joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8cea
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jne 0x4c8d2f
push reloc.wsock32.dll_getpeername
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x4c8d19
mov eax, 0x760403
push eax
push 1
mov ebx, 0x194
call fcn.006031d0
add esp, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c8d63
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c8d7a
mov eax, 0
jmp 0x4c8dc3
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x4c8d98
add eax, 8
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [0x7ad2e1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4c8dbb
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x4c8dc3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4cd09a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4cd0df
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4cd10a
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4cd126
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4cd12b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4cd13c
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4d01ea
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0x13
call dword [0x7ad2ed]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4d022d
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp + 8], 1
jne 0x4d0265
mov dword [ebp - 4], esp
push 0
push 4
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4d0260
push 6
call fcn.005fffca
add esp, 4
jmp 0x4d028e
mov dword [ebp - 4], esp
push 0
push 0
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4d028e
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x4d02bd
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x10
call fcn.005fffc4
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 8], esp
push 0
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4d031c
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_GetWindowRect]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4d0344
push 6
call fcn.005fffca
add esp, 4
test eax, eax
je 0x4d0389
mov ebx, dword [ebp - 4]
add ebx, 0xc
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 8]
fild dword [ebx]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
fild dword [ebx]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004c58cd
jmp 0x4d0393
mov eax, 0x1e
jmp 0x4d0393
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4d4af4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4d4b37
push 6
call fcn.005fffca
add esp, 4
jmp 0x4d4b3c
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4d7103
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4d7148
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4d7176
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d7192
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4d7197
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4d71a8
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4d74dc
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
call dword [sym.imp.user32.dll_GetForegroundWindow]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4d7512
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4d7543
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4d7565
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4d7592
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], esp
call dword [sym.imp.user32.dll_GetFocus]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4d75b1
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4d75d3
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4d7600
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x4d7608
mov esp, ebp
pop ebp
ret
Function at 0x4d9c81
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 0
push 0x4da236
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4d9cb3
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [0x7ad119]
push eax
mov ebx, eax
call fcn.004c6a80
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.005fffc4
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x4d9d4f
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
push eax
push 0x14
call fcn.005fffc4
add esp, 4
pop esi
mov edi, eax
push eax
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x4d9d20
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x4d9d3f
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x4d9ce7
pop eax
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4d9d70
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4d9d6c
imul eax, dword [ebx]
jmp 0x4d9d61
mov ecx, eax
test ecx, ecx
je 0x4d9db3
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4d9d8e
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4d9da2
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4d9d76
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x7ad119]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4d9de2
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4d9dde
imul eax, dword [ebx]
jmp 0x4d9dd3
mov ecx, eax
test ecx, ecx
je 0x4d9e25
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4d9e00
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x4d9e14
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4d9de8
call fcn.005fffbe
add esp, 4
mov eax, 0x760403
mov dword [0x7ad119], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.004c6a67
jmp 0x4d9e46
mov esp, ebp
pop ebp
ret 8
Function at 0x4da099
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4da0d2
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x760425]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.004c58cd
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4da125
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4da151
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4da16d
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4da172
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4da183
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4db0b3
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [0x7ad121], eax
mov dword [ebp - 4], esp
push dword [0x7ad125]
call dword [sym.imp.user32.dll_UnhookWindowsHookEx]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4db0e9
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], esp
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4db10d
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
push 0x4db217
push 0xd
call dword [sym.imp.user32.dll_SetWindowsHookExA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4db141
push 6
call fcn.005fffca
add esp, 4
mov dword [0x7ad125], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4dc733
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4dc773
push 6
call fcn.005fffca
add esp, 4
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp + 0x18], 0
jne 0x4dc78c
mov ebx, dword [ebp + 0x14]
push dword [ebx]
call fcn.004dc7a5
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
mov eax, 0
setne al
jmp 0x4dc79f
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e18e9
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.kernel32.dll_MoveFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4e191b
push 6
call fcn.005fffca
add esp, 4
jmp 0x4e1920
mov esp, ebp
pop ebp
ret 8

Function at 0x4ebea2
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ebee7
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ebf09
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4ebf36
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetFocus]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ebf58
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ebf7a
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4ebfa7
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], esp
call dword [sym.imp.user32.dll_GetFocus]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4ebfc6
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp - 8], eax
jne 0x4ebfd9
mov eax, 0
jmp 0x4ebfe3
mov eax, 1
jmp 0x4ebfe3
mov esp, ebp
pop ebp
ret 4
Function at 0x4f197b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jne 0x4f19a3
mov dword [ebp + 0xc], 0xffffffff
push 0
mov ebx, 0x308
call sub.kernel32.dll_GetTickCount
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x4bf
push dword [ebp + 0xc]
push 0
lea eax, [ebp + 8]
push eax
push 1
call dword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4f19ed
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0xffffffff
je 0x4f1a48
push 0
mov ebx, 0x308
call sub.kernel32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x24]
fsub qword [ebp - 0x2c]
fcomp qword [0x7604ee]
fnstsw ax
test ah, 1
jne 0x4f1a48
mov dword [ebp - 8], 0x102
push 0
mov ebx, 0x350
call fcn.00604120
add esp, 4
cmp dword [ebp - 8], 0
je 0x4f1a78
cmp dword [ebp - 8], 0x102
je 0x4f1a78
mov eax, 1
jmp 0x4f1a7d
mov eax, 0
test eax, eax
jne 0x4f19b8
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x4f1a96
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4f4fad
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4f4fe5
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4f4fd3
mov al, 1
jmp 0x4f5044
cmp dword [ebx + 0x54], ecx
jne 0x4f4fdc
mov al, 2
jmp 0x4f5044
cmp dword [ebx + 0x7c], ecx
jne 0x4f5044
mov al, 3
jmp 0x4f5044
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4f4ffa
mov al, 4
jmp 0x4f5044
cmp ecx, 5
jne 0x4f501a
cmp ebx, 0
jne 0x4f5008
mov al, 5
jmp 0x4f5044
cmp ebx, 1
jne 0x4f5011
mov al, 6
jmp 0x4f5044
cmp ebx, 2
jne 0x4f501a
mov al, 7
jmp 0x4f5044
cmp ecx, 6
jne 0x4f5042
cmp ebx, 0
jne 0x4f5028
mov al, 8
jmp 0x4f5044
cmp ebx, 1
jne 0x4f502f
mov al, 9
cmp ebx, 2
jne 0x4f5036
mov al, 0xa
cmp ebx, 3
jne 0x4f503d
mov al, 0xb
cmp ebx, 4
jne 0x4f5044
mov al, 0xc
pop ebx
leave
ret
Function at 0x4f71e2
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
jne 0x4f7211
mov dword [ebp + 0xc], 0x400
cmp dword [ebp + 0x18], 0
jne 0x4f7222
mov dword [ebp + 0x14], 0x300
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x760402
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4f724b
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
push 1
push 0x3c
push 1
push dword [ebp + 0x14]
push 1
push dword [ebp + 0xc]
push 1
push 0x20
call fcn.004f73ef
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x67c
call fcn.00603bf0
add esp, 0x10
mov dword [ebp - 0x10], esp
push 0x94cf0000
push 0xfffffff0
push dword [ebp - 4]
call dword [sym.imp.user32.dll_SetWindowLongA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4f72b5
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp + 0x20], 0
jne 0x4f72c6
mov dword [ebp + 0x1c], 0x400
cmp dword [ebp + 0x28], 0
jne 0x4f72d7
mov dword [ebp + 0x24], 0x300
push 0
mov ebx, 0x2d4
call fcn.00607db0
add esp, 4
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp + 0x1c]
fstp qword [ebp - 0x20]
fsub qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fdiv qword [0x76041d]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.004c58cd
mov dword [ebp - 8], eax
push 0
mov ebx, 0x2d8
call fcn.00607dc0
add esp, 4
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp + 0x24]
fstp qword [ebp - 0x20]
fsub qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fdiv qword [0x76041d]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.004c58cd
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.user32.dll_MoveWindow]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4f738c
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], esp
push 0x760402
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4f73b5
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push 0
push 0x1f5
push 0x312
push dword [ebp - 0x14]
call dword [0x7ad345]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4f73e9
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 0x24

Function at 0x4f7ba4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4f7be4
push 6
call fcn.005fffca
add esp, 4
jmp 0x4f7be9
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4f84e6
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4f852b
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4f8542
mov eax, 0x760402
push eax
push 1
mov ebx, 0x130
call fcn.006015a0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_GetUserNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4f857e
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f85ac
mov eax, dword [ebp - 4]
test eax, eax
je 0x4f85a7
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4f85b6
mov eax, 0x760402
jmp 0x4f85b6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4f85c7
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x4fd9bb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.kernel32.dll_DeleteFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4fd9e8
push 6
call fcn.005fffca
add esp, 4
jmp 0x4fd9ed
mov esp, ebp
pop ebp
ret 4
Function at 0x4fde34
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x1c
call fcn.005fffc4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
push 4
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4fde8f
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4fdfb5
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
push ebx
call fcn.005fffbe
add esp, 4
mov eax, 0x760403
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x1c
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_Thread32First]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4fdee8
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4fdfb5
mov ebx, dword [ebp - 8]
add ebx, 0xc
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
cmp dword [ebx], eax
jne 0x4fdf88
mov ebx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
push 4
mov eax, 2
call fcn.006010d0
add esp, 8
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
mov dword [ebp - 0x18], ebx
call fcn.004c6a80
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp - 0x18]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x4fdf5b
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x18]
call fcn.005fffe2
add esp, 8
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x1c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_Thread32Next]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4fdfad
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x4fdeeb
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
call dword [0x7ad2f9]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4fdfd7
push 6
call fcn.005fffca
add esp, 4
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
call fcn.004c6a67
jmp 0x4fdfe6
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8