joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a39b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x4a3a76
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4d70f4]
mov eax, dword [eax + 0xb0]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a3a80
mov ecx, dword [esp + 0x14]
call fcn.004a39b0
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3a80
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4a3a80
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x4a3a00
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3a90
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
test ebp, ebp
je 0x4a3b84
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x4a3ab6
cmp byte [edi], 0
jne 0x4a3abe
test ebx, ebx
je 0x4a3b84
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x4d70f4]
mov eax, dword [eax + 0xb0]
or eax, 0x2001f
push eax
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a3b89
test ebx, ebx
jne 0x4a3b6b
mov ecx, dword [esp + 0x18]
call fcn.004a39b0
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3b89
mov eax, dword [0x4fd8f4]
test al, 1
jne 0x4a3b3b
push str.RegDeleteKeyExA
or eax, 1
push str.advapi32
mov dword [0x4fd8f4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x4fd8f8], ecx
jmp 0x4a3b41
mov ecx, dword [0x4fd8f8]
mov eax, dword [0x4d70f4]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x4a3b5f
test ecx, ecx
je 0x4a3b5f
push 0
push eax
push edi
push ebp
call ecx
mov esi, eax
jmp 0x4a3b89
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
jmp 0x4a3b89
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a3b89
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.0044d3d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4acb50
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x148
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4acc06
cmp byte [edi], 0
je 0x4acc06
push 4
push 0x4cfd90
push edi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcmp]
add esp, 0xc
test eax, eax
je 0x4acb89
mov eax, edi
mov esi, eax
jmp 0x4acb92
lea eax, [edi + 4]
mov esi, eax
test eax, eax
je 0x4acbbb
mov dl, byte [eax]
test dl, dl
je 0x4acbbb
nop dword [eax + eax]
mov ecx, 0x4ce2fc
mov al, 0x3f
cmp dl, al
je 0x4acbd8
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4acba7
mov dl, byte [esi + 1]
inc esi
test dl, dl
jne 0x4acba0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test ebx, ebx
je 0x4acbc8
mov dword [ebx], eax
cmp eax, 0xffffffff
setne al
pop edi
pop esi
pop ebx
add esp, 0x148
ret
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4acc06
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4acbfa
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x148
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x148
ret

Function at 0x4ad130
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x1c]
or eax, 1
push eax
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x4ad1d2
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x104
push eax
push edi
push 0
push 0
push str.InstallDir
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4ad1d2
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4ad1d2
dec ecx
mov dword [esp + 0x18], ecx
cmp byte [ecx + edi], 0
jne 0x4ad1ba
mov eax, ecx
test ecx, ecx
je 0x4ad1d7
cmp byte [ecx + edi - 1], 0
jne 0x4ad1d7
add ecx, 0xffffffff
mov eax, ecx
mov dword [esp + 0x18], ecx
jne 0x4ad1a5
pop edi
pop ecx
ret
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x104
jae 0x4ad1d2
mov byte [ecx + edi], 0
mov eax, dword [esp + 0x18]
pop edi
pop ecx
ret
mov byte [edi], 0
xor eax, eax
pop edi
pop ecx
ret
Function at 0x4ada30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
push edi
mov edi, edx
mov dword [esp + 0x24], edi
test ebp, ebp
je 0x4ada5b
push 2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov dword [esp + 0x1c], eax
jmp 0x4ada65
mov esi, dword [0x4d99e0]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x4adbf6
test edi, edi
jns 0x4ada7a
mov eax, edi
neg eax
movzx eax, ax
jmp 0x4adaab
test edi, edi
mov dword [esp + 0x2c], ebx
mov eax, 1
mov dword [esp + 0x30], 0x4dc35d
cmovne eax, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 0x4ada00
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov eax, dword [esp + 0x30]
cmp eax, 0x4dc35d
je 0x4adbcf
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4adbcf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4adbcf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4adbcf
cmp dword [esp + 0x38], 0xffffffff
mov ebx, dword [esp + 0x3c]
cmovne ebx, dword [esp + 0x38]
test ebx, ebx
jne 0x4adb0d
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x18]
mov ebx, eax
lea eax, [ecx + 6]
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
xor ebp, ebp
movzx eax, word [ecx + 4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4adbc9
