joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f21e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 3
push esi
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x1fa0
call fcn.0053f875
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
cmp edi, esi
jne 0x4af703
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4af6e7
and eax, 0xffff
or eax, 0x80070000
push str.hFile
push eax
lea ecx, [ebp - 0x3c]
call fcn.00434a80
push 0x5cc0a0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00554cbc
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x8c]
call fcn.004ac160
mov byte [ebp - 4], 2
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, 0xfd0
sub eax, esi
add eax, eax
push eax
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + esi*2]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov ebx, eax
shr ebx, 1
add ebx, esi
add dword [ebp - 0x24], eax
test eax, eax
je 0x4af7dd
xor esi, esi
mov dword [ebp - 0x14], esi
lea esp, [esp]
mov edi, ebx
sub edi, esi
mov eax, dword [ebp - 0x18]
lea eax, [eax + esi*2]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push eax
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xffffffff
je 0x4af7a5
test eax, eax
je 0x4af7d0
add esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
jb 0x4af7cc
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x4af7d0
lea eax, [edi + edi]
cmp eax, 0xfd0
ja 0x4af79e
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0xfd0
mov edx, dword [ebp - 0x18]
push edx
call fcn.00554d08
add esp, 0x10
mov esi, edi
mov dword [ebp - 0x14], esi
jmp 0x4af7d0
test eax, eax
jg 0x4af760
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], 0
jne 0x4af722
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.004abd00
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4af807
push eax
call fcn.005559df
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4af834
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2ac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push esi
mov esi, ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x364]
push edi
push ecx
call ebx
lea edx, [ebp - 0x4c]
mov edi, eax
push edx
push edi
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov eax, dword [esi + 0x364]
push edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x364]
push 0x400
lea eax, [ebp - 0x84c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 8]
cdq
sub eax, edx
mov edx, dword [esi + 0x374]
mov edi, eax
push edx
sar edi, 1
call ebx
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov dword [ebp + 0x14], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov edx, dword [ebp + 0x14]
mov eax, dword [esi + 0x374]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x374]
push 0x400
lea eax, [ebp - 0x84c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [0x5f7bf0], 0
jne 0x4b2c71
mov edx, dword [esi + 0x370]
push edx
call ebx
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov dword [ebp + 0x14], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov edx, dword [ebp + 0x14]
mov eax, dword [esi + 0x370]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x370]
push 0x400
lea eax, [ebp - 0x84c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 0x40
push 0x19
push eax
sub eax, edi
add edx, 0xffffffe7
push edx
dec eax
push eax
mov eax, dword [esi + 0x370]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0x368]
push ecx
call ebx
lea edx, [ebp - 0x4c]
mov ebx, eax
push edx
push ebx
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov eax, dword [esi + 0x368]
push ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x368]
push 0x400
lea eax, [ebp - 0x84c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push 0x40
push 0x17
lea edx, [eax - 1]
push edx
mov edx, dword [esi + 0x368]
add ecx, 0xffffffe8
push ecx
sub eax, edi
add eax, 0xa
push eax
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b2e10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x368]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x18]
push ecx
push edx
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push eax
push ecx
lea edx, [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x4b2e9f
mov ecx, dword [0x5fd7c0]
push 0x80
lea eax, [ebp - 0x118]
push eax
push 0x108
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
push 0
push 0
