a0
push 0
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x508bc7
push ebx
push esi
mov ebx, 0x7329d0
push edi
nop
cmp dword [ebx], 0
je 0x508bc4
mov ecx, dword [ebx + 4]
push str..lnk
push ecx
lea edx, [esp + 0x428]
push edx
lea eax, [esp + 0x224]
call fcn.004ad3a0
mov eax, dword [ebx]
push eax
push str._extfind__s
mov esi, 0x104
lea edi, [esp + 0x18]
call fcn.004af0d0
mov eax, dword [ebx + 4]
add esp, 8
mov ecx, edi
push ecx
push ebp
lea edx, [esp + 0x428]
push edx
call fcn.00507ed0
add ebx, 8
jne 0x508b70
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x618
ret 4
Function at 0x508be0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x820
push ebp
push esi
push edi
xor ebp, ebp
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x214]
push eax
push ebp
push ebp
push 0x17
push ebp
mov word [esp + 0x20], bp
mov word [esp + 0x228], bp
call esi
cmp word [esp + 0x214], bp
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
je 0x508c65
push 0x6bc0cc
push str.NCH_Software_Suite
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x220]
call fcn.004ad3a0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x508d38
lea eax, [esp + 0xc]
push eax
call fcn.004021c0
test al, al
je 0x508d2c
cmp word [esp + 0xc], bp
jne 0x508cb8
lea edx, [esp + 0x214]
push edx
push ebp
push ebp
push 2
push ebp
mov word [esp + 0x228], bp
call esi
cmp word [esp + 0x214], bp
je 0x508d2c
push 0x6bc0cc
push str.NCH_Software_Suite
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x220]
call fcn.004ad3a0
push ebp
lea ecx, [esp + 0x10]
push ecx
call edi
test eax, eax
je 0x508d2c
cmp dword [str.VideoPad], ebp
je 0x508d2c
push ebx
mov ebx, 0x7329d0
mov edx, dword [ebx + 4]
push str..lnk
push edx
lea eax, [esp + 0x630]
push eax
lea eax, [esp + 0x1c]
call fcn.004ad3a0
mov ecx, dword [ebx]
push ecx
push str._extfind__s
mov esi, 0x104
lea edi, [esp + 0x428]
call fcn.004af0d0
mov eax, dword [esp + 0x83c]
add esp, 8
mov edx, edi
push edx
push eax
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x630]
push ecx
call fcn.00507ed0
add ebp, 1
cmp dword [ebp*8 + 0x7329d0], 0
lea ebx, [ebp*8 + 0x7329d0]
jne 0x508cc6
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x820
ret 4
push ebp
lea ecx, [esp + 0x10]
push ecx
call edi
test eax, eax
jne 0x508c65
mov word [esp + 0xc], bp
jmp 0x508c6c
Function at 0x5090f0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x20c
push ebx
push esi
push edi
push eax
push ecx
push str.SoftwareClassesSystemFileAssociations._sShell_s
mov esi, 0x104
lea edi, [esp + 0x1c]
call fcn.004af0d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 1
push 0
mov eax, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x509155
mov ecx, dword [esp + 0xc]
push ecx
call edi
cmp word [esp + 0x10], 0
je 0x509155
lea edx, [esp + 0x10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
lea eax, [esp + 0xc]
push eax
push 1
push 0
lea ecx, [esp + 0x1c]
push ecx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x509189
mov edx, dword [esp + 0xc]
push edx
call edi
cmp word [esp + 0x10], 0
je 0x509189
lea eax, [esp + 0x10]
push eax
push SysReAllocStringLen
call ebx
pop edi
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x50abd0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0xa38
lea eax, [esp + 0x218]
push eax
call fcn.004c4840
push 0x6bc0cc
push str.debut.exe
lea ecx, [esp + 0x428]
push ecx
lea eax, [esp + 0x224]
call fcn.004ad3a0
cmp dword [str.WavePad], 0
mov dword [esp + 8], 0
je 0x50adc6
push ebx
push ebp
push esi
mov esi, 0x7325e4
push edi
mov dword [esp + 0x10], 0x7325dc
xor ebx, ebx
mov dword [esp + 0x1c], esi
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
call fcn.00507ce0
