joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eac0
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
cmp byte [esi + 0x17], 0
push edi
mov edi, ecx
jne 0x46ead2
mov esi, dword [esi + 0xc]
cmp byte [edi + 0x17], 0
jne 0x46eadb
mov edi, dword [edi + 0xc]
mov al, byte [esi + 0x15]
test al, 0x10
je 0x46eb67
test al, 8
jne 0x46eb4c
mov eax, dword [esi + 8]
movsx ecx, byte [eax]
mov edx, dword [esi + 0xc]
movsx eax, byte [edx + eax - 1]
cmp ecx, 0x20
je 0x46eb16
cmp ecx, 9
je 0x46eb16
cmp eax, 0x20
je 0x46eb16
cmp eax, 9
je 0x46eb16
cmp ecx, 0x30
je 0x46eb16
cmp ecx, 0x2b
jne 0x46eb4c
mov eax, dword [esi + 8]
push 1
push 0
push edx
push eax
push edi
call fcn.0046f1f0
test eax, eax
jne 0x46eb31
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x10
push eax
push ecx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0x18
push edx
push eax
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 0x20
je 0x46ebcd
test al, 8
jne 0x46eba9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push 1
push 0
push eax
push ecx
push edi
call fcn.0046f1f0
test eax, eax
je 0x46eb29
fld qword [esi]
push 0x20
fstp qword [esp + 0xc]
mov eax, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
fld qword [esi]
push 0x28
fstp qword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 1
je 0x46ebdf
mov ecx, esi
mov edx, edi
pop edi
pop esi
add esp, 0xc
jmp fcn.0046efc0
test al, 2
je 0x46ebfb
mov esi, dword [esi]
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
push esi
mov eax, edi
call fcn.004125f0
pop edi
pop esi
add esp, 0xc
ret
cmp byte [esi + 0x17], 0
jne 0x46ec06
mov eax, dword [esi + 0xc]
jmp 0x46ec08
mov eax, esi
test byte [eax + 0x15], 4
je 0x46ec15
mov eax, esi
call fcn.0042d4f0
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 8]
push 1
push 0
push eax
push esi
push edi
call fcn.0046f1f0
pop edi
pop esi
add esp, 0xc
ret
Function at 0x46ec30
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
dec eax
cmp eax, 4
ja case.default.0x46ec40
jmp dword [eax*4 + 0x46ece0]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push edi
call fcn.00412590
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je case.default.0x46ec40
mov ecx, dword [esi]
cmp byte [ecx], 0x30
je 0x46ec73
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push edi
call fcn.00412590
pop esi
ret
push 1
push 0
push 0xffffffffffffffff
push ecx
push edi
call fcn.0046f1f0
test eax, eax
jne 0x46ec86
pop esi
ret
mov esi, dword [esi + 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0x10
push ecx
push edx
mov eax, edi
call fcn.004010d0
mov eax, 1
pop esi
ret
mov eax, dword [esi]
mov ecx, edi
pop esi
jmp fcn.0046eac0
fld qword [esi]
sub esp, 8
fstp qword [esp]
push edi
call fcn.004125c0
pop esi
ret
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
push esi
mov eax, edi
call fcn.004125f0
pop esi
ret
mov esi, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push esi
push edi
call fcn.0046f1f0
pop esi
ret
Function at 0x46efc0
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
cmp byte [esi + 0x17], 0
push edi
mov ebx, ecx
jne 0x46efda
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x46efd1
cmp byte [ebx + 0x17], 0
jne 0x46efe3
mov ebx, dword [ebx + 0xc]
mov eax, ebx
call fcn.00401150
cmp byte [esi + 0x17], 1
jne 0x46f03a
cmp esi, ebx
je 0x46f0b3
mov eax, dword [ebx + 0xc]
push 0
push 1
push eax
push 0
push esi
call fcn.0046f1f0
test eax, eax
jne 0x46f014
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
inc eax
push eax
push ecx
push edx
call fcn.00487870
add esp, 0xc
or byte [esi + 0x15], 1
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x4a5278
call fcn.00404220
test eax, eax
jne 0x46f064
push 0x49281e
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4a4c40
call fcn.0042cf80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, edi
lea esi, [edi + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
jbe 0x46f0c4
xor esi, esi
cmp dword [0x4a5290], esi
je 0x46f0b3
cmp dword [0x4a5280], esi
je 0x46f0a1
mov eax, dword [0x4a5278]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a5280], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4a5290], esi
mov dword [0x4a5278], esi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov edi, dword [edi]
mov dword [esp + 0x18], edi
test edi, edi
je 0x46f07d
mov ecx, esi
add esi, 4
cmp esi, eax
ja 0x46f07d
mov ebx, dword [ecx]
mov edi, esi
add esi, ebx
cmp esi, eax
ja 0x46f07d
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x46f131
test ebx, ebx
je 0x46f117
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46f188
push ebx
push edi
push eax
call fcn.00487870
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, esi
mov eax, dword [esp + 0x18]
push ebp
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
lea esi, [edi + 4]
cmp esi, dword [esp + 0x14]
jbe 0x46f0c0
jmp 0x46f07d
cmp dword [0x4a5290], 0
je 0x46f16c
cmp dword [0x4a5280], 0
je 0x46f15a
mov ecx, dword [0x4a5278]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a5280], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
mov dword [0x4a5290], eax
mov dword [0x4a5278], eax
push 0x49281e
push str.Out_of_memory.
mov ecx, 0x4a4c40
call fcn.0042cf80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
cmp dword [0x4a5290], esi
je 0x46f1c6
cmp dword [0x4a5280], esi
je 0x46f1b4
mov edx, dword [0x4a5278]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a5280], esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4a5290], esi
mov dword [0x4a5278], esi
push 0x49281e
push 0x4929ac
mov ecx, 0x4a4c40
call fcn.0042cf80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x46f530
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0x17]
push edi
cmp eax, 3
ja case.default.0x46f543
jmp dword [eax*4 + 0x46f6f4]
mov eax, esi
call fcn.00401150
cmp dword [0x4a2d54], 0
jne 0x46f614
cmp dword [esi + 0xc], 0
jne 0x46f614
mov edi, dword [esp + 0x14]
cmp dword [0x4a5ce0], esi
jne 0x46f578
test edi, edi
jne 0x46f5d5
mov ecx, dword [esi + 0x18]
push 0
lea eax, [esp + 0x13]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x46f5d1
mov dword [0x4a5ce0], 0
test edi, edi
je 0x46f5c9
mov eax, dword [0x4a2d34]
test eax, eax
je 0x46f5ba
mov edx, dword [esi + 0x18]
push edx
push str.An_environment_variable_is_being_accessed__see_NoEnv.
push eax
push 0x4a4c40
xor ecx, ecx
call fcn.0042d3c0
mov ecx, dword [esi + 0x18]
call fcn.0046db50
pop edi
pop esi
pop ebx
pop ecx
ret 4
dec eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
test edi, edi
je 0x46f605
cmp byte [esi + 0x17], 0
jne 0x46f5e0
mov eax, dword [esi + 0xc]
jmp 0x46f5e2
mov eax, esi
test byte [eax + 0x15], 4
je 0x46f5ef
mov eax, esi
call fcn.0042d4f0
mov byte [edi], 0
mov dword [0x4a5ce0], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [0x4a5ce0], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0xc]
test edi, edi
je 0x46f685
test ebx, ebx
jne 0x46f646
movzx eax, byte [esi + 0x17]
neg eax
sbb eax, eax
and eax, esi
test byte [eax + 0x15], 4
je 0x46f63a
mov eax, esi
call fcn.0042d4f0
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 8]
cmp edi, ecx
je 0x46f685
cmp ebx, 0x186a0
jae 0x46f676
mov al, byte [ecx]
test al, al
je 0x46f66a
jmp 0x46f660
inc ecx
mov byte [edi], al
mov al, byte [ecx]
inc edi
test al, al
jne 0x46f660
mov byte [edi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
push ebx
push ecx
push edi
call fcn.00487870
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push eax
call fcn.0046f530
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
push 0x4a5278
mov ecx, esi
call fcn.00403c70
cmp eax, 0xffffffff
jne 0x46f6b9
xor eax, eax
test esi, esi
je 0x46f6ed
mov byte [eax + esi], 0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46f6d3
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
push ecx
push edx
call eax
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x470010
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x47001f
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4a4c00]
je 0x47004a
mov esi, edi
call fcn.00471070
test al, al
jne 0x4701e2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x470064
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp edi, esi
jne 0x470072
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x470086
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4a2d12], 0
jne 0x4700a0
push esi
call fcn.0046ffb0
add esp, 4
test eax, eax
jne 0x4701e4
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x4700fd
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4700fd
cmp dword [0x4a4c00], ebx
je 0x4700e4
call fcn.00471070
test al, al
jne 0x4700e4
mov eax, dword [0x4a4c00]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x4700fd
cmp ebx, ebp
je 0x4700fd
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x470110
push edi
call ebx
push 1
push 0xa
mov dword [0x49f3a4], 0
call fcn.00401280
add esp, 8
mov dword [0x49f3a4], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x470143
mov ebp, edi
jmp 0x470154
cmp ebp, esi
je 0x470158
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x470158
test ebp, ebp
jne 0x470199
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x470110
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e970
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e970
push esi
call fcn.0046ffb0
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x4701b4
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4a4c00]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4701cd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x4701e2
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x4702d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x4702e0
mov eax, esi
call fcn.0044f400
jmp 0x4702ed
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 4]
test eax, eax
js 0x470348
je 0x470348
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401280
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x470345
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x470345
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call ebx
test eax, eax
jne 0x470324
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x470520
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.0048b740
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x47054b
cmp cl, 0x61
jne 0x47059c
cmp byte [edx + 1], bl
jne 0x47059c
cmp byte [edi], bl
jne 0x47059c
cmp byte [eax], bl
jne 0x47059c
cmp byte [esi], bl
jne 0x47059c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x47057d
cmp byte [ebp + 0xc6], bl
jne 0x47057d
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x47057d
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x470590
cmp esi, ebx
je 0x470590
mov dword [ebp + 0xa0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x4705bd
cmp byte [edi], bl
jne 0x4705bd
cmp byte [eax], bl
jne 0x4705bd
cmp byte [esi], bl
jne 0x4705bd
mov eax, ebp
call fcn.00470710
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x49281e
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.004711b0
test eax, eax
je 0x4706ce
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x4706da
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x4706a6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4706ce
cmp byte [ebp + 0xc6], bl
jne 0x47069f
mov eax, dword [esp + 0x828]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x47069f
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x4706ce
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x4706bf
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.004715f0
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.004716b0
test eax, eax
jne 0x4706ea
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x470780
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x470704
cmp eax, ebx
je 0x470704
mov dword [ebp + 0xa0], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x4708f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.0048b740
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x470919
mov ecx, edi
call fcn.00412530
cmp dword [esp + 0x8038], 0
jne 0x47092e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x470943
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x47094d
mov ebp, 1
test esi, esi
je 0x470b1a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x470b1a
cmp ebp, dword [esp + 0x20]
jg 0x470b1a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.0046dc90
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x470b13
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x4709c0
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x470a37
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x470a8e
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x470a37
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x470a89
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.0046fe80
test al, al
jne 0x470ab4
cmp dword [esp + 0x802c], 0
jne 0x470a98
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x470ae7
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x470a6e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x470acc
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401280
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x4709c0
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x470ae7
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.0046f1f0
mov esi, eax
jmp 0x470aec
mov eax, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x492868
push eax
call fcn.0046f1f0
jmp 0x470a8e
mov ecx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push 0x493ec0
push ecx
call fcn.0046f1f0
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x493ec0
test edi, edi
jne 0x470b28
mov eax, 0x494008
mov ecx, dword [0x49f440]
cmp byte [ecx + 0xe4], 0
jne 0x470b55
mov edx, dword [0x4a33f4]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.0046f1f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4a4fa4]
push 0x49281e
push 0
push 0x493ec0
call fcn.0042ca10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x4715f0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x4716a7
mov eax, dword [esi]
test eax, eax
je 0x4716a7
push edi
test al, 1
jne 0x471619
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x471632
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x471632
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47164d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x471688
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x471688
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044b120
add esp, 4
test eax, eax
jne 0x471688
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x4716a7
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x471c20
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.0048b740
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x471ccd
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x472350
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x49281e
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x471ccd
mov ecx, dword [0x49f440]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x471ccd
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x471ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x471cfc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x49f440]
push eax
push esi
mov ecx, edi
call fcn.00472190
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x471d33
test eax, eax
jne 0x471d37
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00471df0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x471db6
test esi, esi
je 0x471db6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401280
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x471d95
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x471d95
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call edi
test eax, eax
jne 0x471d70
mov edx, dword [0x49f440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x471dae
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x471dd0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00471df0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00471f60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x471f60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.0048b740
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x4720e0
xor cl, cl
mov eax, edi
call fcn.00472100
test eax, eax
jne 0x471f95
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x49f440]
push eax
push ebp
mov ecx, edi
call fcn.00472190
test eax, eax
je 0x471fb8
xor eax, eax
mov dword [0x4a4bf8], eax
jmp 0x471fbd
mov eax, dword [0x4a4bf8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x49281e
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x472003
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x47200b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4a4bf4]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x472260
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x4720b8
lea ecx, [esp + 0x10]
push ecx
push 0x470fc0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x472075
mov edx, dword [esp + 0xc48]
call fcn.00471a40
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00470010
mov edx, dword [esp + 0xc48]
call fcn.00471a40
mov edx, dword [0x49f440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x4720e0
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4a4bf8]
cmp eax, ebx
je 0x4720e0
cmp eax, 1
setg al
mov dword [0x4a4bf8], ebx
cmp al, bl
je 0x4720e0
mov edx, ebp
call fcn.00471a40
push ebx
mov ecx, edi
call fcn.00471f60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4