lea edx, [ebp - 0x118]
push edx
push 0x59bf70
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 0x370]
lea ecx, [ebp - 0x18]
push ecx
push edx
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
push ecx
lea edx, [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x4b2e8b
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b4ed0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f9c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CSNView.1.0
mov dword [esi + 0x50], vtable.CSNView.0
mov dword [ebp - 4], 7
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x358], ebx
jbe 0x4b4f3e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, dword [esi + 0x358]
jae 0x4b5041
mov eax, dword [esi + 0x354]
lea eax, [eax + edi*4]
mov eax, dword [eax]
push eax
call ebx
inc edi
cmp edi, dword [esi + 0x358]
jb 0x4b4f25
xor ebx, ebx
mov byte [ebp - 4], 6
lea ecx, [esi + 0x354]
call fcn.00432860
mov byte [ebp - 4], 5
lea ecx, [esi + 0x344]
call fcn.004b4d50
mov byte [ebp - 4], 4
lea ecx, [esi + 0x2f8]
call fcn.00494560
mov cl, 3
mov byte [ebp - 4], cl
lea eax, [esi + 0x2b4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], cl
mov eax, dword [eax]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4f9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x2a4]
cmp eax, ebx
je 0x4b4fb9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, ebx
je 0x4b4fb9
mov dword [esi + 0x2a4], ebx
mov byte [ebp - 4], 1
lea ecx, [esi + 0x26c]
call fcn.0044fc90
mov byte [ebp - 4], 0
lea ecx, [esi + 0x50]
call fcn.004f9fe0
mov dword [ebp - 4], 9
lea edi, [esi + 0x24]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xb
mov eax, dword [edi + 0x1c]
cmp eax, ebx
je 0x4b4ff8
push eax
call fcn.00554c82
add esp, 4
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov byte [ebp - 4], 9
push fcn.00419b10
push 2
push 4
add edi, 8
push edi
call fcn.00555d39
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
lea eax, [esi + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0xc]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x4b5033
push eax
call fcn.00552eea
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401150
int3
Function at 0x4b68b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fc33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 3
push esi
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x1fa0
call fcn.0053f875
add esp, 4
mov ebx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
cmp edi, esi
jne 0x4b6945
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4b6929
and eax, 0xffff
or eax, 0x80070000
push str.hFile
push eax
lea ecx, [ebp - 0x3c]
call fcn.00434a80
push 0x5cc0a0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00554cbc
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x90]
call fcn.004b4e70
mov byte [ebp - 4], 2
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, 0x1fa0
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add esi, eax
mov dword [ebp - 0x28], esi
add dword [ebp - 0x24], eax
test eax, eax
je 0x4b6a19
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x4b69a3
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
sub edi, esi
add ebx, esi
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push ebx
lea ecx, [ebp - 0x90]
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xffffffff
je 0x4b69e3
test eax, eax
je 0x4b6a09
add esi, eax
mov dword [ebp - 0x14], esi
cmp esi, dword [ebp - 0x28]
jb 0x4b6a05
xor esi, esi
mov dword [ebp - 0x14], esi
jmp 0x4b6a09
cmp edi, 0x1fa0
ja 0x4b69dc
push edi
push ebx
push 0x1fa0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00554d08
add esp, 0x10
mov esi, edi
mov dword [ebp - 0x14], esi
jmp 0x4b6a09
test eax, eax
jg 0x4b69a0
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x2c], 0
jne 0x4b6967
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.004b4d70
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4b6a3c
push ebx
call fcn.005559df
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b6a69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8ef0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x2cc8]
mov edx, dword [esi + 0x2ccc]
xor edi, edi
push edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esi + 0x2cd0]
mov dword [eax + 4], edx
mov edx, dword [esi + 0x2cd4]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x2cc4]