test al, al
je 0x50ad9a
cmp dword [esi], 0
je 0x50ad9a
lea ecx, [ebx + 0x7325e4]
mov eax, esi
mov dword [esp + 0x14], ecx
lea esp, [esp]
mov ebp, dword [eax]
push ebp
push str.SoftwareClasses._s
mov esi, 0x104
lea edi, [esp + 0x28]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x228]
push edx
push 0x6bc0cc
push 0
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x228], 0
je 0x50ad82
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x434]
push edx
push str.__s___extfind__s____L_
lea edi, [esp + 0x644]
call fcn.004af0d0
mov eax, dword [ebx + 0x7325e0]
push eax
lea ecx, [esp + 0x238]
push ecx
push str.SoftwareClasses_sShell_scommand
lea edi, [esp + 0x38]
call fcn.004af0d0
add esp, 0x18
lea edx, [esp + 0x840]
push edx
push 0x6bc0cc
push 0
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
lea ecx, [esp + 0x638]
lea eax, [esp + 0x840]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x50ad36
test dx, dx
je 0x50ad32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x50ad36
add eax, 4
add ecx, 4
test dx, dx
jne 0x50ad10
xor eax, eax
jmp 0x50ad3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ad82
mov eax, dword [ebx + 0x7325e0]
push eax
lea ecx, [esp + 0x22c]
push ecx
push str.SoftwareClasses_sShell_s
lea edi, [esp + 0x2c]
call fcn.004af0d0
add esp, 0xc
cmp word [esp + 0x20], 0
je 0x50ad75
mov edx, edi
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebx + 0x7325e0]
mov ecx, ebp
call fcn.005090f0
mov eax, dword [esp + 0x14]
add eax, 4
cmp dword [eax], 0
mov dword [esp + 0x14], eax
jne 0x50ac60
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
add ebx, 1
mov dword [esp + 0x18], ebx
imul ebx, ebx, 0x5c
lea eax, [ebx + 0x7325dc]
add esi, 0x5c
cmp dword [eax], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
jne 0x50ac30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa38
ret
Function at 0x50b5a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push ebp
push esi
push edi
movzx edi, bx
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx esi, bx
cmp esi, 0x25
mov ebp, eax
je 0x50b603
cmp esi, 0x27
je 0x50b603
cmp esi, 0x26
je 0x50b603
cmp esi, 0x28
je 0x50b603
cmp esi, 0x2d
je 0x50b603
cmp esi, 0x21
je 0x50b603
cmp esi, 0x22
je 0x50b603
cmp esi, 0x2e
je 0x50b603
cmp esi, 0x24
je 0x50b603
cmp esi, 0x23
je 0x50b603
cmp esi, 0x5b
je 0x50b603
cmp esi, 0x5c
je 0x50b603
cmp esi, 0x5d
jne 0x50b609
or ebp, 0x100
movzx ecx, bp
push 0x104
lea eax, [esp + 0x14]
shl ecx, 0x10
push eax
or ecx, edi
push ecx
mov word [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp word [esp + 0x10], 0
jne 0x50b644
cmp esi, 0x13
jne 0x50b644
mov edx, str.Pause
lea esi, [esp + 0x10]
call fcn.004011d0
test ebx, 0x40000
je 0x50b656
cmp ebp, 0x2a
mov edx, str.Shift
jne 0x50b65b
mov edx, 0x6bc0cc
test ebx, 0x10000
je 0x50b66d
cmp ebp, 0x38
mov ecx, str.Alt
jne 0x50b672
mov ecx, 0x6bc0cc
test ebx, 0x20000
je 0x50b684
cmp ebp, 0x1d
mov eax, str.Ctrl
jne 0x50b689
mov eax, 0x6bc0cc
mov edi, dword [esp + 0x220]
lea esi, [esp + 0x10]
push esi
push edx
push ecx
push eax
push str._s_s_s_s
mov esi, 0x104
call fcn.004af0d0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x50b700
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x7364f4]
test eax, eax
push esi
je 0x50b730
mov esi, eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push esi
call fcn.0069d0cc
add esp, 4
mov dword [0x7364f4], 0
push 8
call fcn.0069e704
mov esi, eax
add esp, 4
test esi, esi
jne 0x50b752
call fcn.004b05b0
mov dword [0x7364f4], esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0x50b780
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 4], eax
mov dword [0x7364f4], esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x50c610