mov edi, dword [esp + 0x20]
mov esi, 0x100
movzx edx, byte [edi]
test edx, edx
cmove edx, esi
xor ecx, ecx
cmp edx, ebp
jle 0x4adb4c
cmp ebp, ebx
setl cl
jmp 0x4adb51
cmp edx, ebx
setge cl
test ecx, ecx
mov eax, edi
cmove eax, dword [esp + 0x14]
add edi, 0xe
test ecx, ecx
mov dword [esp + 0x14], eax
cmove edx, ebp
sub dword [esp + 0x18], 1
mov ebp, edx
jne 0x4adb37
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
test eax, eax
je 0x4adbc9
movzx eax, word [eax + 0xc]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x4adbc9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4adbc9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4adbc9
push 0
push 0
push 0
push 0x30000
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ebx, eax
jmp 0x4adbcb
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4adbe7
test ebx, ebx
je 0x4adbe7
mov dword [eax], esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret
test ebp, ebp
je 0x4adbf2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4adbdd
test edi, edi
jle 0x4adc0f
lea eax, [edi - 1]
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
xor eax, eax
cmp edi, 0xffffffff
cmovl eax, edi
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4af290
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x410
push edi
push 0x400
lea eax, [esp + 0x18]
mov dword [esp + 8], edx
push 0
push eax
mov edi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4af429
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4af429
mov ecx, dword [esp + 0x418]
test ecx, ecx
je 0x4af332
cmp dword [ecx], 0
je 0x4af332
push esi
xor edx, edx
mov eax, ecx
mov esi, 0x4d059c
nop dword [eax]
cmp ecx, 0x4d8234
jne 0x4af31c
mov eax, esi
jmp 0x4af31e
mov eax, dword [eax]
mov al, byte [eax]
add esi, 5
mov byte [esp + edx + 0x18], al
inc edx
cmp dword [ecx + edx*4], 0
lea eax, [ecx + edx*4]
jne 0x4af310
pop esi
lea ecx, [esp + 0x14]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4af340
push 0
sub ecx, edx
lea eax, [esp + 0x18]
push ecx
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4af429
push 0x400
lea eax, [esp + 0x18]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x42c]
add esp, 0xc
cmp ecx, 0x80
jne 0x4af38d
mov eax, 0x660e
jmp 0x4af39d
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea edx, [esp + 0xc]
shl ecx, 0x10
push edx
push ecx
push dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4af429
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x4af429
cmp byte [esp + 0x41c], 0
je 0x4af3f1
mov eax, dword [esp + 4]
add eax, 0x10
push eax
lea eax, [esp + 8]
push eax
push edi
push 0
push 1
push 0
push dword [esp + 0x24]
call dword [0x4d99a4]
jmp 0x4af407
lea eax, [esp + 4]
push eax
push edi
push 0
push 1
push 0
push dword [esp + 0x20]
call dword [0x4d99a0]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 4]
pop edi
add esp, 0x410
ret
xor eax, eax
pop edi
add esp, 0x410
ret
Function at 0x4b0320
Capabilities:
Write clipboard data

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, 0x4dba7c
push esi
mov esi, edx
call fcn.004064e0
test eax, eax
jne 0x4b0351
push 0x4c3c29
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4dba98
call fcn.0044da60
pop esi
pop ebx
add esp, 8
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + esi]
lea esi, [ebx + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
ja 0x4b03d9
mov ecx, dword [ebx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4b03d9
mov edi, esi
add esi, 4
cmp esi, eax
ja 0x4b03d9
mov edi, dword [edi]
mov ebx, esi
add esi, edi
cmp esi, eax
ja 0x4b03d9
xor eax, eax
test edi, edi
sete al
add eax, edi
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4b048d
test edi, edi
je 0x4b03c3
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4b0428
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, esi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [esp + 0x14]
lea esi, [ebx + 4]
cmp esi, eax
jbe 0x4b0367
cmp dword [0x4dba94], 0
je 0x4b041b
cmp dword [0x4dba84], 0
je 0x4b0401
push dword [0x4dba7c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dba84], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dba94], 0
mov dword [0x4dba7c], 0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4dba94], 0
je 0x4b0471
cmp dword [0x4dba84], 0
je 0x4b0457
push dword [0x4dba7c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dba84], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dba94], 0
mov dword [0x4dba7c], 0
push 0x4c3c29
push 0x4c3ff0
mov ecx, 0x4dba98
call fcn.0044da60
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x4dba94], 0
je 0x4b04cf
cmp dword [0x4dba84], 0
je 0x4b04b5
push dword [0x4dba7c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4dba84], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4dba94], 0
mov dword [0x4dba7c], 0
push 0x4c3c29
push str.Out_of_memory.
mov ecx, 0x4dba98
call fcn.0044da60
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x4b1230
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
push esi
push edi
mov edi, edx
mov al, byte [edi]
cmp al, 0x41
je 0x4b1246
cmp al, 0x61
jne 0x4b12aa
cmp byte [edi + 1], 0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
jne 0x4b12b2
cmp byte [ecx], 0
jne 0x4b12b2
cmp byte [eax], 0
jne 0x4b12b2
cmp byte [ebp], 0
jne 0x4b12b2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4b12aa
cmp byte [ebx + 0xca], 0
jne 0x4b128f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b12aa
mov ecx, esi
call fcn.004b26f0
test al, al
jne 0x4b12aa
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b12a3
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
test dl, dl
jne 0x4b12d4
cmp byte [edi], dl
jne 0x4b12d4
cmp byte [ecx], dl
jne 0x4b12d4
cmp byte [eax], dl
jne 0x4b12d4
cmp byte [ebp], dl
jne 0x4b12d4
mov ecx, ebx
call fcn.004b1ad0
jmp 0x4b12ee
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push edx
push ebp
push eax
push ecx
mov edx, edi
mov ecx, ebx
call fcn.004b1900
add esp, 0x1c
test eax, eax
jne 0x4b12f7
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov ecx, eax
pop ebx
jmp fcn.004b1310
Function at 0x4b1690
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x4b16fa
lea eax, [esp + 0xc]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x4b1707
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b1707
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4b1707
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b1707
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x4b1773
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword fs:[0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
nop word [eax + eax]
cmp dword [0x4dba60], ebx
jne 0x4b1749
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401870
jmp 0x4b174d
push 0xa
call ebp
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b176b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jg 0x4b1730
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x4b1900
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e64
call fcn.004c1c60
push ebx
mov ebx, dword [esp + 0x8e6c]
push ebp
mov ebp, edx
mov edx, dword [esp + 0x8e74]
push esi
mov esi, dword [esp + 0x8e7c]
push edi
mov al, byte [ebp]
mov edi, ecx
cmp al, 0x41
je 0x4b1932
cmp al, 0x61
jne 0x4b1995
cmp byte [ebp + 1], 0
jne 0x4b1995
cmp byte [ebx], 0
jne 0x4b1995
cmp byte [edx], 0
jne 0x4b1995
cmp byte [esi], 0
jne 0x4b1995
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4b1974
cmp byte [edi + 0xca], 0
jne 0x4b1974
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b1972
mov ecx, esi
call fcn.004b26f0
test al, al
je 0x4b1974
xor esi, esi
cmp byte [esp + 0x8e88], 0
je 0x4b1988
test esi, esi
je 0x4b1988
mov dword [edi + 0xa4], esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
test al, al
jne 0x4b19b5
cmp byte [ebx], al
jne 0x4b19b5
cmp byte [edx], al
jne 0x4b19b5
cmp byte [esi], al
jne 0x4b19b5
call fcn.004b1ad0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
lea ecx, [esp + 0x10]
call fcn.0044f390
push esi
push edx
push ebx
push ebp
push edi
call fcn.004b2840
test eax, eax
je 0x4b1a8a
test byte [esp + 0x10], 2
mov al, byte [esp + 0x8e84]
mov byte [esp + 0xc3d], al
mov eax, dword [esp + 0x8e8c]
mov dword [esp + 0xc4c], eax
mov eax, dword [esp + 0x8e90]
mov dword [esp + 0xc50], eax
je 0x4b1a97
mov esi, dword [esp + 0x82c]
cmp esi, 0xffff
je 0x4b1a62
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b1a8a
cmp byte [edi + 0xca], 0
mov esi, dword [esp + 0x82c]
jne 0x4b1a62
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b1a45
mov ecx, esi
call fcn.004b26f0
test al, al
je 0x4b1a5b
push 0xfffffffffffffff0
push dword [esp + 0x830]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x4b1a8a
mov esi, dword [esp + 0x82c]
cmp dword [esp + 0xc64], esi
je 0x4b1a7b
lea ecx, [esp + 0x10]
mov dword [esp + 0xc64], esi
call fcn.004b2cb0
push 0
lea ecx, [esp + 0x14]
call fcn.004b2d90
test eax, eax
jne 0x4b1aa7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
lea eax, [esp + 0x10]
push eax
push 0x4b1b70
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [esp + 0x8e88], 0
mov eax, dword [esp + 0xc44]
je 0x4b1a8c
test eax, eax
je 0x4b1a8c
mov dword [edi + 0xa4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e64
