joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456ef8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x456f4d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call fcn.00407f3c
mov ebx, eax
push 9
call fcn.00407f3c
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f54
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x456fc4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x457039
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00456c04
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0043191c
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00408264
cmp dword [ebp - 0x10], 0
je 0x457023
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00408264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457040
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x457048
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4570bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00456c04
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call fcn.00408264
cmp dword [ebp - 0x10], 0
je 0x4570a7
mov eax, dword [ebp - 0x10]
push eax
push 9
call fcn.00408264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570c4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4596a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404e30
push 0
movzx eax, byte [ebp - 2]
push eax
call fcn.00408164
shl eax, 0x10
test eax, eax
je 0x4596ee
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call fcn.00407f8c
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004050a0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e818
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45e94b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call fcn.00407fac
mov dl, 1
mov eax, dword [0x42b1b0]
call fcn.0042b31c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x45e921
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042b3f8
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004050a0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x45e960
call fcn.00405164
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0042b660
lea ecx, [ebp - 4]
mov edx, 0x45e99c
mov eax, dword [ebp - 0xc]
call fcn.0042bc70
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004106f4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x45e904
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x45e9a8
mov eax, dword [ebp - 8]
push eax
call fcn.00407844
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x5c99e0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e90b
mov eax, dword [ebp - 8]
push eax
call fcn.00407764
ret

Function at 0x45e9f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x45ea3f
push 0x10
call fcn.00407f94
test ax, ax
jge 0x45ea22
add bx, 0x2000
push 0x11
call fcn.00407f94
test ax, ax
jge 0x45ea33
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x45ea3f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x463fcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5d4c84], 0
je 0x464115
push 0x11
call fcn.00407f94
test ax, 0x8000
setne al
mov edx, dword [0x5cf658]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x464115
mov eax, dword [0x5d4c88]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5d4c84]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4640e4
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5d4c84]
call fcn.0041d08c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4640dc
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x4640dc
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4640dc
mov eax, dword [ebp - 0x14]
call fcn.0046e970
push eax
call fcn.00408124
test eax, eax
je 0x4640dc
push ebp
call fcn.00463f88
pop ecx
test al, al
jne 0x4640dc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.004040ec
test al, al
je 0x4640dc
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.004040ec
cmp byte [ebp - 1], 0
je 0x4640dc
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call fcn.004081cc
test eax, eax
je 0x4640dc
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5d4c88]
call fcn.004636f4
inc edi
dec ebx
jne 0x464031
mov eax, dword [0x5d4c88]
cmp dword [eax + 8], 0
jle 0x4640fc
mov eax, dword [0x5d4c88]
call fcn.004637ac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x464115
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00463dec
pop ecx
test al, al
jne 0x464115
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b80c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call fcn.00407ff4
call fcn.00407400
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0046637c
test ebx, ebx
jne 0x46b85f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.0046b748
mov ebx, eax
test ebx, ebx
je 0x46b94a
cmp esi, ebx
je 0x46b888
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x46b89d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x46b8d5
add eax, 0xffffff5f
sub eax, 2
jb 0x46b8ed
dec eax
sub eax, 2
jb 0x46b901
dec eax
sub eax, 2
jb 0x46b8f7
jmp 0x46b90b
add eax, 0xfffffdff
sub eax, 2
jb 0x46b8ed
dec eax
sub eax, 2
jb 0x46b901
dec eax
sub eax, 2
jb 0x46b8f7
jmp 0x46b90b
mov byte [esp + 0x120], 0
jmp 0x46b913
mov byte [esp + 0x120], 2
jmp 0x46b913
mov byte [esp + 0x120], 1
jmp 0x46b913
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call fcn.00407fb4
lea eax, [esp + 0x14]
call fcn.0047b504
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00467b6c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x46b94c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x473e10
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5cf9fc]
cmp byte [eax + 0xc], 0
je 0x473f7d
push 0x8000
call fcn.004079c4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x473f76
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5d4c94], 0
jne 0x473e64
push 0x473f84
call fcn.00407834
mov ebx, eax
push 0x473f8c
push ebx
call fcn.00407844
mov dword [0x5d4c94], eax
cmp dword [0x5c9b28], 0
jne 0x473f5f
push 0x473f9c
call fcn.0040793c
mov dword [0x5c9b28], eax
cmp dword [0x5c9b28], 0
je 0x473f5f
push 0x473fa8
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4c98], eax
push 0x473fb8
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4c9c], eax
push 0x473fcc
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4ca0], eax
push 0x473fe4
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4ca4], eax
push 0x473ffc
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4ca8], eax
push 0x474010
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4cac], eax
push 0x474028
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4cb0], eax
push 0x474040
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4cb4], eax
push 0x47405c
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4cb8], eax
push 0x474068
mov eax, dword [0x5c9b28]
push eax
call fcn.00407844
mov dword [0x5d4cbc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473f7d
mov eax, dword [ebp - 4]
push eax
call fcn.004079c4
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x47b048
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call fcn.00408074
mov edi, eax
test bl, bl
je 0x47b069
test edi, 0x40000
je 0x47b083
test bl, bl
jne 0x47b104
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x47b104
push esi
call fcn.004080fc
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call fcn.00408124
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x47b0b6
push 0
push esi
call fcn.00408314
test bl, bl
je 0x47b0cb
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call fcn.004082cc
jmp 0x47b0da
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call fcn.004082cc
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x47b0eb
cmp byte [esp + 2], 0
je 0x47b104
cmp byte [esp + 2], 0
je 0x47b0fc
push 6
push esi
call fcn.00408314
jmp 0x47b104
push 5
push esi
call fcn.00408314
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x47b3a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call fcn.00407f04
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x47b3ce
mov eax, esp
push eax
push 0x47b370
call fcn.00407edc
jmp 0x47b3e1
mov eax, esp
push eax
push 0x47b350
call fcn.004077bc
push eax
call fcn.00407ed4
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret
Function at 0x47b46c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x47b4c0]
test si, 4
je 0x47b481
or bl, 1
test si, 8
je 0x47b48b
or bl, 4
test si, 1
je 0x47b495
or bl, 8
test si, 2
je 0x47b49f
or bl, 0x10
test si, 0x10
je 0x47b4a9
or bl, 0x20
push 0x12
call fcn.00407f94
test ax, ax
jge 0x47b4b8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x47b4c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x47b500]
push 0x10
call fcn.00407f94
test ax, ax
jge 0x47b4de
or bl, 1
push 0x11
call fcn.00407f94
test ax, ax
jge 0x47b4ed
or bl, 4
test esi, 0x20000000
je 0x47b4f8
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x47b550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call fcn.00407fb4
mov eax, esp
call fcn.0047b504
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x4835f8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x48360a
add esp, 0xfffffff0
call fcn.00404254
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042677c
mov eax, dword [0x5cf1dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x48399c
mov eax, dword [0x5cf1fc]
mov dword [eax + 4], ebx
mov dword [eax], 0x4839a8
mov eax, ebx
call fcn.004839b4
push 0
call fcn.00407f9c
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x7c], eax
push 0
call fcn.00407f54
mov esi, eax
push 0x5a
push esi
call fcn.00407bbc
mov dword [ebx + 0x40], eax
push esi
push 0
call fcn.004081fc
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x47edf0
push eax
push 0
push 0
mov eax, dword [0x5cf518]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x42c574]
call fcn.0042df1c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x42c574]
call fcn.0042df1c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x42c574]
call fcn.0042df1c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00483ebc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x483d44
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x483d44
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x483d44
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x483747
call fcn.004042ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x483b28
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x483cb4
mov dl, 1
mov eax, dword [0x41adf8]
call fcn.00403ec0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404e30
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.00407fa4
dec eax
test eax, eax
jl 0x483ca3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0047416c
test al, al
je 0x483c96
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x483ce4
lea eax, [ebp - 0x254]
call fcn.0040b92c
push eax
push 0x80000002
call fcn.0040766c
test eax, eax
jne 0x483c96
xor eax, eax
push ebp
push 0x483c8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x483d1c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040767c
test eax, eax
jne 0x483c78
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004050a0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x483c78
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004050a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483c96
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407634
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x483b99
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.004201e4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483cda
