joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ad68
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x43ae07
cmp dword [ebx + 0x94], 0
jne 0x43ae01
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43acf0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x43ae01
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43adc7
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43ae01
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041919c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43add6
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x43b020
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x48ebec]
cmp dword [eax + 0x30], 0
je 0x43b17d
test bl, bl
jne 0x43b0ce
cmp dword [esi + 0x9c], 0
jne 0x43b0c3
mov eax, esi
call fcn.0043d708
push eax
push 0x43af4c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x43b094
mov eax, dword [0x48ebec]
call fcn.0043dcf8
test al, al
je 0x43b094
mov eax, dword [0x48ec10]
call fcn.0040630c
mov edi, eax
cmp edi, 0
jl 0x43b094
push 0
mov eax, dword [0x48ec10]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x43b07e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x43b0c3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041919c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x43b0a3
inc dword [esi + 0x9c]
jmp 0x43b17d
cmp dword [esi + 0x9c], 0
jle 0x43b17d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x43b17d
cmp dword [esi + 0x44], 0
je 0x43b129
mov eax, dword [0x48ebec]
call fcn.0043dcf8
test al, al
je 0x43b129
mov eax, dword [0x48ec10]
call fcn.0040630c
mov edi, eax
cmp edi, 0
jl 0x43b129
push 5
mov eax, dword [0x48ec10]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x43b113
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x43b158
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041919c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x43b138
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x48ec10
mov ecx, 1
mov edx, dword [0x43af2c]
call fcn.004064c0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x43bc64
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x43bcce
mov eax, ebx
call fcn.0043dcf8
test al, al
jne 0x43bcce
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405138
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x43bcbb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x43bcdb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040509c
jmp 0x43bcdb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040509c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x43cf0c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x43cf7a
mov eax, esi
call fcn.00456b40
test al, al
je 0x43cf7a
mov eax, dword [ebx + 0x84]
call fcn.00456844
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43cf7a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x43cf6e
push 0
mov eax, dword [ebx + 0x84]
call fcn.00456844
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044e8e8
jmp 0x43cf7a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0043cd48
pop esi
pop ebx
ret

Function at 0x43edb4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405048
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ee02
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004052b8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443ee4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444017
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x422b64]
call fcn.00422c34
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x443fed
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00422cd4
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.004052b8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x44402c
call fcn.00405360
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00422d38
lea ecx, [ebp - 4]
mov edx, 0x444068
mov eax, dword [ebp - 0xc]
call fcn.00422f80
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040f248
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x443fd0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x444074
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4885d4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443fd7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4440c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x44410b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4440ee
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4440ff
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x44410b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x44c188
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x48ec94], 0
je 0x44c2d1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x489a8c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x44c2d1
mov eax, dword [0x48ec98]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x48ec94]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44c2a0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x48ec94]
call fcn.0041919c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44c298
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x44c298
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x44c298
mov eax, dword [ebp - 0x14]
call fcn.00456844
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c298
push ebp
call fcn.0044c144
pop ecx
test al, al
jne 0x44c298
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.0040435c
test al, al
je 0x44c298
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.0040435c
cmp byte [ebp - 1], 0
je 0x44c298
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x44c298
mov edx, dword [ebp - 0x14]
mov eax, dword [0x48ec98]
call fcn.0044b8b4
inc edi
dec ebx
jne 0x44c1ed
mov eax, dword [0x48ec98]
cmp dword [eax + 8], 0
jle 0x44c2b8
mov eax, dword [0x48ec98]
call fcn.0044b96c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44c2d1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044bfa8
pop ecx
test al, al
jne 0x44c2d1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453718
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040727c
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0044e510
test ebx, ebx
jne 0x45376b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00453654
mov ebx, eax
test ebx, ebx
je 0x453856
cmp esi, ebx
je 0x453794
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4537a9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4537e1
add eax, 0xffffff5f
sub eax, 2
jb 0x4537f9
dec eax
sub eax, 2
jb 0x45380d
dec eax
sub eax, 2
jb 0x453803
jmp 0x453817
add eax, 0xfffffdff
sub eax, 2
jb 0x4537f9
dec eax
sub eax, 2
jb 0x45380d
dec eax
sub eax, 2
jb 0x453803
jmp 0x453817
mov byte [esp + 0x120], 0
jmp 0x45381f
mov byte [esp + 0x120], 2
jmp 0x45381f
mov byte [esp + 0x120], 1
jmp 0x45381f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004314ac
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0044fc80
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x453858
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45b9ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x489ce4]
cmp byte [eax + 0xc], 0
je 0x45bb19
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45bb12
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48eca4], 0
jne 0x45ba00
push 0x45bb20
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45bb28
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eca4], eax
cmp dword [0x4887a4], 0
jne 0x45bafb
push 0x45bb38
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4887a4], eax
cmp dword [0x4887a4], 0
je 0x45bafb
push 0x45bb44
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eca8], eax
push 0x45bb54
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecac], eax
push 0x45bb68
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecb0], eax
push 0x45bb80
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecb4], eax
push 0x45bb98
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecb8], eax
push 0x45bbac
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecbc], eax
push 0x45bbc4
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecc0], eax
push 0x45bbdc
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecc4], eax
push 0x45bbf8
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48ecc8], eax
push 0x45bc04
mov eax, dword [0x4887a4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48eccc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb19
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x47b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47b63a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047b5d0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00478d90
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004788a8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b641
lea eax, [ebp - 4]
call fcn.00405048
ret
Function at 0x4025a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol ebx, 0x3e
rcr eax, 0x10
ror eax, 0x93
inc edi
mov esi, 0xa2
sub edx, 0xa8
inc eax
mov eax, 0xb2
or ebx, 0x5f
neg edx
not edx
inc ebx
bswap edi
sbb esi, 0x60
sbb edi, 0x6f
neg eax
add eax, 0x47
or edx, 0xec
neg ebx
rcl edi, 0x35
not esi
dec eax
neg edi
mov eax, 0xb
rcl edx, 0x4e
sbb eax, 0x74
neg eax
neg esi
add ebx, 0
and eax, 0x85
and esi, 0xb7
sbb edx, 0
inc esi
add eax, 0x58
inc edx
sub edi, 0xc9
dec edx
and ebx, 0x89
sbb ebx, 0x27
rol edi, 0xfa
imul ebx
sbb edi, 0x42
rcr edx, 0x22
rcr esi, 0x9c
ror eax, 0xc5
and edx, 0x16
bswap edi
dec ebx
add esi, 0x23
add esi, 0xf4
xor ecx, ecx
xor edi, edi
imul edx
ror esi, 0x91
rcr eax, 0x26
inc edx
bswap esi
neg esi
or eax, 0x5f
not esi
dec eax
not esi
or esi, 0x3d
not eax
mov ebx, 0x8b
neg edi
sbb eax, 0x56
inc edx
inc esi
not edx
mov eax, 0xad
sub eax, 0x45
ror edi, 0x60
neg edx
inc esi
mov eax, 0xe
bswap eax
not edx
bswap esi
or esi, 0x7e
imul esi
rol edx, 0x5d
inc edi
not eax
dec ebx
rol eax, 0x8f
rcl ebx, 0xed
inc edx
imul esi
not eax
bswap esi
rcr edi, 0xc8
and eax, 0x9c
not edi
inc edi
not ebx
imul eax
imul esi
add esi, 0x87
rcr edx, 0x14
rol ebx, 0xa7
neg ebx
mov ecx, dword [ebp + 0xc]
rol edx, 0x53
sub edx, 0xe
dec eax
imul edx
mov edi, 0x64
and esi, 0xb4
rcl edx, 0x2d
and ebx, 0x80
not esi
sub eax, 5
or ebx, 0x80
bswap edx
bswap edi
mov esi, 0x33
imul eax
imul ebx
bswap ebx
rcl edi, 0x9a
mov edx, 0xc5
dec esi
not edi
sbb edi, 0x6b
not edx
ror eax, 0x6c
neg ebx
imul edx
neg edi
sbb edx, 0x9a
imul edi
inc eax
sub edx, 0x43
sbb edx, 0xee
mov ebx, 0xfb
rcl esi, 0x27
and esi, 0xfd
rcl edx, 0x6e
rcl esi, 0xc8
bswap ebx
ror eax, 0x52
rol eax, 0x38
add edx, 0x2a
rcl esi, 0xab
mov edx, 0x61
rol edx, 0x1a
and ebx, 0xeb
and edi, 0xc6
add edi, 0x93
sub edx, 0xff
dec esi
ror esi, 0x72
mov edi, dword [ebp + 8]
xor eax, esi
xor ebx, esi
xor ebx, ebx
not byte [edi]
mov eax, eax
xor esi, esi
xor esi, esi
xor esi, ebx
xor eax, esi
mov ebx, eax
xor esi, eax
xor eax, eax
mov esi, eax
add byte [edi], 0x87
xor esi, esi
xor ebx, ebx
mov esi, ebx
mov esi, ebx
mov esi, esi
xor ebx, eax
mov ebx, ebx
mov ebx, eax
xor ebx, ebx
sub byte [edi], 0x54
mov esi, esi
mov esi, ebx
mov eax, eax
mov ebx, eax
xor esi, esi
mov ebx, esi
mov esi, esi
xor eax, ebx
mov esi, esi
imul byte [edi]
inc edi
loop 0x40276c
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407faa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46c094]
jne 0x407fb4
repz ret
jmp fcn.0040c985
Function at 0x40e18d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040af4f
and dword [ebp - 4], 0
cmp dword [0x46d614], 0
mov ebx, eax
jne 0x40e23e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40e2ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40e2ef
push eax
call fcn.0040aedd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46d614], eax
call esi
push eax
call fcn.0040aedd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46d618], eax
call esi
push eax
call fcn.0040aedd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46d61c], eax
call esi
push eax
call fcn.0040aedd
pop ecx
mov dword [0x46d624], eax
test eax, eax
je 0x40e23e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040aedd
pop ecx
mov dword [0x46d620], eax
mov eax, dword [0x46d620]
cmp eax, ebx
je 0x40e296
cmp dword [0x46d624], ebx
je 0x40e296
push eax
call fcn.0040af58
push dword [0x46d624]
mov esi, eax
call fcn.0040af58
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40e296
test edi, edi
je 0x40e296
call esi
test eax, eax
je 0x40e28d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40e28d
test byte [ebp - 0xc], 1
jne 0x40e296
or dword [ebp + 0x10], 0x200000
jmp 0x40e2cf
mov eax, dword [0x46d618]
cmp eax, ebx
je 0x40e2cf
push eax
call fcn.0040af58
pop ecx
test eax, eax
je 0x40e2cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40e2cf
mov eax, dword [0x46d61c]
cmp eax, ebx
je 0x40e2cf
push eax
call fcn.0040af58
pop ecx
test eax, eax
je 0x40e2cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46d614]
call fcn.0040af58
pop ecx
test eax, eax
je 0x40e2ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40e2f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404a1a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0040ffd1
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0040ffd1
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x404ab0
mov dword [ebp - 0x18], esp
mov eax, 0x10
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404aad
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0x11
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404adc
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x12
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404b0a
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x55af15
push 0
mov eax, 0x13
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404b36
push 6
call fcn.0040ffd7
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x14
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404bc5
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0xf
call fcn.0040ffdd
cmp dword [ebp - 0x18], esp
je 0x404bea
push 6
call fcn.0040ffd7
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x404bf2
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0040ffcb
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0040ffcb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x408540
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0040ffd1
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0040ffd1
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.0040ffd1
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0x2d
call fcn.0040ffdd
cmp dword [ebp - 0x20], esp
je 0x4085fd
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 4], eax
mov eax, 0x55af15
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408616
push ebx
call fcn.0040ffcb
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x2e
call fcn.0040ffdd
cmp dword [ebp - 0x20], esp
je 0x408645
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x48529f
mov eax, 0x2f
call fcn.0040ffdd
cmp dword [ebp - 0x20], esp
je 0x40866f
push 6
call fcn.0040ffd7
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x30
call fcn.0040ffdd
cmp dword [ebp - 0x20], esp
je 0x408703
push 6
call fcn.0040ffd7
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x31
call fcn.0040ffdd
cmp dword [ebp - 0x20], esp
je 0x408728
push 6
call fcn.0040ffd7
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x408730
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408741
push ebx
call fcn.0040ffcb
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0040ffcb
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0040ffcb
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.0040ffcb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret