joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4664ec
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520e0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0043fa60
pop ecx
mov dword [0x562494], ebx
push 0
lea ecx, [ebp - 0x28]
call fcn.004319ec
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x46656f
lea edx, [ebp - 0x58]
push eax
push edx
call fcn.00446a20
add esp, 8
mov dword [ebp - 4], 1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.004317d8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00431724
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [eax*4 + 4]
push edx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov dword [ebp - 0x14], eax
add esp, 4
mov edx, dword [ebp - 0x18]
test edx, edx
jle 0x4665ae
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push dword [eax + ebx*4]
call dword [sym.imp.MSVCR80.dll__strdup]
pop ecx
mov edx, dword [ebp - 0x14]
mov dword [edx + ebx*4], eax
mov edx, dword [ebp - 0x18]
add ebx, 1
cmp ebx, edx
jl 0x466591
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], 0x4664a0
xor eax, eax
mov byte [ebp - 0x48], al
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 2
mov eax, ecx
lea edx, [ebp - 0x18]
push eax
push edx
call fcn.0043fa74
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 3
movzx eax, byte [ebp - 0x48]
test eax, eax
jne 0x466601
mov dword [ebp - 4], 4
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call dword [ebp - 0x44]
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00431724
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x469528
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5216f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov eax, 0x54a4d8
test eax, eax
je 0x469590
mov eax, 0x54a4d8
jmp 0x469595
mov eax, 0x542830
push dword [0x543670]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00431a04
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00515300
pop ecx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], ecx
test eax, eax
mov eax, 2
je 0x4695ce
mov eax, 0
mov byte [edx + 0x1a], al
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x28]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x4695fd
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x4695fd
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46c198
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522054
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x114]
mov dword [ebp - 0x18], eax
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.0047a778
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00467740
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00467624
test ebx, ebx
je 0x46c214
mov eax, dword [ebp - 0x14]
push ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x9c]
push eax
push edx
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
test ebx, ebx
je 0x46c234
mov eax, dword [ebp - 0x14]
push ebx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
mov edi, dword [ebp - 0x94]
mov esi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
mov edx, dword [ebp - 0x60]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x5c]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x58]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x54]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x50]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x4c]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x48]
mov dword [eax + 0x1c], edx
mov edx, dword [ebp - 0x44]
mov dword [eax + 0x20], edx
mov edx, dword [ebp - 0x40]
mov dword [eax + 0x24], edx
mov edx, dword [ebp - 0x3c]
mov dword [eax + 0x28], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x34], edx
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4716d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522dc4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp + 0x10]
push dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
call fcn.004941c0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push 0x10
mov edx, dword [eax + 0x28]
mov dword [ecx + 0x14], edx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
push 0x11
movsx eax, ax
shr eax, 0x1f
mov byte [edx + 0x31], al
call dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
movsx eax, ax
shr eax, 0x1f
mov byte [edi + 0x30], al
mov eax, dword [ebp - 0x20]
mov edx, esi
shr edx, 0x10
and edx, 0x2000
mov dword [edi + 8], ebx
xor ecx, ecx
cmp edx, 0x2000
sete cl
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov byte [edi + 0x32], cl
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], esi
call dword [sym.imp.USER32.dll_GetMessageTime]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, ebx
lea eax, [ebp - 0x44]
push eax
push dword [edx + 0x114]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4723d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ecx
and byte [ecx + 0x11c], 0xfe
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
movsx eax, ax
test eax, eax