lea eax, [ebp - 0x260]
call fcn.00404e30
ret

Function at 0x484694
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5d4cd8]
cmp byte [eax + 0xad], 0
jne 0x484705
cmp dword [0x5d4cf4], 0
jne 0x4846c6
call fcn.004077bc
push eax
push 0
mov eax, 0x484650
push eax
push 3
call fcn.004082f4
mov dword [0x5d4cf4], eax
cmp dword [0x5d4cf0], 0
jne 0x4846e1
push 0
push 0
push 0
push 0
call fcn.004076b4
mov dword [0x5d4cf0], eax
cmp dword [0x5d4cf8], 0
jne 0x484705
push esp
push 0
push 0
push 0x4845f4
push 0x3e8
push 0
call fcn.004076d4
mov dword [0x5d4cf8], eax
pop edx
ret
Function at 0x484934
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x48494b
add esp, 0xfffffff0
call fcn.00404254
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042677c
mov eax, dword [0x5cf4e4]
cmp word [eax + 2], 0
jne 0x484973
mov eax, dword [0x5cf4e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0048667c
mov eax, dword [0x5cf6a8]
cmp word [eax + 2], 0
jne 0x48498d
mov eax, dword [0x5cf6a8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00486888
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.00403ec0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42d1d8]
call fcn.00435aa8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x484b44
mov eax, dword [0x5cf2e8]
mov eax, dword [eax]
push eax
call fcn.0040814c
mov edx, eax
mov eax, esi
call fcn.00435e7c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x486f5c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5cf2e8]
mov eax, dword [eax]
push eax
call fcn.0040782c
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call fcn.0040818c
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040f894
test eax, eax
je 0x484a94
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040b2a4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040f8c8
test eax, eax
je 0x484aa8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call fcn.00407d94
push eax
call fcn.00407d5c
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004050a0
mov byte [ebx + 0xd4], 0
push ebx
push 0x486108
call fcn.0042790c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x5cefac]
cmp byte [eax], 0
jne 0x484af9
mov eax, ebx
call fcn.00484c88
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00487170
mov eax, ebx
call fcn.00487cd4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x484b39
call fcn.004042ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484f08
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x484fa7
cmp dword [ebx + 0x94], 0
jne 0x484fa1
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x484e90
call fcn.00407edc
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x484fa1
push 3
mov eax, dword [esp + 4]
push eax
call fcn.00408064
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.00408074
test al, 8
je 0x484f67
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x484fa1
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d08c
push eax
call fcn.004082e4
dec esi
cmp esi, 0xffffffff
jne 0x484f76
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4851c0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5d4cd8]
cmp dword [eax + 0x30], 0
je 0x48531d
test bl, bl
jne 0x48526e
cmp dword [esi + 0x9c], 0
jne 0x485263
mov eax, esi
call fcn.00487b50
push eax
push 0x4850ec
call fcn.00407edc
cmp dword [esi + 0x44], 0
je 0x485234
mov eax, dword [0x5d4cd8]
call fcn.00488230
test al, al
je 0x485234
mov eax, dword [0x5d4cfc]
call fcn.00406474
mov edi, eax
cmp edi, 0
jl 0x485234
push 0
mov eax, dword [0x5d4cfc]
mov eax, dword [eax + edi*4]
push eax
call fcn.00408314
dec edi
cmp edi, 0xffffffff
jne 0x48521e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x485263
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041d08c
push eax
call fcn.00408304
dec edi
cmp edi, 0xffffffff
jne 0x485243
inc dword [esi + 0x9c]
jmp 0x48531d
cmp dword [esi + 0x9c], 0
jle 0x48531d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x48531d
cmp dword [esi + 0x44], 0
je 0x4852c9
mov eax, dword [0x5d4cd8]
call fcn.00488230
test al, al
je 0x4852c9
mov eax, dword [0x5d4cfc]
call fcn.00406474
mov edi, eax
cmp edi, 0
jl 0x4852c9
push 5
mov eax, dword [0x5d4cfc]
mov eax, dword [eax + edi*4]
push eax
call fcn.00408314
dec edi
cmp edi, 0xffffffff
jne 0x4852b3
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4852f8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041d08c
push eax
call fcn.00408304
dec edi
cmp edi, 0xffffffff
jne 0x4852d8
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x5d4cfc
mov ecx, 1
mov edx, dword [0x4850cc]
call fcn.00406628
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x485e04
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x485e6e
mov eax, ebx
call fcn.00488230
test al, al
jne 0x485e6e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call fcn.00408094
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f20
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x485e5b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x485e7b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e84
jmp 0x485e7b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404e84
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x487354
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4873c2
mov eax, esi
call fcn.0046ed10
test al, al
je 0x4873c2
mov eax, dword [ebx + 0x84]
call fcn.0046e970
push eax
call fcn.00408124
test eax, eax
je 0x4873c2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4873b6
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046e970
push eax
call fcn.00408314
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00466764
jmp 0x4873c2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00487190
pop esi
pop ebx
ret