joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474f44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004091a0
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0046f468
test ebx, ebx
jne 0x474f97
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00474dd8
mov ebx, eax
test ebx, ebx
je 0x475082
cmp esi, ebx
je 0x474fc0
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x474fd5
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x47500d
add eax, 0xffffff5f
sub eax, 2
jb 0x475025
dec eax
sub eax, 2
jb 0x475039
dec eax
sub eax, 2
jb 0x47502f
jmp 0x475043
add eax, 0xfffffdff
sub eax, 2
jb 0x475025
dec eax
sub eax, 2
jb 0x475039
dec eax
sub eax, 2
jb 0x47502f
jmp 0x475043
mov byte [esp + 0x120], 0
jmp 0x47504b
mov byte [esp + 0x120], 2
jmp 0x47504b
mov byte [esp + 0x120], 1
jmp 0x47504b
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004857f0
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00470ca0
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x475084
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4852f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x485315
test edi, 0x40000
je 0x48532f
test bl, bl
jne 0x4853b0
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4853b0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x485362
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x485377
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x485386
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x485397
cmp byte [esp + 2], 0
je 0x4853b0
cmp byte [esp + 2], 0
je 0x4853a8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4853b0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48565c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x485682
mov eax, esp
push eax
push 0x485624
call sub.user32.dll_EnumWindows
jmp 0x485695
mov eax, esp
push eax
push 0x485604
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x485758
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4857ac]
test si, 4
je 0x48576d
or bl, 1
test si, 8
je 0x485777
or bl, 4
test si, 1
je 0x485781
or bl, 8
test si, 2
je 0x48578b
or bl, 0x10
test si, 0x10
je 0x485795
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4857a4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4857b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4857ec]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4857ca
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4857d9
or bl, 4
test esi, 0x20000000
je 0x4857e4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x48be54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x48bee2
movzx eax, word [esi + 4]
sub ax, 9
je 0x48be7b
add eax, 0xffffffe4
sub ax, 4
jb 0x48bead
jmp 0x48bee2
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x48bee2
push 1
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setge cl
mov edx, dword [ebx + 0x278]
mov eax, ebx
call fcn.00478898
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x278]
test eax, eax
je 0x48beeb
push 0
movzx edx, word [esi + 4]
cmp dx, 0x27
je 0x48becd
cmp dx, 0x28
je 0x48becd
xor ecx, ecx
jmp 0x48becf
mov cl, 1
mov edx, dword [eax + 0x30]
xchg edx, eax
call fcn.00478898
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004775e8
pop esi
pop ebx
ret
Function at 0x48dc14
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x48dc26
add esp, 0xfffffff0
call fcn.004044d0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043f474
mov eax, dword [0x557b34]
mov dword [eax + 4], ebx
mov dword [eax], 0x48e028
mov eax, dword [0x557b40]
mov dword [eax + 4], ebx
mov dword [eax], 0x48e034
mov eax, ebx
call fcn.0048e040
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x488f74
push eax
push 0
push 0
mov eax, dword [0x557d98]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x443924]
call fcn.004453a4
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x443924]
call fcn.004453a4
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x443924]
call fcn.004453a4
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x443924]
call fcn.004453a4
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0048e5d4
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48e45c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48e45c
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48e45c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x48e45c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48dd79
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48e1fc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48e3a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x48e38a
mov dl, 1
mov eax, dword [0x435a84]
call fcn.0043a634
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.00406448
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x48e379
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047ddb4
test al, al
je 0x48e36c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x48e3b8
lea eax, [ebp - 0x394]
call fcn.0040e094
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x48e36c
xor eax, eax
push ebp
push 0x48e365
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x48e428
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x48e34e
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406640
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x48e34e
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e36c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x48e26f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.0043a420
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e3b0
lea eax, [ebp - 0x3a0]
call fcn.00406438
ret