ret
Function at 0x4b2cb0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc54]
test ecx, ecx
je 0x4b2d86
mov eax, dword [esi]
test eax, eax
je 0x4b2d86
push edi
test al, 1
jne 0x4b2cdc
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x4b2cf5
push 0x7fff
lea edi, [esi + 0xc60]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x4b2cf5
mov byte [edi], al
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test al, 4
je 0x4b2d12
lea eax, [esi + 0xc5c]
push eax
push dword [esi + 0xc54]
call edi
mov eax, dword [esi]
test al, 0x20
je 0x4b2d4c
lea eax, [esp + 8]
push eax
push dword [esi + 0xc54]
call edi
test eax, eax
je 0x4b2d4c
movzx eax, byte [esi + 0xc2c]
lea edx, [esi + 0x8d60]
push eax
push ecx
mov ecx, dword [esp + 0x10]
call fcn.00477f70
add esp, 8
test eax, eax
jne 0x4b2d4c
mov byte [esi + 0x8d60], al
mov eax, dword [esi]
pop edi
test al, 8
je 0x4b2d6d
push 0x101
lea eax, [esi + 0x8c5f]
push eax
push dword [esi + 0xc54]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, dword [esi]
test eax, 0x100
je 0x4b2d86
push dword [esi + 0xc54]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esi + 0xc58], eax
pop esi
pop ecx
ret

Function at 0x4b3830
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e64
call fcn.004c1c60
mov edx, dword [ecx + 8]
test edx, edx
je 0x4b38d0
lea ecx, [esp]
call fcn.0044f390
mov al, byte [esp + 0x8e68]
mov byte [esp + 0xc48], al
mov eax, dword [esp + 0x8e6c]
mov dword [esp + 0xc4c], eax
mov eax, ecx
push eax
push 0x4b4000
mov dword [esp + 0xc4c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], 0
je 0x4b38d0
mov eax, dword [0x4d70f4]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4b38d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4dba60], eax
je 0x4b38bd
mov eax, dword [0x4d70f4]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add esp, 0x8e64
ret 8
mov ecx, dword [0x4d70f4]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.00401870
mov eax, 1
add esp, 0x8e64
ret 8
Function at 0x4b3ba0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8e74
call fcn.004c1c60
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x4b3d90
push 0
call fcn.004b3da0
test eax, eax
jne 0x4b3bd3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x4d70f4]
mov ebx, eax
mov ecx, esi
push ebx
call fcn.004b3e40
mov edx, dword [0x4db1e8]
xor ecx, ecx
test eax, eax
cmovne edx, ecx
lea ecx, [esp + 0x18]
mov dword [0x4db1e8], edx
call fcn.0044f390
cmp byte [ebp + 8], 0
je 0x4b3c17
mov byte [esp + 0xc45], 0
test edx, edx
je 0x4b3c1f
mov byte [esp + 0xc45], 1
mov eax, dword [0x4db1e4]
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
mov eax, dword [esi + 8]
mov dword [esp + 0xc5c], eax
lea eax, [esp + 0x18]
push eax
push 0x4b3ed0
mov dword [esp + 0xc60], edx
call edi
mov eax, dword [esp + 0xc4c]
test eax, eax
je 0x4b3d58
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x4b2630
mov dword [esp + 0x1c], 0
call edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4b3cbb
mov ecx, dword [0x4db1e8]
xor eax, eax
mov edx, dword [esp + 0xc4c]
mov esi, dword [0x4db1e4]
test ecx, ecx
jle 0x4b3ca0
cmp dword [esi + eax*4], edx
je 0x4b3cb2
inc eax
cmp eax, ecx
jl 0x4b3c96
cmp ecx, 0x1f4
jge 0x4b3cb2
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4db1e8], ecx
mov dword [esp + 0xc4c], edi
jmp 0x4b3cc2
mov edi, dword [esp + 0xc4c]
mov ecx, edi
call fcn.004b1310
mov ecx, dword [0x4db1e8]
xor eax, eax
mov edx, dword [esp + 0xc4c]
mov esi, dword [0x4db1e4]
test ecx, ecx
jle 0x4b3cec
cmp dword [esi + eax*4], edx
je 0x4b3cfe
inc eax
cmp eax, ecx
jl 0x4b3ce2
cmp ecx, 0x1f4
jge 0x4b3cfe
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4db1e8], ecx
mov eax, dword [0x4d70f4]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4b3d90
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4dba60], eax
je 0x4b3d37
mov eax, dword [0x4d70f4]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4d70f4]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.00401870
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4db1e8]
test eax, eax
je 0x4b3d90
cmp eax, 1
mov dword [0x4db1e8], 0
setg al
test al, al
je 0x4b3d90
mov ecx, dword [0x4db1e4]
push 0
mov dword [0x4db1e8], 1
mov dword [ecx], ebx
mov ecx, esi
call fcn.004b3ba0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4