mov dword [eax + 0xc], edx
call fcn.00412290
mov eax, dword [esi + 0x2d0c]
cmp eax, edi
je 0x4b8f48
cmp eax, 0xffffffff
je 0x4b8f48
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [esi + 0x2cf0]
cmp eax, edi
je 0x4b8f5c
add eax, 4
jmp 0x4b8f5e
xor eax, eax
mov ecx, dword [esi + 0x2cd8]
mov dword [ebp - 0x30], eax
cmp ecx, edi
je 0x4b8f73
add ecx, 4
mov dword [ebp - 0x2c], ecx
jmp 0x4b8f76
mov dword [ebp - 0x2c], edi
mov ecx, dword [esi + 0x2d00]
cmp ecx, edi
je 0x4b8f88
add ecx, 4
mov dword [ebp - 0x28], ecx
jmp 0x4b8f8b
mov dword [ebp - 0x28], edi
mov ecx, dword [esi + 0x2ce4]
cmp ecx, edi
je 0x4b8f9d
add ecx, 4
mov dword [ebp - 0x24], ecx
jmp 0x4b8fa0
mov dword [ebp - 0x24], edi
mov ecx, dword [esi + 0x2d04]
cmp ecx, edi
je 0x4b8fb2
add ecx, 4
mov dword [ebp - 0x20], ecx
jmp 0x4b8fb5
mov dword [ebp - 0x20], edi
mov ecx, dword [esi + 0x2cec]
cmp ecx, edi
je 0x4b8fc7
add ecx, 4
mov dword [ebp - 0x1c], ecx
jmp 0x4b8fca
mov dword [ebp - 0x1c], edi
mov ecx, dword [esi + 0x2ce8]
cmp ecx, edi
je 0x4b8fdc
add ecx, 4
mov dword [ebp - 0x18], ecx
jmp 0x4b8fdf
mov dword [ebp - 0x18], edi
mov ecx, dword [esi + 0x2ce0]
cmp ecx, edi
je 0x4b8ff1
add ecx, 4
mov dword [ebp - 0x14], ecx
jmp 0x4b8ff4
mov dword [ebp - 0x14], edi
mov ecx, dword [esi + 0x2cfc]
cmp ecx, edi
je 0x4b9006
add ecx, 4
mov dword [ebp - 0x10], ecx
jmp 0x4b9009
mov dword [ebp - 0x10], edi
mov ecx, dword [esi + 0x2cf4]
cmp ecx, edi
je 0x4b901b
add ecx, 4
mov dword [ebp - 0xc], ecx
jmp 0x4b901e
mov dword [ebp - 0xc], edi
mov ecx, dword [esi + 0x2cf8]
cmp ecx, edi
je 0x4b9030
add ecx, 4
mov dword [ebp - 8], ecx
jmp 0x4b9033
mov dword [ebp - 8], edi
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], edi
cmp eax, edi
je 0x4b905b
mov ecx, dword [eax]
push 0
push 0
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov eax, dword [ebp + edi*4 - 0x2c]
inc edi
test eax, eax
jne 0x4b9040
mov edx, dword [esi + 0x2d48]
mov eax, dword [edx + 4]
push 0
push esi
push 0x53b
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 0x2d68]
push ecx
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b9aa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x4b9ad4
push edi
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x4b9ad4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x1fe]
push edx
mov word [ebp - 0x200], cx
call fcn.00555020
mov ecx, dword [esi + 4]
add esp, 0xc
push 0x109
lea eax, [ebp - 0x200]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x2d18]
jne 0x4b9b27
mov ecx, dword [esi + 0x2cdc]
push edi
call fcn.004a6a50
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d1c]
jne 0x4b9b43
mov ecx, dword [esi + 0x2ce0]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d20]
jne 0x4b9b5f
mov ecx, dword [esi + 0x2cd8]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d24]
jne 0x4b9b7b
mov ecx, dword [esi + 0x2d04]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d28]
jne 0x4b9b97
mov ecx, dword [esi + 0x2ce4]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d3c]
jne 0x4b9bb3
mov ecx, dword [esi + 0x2cf4]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d40]
jne 0x4b9bcf
mov ecx, dword [esi + 0x2cf8]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d30]
jne 0x4b9beb
mov ecx, dword [esi + 0x2cfc]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, dword [esi + 0x2d14]
jne 0x4b9c07
mov ecx, dword [esi + 0x2d00]
push edi
call fcn.004e5f30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4bad10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58ffaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], edi
mov dword [ebp - 4], 1
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
or ebx, 0xffffffff
lea ecx, [esi + 0x30]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
call fcn.004a3030
mov byte [ebp - 4], 5
mov dword [esi + 0x40], edi
mov byte [ebp - 4], 6
mov dword [esi + 0x44], edi
mov byte [ebp - 4], 7
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x98], edi
lea ecx, [esi + 0x50]
mov dword [esi + 0x9c], edi
mov edi, dword [sym.imp.USER32.dll_SetRectEmpty]
push ecx
call edi
lea edx, [esi + 0x80]
push edx
call edi
lea eax, [esi + 0x60]
push eax
call edi
lea ecx, [esi + 0x70]
push ecx
call edi
or dword [esi + 0xac], 0xa808
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4bb2f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5860e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 4], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], edi