Capabilities:
Log keystrokes

Disassembly:
push edi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 4]
je 0x50c695
push ebx
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call ebx
mov edi, eax
mov eax, dword [esi + 4]
push 0
push eax
call ebx
mov ebx, eax
cmp edi, ebx
je 0x50c666
push ebp
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push ebx
push edi
call ebp
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call ebp
pop ebp
jmp 0x50c670
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov ecx, dword [esi + 4]
test eax, eax
setne al
neg al
sbb eax, eax
and eax, 0xfffffffa
add eax, 9
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop edi
ret
Function at 0x50c9f0
Capabilities:
Empty the recycle bin

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
mov esi, eax
movzx eax, di
cmp eax, 0x62
jg 0x50ca43
je 0x50ca31
cmp eax, 9
je 0x50ca23
cmp eax, 0x61
jne 0x50caa8
call fcn.004b2f40
jmp 0x50cbbf
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
jmp 0x50cbbf
mov eax, dword [esi + 4]
push str.Video
call fcn.00422290
jmp 0x50cbbf
cmp eax, 0x321
je 0x50ca78
cmp eax, 0x2396
jne 0x50caa8
mov eax, dword [esi + 4]
push 5
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
push str.SpaceWarningThreshold
push str.Settings
mov eax, 0x400
call fcn.00480f20
jmp 0x50cbbf
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
test al, al
je 0x50cbbf
mov ecx, dword [esi + 4]
push 1
push 0
push 0x466
push ecx
mov byte [esi + 0x13c], 0
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x50cbbf
lea edx, [edi - 0x2328]
cmp dx, 0x3e7
ja 0x50cb9b
lea ecx, [eax - 0x2329]
cmp ecx, 0x59
ja case.0x50cacf.9013
movzx ecx, byte [ecx + 0x50cc1c]
jmp dword [ecx*4 + 0x50cbd8]
lea edx, [esp + 8]
push edx
call fcn.0049c600
lea esi, [esp + 8]
call fcn.00401210
jmp 0x50cbbf
mov eax, dword [esi + 4]
push eax
call fcn.004b96b0
jmp 0x50cbbf
mov eax, esi
call fcn.004f1dd0
jmp 0x50cbbf
mov esi, str.www.nchsoftware.com_capture_index.html
call fcn.00401210
jmp 0x50cbbf
mov esi, str.www.nchsoftware.com_capture_support.html
call fcn.00401210
jmp 0x50cbbf
call fcn.004a0780
jmp 0x50cbbf
call fcn.00421830
jmp 0x50cbbf
call fcn.004a0740
jmp 0x50cbbf
call fcn.004a0800
jmp 0x50cbbf
mov ecx, dword [esi + 4]
push ecx
call fcn.00421930
jmp 0x50cbbf
mov esi, str.https:__www.nchsoftware.com_software_video.html
call fcn.00401210
jmp 0x50cbbf
mov esi, str.http:__nch.invisionzone.com_index.php__forum_54_debut_
call fcn.00401210
jmp 0x50cbbf
mov esi, str.https:__www.facebook.com_NCHSoftware
call fcn.00401210
jmp 0x50cbbf
mov esi, str.https:__twitter.com_nchsoftware
call fcn.00401210
jmp 0x50cbbf
mov edx, dword [esi + 4]
push edx
call fcn.004a0870
jmp 0x50cbbf
mov ecx, esi
call fcn.00517400
test al, al
jne 0x50cbbf
jmp 0x50cbb4
add eax, 0xfffffcd6
cmp eax, 3
ja 0x50cbb4
lea ecx, [esi + 0x589]
call fcn.00514da0
test al, al
jne 0x50cbca
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push ebx
push edi
mov ecx, esi
call edx
push edi
call fcn.004a18a0
call fcn.004b09c0
pop esi
pop ebx
add esp, 0x208
ret 4
Function at 0x512820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x410
push esi
push edi
mov edi, eax
push str.SPLASH
mov dword [edi], 0
push edi
mov dword [edi + 4], 0
call fcn.005076f0
lea esi, [esp + 0x210]
call fcn.004acf70
push 0x6bc0cc
push str.splash.jpg
lea eax, [esp + 0x10]
push eax
mov eax, esi
call fcn.004ad3a0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x512889
lea edx, [esp + 8]
push edx
call fcn.00507870
mov eax, edi
pop edi
pop esi
add esp, 0x410
ret
push 0x152
push edi
call fcn.005076f0
mov eax, edi
pop edi
pop esi
add esp, 0x410
ret