mov esi, 4
jl 0x472424
mov esi, 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
movsx eax, ax
mov edx, 8
test eax, eax
jl 0x47243d
mov edx, 0
or esi, edx
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
push 4
mov ebx, esi
or ebx, 1
test eax, eax
jne 0x472457
mov ebx, esi
call dword [sym.imp.USER32.dll_GetKeyState]
test eax, 0x8000
push 2
mov eax, 0x10
jne 0x472470
mov eax, 0
or ebx, eax
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
mov edx, ebx
or edx, 2
test eax, eax
jne 0x472488
mov edx, ebx
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x44]
push eax
push dword [edx + 0x114]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [0x572b08]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
sub dword [ebp - 0x34], eax
lea ecx, [ebp - 0x84]
sub dword [ebp - 0x30], edx
call fcn.0049427c
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x84]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push edx
call fcn.0047637c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x84]
push edx
mov ecx, dword [eax + 0x5c]
mov ebx, dword [ecx]
call dword [ebx + 0x10]
lea eax, [ebp - 0x84]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x84], 0x588888
lea ecx, [ebp - 0x84]
call fcn.0042eb08
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x475988
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
movzx eax, byte [esp + 8]
test eax, eax
je 0x4759c0
mov dword [0x571c04], 0x4757c0
call fcn.0043fa6c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push dword [0x571c04]
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x571c00], eax
pop esi
ret
push dword [0x571c00]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop esi
ret
Function at 0x4759d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push ebp
sub esp, 8
xor edx, edx
mov esi, dword [esp + 0x14]
mov eax, esi
call fcn.00475a70
mov ebp, eax
cmp esi, 0x16d
je 0x475a4b
cmp esi, 0x137
je 0x475a4b
cmp esi, 0x16c
je 0x475a4b
movzx eax, bp
cmp eax, 1
jne 0x475a17
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x475a2d
mov ebp, 2
jmp 0x475a2d
cmp eax, 2
jne 0x475a2d
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x475a2d
mov ebp, 1
movzx eax, bp
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
xor edx, edx
test eax, eax
setne dl
mov eax, edx
add esp, 8
pop ebp
pop esi
ret
movzx eax, bp
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
xor eax, eax
test edx, edx
setne al
add esp, 8
pop ebp
pop esi
ret

Function at 0x475a70
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push ebx
mov edi, edx
mov ebx, eax
test edi, edi
je 0x475a7d
mov byte [edi], 1
xor eax, eax
cmp ebx, dword [eax*8 + 0x54b024]
je 0x475b17
add eax, 1
cmp eax, 0x3c
jb 0x475a7f
lea eax, [ebx - 0x138]
cmp eax, 0x49
ja case.0x475aa6.318
mov eax, dword [eax*4 + 0x54aee0]
jmp eax
mov eax, 0x22
jmp 0x475b07
mov eax, 0x21
jmp 0x475b07
mov eax, 0x2d
jmp 0x475b07
mov eax, 0x28
jmp 0x475b07
mov eax, 0x27
jmp 0x475b07
mov eax, 0x26
jmp 0x475b07
mov eax, 0x25
jmp 0x475b07
mov eax, 0x24
jmp 0x475b07
mov eax, 0x23
jmp 0x475b07
cmp ebx, 0x7f
jne 0x475af3
mov eax, 0x2e
jmp 0x475b07
movsx eax, bl
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx eax, al
cmp eax, 0xff
je 0x475b0a
pop ebx
pop edi
ret
test edi, edi
je 0x475b11
mov byte [edi], 0
movzx eax, bx
pop ebx
pop edi
ret
movzx eax, word [eax*8 + 0x54b020]
pop ebx
pop edi
ret
Function at 0x47637c
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov esi, ecx
mov edx, dword [esi]
mov ecx, esi
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
lea eax, [esp]
push eax
call dword [edx + 0x60]
mov edi, dword [esp]
mov eax, dword [esp + 4]
neg edi
neg eax
xor ecx, ecx
xor edx, edx
add edi, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
push 0x12
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x28], eax
mov eax, ebx
and eax, 4
setne cl
mov eax, ebx
and eax, 8
mov byte [ebp + 0x30], cl
setne dl
mov eax, ebx
and eax, 1
mov byte [ebp + 0x2f], dl
mov byte [ebp + 0x2c], al
mov edx, ebx
and edx, 0x10
and ebx, 2
xor eax, eax
test edx, edx
setne al
mov byte [ebp + 0x2d], al
xor eax, eax
test ebx, ebx
setne al
mov byte [ebp + 0x2e], al
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
shr eax, 0x1f
mov byte [ebp + 0x31], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov ecx, esi
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], esi
mov eax, dword [esi + 0x28]
mov dword [esp + 0xc], ebx
lea edi, [esp + 0xc]
mov dword [ebp + 0x14], eax
mov edx, dword [esi]
lea eax, [esp + 8]
push edi
push eax
call dword [edx + 0x1fc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [0x571bf0], eax
mov dword [0x571bf4], edx
mov dword [0x571bf8], ecx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
Function at 0x48da5c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52749e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [ecx], 0x588888
mov dword [ebp - 0x20], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5a2784