Function at 0x48ede8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x55e17c]
cmp byte [eax + 0xa9], 0
jne 0x48ee5a
cmp dword [0x55e194], 0
jne 0x48ee1a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x556dd4]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x55e194], eax
cmp dword [0x55e190], 0
jne 0x48ee35
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x55e190], eax
cmp dword [0x55e198], 0
jne 0x48ee5a
push esp
push 0
push 0
mov eax, dword [0x556dd0]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x55e198], eax
pop edx
ret
Function at 0x48f070
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x48f087
add esp, 0xfffffff0
call fcn.004044d0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043f474
mov eax, dword [0x5579e8]
cmp byte [eax], 0
jne 0x48f0b4
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x557d6c]
cmp word [eax + 2], 0
jne 0x48f0ce
mov eax, dword [0x557d6c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0049102c
mov eax, dword [0x557e98]
cmp word [eax + 2], 0
jne 0x48f0e8
mov eax, dword [0x557e98]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0049123c
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x443924]
call fcn.004453a4
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4916c0
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x44417c]
call fcn.0044b614
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x48f2c4
mov eax, dword [0x557bd0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0044ba18
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x491970
mov dl, 1
mov eax, dword [0x43560c]
call fcn.00404068
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x557bd0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040decc
test eax, eax
je 0x48f1f6
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040dc5c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040deb4
test eax, eax
je 0x48f20e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406640
push ebx
push 0x4909fc
call fcn.0048573c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x5579e8]
cmp byte [eax], 0
jne 0x48f25f
mov eax, ebx
call fcn.0048f438
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.00491b98
mov eax, ebx
call fcn.0049275c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48f2bc
call fcn.00404528
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f70c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x48f7ae
cmp dword [ebx + 0x90], 0
jne 0x48f7a8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48f658
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x48f7a8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x48f76e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x48f7a8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00437d5c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48f77d
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48f9cc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x55e17c]
cmp dword [eax + 0x170], 0
je 0x48fb31
test bl, bl
jne 0x48fa7f
cmp dword [esi + 0x98], 0
jne 0x48fa74
mov eax, esi
call fcn.004925ac
push eax
push 0x48f8d8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x48fa45
mov eax, dword [0x55e17c]
cmp byte [eax + 0xcf], 0
je 0x48fa45
mov eax, dword [esi + 0xd4]
call fcn.00407e64
mov edi, eax
cmp edi, 0
jl 0x48fa45
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x48fa2e
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x48fa74
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00437d5c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x48fa54
inc dword [esi + 0x98]
jmp 0x48fb31
cmp dword [esi + 0x98], 0
jle 0x48fb31
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x48fb31
cmp dword [esi + 0x40], 0
je 0x48fadc
mov eax, dword [0x55e17c]
cmp byte [eax + 0xcf], 0
je 0x48fadc
mov eax, dword [esi + 0xd4]
call fcn.00407e64
mov edi, eax
cmp edi, 0
jl 0x48fadc
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x48fac5
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x48fb0b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00437d5c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x48faeb
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x485144]
call fcn.00408024
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4906ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x490757
cmp byte [ebx + 0xcf], 0
jne 0x490757
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406584
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x490744
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x490764
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406448
jmp 0x490764
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00406448
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x491d6c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x491dda
mov eax, esi
call fcn.00478604
test al, al
je 0x491dda
mov eax, dword [ebx + 0x80]
call fcn.00478258
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x491dda
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x491dce
push 0
mov eax, dword [ebx + 0x80]
call fcn.00478258
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0046f858
jmp 0x491dda
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00491bb8
pop esi
pop ebx
ret

Function at 0x493338
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x49337e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004932cc
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493385
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x49338c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4933a5
test al, 0x10
je 0x4933a9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4933d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4933f2
test al, 0x10
je 0x4933f2
test ah, 4
je 0x4933f6
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4933fc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00406430
xor eax, eax
push ebp
push 0x4934f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00406eb0
mov ebx, pe_nt_image_headers32
mov eax, edi
mov ecx, ebx
xor edx, edx
call fcn.00406584
cmp dword [ebp + 0xc], 0
je 0x49347b
mov eax, dword [ebp + 0xc]
call fcn.004064d4
push eax
push ebx
mov eax, edi
call fcn.00406eb8
push eax
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov esi, eax
jmp 0x4934a6
push ebx
mov eax, edi
call fcn.00406eb8
push eax
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
mov esi, eax
test esi, esi
je 0x4934b8
mov eax, dword [edi]
call fcn.004064d4
call fcn.0040dc10
mov esi, eax
mov eax, ebx
sub eax, 8
cmp esi, eax
jl 0x4934c9
cmp ebx, 0x10000
jl 0x4934d4
mov eax, edi
mov edx, esi
call fcn.004067bc
jmp 0x4934db
add ebx, ebx
jmp 0x493434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4934f8
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x4935c4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov word [ebp - 0x10], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x49360e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004064d4
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x493632
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004064d4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
push ebx
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4936a4
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov word [esp], 0
test ebx, ebx
je 0x4936e2
mov eax, ebx
call fcn.004064d4
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x493714
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x493700
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x493714
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.kernel32.dll_GetProfileStringW
cmp word [esp], 0
sete al
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x493ae4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x493b7b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x493b2f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00406584
jmp 0x493b65
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x493b48
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040649c
jmp 0x493b5b
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00493934
mov ebx, eax
test esi, esi
je 0x493b5b
dec esi
jmp 0x493b36
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493b82
lea eax, [ebp - 4]
call fcn.00406438
ret

Function at 0x493f5c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040dfb4
add esp, 0x208
pop ebx
ret

Function at 0x493f88
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040dfb4
add esp, 0x208
pop ebx
ret

Function at 0x49405c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4940db
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4940b7
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x4940b7
lea eax, [ebp - 8]
call fcn.00493f88
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00492ad8
lea eax, [ebp - 4]
mov edx, 0x4940f4
call fcn.00406854
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.00492f04
jmp 0x4940c0
mov eax, esi
xor edx, edx
call fcn.00406448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4940e2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret