joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4544bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404014
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x454514
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4aa61c]
mov dl, 1
mov eax, dword [0x453a78]
call fcn.0040b91c
call fcn.004035e4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00453c1c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x455aa4
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x455b73
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x455b80
call sub.user32.dll_FindWindowA
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x455b52
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x455b44
lea edx, [ebp - 4]
lea eax, [ebp - 0x84]
call fcn.00408fe0
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.00408570
mov eax, dword [ebp - 0x88]
mov edx, 0x455b98
call fcn.00403f60
jne 0x455b44
push esi
call sub.user32.dll_IsWindowVisible
test bl, bl
je 0x455b3c
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x455b44
push 5
push esi
call sub.user32.dll_ShowWindow
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x455ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455b7a
lea eax, [ebp - 0x88]
call fcn.00403bb4
lea eax, [ebp - 4]
call fcn.00403bb4
ret

Function at 0x455da8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4ab8c4
cmp dword [edi], 0
jne 0x455e24
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4ab8c0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4a9b70
mov ecx, 2
call fcn.00402834
mov edx, 0x455d80
lea eax, [esi + 5]
call fcn.00455da0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00455da0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x455df9
mov dword [0x4ab8c0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4617ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461884
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ab93c], 0
jne 0x461868
lea eax, [ebp - 4]
mov edx, 0x46189c
call fcn.00403c4c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404014
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x461868
mov eax, ebx
call fcn.0040271c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x461861
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46184b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4618ac
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46184b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4ab93c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461868
mov eax, dword [ebp - 0xc]
call fcn.00402734
ret
mov ebx, dword [0x4ab93c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46188b
lea eax, [ebp - 4]
call fcn.00403bb4
ret

Function at 0x476de4
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x476df4
call sub.user32.dll_FindWindowA
ret

Function at 0x477b08
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0
push 0x477b74
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x477b6d
push 0
push 0x477b84
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b6d
mov esi, eax
push 0x477b94
push 0x477b98
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b58
push 0
push 0x477ba4
push 0
push eax
call sub.user32.dll_FindWindowExA
jmp 0x477b67
push 0
push 0x477ba4
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b6d
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x477b0c
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
xor ebx, ebx
push 0
push 0x477b74
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x477b6d
push 0
push 0x477b84
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b6d
mov esi, eax
push 0x477b94
push 0x477b98
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b58
push 0
push 0x477ba4
push 0
push eax
call sub.user32.dll_FindWindowExA
jmp 0x477b67
push 0
push 0x477ba4
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x477b6d
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47be8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c0eb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47beee
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047b954
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c118
cmp al, 1
jne 0x47beee
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047bc6c
test al, al
je 0x47c07a
cmp dword [ebp - 8], 0
jge 0x47bf0c
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047b954
mov eax, dword [ebp - 0x210]
call fcn.00403e50
cmp ebx, eax
jge 0x47bf56
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047b954
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4aa5fc]
and eax, 0xff
bt dword [edx], eax
jae 0x47bf56
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x47bf6a
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047be68
cmp ebx, dword [ebp - 8]
je 0x47c06c
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47bf96
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403028
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a9f70]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x47c059
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403028
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a9f70]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00438514
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.00403028
and eax, 0x7f
movzx eax, word [eax*2 + 0x4a9f70]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00438514
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c060
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x47c0cd
cmp dword [ebp - 8], 0
jge 0x47c085
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047b954
mov eax, dword [ebp - 0x218]
call fcn.00403e50
cmp eax, dword [ebp - 8]
jg 0x47c0bf
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047b954
mov eax, dword [ebp - 0x21c]
call fcn.00403e50
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047be68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c0f2
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403bd8
ret
Function at 0x48c330
Capabilities:
Access peb ldr_data
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c540
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x150]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, 0x48c558
call fcn.004551f4
mov eax, dword [ebp - 0x150]
call fcn.00404014
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x48c522
xor eax, eax
push ebp
push 0x48c51b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14c], 0x10
je 0x48c4ec
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403de4
mov edx, dword [ebp - 0x158]
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004551f4
mov ecx, dword [ebp - 0x154]
mov dl, 1
mov eax, dword [0x452ec8]
call fcn.00452f70
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48c4e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48b7c4]
call fcn.00402e1c
mov ebx, eax
lea eax, [ebx + 4]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403de4
push 0
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0x48c568
mov edx, 0x48c578
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x15c]
lea eax, [ebx + 0xc]
call fcn.00403c08
push 0
lea eax, [ebp - 0x160]
push eax
mov edx, 0x48c578
mov ecx, 0x48c588
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x160]
lea eax, [ebx + 0x10]
call fcn.00403c08
push 0
lea eax, [ebp - 0x164]
push eax
mov edx, 0x48c578
mov ecx, 0x48c598
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi]
mov edx, dword [ebp - 0x164]
lea eax, [ebx + 8]
call fcn.00403c08
cmp dword [ebx + 8], 0
jne 0x48c4c2
lea eax, [ebx + 8]
mov edx, dword [ebx + 4]
call fcn.00403c08
mov edx, dword [ebx + 8]
mov ecx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c4ec
mov eax, dword [ebp - 0xc]
call fcn.00402e4c
ret
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x48c3bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c522
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c547
lea eax, [ebp - 0x164]
mov edx, 6
call fcn.00403bd8
ret
Function at 0x494d00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494e30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00455e40
mov ebx, eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00494f20
test al, al
jne 0x494e1a
mov eax, dword [0x4aa494]
mov eax, dword [eax]
cmp ebx, dword [eax + 0x24]
je 0x494e1a
mov ecx, ebx
mov dl, 1
mov eax, dword [0x455cc4]
call fcn.004560e8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x494e0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00494c24
test al, al
je 0x494d80
mov edx, 6
mov eax, ebx
call fcn.00455eb8
push 0
push ebx
call sub.user32.dll_ShowWindow
test eax, eax
je 0x494df6
inc dword [0x4aa08c]
mov eax, dword [ebp - 8]
call fcn.004561e8
call fcn.0042115c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4aa08c]
push eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00456160
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x47649c]
call fcn.00477240
mov ebx, eax
mov byte [ebx + 0x78], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, ebx
call fcn.004108e0
mov eax, dword [ebp - 4]
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x90], 0x494ef0
mov dl, 1
mov eax, ebx
call fcn.0047704c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e13
mov eax, dword [ebp - 8]
call fcn.00402e4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e37
lea eax, [ebp - 0xc]
call fcn.00403bb4
ret
Function at 0x49fe84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49ffc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403bb4
test edi, edi
je 0x49ffb1
lea eax, [ebp - 8]
mov edx, 0x49ffe0
call fcn.00403c4c
mov eax, edi
call fcn.00403e50
mov ebx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor ebx, eax
lea eax, [ebp - 8]
call fcn.00404020
mov byte [eax], bl
mov eax, edi
call fcn.00403e50
mov esi, eax
test esi, esi
jle 0x49ff08
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404020
mov edx, dword [ebp - 8]
mov dl, byte [edx]
mov cl, byte [edi + ebx - 1]
xor dl, cl
mov byte [eax], dl
inc ebx
dec esi
jne 0x49feef
mov eax, dword [ebp - 8]
call fcn.00403e50
mov esi, eax
sub esi, 2
jl 0x49ff3d
inc esi
mov ebx, 2
lea eax, [ebp - 8]
call fcn.00404020
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + ebx - 2]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x49ff1d
mov eax, dword [ebp - 8]
call fcn.00403e50
mov esi, eax
test esi, esi
jle 0x49ff76
mov ebx, 1
mov eax, dword [ebp - 8]
call fcn.00403e50
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ebx - 1]
xor eax, edx
sub eax, ebx
push eax
lea eax, [ebp - 8]
call fcn.00404020
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x49ff50
mov eax, dword [ebp - 8]
call fcn.00403e50
mov esi, eax
test esi, esi
jle 0x49ffb1
mov ebx, 1
push ebp
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shr eax, 4
call fcn.0049fd0c
pop ecx
push ebp
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
and eax, 0xf
call fcn.0049fd0c
pop ecx
inc ebx
dec esi
jne 0x49ff89
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ffce
lea eax, [ebp - 8]
call fcn.00403bb4
ret
Function at 0x4a0e87
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov ebp, dword [0x4aa494]
mov esi, dword [ebx + 0x5ac]
test esi, esi
je 0x4a0d09
mov eax, dword [ebx + 0x440]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov edx, eax
mov eax, esi
call fcn.00455840
mov eax, ebx
call fcn.004a3a78
xor eax, eax
call fcn.00455aa4
mov eax, dword [ebp]
call fcn.00451750
mov eax, ebx
call fcn.004a0494
mov eax, dword [ebp]
call fcn.00451750
mov eax, ebx
call fcn.004a0400
mov eax, dword [ebp]
call fcn.00451750
mov eax, dword [ebx + 0x5b0]
test eax, eax
je 0x4a0d4d
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
mov dword [ebx + 0x5b0], eax
mov esi, dword [ebx + 0x5ac]
test esi, esi
je 0x4a0d76
mov eax, dword [ebx + 0x440]
mov edx, dword [eax]
call dword [edx + 0xb4]
mov edx, eax
mov eax, esi
call fcn.00455840
mov eax, dword [ebx + 0x5ac]
call fcn.00402e4c
xor eax, eax
mov dword [ebx + 0x5ac], eax
xor edx, edx
mov eax, dword [ebx + 0x5a8]
call fcn.00485aac
xor edx, edx
mov eax, dword [ebx + 0x5f0]
call fcn.0049648c
mov eax, dword [ebp]
call fcn.00451750
mov esi, dword [ebx + 0x5a4]
test esi, esi
je 0x4a0e62
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov byte [esi + 0x24], 0
mov eax, dword [esi + 0x70]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4a0e0a
mov eax, dword [ebx + 0x5a4]
mov eax, dword [eax + 0x70]
call fcn.00448e68
mov eax, dword [ebp]
call fcn.00451750
mov eax, dword [ebx + 0x5a4]
mov byte [eax + 0x60], 1
mov eax, dword [ebp]
call fcn.00451750
mov eax, dword [ebx + 0x5a4]
call fcn.00477674
mov esi, eax
dec esi
test esi, esi
jl 0x4a0e44
inc esi
xor edi, edi
mov eax, dword [ebp]
call fcn.00451750
mov edx, edi
mov eax, dword [ebx + 0x5a4]
call fcn.0047767c
mov byte [eax + 0x78], 0
inc edi
dec esi
jne 0x4a0e27
mov eax, dword [ebp]
call fcn.00451750
mov eax, dword [ebx + 0x5a4]
call fcn.0047792c
mov eax, dword [ebx + 0x5a4]
call fcn.00402e4c
xor eax, eax
mov dword [ebx + 0x5a4], eax
mov edx, dword [ebx + 0x5a0]
mov eax, edx
mov byte [edx + 0x78], 0
call fcn.00402e4c
xor eax, eax
mov dword [ebx + 0x5a0], eax
push 0
push 0
push 0
push 0x4a0eac
call sub.user32.dll_FindWindowA
mov edx, dword [ebx + 0x418]
mov cl, byte [edx + 0x210]
xor edx, edx
call fcn.004559a8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a4a30
Capabilities:
Find taskbar

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x4a4a6c
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4a4a69
push 0
push 0
mov edx, dword [ebx + 0x418]
mov ecx, dword [edx + 0x210]
cmp ecx, dword [edx + 0x208]
setl cl
mov dl, byte [edx + 0x210]
xchg edx, ecx
call fcn.004559a8
pop ebx
ret
Function at 0x4a4dd8
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
add esp, 0xffffff98
push 0
push 0x4a4e50
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4a4e48
push 0
push 0x4a4e60
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jbe 0x4a4e48
push esp
push ebx
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x4a4e48
cmp byte [0x4aa168], 0
je 0x4a4e1f
push 0
push ebx
call sub.user32.dll_ShowWindow
jmp 0x4a4e27
push 5
push ebx
call sub.user32.dll_ShowWindow
mov al, byte [0x4aa168]
xor al, 1
mov byte [0x4aa168], al
lea eax, [esp + 0x10]
push eax
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x476af0]
call fcn.004795b0
add esp, 0x68
pop ebx
ret

Function at 0x4a4e98
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x59c], 0
jne 0x4a4f4d
push 0
push 0x4a4f54
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4a4f41
push 0
push 0x4a4f64
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jbe 0x4a4f4d
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x4a4f4d
mov eax, dword [ebp - 4]
call fcn.00438514
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
push ebp
push 0x4a4f21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a4f2b
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00438514
push eax
call sub.user32.dll_PostMessageA
jmp 0x4a4f4d
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a0ef0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5014
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a501c
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5242
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x4aa494]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x48b334]
call fcn.0044a830
mov dword [ebp - 4], eax
push 0x4a5258
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4a5280
mov edx, 0x4a5298
mov eax, ebx
call fcn.004a5ef4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004323d4
push 0x4a52a8
lea eax, [ebp - 0x10]
push eax
mov edx, 0x4a5298
mov ecx, 0x4a52b4
mov eax, ebx
call fcn.004a5ef4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
call fcn.004323d4
push 0x4a52d0
lea eax, [ebp - 0x14]
push eax
mov edx, 0x4a5298
mov ecx, 0x4a52f4
mov eax, ebx
call fcn.004a5ef4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
call fcn.004323d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
mov edx, 0x4a5310
call fcn.004866a8
push 0x4a533c
lea eax, [ebp - 0x18]
push eax
mov edx, 0x4a5298
mov ecx, 0x4a534c
mov eax, ebx
call fcn.004a5ef4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
call fcn.004323d4
mov eax, dword [ebx + 0x388]
cmp byte [eax + 0x58], 0
je 0x4a511a
mov dl, 3
mov eax, dword [ebp - 4]
call fcn.0044c0b8
xor eax, eax
push ebp
push 0x4a520b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xd8]
dec eax
jne 0x4a51f5
mov ecx, 0x20006
mov dl, 1
mov eax, dword [0x453b40]
call fcn.00453c88
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a51ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000000
mov eax, dword [ebp - 8]
call fcn.00453d20
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
call fcn.004323a4
mov eax, dword [ebp - 0x1c]
call fcn.004a7934
mov eax, dword [ebp - 8]
call fcn.00453cf0
push 8
lea edx, [ebp - 0x24]
mov eax, dword [0x4aa494]
mov eax, dword [eax]
call fcn.00451dc4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408cd0
mov eax, dword [ebp - 0x20]
call fcn.00404014
push eax
push 0x4a5360
lea edx, [ebp - 0x28]
mov eax, dword [0x4aa494]
mov eax, dword [eax]
call fcn.00451dc4
mov eax, dword [ebp - 0x28]
call fcn.00404014
push eax
push 0x4a5368
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a51f5
mov eax, dword [ebp - 8]
call fcn.00402e4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5212
mov eax, dword [ebp - 4]
call fcn.00402e4c
ret