joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a4c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
inc eax
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x1000a513
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1000a518
jmp 0x10009e6b
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000a55f
lea eax, [ebp - 0x714]
push eax
call fcn.100084d9
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1000848e
add esp, 0xc

Function at 0x1000a687
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
je 0x1000a68d
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.100084c9
jno 0x1000a705
and al, 0x3e
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100084c9
mov ebp, 0x491062fb
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
je 0x1000a711
cmp dword [esi], eax
jne 0x1000a6b6
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1000a6b6
call fcn.100084c9
dec ebx
sal dword [ebx], cl
outsb dx, byte [esi]
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.100084c9
movsd dword es:[edi], dword [esi]
popfd
or esi, dword [ecx - 1]
jne 0x1000a700
push dword [ebp + 4]
push dword [ebp]
call fcn.10008cc9
and dword [ebp - 4], 0
jmp 0x1000a723
in eax, 0xff
inc dword [ebx - 0x14ff039b]
cld
add bl, ch
sbb bh, bh
jne 0x1000a6f8
call fcn.1000a63e
pop ecx
ret
mov dword [ebp - 0x1c], esi
jmp 0x1000a6be
Function at 0x401510
Capabilities:
Enumerate gui resources

Disassembly:
push esi
push edi
call fcn.004013b0
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 0x401320
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0
push 0x401350
call esi
push 0x3e8
call edi
jmp 0x401530

Function at 0x4031b0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebp, 0x811c9dc5
cmp esi, 0xfffffffe
je 0x4031d5
test esi, esi
je 0x4031d0
cmp esi, dword [esp + 0x1c]
je 0x4031d5
call fcn.0040445e
cmp edi, dword [esp + 0x20]
je 0x403246
cmp esi, 0xfffffffe
mov ebx, edi
je 0x403208
test esi, esi
jne 0x4031eb
call fcn.0040445e
cmp dword [esi + 0x18], 8
jb 0x4031f6
mov eax, dword [esi + 4]
jmp 0x4031f9
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ecx*2]
cmp edi, edx
jb 0x403208
call fcn.0040445e
add edi, 2
cmp esi, 0xfffffffe
je 0x403236
test esi, esi
jne 0x403219
call fcn.0040445e
cmp dword [esi + 0x18], 8
jb 0x403224
mov eax, dword [esi + 4]
jmp 0x403227
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ecx*2]
cmp ebx, edx
jb 0x403236
call fcn.0040445e
movzx eax, word [ebx]
imul ebp, ebp, 0x1000193
xor ebp, eax
jmp 0x4031c1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x404092
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f054]
jne 0x40409c
repz ret
jmp fcn.00404d05
Function at 0x409fd5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040542b
xor ebx, ebx
cmp dword [0x4107a4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40a0aa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40a015
xor eax, eax
jmp 0x40a16e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40a00e
push eax
call fcn.004053c8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4107a4], eax
call esi
push eax
call fcn.004053c8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4107a8], eax
call esi
push eax
call fcn.004053c8
mov dword [0x4107ac], eax
lea eax, [ebp - 8]
push eax
call fcn.00405b1a
test eax, eax
pop ecx
pop ecx
je 0x40a078
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040433e
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40a0aa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004053c8
cmp eax, ebx
pop ecx
mov dword [0x4107b4], eax
je 0x40a0aa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004053c8
pop ecx
mov dword [0x4107b0], eax
mov eax, dword [0x4107b0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40a123
cmp dword [0x4107b4], esi
je 0x40a123
push eax
call fcn.00405434
pop ecx
call eax
cmp eax, ebx
je 0x40a0f0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4107b4]
call fcn.00405434
pop ecx
call eax
test eax, eax
je 0x40a0f0
test byte [ebp - 0x18], 1
jne 0x40a123
lea eax, [ebp - 0xc]
push eax
call fcn.00405b51
test eax, eax
pop ecx
je 0x40a10b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040433e
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40a11a
or dword [ebp + 0x10], 0x200000
jmp 0x40a154
or dword [ebp + 0x10], 0x40000
jmp 0x40a154
mov eax, dword [0x4107a8]
cmp eax, esi
je 0x40a154
push eax
call fcn.00405434
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40a154
mov eax, dword [0x4107ac]
cmp eax, esi
je 0x40a154
push dword [ebp - 4]
push eax
call fcn.00405434
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4107a4]
call fcn.00405434
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4af34ac5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..reloc
nop
nop
nop
nop
cmp eax, 0
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x68b2705d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4f714c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f7238
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4014
push 0xaea4d400
push 0
call fcn.0042f028
cmp eax, 0x96c721
jne 0x4f7190
mov eax, 0x4f724c
call fcn.00446774
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x4f7254
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4f7298
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4f71ef
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040498c
jmp 0x4f71fb
mov eax, ebx
mov edx, 0x4f72a4
call fcn.00404770
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x4f72dc
mov edx, 0x4f72ec
mov eax, 0x4f72f8
call fcn.004471f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f723f
lea eax, [ebp - 0x110]
call fcn.0040471c
ret
Function at 0x4f7320
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x87
push 0
push 0
dec ecx
jne 0x4f7328
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f75ce
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x40c]
mov edx, 5
mov eax, 0x4f75e8
call fcn.00447290
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x410]
mov edx, 1
mov eax, 0x4f7618
call fcn.00447290
mov edx, dword [ebp - 0x410]
pop eax
call fcn.00404b28
jne 0x4f739c
lea edx, [ebp - 0x414]
mov eax, 0x4f7628
call fcn.00408dc0
xor ebx, ebx
push 0
push 0x4f7630
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f75a3
push 0
push 0x4f7638
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f75a3
push 0
push 0x4f7648
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f765c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x4f75a3
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f740b
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f75a3
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f9960
lea ecx, [ebp - 0x418]
mov edx, 9
mov eax, 0x4f766c
call fcn.00447290
mov eax, dword [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
mov edx, 2
mov eax, 0x4f7618
call fcn.00447290
mov edx, dword [ebp - 0x41c]
pop eax
call fcn.00404b28
jne 0x4f747e
lea edx, [ebp - 0x420]
mov eax, 0x4f769c
call fcn.00408dc0
mov eax, dword [ebp - 4]
mov edx, 0x4f76ac
call fcn.00404b28
jne 0x4f74c0
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f7554
mov bl, 1
jmp 0x4f7554
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x428]
call fcn.0040991c
test al, al
jne 0x4f75a3
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f7554
push 0x32
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x430]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x430]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
lea ecx, [ebp - 0x434]
mov edx, 9
mov eax, 0x4f76bc
call fcn.00447290
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x438]
mov edx, 2
mov eax, 0x4f7618
call fcn.00447290
mov edx, dword [ebp - 0x438]
pop eax
call fcn.00404b28
jne 0x4f75a3
lea edx, [ebp - 0x43c]
mov eax, 0x4f76ec
call fcn.00408dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f75d5
lea eax, [ebp - 0x43c]
mov edx, 0xd
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret
Function at 0x4f76f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f798b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x40c]
mov edx, 4
mov eax, 0x4f79a4
call fcn.00447290
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x410]
mov edx, 1
mov eax, 0x4f79d4
call fcn.00447290
mov edx, dword [ebp - 0x410]
pop eax
call fcn.00404b28
jne 0x4f7798
lea edx, [ebp - 0x414]
mov eax, 0x4f79e4
call fcn.00408dc0
xor ebx, ebx
push 0
push 0x4f79ec
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7960
push 0
push 0x4f79f4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7960
push 0
push 0x4f7a04
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f7a18
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0x4015
push 0xab7b8200
push 0
call fcn.0042f028
cmp eax, 0x8faabc
jne 0x4f780c
mov eax, 0x4f7a28
call fcn.00446774
test esi, esi
je 0x4f7960
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f7829
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f7960
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f9960
push 0x4014
push 0x81fcd800
push 0
call fcn.0042f028
cmp eax, 0xda8115
jne 0x4f786f
mov eax, 0x4f7a38
call fcn.00446774
mov eax, dword [ebp - 4]
mov edx, 0x4f7a48
call fcn.00404b28
jne 0x4f78b1
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f793e
mov bl, 1
jmp 0x4f793e
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x41c]
call fcn.0040991c
test al, al
jne 0x4f7960
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f793e
lea eax, [ebp - 0x424]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x424]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
push 0x4014
push 0xf6e58000
push 0
call fcn.0042f028
cmp eax, 0x9fd8d8
jne 0x4f7960
mov eax, 0x4f7a58
call fcn.00446774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7992
lea eax, [ebp - 0x424]
mov edx, 7
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret
Function at 0x4f7a60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f7d01
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x40c]
mov edx, 4
mov eax, 0x4f7d18
call fcn.00447290
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x410]
mov edx, 1
mov eax, 0x4f7d48
call fcn.00447290
mov edx, dword [ebp - 0x410]
pop eax
call fcn.00404b28
jne 0x4f7b0a
lea edx, [ebp - 0x414]
mov eax, 0x4f7d58
call fcn.00408dc0
xor ebx, ebx
push 0
push 0x4f7d60
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7cd6
push 0
push 0x4f7d68
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7cd6
push 0
push 0x4f7d78
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f7d88
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f7d94
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
lea eax, [ebp - 0x418]
push eax
mov ecx, 0x4f7d48
mov edx, 0x4f7da4
mov eax, 0x4f7db0
call fcn.004471f4
test esi, esi
je 0x4f7cd6
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f7ba5
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f7cd6
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f9960
push 0x4015
push 0xbe778600
push 0
call fcn.0042f028
cmp eax, 0x9b5650
jne 0x4f7beb
mov eax, 0x4f7de0
call fcn.00446774
mov eax, dword [ebp - 4]
mov edx, 0x4f7df0
call fcn.00404b28
jne 0x4f7c2d
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f7cc7
mov bl, 1
jmp 0x4f7cc7
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x420]
call fcn.0040991c
test al, al
jne 0x4f7cd6
mov eax, dword [ebp - 4]
mov edx, 0x4f7df0
call fcn.00404b28
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f7cc7
lea eax, [ebp - 0x428]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x428]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
mov edx, 0x4f7e00
mov eax, 0x4f7e2c
call fcn.0040e798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7d08
lea eax, [ebp - 0x428]
mov edx, 8
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret
Function at 0x4faf00
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4faf08
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4fb0e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4fb0b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x130]
mov edx, 6
mov eax, 0x4fb0fc
call fcn.00447290
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x134]
mov edx, 2
mov eax, 0x4fb12c
call fcn.00447290
mov edx, dword [ebp - 0x134]
pop eax
call fcn.00404b28
jne 0x4faf8f
lea edx, [ebp - 0x138]
mov eax, 0x4fb13c
call fcn.004faeb0
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
mov ebx, eax
lea eax, [ebp - 0x13c]
push eax
mov ecx, 0x4fb14c
mov edx, 0x4fb15c
mov eax, 0x4fb168
call fcn.004471f4
jmp 0x4fb086
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040498c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00409a7c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004faeb0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.004faeb0
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.00404b28
je 0x4fb068
lea eax, [ebp - 0x154]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040498c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.004faeb0
mov eax, dword [ebp - 0x150]
push eax
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
call fcn.004faeb0
mov edx, dword [ebp - 0x158]
pop eax
call fcn.00404b28
jne 0x4fb07d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
mov ebx, eax
test ebx, ebx
jne 0x4fafc9
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x4fb14c
mov edx, 0x4fb15c
mov eax, 0x4fb198
call fcn.004471f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fb0bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb0ea
lea eax, [ebp - 0x15c]
mov edx, 0xc
call fcn.00404740
lea eax, [ebp - 4]
call fcn.0040471c
ret
Function at 0x4fc298
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], ecx
xor eax, eax
push ebp
push 0x4fc350
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, edx
call fcn.004f8a0c
lea edx, [ebp - 0x404]
push edx
push 0x3ff
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x408]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x408]
lea edx, [ebp - 4]
call fcn.00408e10
mov edx, 0x4fc368
mov eax, 0x4fc398
call fcn.0040e798
mov edx, dword [ebp - 4]
mov eax, 0x4fc3c8
call fcn.0040e798
test eax, eax
jg 0x4fc32d
mov edx, dword [ebp - 4]
mov eax, 0x4fc3dc
call fcn.0040e798
test eax, eax
jle 0x4fc32f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc357
lea eax, [ebp - 0x408]
call fcn.0040471c
lea eax, [ebp - 4]
call fcn.0040471c
ret
Function at 0x4fdd60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4fdec5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040471c
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x134]
push eax
mov ecx, 0x4fdedc
mov edx, 0x4fdeec
mov eax, 0x4fdef8
call fcn.004471f4
jmp 0x4fde16
mov edx, 0x4fdf24
mov eax, 0x4fdf54
call fcn.0040e798
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 4]
jne 0x4fde03
mov edi, dword [ebp - 0x118]
jmp 0x4fde1a
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4fdde1
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4fde81
cmp edi, dword [ebp - 0x128]
jne 0x4fde6e
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040498c
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408e10
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 8]
call fcn.004fae60
jmp 0x4fde85
lea eax, [ebp - 0x130]
push eax
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4fde2f
push 0x4014
push 0xd5fefc00
push 0
call fcn.0042f028
cmp eax, 0xcf528d
jne 0x4fdea7
mov eax, 0x4fdf84
call fcn.00446774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdecc
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.00404740
ret