mov edx, dword [0x55d358]
mov dword [ecx + 8], edx
mov dword [ebp - 4], 1
push eax
xor edx, edx
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x34], edx
mov dword [ecx + 0x38], edx
mov dword [ecx + 0x3c], edx
add ecx, 8
call fcn.00430810
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov byte [eax + 0x40], dl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x49510c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528cb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ecx], 0x588888
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5a4ec8
lea eax, [ecx + 8]
mov dword [ebp - 0x14], eax
mov dword [ecx + 8], 0x588888
mov edx, dword [ebp - 0x14]
mov dword [edx + 4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0x58889c
mov esi, dword [ebp - 0x14]
mov dword [esi], 0x5888c4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x588924
mov ecx, dword [ebp - 0x14]
call fcn.00466848
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0x588a04
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0x588a04
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x24]
mov eax, dword [0x55d358]
mov dword [edx + 0x40], 0xffffffff
mov dword [edx + 0x3c], eax
mov dword [edx + 0x44], 0
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x24]
lea ebx, [eax + 8]
mov edx, 0x5726c0
cmp ebx, edx
je 0x495206
push 0x5726c0
mov ecx, ebx
call fcn.0042ee90
mov eax, dword [ebp - 0x24]
mov edx, dword [0x5726c8]
mov esi, dword [ebp - 0x1c]
mov dword [ebx + 8], edx
movzx ecx, byte [0x5726cc]
mov byte [ebx + 0xc], cl
movzx edx, byte [0x5726cd]
mov byte [ebx + 0xd], dl
movzx edx, byte [0x5726ce]
mov byte [ebx + 0xe], dl
movzx edx, byte [0x5726cf]
mov byte [ebx + 0xf], dl
movzx edx, byte [0x5726d0]
mov byte [ebx + 0x10], dl
xor edx, edx
mov byte [eax + 0x1c], dl
mov dword [eax + 0x38], 0xffffffff
mov ebx, 1
mov byte [eax + 0x1d], bl
mov byte [eax + 0x1e], bl
mov ebx, dword [ebp - 0x18]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4952f4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528d06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ecx
mov dword [ecx], 0x588888
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5a4f04
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
add ecx, 0x38
call fcn.004953bc
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call fcn.004954ac
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov byte [eax + 0x30], cl
mov edx, 1
mov byte [eax + 0x31], dl
mov byte [eax + 0x32], dl
mov byte [eax + 0x33], dl
mov byte [eax + 0x34], dl
mov byte [eax + 0x36], cl
mov byte [eax + 0x35], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4953bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528d44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ecx
mov dword [ecx], 0x588888
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x5a4edc
mov eax, dword [0x55d358]
mov dword [ecx + 0x20], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ecx + 0x34], eax
mov edx, dword [0x55d358]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
mov dword [ebp - 4], 2
push dword [0x55d358]
mov dword [ecx + 0x10], 3
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov esi, 1
mov dword [ecx + 0x18], esi
mov byte [ecx + 0x1c], al
mov dword [ecx + 0x14], esi
mov byte [ecx + 0x1d], al
add ecx, 0x20
call fcn.00430664
mov ebx, dword [ebp - 0x20]
mov eax, dword [0x572680]
mov edx, dword [0x572684]
xor ecx, ecx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x30], ecx
mov byte [ebx + 0x24], 1
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x44], ecx
call fcn.0048dc2c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x3c]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0x48], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a8c1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c53c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x55d258]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x64]
call fcn.00469528
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x34]
mov ebx, dword [ebx + 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 0
mov dword [ebp - 0x2c], ebx
mov dword [eax], 0x588984
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ecx], 0x588a04
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.004686f8
mov ecx, dword [ebp - 0x14]
call fcn.00427c84
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a96cc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c6de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [0x55d358]
mov dword [ecx], eax
mov dword [ebp - 4], 0
test edx, edx
je 0x4a975f
push edx
mov dword [ebp - 0x20], edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], 0
add eax, 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], edx
call fcn.0042f7f0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
push ecx
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
call fcn.0042f7a8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret