joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a43f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [0x4f5508], edi
je 0x49a455
mov eax, 0x10dd
jmp 0x49a4af
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4f5508
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x49a44e
push esi
mov esi, dword [0x4f54fc]
mov dword [0x4f5504], edi
mov dword [0x4f5518], edi
mov dword [0x4f5514], edi
mov dword [0x4f550c], edi
mov dword [0x4f5510], edi
jmp 0x49a4a8
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x49a493
xor eax, eax
pop esi
pop edi
leave
ret

Function at 0x49a4b2
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4f5508], eax
je 0x49a4cb
mov eax, 0x10dd
leave
ret
push esi
mov esi, dword [0x4f5518]
push edi
test esi, esi
je 0x49a52b
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], 0
jne 0x49a51b
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x49a51b
push 8
xor eax, eax
mov edx, ebx
and edx, 0xffff0000
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [edx + 8]
mov dword [ebx + 0x18], eax
mov dword [edx + 8], ebx
and dword [esi + 0x10], 0
mov edi, dword [esi]
push esi
call fcn.004a5452
pop ecx
mov esi, edi
test edi, edi
jne 0x49a4d8
pop ebx
and dword [0x4f5518], 0
call fcn.0049a19b
mov esi, dword [0x4f5514]
test esi, esi
je 0x49a559
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004a5452
pop ecx
mov esi, edi
test edi, edi
jne 0x49a541
and dword [0x4f5514], 0
and dword [0x4f5508], 0
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x49aa00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
test esi, esi
je 0x49ab46
test ebx, ebx
je 0x49ab46
cmp dword [ebp + 0xc], 0
je 0x49ab46
lea ecx, [edi + 2]
test ecx, ecx
js 0x49ab46
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x49ab46
mov ecx, ebx
cmp edi, 2
jle 0x49aacf
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
add eax, eax
shr ebx, 4
movzx eax, byte [ebx + eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
add esi, 3
dec edx
jne 0x49aa70
mov ebx, dword [ebp + 8]
test edi, edi
je 0x49ab33
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
cmp edi, 1
jle 0x49ab18
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
add edx, edx
shr eax, 4
movzx edx, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
movzx eax, byte [esi + 1]
and eax, 0xf
movzx edx, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
jmp 0x49ab30
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], dl
mov word [ecx + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0xc]
mov eax, ecx
sub eax, ebx
pop edi
pop esi
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x49c2e6
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00499a9d
mov ebx, 0x4e2a00
cmp eax, 7
jge 0x49c301
mov ebx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
and dword [ebp - 4], 0
push 0
push 0x18
push ebx
mov edi, str.SEContainer
push edi
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x49c32c
push 8
push 0x18
push ebx
push edi
lea eax, [ebp - 4]
push eax
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49c334
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x49c354
mov esi, str.vc8v7vghw7v278vn2v8239vh29vh890m
push 8
pop ecx
xor eax, eax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp dword [ebp - 0x34], ebx
je 0x49c3c4
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x38]
push eax
push 4
push dword [ebp - 0x34]
xor edi, edi
inc edi
mov dword [ebp - 0x38], edi
call esi
push ebx
lea eax, [ebp - 0x3c]
push eax
push 3
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], edi
call esi
push ebx
push str.aqkeezgxijvlm2op
push edi
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x34]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a545d
leave
ret

Function at 0x49c3d6
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x49c476
cmp dword [ebp + 0xc], 0xffffffff
je 0x49c476
call fcn.0049c2e6
mov dword [ebp - 4], eax
cmp eax, edi
je 0x49c472
mov ecx, dword [ebp + 0x14]
push ebx
push eax
call fcn.0049c334
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x49c466
mov eax, dword [ebp + 0xc]
push esi
test al, 0xf
je 0x49c420
shr eax, 4
lea esi, [eax + 1]
shl esi, 4
jmp 0x49c423
lea esi, [eax + 0x10]
push esi
call fcn.004a481a
push esi
mov edi, eax
push 0
push edi
call fcn.004a63e0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.004a5470
add esp, 0x1c
push esi
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 1
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
mov eax, edi
jmp 0x49c478
xor eax, eax
pop edi
leave
ret
Function at 0x49c47b
Capabilities:
Encrypt or decrypt via wincrypt
Reference public rsa key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [ebp - 4], 0x20
cmp dword [ebp + 8], ebx
je 0x49c598
push edi
xor edi, edi
call fcn.0049c2e6
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x49c58a
lea ecx, [ebp - 8]
push ecx
push ebx
push ebx
push 0x94
push 0x4d0ea8
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x49c575
push esi
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 1
push ebx
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
je 0x49c560
push dword [ebp - 0xc]
call fcn.004a481a
push dword [ebp - 4]
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.004a5470
add esp, 0x10
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 1
push ebx
push dword [ebp - 8]
call esi
test eax, eax
je 0x49c54c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], ecx
test ecx, 0xfffffffe
jbe 0x49c569
mov eax, edi
mov cl, byte [eax + ecx - 1]
mov dl, byte [esi + edi]
mov byte [esi + edi], cl
mov ecx, dword [ebp - 4]
mov byte [eax + ecx - 1], dl
mov ecx, dword [ebp - 4]
mov edx, ecx
inc esi
shr edx, 1
dec eax
cmp esi, edx
jb 0x49c52a
xor ebx, ebx
jmp 0x49c569
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], 0xfffffff5
call fcn.004a5452
pop ecx
xor edi, edi
jmp 0x49c569
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xfffffff4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop esi
jmp 0x49c57e
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xfffffff3
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x49c593
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xfffffff2
mov eax, edi
pop edi
jmp 0x49c5a3
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xfffffff6
xor eax, eax
pop ebx
leave
ret
Function at 0x4a0510
Capabilities:
Enumerate process modules

Disassembly:
push 0x444
mov eax, 0x4c3847
call fcn.004ac3e5
mov eax, dword [ebp + 8]
mov esi, ecx
push 0x2801
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], 0x2800
call fcn.004a481a
pop ecx
lea ecx, [ebp - 0x444]
push ecx
mov ecx, dword [ebp - 0x444]
inc ecx
push ecx
push eax
push esi
mov dword [ebp - 0x44c], eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4a0616
and dword [ebp - 0x440], 0
test dword [ebp - 0x444], 0xfffffffc
jbe 0x4a0616
mov ecx, dword [ebp - 0x440]
push 0x208
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x44c]
push dword [eax + ecx*4]
push dword [ebp - 0x448]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
cmp eax, 4
jbe 0x4a05fb
lea eax, [ebp + eax*2 - 0x428]
push str..tmp
push eax
call fcn.004a6dda
pop ecx
pop ecx
test eax, eax
jne 0x4a05fb
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x43c]
call fcn.00409d45
mov edi, dword [ebp - 0x450]
and dword [ebp - 4], 0
lea ebx, [ebp - 0x43c]
call fcn.00407b75
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
mov esi, ebx
call fcn.0040a3ed
mov eax, dword [ebp - 0x444]
inc dword [ebp - 0x440]
shr eax, 2
cmp dword [ebp - 0x440], eax
jb 0x4a0581
push dword [ebp - 0x44c]
call fcn.004a5452
pop ecx
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004ac468
ret
Function at 0x4a1ac3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, str.Unknown
call fcn.00499a9d
cmp eax, 6
jg 0x4a1b39
je 0x4a1b32
cmp eax, 0xfffffc18
je 0x4a1b2b
cmp eax, 1
je 0x4a1b24
cmp eax, 2
je 0x4a1b1d
cmp eax, 3
je 0x4a1b16
cmp eax, 4
je 0x4a1b0f
cmp eax, 5
jne 0x4a1b6f
mov esi, str.Windows_XP_SP3
jmp 0x4a1b6f
mov esi, str.Windows_XP_SP2
jmp 0x4a1b6f
mov esi, str.Windows_XP_SP1
jmp 0x4a1b6f
mov esi, str.Windows_XP
jmp 0x4a1b6f
mov esi, str.Windows_2000
jmp 0x4a1b6f
mov esi, str.Old_Windows
jmp 0x4a1b6f
mov esi, str.Windows_2003
jmp 0x4a1b6f
sub eax, 7
je 0x4a1b6a
dec eax
je 0x4a1b63
dec eax
je 0x4a1b5c
dec eax
je 0x4a1b55
sub eax, 0x3de
jne 0x4a1b6f
mov esi, str.Windows_Newest
jmp 0x4a1b6f
mov esi, str.Windows_7
jmp 0x4a1b6f
mov esi, str.Windows_Vista_SP2
jmp 0x4a1b6f
mov esi, str.Windows_Vista_SP1
jmp 0x4a1b6f
mov esi, str.Windows_Vista
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.004a63e0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x29
push dword [ebp - 0x10c]
mov eax, esi
push 0x2e
push dword [ebp - 0x110]
push 0x2e
push dword [ebp - 0x114]
push edi
call fcn.00412af6
push eax
mov eax, 0x4ddad4
call fcn.00412af6
pop ecx
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
call fcn.00412ee6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
call fcn.00412ee6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
call fcn.00412ee6
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.004a545d
leave
ret
Function at 0x4a1c02
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x24], 0x20
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 8]
add eax, 0xfffff
shr eax, 0x14
push eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffff
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffff
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffff
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffff
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffff
shr eax, 0x14
push eax
push dword [ebp - 0x20]
mov esi, ebx
call fcn.004a2463
push eax
mov eax, str.__memory_in_use.
call fcn.00412af6
push eax
mov edi, str._r_n
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_physical_memory.
call fcn.00412af6
push eax
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_physical_memory_free.
call fcn.00412af6
push eax
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_paging_file.
call fcn.00412af6
push eax
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_paging_file_free.
call fcn.00412af6
push eax
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_user_address_space.
call fcn.00412af6
push eax
mov eax, edi
call fcn.00412af6
add esp, 0xc
mov esi, eax
call fcn.004a2463
push eax
mov eax, str._MBytes_user_address_space_free.
call fcn.00412af6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.004a545d
leave
ret

Function at 0x4a1d51
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 0x2801
mov dword [ebp - 8], 0x2800
call fcn.004a481a
mov ebx, eax
pop ecx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
inc eax
push eax
push ebx
push dword [esi]
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4a1dbb
xor edi, edi
test dword [ebp - 8], 0xfffffffc
jbe 0x4a1dbb
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + edi*4]
lea edx, [ebp - 0x10]
mov dword [ebp - 0xc], eax
call fcn.004a1dc2
push eax
mov eax, 0x4de2b8
call fcn.00412af6
mov eax, dword [ebp - 8]
inc edi
shr eax, 2
pop ecx
cmp edi, eax
jb 0x4a1d8e
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret
Function at 0x4a2142
Capabilities:
Enumerate processes

Disassembly:
push 0x298
mov eax, 0x4c480a
call fcn.004ac3e5
mov eax, dword [ebp + 8]
push 0x228
mov dword [ebp - 0x29c], eax
xor ebx, ebx
lea eax, [ebp - 0x294]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 0x298], 0x22c
call fcn.004a63e0
add esp, 0xc
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4a22ae
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x274]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x48]
call fcn.00412e4d
add esp, 0xc
push dword [ebp - 0x290]
mov edi, eax
push dword [ebp - 0x29c]
mov eax, str._____
call fcn.00412af6
pop ecx
mov esi, eax
call fcn.004a2463
pop ecx
push eax
mov eax, 0x4e3490
call fcn.00412af6
pop ecx
push eax
mov eax, edi
call fcn.00412a1f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040a0a5
cmp dword [ebp - 0x290], ebx
je 0x4a228a
push dword [ebp - 0x290]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2a4], eax
cmp eax, ebx
je 0x4a228a
mov edx, eax
lea ecx, [ebp - 0x64]
call fcn.004a18dd
mov ecx, 0xfde9
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], ebx
call fcn.00412ebd
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040a3ed
cmp dword [ebp - 0x1c], ebx
je 0x4a2273
push dword [ebp - 0x29c]
mov eax, 0x4ddad4
call fcn.00412af6
pop ecx
push eax
lea eax, [ebp - 0x2c]
call fcn.00412a1f
pop ecx
push eax
mov eax, 0x4e349c
call fcn.00412af6
pop ecx
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040a0a5
push dword [ebp - 0x29c]
mov eax, 0x4de2b8
call fcn.00412af6
pop ecx
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4a2196
push dword [ebp - 0x2a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x29c]
call fcn.004ac468
ret
Function at 0x4a249b
Capabilities:
Get graphical window text

Disassembly:
push 0x42c
mov eax, 0x4c37ab
call fcn.004ac3e5
mov eax, dword [ebp + 8]
mov dword [ebx], eax
lea edi, [ebx + 4]
push 0xf
xor ecx, ecx
pop eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ecx
mov dword [ebp - 0x438], ebx
mov byte [edi], cl
mov dword [ebp - 4], ecx
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], ecx
mov byte [ebx + 0x20], cl
xor eax, eax
mov dword [ebx + 0x50], 7
mov dword [ebx + 0x4c], ecx
mov word [ebx + 0x3c], ax
mov dword [ebx + 0x64], ecx
mov dword [ebx + 0x68], ecx
mov dword [ebx + 0x6c], ecx
mov byte [ebp - 4], 3
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [ebx + 0x60], al
lea eax, [ebx + 0x58]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebx + 0x5c], eax
mov esi, 0x80
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x434]
call fcn.00412e4d
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 4
call fcn.0040e7a3
push 0
push 1
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 3
call fcn.0040a0a5
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x434]
call fcn.00412e4d
add esp, 0xc
mov esi, eax
lea edi, [ebx + 0x20]
mov byte [ebp - 4], 5
call fcn.0040e7a3
xor esi, esi
push esi
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x434]
call fcn.0040a0a5
push dword [ebx + 0x58]
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x4a260e
push 0x104
lea eax, [ebp - 0x418]
push eax
push esi
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4a2607
lea eax, [ebp - 0x418]
push 0x5c
push eax
call fcn.004aa6ee
pop ecx
cmp eax, esi
pop ecx
lea esi, [eax + 2]
jne 0x4a25f6
lea esi, [ebp - 0x418]
push esi
call fcn.004a5eb4
pop ecx
mov ecx, esi
lea esi, [ebx + 0x3c]
call fcn.00409cca
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.004ac468
ret 4
Function at 0x4a2618
Capabilities:
Enumerate gui resources

Disassembly:
push 0x23c
mov eax, 0x4c57f5
call fcn.004ac3e5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
xor ebx, ebx
cmp ecx, ebx
je 0x4a27ff
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
push SysReAllocString
push 0x7c
lea edx, [ebp - 0x244]
mov dword [ebp - 4], ebx
call fcn.004134a2
pop ecx
pop ecx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
lea eax, [ebp - 0x230]
push eax
push 0x4a286d
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x4a26c0
cmp dword [ebp - 0x230], ebx
je 0x4a26a9
push dword [ebp - 0x230]
call fcn.004a5452
pop ecx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
jmp 0x4a27f4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x22c]
sub eax, dword [ebp - 0x230]
xor edi, edi
sar eax, 2
test eax, eax
je 0x4a278a
mov eax, dword [ebp - 0x240]
sub eax, dword [ebp - 0x244]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], ebx
jbe 0x4a2776
mov esi, dword [ebp - 0x244]
cmp dword [esi + 0x14], 8
jb 0x4a2729
mov ecx, dword [esi]
jmp 0x4a272b
mov ecx, esi
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + edi*4]
add eax, 0x3c
cmp dword [eax + 0x14], 8
jb 0x4a273f
mov eax, dword [eax]
push ecx
push eax
call fcn.004a6dda
pop ecx
pop ecx
test eax, eax
je 0x4a275a
inc ebx
add esi, 0x1c
cmp ebx, dword [ebp - 0x234]
jb 0x4a271f
jmp 0x4a2774
mov eax, dword [ebp - 0x230]
push 0
push dword [eax + edi*4]
lea eax, [ebp - 0x220]
push eax
call fcn.004a28c5
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 0x22c]
sub eax, dword [ebp - 0x230]
inc edi
sar eax, 2
cmp edi, eax
jb 0x4a2711
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x218]
mov edi, dword [ebp - 0x248]
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 0x218]
push eax
mov ebx, str.wndinfo.txt
call fcn.004a30f1
lea eax, [ebp - 0x214]
pop ecx
cmp dword [ebp - 0x218], eax
je 0x4a27cc
push dword [ebp - 0x218]
call fcn.004a5f5b
pop ecx
xor esi, esi
cmp dword [ebp - 0x230], esi
je 0x4a27e2
push dword [ebp - 0x230]
call fcn.004a5452
pop ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
lea ebx, [ebp - 0x244]
call fcn.004083a6
call fcn.004ac468
ret
Function at 0x4a30f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4f06b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [edi + 4]
lea esi, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x24]
push ebx
push ecx
call fcn.004a33a0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
push 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x1e
lea eax, [ebp - 0x24]
push eax
push dword [edi]
call esi
push 0
lea eax, [ebp - 0x30]
push eax
movzx eax, word [ebp - 0xa]
push eax
push ebx
push dword [edi]
call esi
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x12]
push dword [ebp - 0x28]
push dword [edi]
call esi
push dword [ebp - 0x28]
call fcn.004a5f5b
pop ecx
lea esi, [edi + 8]
lea eax, [ebp - 0x3c]
call fcn.00413553
movzx ecx, word [ebp - 0xa]
mov edx, dword [ebp - 0x12]
lea eax, [ecx + edx + 0x1e]
add dword [edi + 4], eax
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2c]
lea ecx, [ecx + edx + 0x1e]
add eax, dword [ebp - 0x34]
pop esi
sub eax, ecx
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004a545d
leave
ret