mov dword [ebp - 4], 1
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
mov dword [esi], vtable.CbannerWnd.0
mov edx, dword [0x5f5774]
mov eax, dword [edx + 0xc]
lea ebx, [esi + 0x24]
mov ecx, 0x5f5774
mov dword [ebp - 0x14], ebx
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 6
mov edx, dword [0x5f5774]
mov eax, dword [edx + 0xc]
lea ebx, [esi + 0x28]
mov ecx, 0x5f5774
mov dword [ebp - 0x14], ebx
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 8
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4be440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583a78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x4be489
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebp + 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jle 0x4be5d9
push esi
push 0x30
lea edx, [ebp - 0x40]
push 0
push edx
call fcn.00555020
push 0x110
lea eax, [ebp - 0x150]
push 0
push eax
mov dword [ebp - 0x40], 0x30
call fcn.00555020
add esp, 0x18
lea ecx, [ebp - 0x154]
push ecx
mov dword [ebp - 0x154], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4be504
mov eax, dword [ebp - 0x150]
cmp eax, 5
jae 0x4be50b
cmp eax, 4
jne 0x4be504
cmp dword [ebp - 0x14c], 0x5a
jae 0x4be50b
mov dword [ebp - 0x40], 0x2c
lea eax, [ebp - 0x40]
push eax
push 1
push edi
lea edx, [ebp - 0x21c]
push ebx
mov dword [ebp - 0x18], 0x64
mov dword [ebp - 0x3c], 0x3f
mov dword [ebp - 0x1c], edx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test dword [ebp - 0x38], 0x100
jne 0x4be5c8
push 0x10
call fcn.0055549a
mov esi, eax
add esp, 4
test esi, esi
je 0x4be5c8
mov eax, dword [ebp - 0x38]
or eax, 0x100
mov dword [ebp - 0x38], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x34]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4be570
add ecx, 0xfffffedc
jmp 0x4be572
xor ecx, ecx
push esi
lea edx, [ebp - 0x40]
push edx
call fcn.004b9450
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0053f875
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x4be5b7
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x40]
push edx
push 1
push edi
push ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push ebx
inc edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp edi, eax
jl 0x4be4a6
pop esi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x10]
push eax
add ecx, 0x20
mov dword [ebp + 0x10], ebx
call fcn.00425c60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c1d40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590b21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0x10]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], ebx
mov dword [ebp - 4], 1
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x28], eax
mov dword [ebp - 4], 3
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [ebp - 4], 5
mov byte [esi + 0x3c], bl
mov dword [ebp - 4], 6
lea edi, [esi + 0x40]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004be610
mov byte [ebp - 4], 7
mov dword [edi + 0xc0], ebx
mov eax, 0x10
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], eax
mov eax, 1
mov dword [edi + 0xcc], 0x18
mov dword [edi + 0xd0], eax
mov byte [edi + 0xd4], al
mov byte [ebp - 4], 8
mov cl, byte [ebp + 8]
mov dl, byte [ebp + 0xc]
mov dword [esi], vtable.CTabbedFrameImpl_class_CSpyChildFrame__class_CDotNetTabCtrl_class_CTabViewTabItem___class_CTabbedMDIChildWindowImpl_class_CSpyChildFrame__class_WTL::CMDIWindow__class_ATL::CWinTraits_1473183744__64___.0
mov byte [esi + 0x118], cl
mov byte [esi + 0x119], dl
mov dword [esi + 0x11c], 0x4002
mov dword [esi + 0x120], ebx
mov dword [esi + 0x110], eax
mov byte [esi + 0x114], al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c2e80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4c2edf
mov edx, dword [ecx + 0x44]
cmp edx, dword [eax]
jne 0x4c2edf
mov eax, dword [ecx + 0x64]
test eax, eax
js 0x4c2edf
cmp eax, dword [ecx + 0x74]
jb 0x4c2ea1
xor eax, eax
jmp 0x4c2ea7
mov edx, dword [ecx + 0x70]
mov eax, dword [edx + eax*4]
push esi
mov esi, dword [eax + 0x24]
test esi, esi
je 0x4c2ede
push edi
mov edi, dword [ecx + 0x120]
cmp esi, edi
je 0x4c2edd
push 0
push 1
mov dword [ecx + 0x120], esi
call fcn.004bfc30
test edi, edi
je 0x4c2ed6
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0xc