joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4e37f4]
push ebx
push esi
push edi
lea eax, [eax + eax*4]
add eax, 0xa
shl eax, 5
push eax
call fcn.0049ebfd
add esp, 4
mov dword [0x4e7ca8], eax
test eax, eax
jne 0x439a77
pop edi
pop esi
pop ebx
ret
mov esi, dword [0x4e37f8]
mov edi, eax
inc dword [0x4e7cbc]
mov ecx, 0x28
push 0x4045f0
push 0x4ef6d80
push 0xe
push dword [0x4e7ccc]
rep movsd dword es:[edi], dword [esi]
mov dword [0x4e37f8], eax
mov dword [eax + 0x58], 0
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x4e8f30], 0
jne 0x439ac3
mov ebx, 1
jmp 0x439b7c
mov eax, dword [0x4e37f8]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [eax + 0x53], 0
call esi
mov ecx, dword [0x4e37f8]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x44], 0x64
mov byte [0x4e9605], 1
call esi
mov ecx, dword [0x4e8eac]
mov dword [0x4e961c], eax
cmp ecx, dword [0x4e8eb0]
jne 0x439b0b
call fcn.0040709e
mov ecx, dword [0x4e8eac]
cmp ecx, dword [0x4e8ea8]
jb 0x439b20
mov eax, dword [0x4e9574]
mov dword [ecx], eax
mov ecx, dword [0x4e8eac]
add ecx, 0xc
mov dword [0x4e8eac], ecx
push 0
push 0
mov dword [ecx], 0
mov dword [ecx + 4], str.Auto_execute
mov dword [ecx + 8], 0
mov ecx, dword [0x4e8f30]
push 1
call fcn.00448550
mov ecx, dword [0x4e8eac]
mov ebx, eax
sub ecx, 0xc
mov dword [0x4e8eac], ecx
cmp ecx, dword [0x4e8ea8]
jb 0x439b75
mov ecx, dword [ecx]
mov dword [0x4e8ebc], ecx
mov dword [0x4e9574], ecx
mov byte [0x4e9605], 0
mov esi, dword [0x4e37f8]
dec dword [0x4e7cbc]
mov edi, dword [esi + 0x30]
test edi, edi
je 0x439bc7
cmp dword [edi + 8], 5
jne 0x439b9d
mov eax, dword [edi]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x439bad
push eax
call fcn.0049ebe2
add esp, 4
push 0x20
push dword [esi + 0x30]
call fcn.0049b1e8
mov dword [esi + 0x30], 0
add esp, 8
mov esi, dword [0x4e37f8]
pop edi
mov dword [esi + 0x3c], connect
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x43a1d0
Capabilities:
Check if file exists
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0xfffffffe
je 0x43a200
mov eax, dword [0x4e37f8]
lea ecx, [edi + 0x30]
mov dword [0x4e37f0], 0
mov byte [eax + 0x50], 0
call fcn.0043a150
lea ecx, [edi + 0x10]
call fcn.0043a1a0
push 0
push esi
mov ecx, 0x4e8ea8
call fcn.0040ac83
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push esi
call fcn.004a9cc7
pop edi
pop esi
Function at 0x443160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x10004
call fcn.004b5400
push edi
push dword [esp + 0x10014]
lea eax, [esp + 8]
push dword [esp + 0x10014]
push str._s_s
push 0x8001
push eax
call fcn.004814a0
add esp, 0x14
mov edi, eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4431e6
test al, 0x10
je 0x4431e6
lea ecx, [edi*2 + 0x204]
call fcn.0047e200
mov ecx, eax
test ecx, ecx
je 0x4431fd
push esi
mov esi, dword [esp + 0x10010]
lea eax, [edi*2 + 2]
push eax
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esi], ecx
call fcn.0049c720
add esp, 0xc
mov dword [esi + 4], edi
pop esi
pop edi
add esp, 0x10004
ret 0xc
mov eax, dword [esp + 0x1000c]
pop edi
mov dword [eax], 0x4cdea8
add esp, 0x10004
ret 0xc
call fcn.0040db20
int3

Function at 0x443210
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x208
cmp dword [0x4e9f78], 0
mov eax, dword [esp + 0x214]
push ebx
push ebp
mov ebx, ecx
mov byte [eax], 0
mov eax, dword [esp + 0x220]
push esi
mov dword [esp + 0x14], ebx
mov byte [eax], 0
jne 0x44329d
push str.Lib_
push dword [ebx + 0x6b8]
push 0x4e9f78
call fcn.00443160
lea eax, [esp + 0x10]
push eax
push 0
push 0x4000
push 0x4b7850
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor esi, esi
test eax, eax
push str.AutoHotkeyLib_
cmovns esi, dword [esp + 0x14]
push esi
push 0x4e9f80
call fcn.00443160
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Lib_
push dword [ebx + 0x6c8]
push 0x4e9f88
call fcn.00443160
mov ebx, dword [esp + 0x21c]
mov ebp, dword [esp + 0x218]
test ebx, ebx
jne 0x4432c3
mov ebx, ebp
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4432b4
sub ebx, ecx
sar ebx, 1
cmp ebx, 0xfd
ja 0x4433bf
mov edx, ebp
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
push edi
nop
xor esi, esi
mov ecx, dword [esi*8 + 0x4e9f78]
cmp word [ecx], 0
je 0x44333b
mov eax, dword [esi*8 + 0x4e9f7c]
lea edi, [ebx + ebx]
push edi
push edx
lea eax, [ecx + eax*2]
push eax
call fcn.0049c720
movq xmm0, qword [str..ahk]
add esp, 0xc
movq qword [edi + eax], xmm0
lea ecx, [edi + eax]
mov ax, word [0x4d5e34]
mov word [ecx + 8], ax
push dword [esi*8 + 0x4e9f78]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x443337
test al, 0x10
je 0x443392
mov edx, dword [esp + 0x10]
inc esi
cmp esi, 3
jl 0x4432e2
push 0x5f
push ebp
call fcn.0049c671
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4433be
sub ebx, ebp
sar ebx, 1
cmp ebx, 0xfe
jae 0x4433be
lea esi, [ebx + ebx]
push esi
lea eax, [esp + 0x20]
push ebp
push eax
mov dword [esp + 0x1c], eax
call fcn.0049c720
xor eax, eax
add esp, 0xc
mov word [esp + esi + 0x1c], ax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 2
jge 0x4433be
mov edx, dword [esp + 0x10]
jmp 0x4432e0
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x18]
push 0
push 0
push dword [esi*8 + 0x4e9f78]
mov byte [eax], 1
call fcn.0043af00
test eax, eax
jne 0x4433be
mov eax, dword [esp + 0x224]
mov byte [eax], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 0x10
Function at 0x44ce40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d0
push ebx
mov ebx, dword [esp + 0x3d8]
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44ce6d
push 0x64
lea ecx, [esp + 0x114]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x44ce77
xor eax, eax
mov word [esp + 0x110], ax
mov esi, dword [0x4e95bc]
xor eax, eax
mov word [esp + 0x10], ax
test esi, esi
je 0x44cf38
nop dword [eax]
cmp byte [esi + 0x12], 0
je 0x44ced3
push 0
push 0x4e6c78
push 0x4e6ccc
push 0
push dword [esi]
call fcn.004b5c08
add esp, 0x14
test eax, eax
je 0x44ceb7
mov eax, dword [eax + 0x14]
jmp 0x44cebe
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x20]
push eax
push 0x4d8068
lea eax, [esp + 0x18]
push 0x7d
push eax
call fcn.004814f0
add esp, 0x10
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x44ce90
cmp word [esp + 0x10], si
je 0x44cf38
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44cef0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7b
jbe 0x44cf29
mov esi, 0x7f
lea edi, [esp + 0x10]
sub esi, ecx
lea edi, [edi + ecx*2]
push esi
push 0x4d4ac4
push edi
call fcn.004aa0e4
add esp, 0xc
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x44cf38
cmp word [esp + ecx*2 + 0xe], 0x20
jne 0x44cf38
xor eax, eax
mov word [esp + ecx*2 + 0xe], ax
mov eax, dword [0x4e7ca8]
cmp byte [eax + 0x50], 0
je 0x44cf53
cmp byte [0x4e9605], 0
jne 0x44cf53
mov esi, 1
jmp 0x44cf55
xor esi, esi
mov eax, dword [0x4e7cbc]
cmp eax, 1
jle 0x44cf64
lea edi, [eax - 1]
jmp 0x44cf66
xor edi, edi
mov cl, 1
call fcn.0041c110
lea edx, [esp + 0x1d8]
mov cl, al
call fcn.0041c4f0
mov ecx, dword [0x4e7cbc]
mov edx, 0x4cdea8
push eax
push dword [0x4e7cd0]
mov eax, dword [0x4e7cac]
push ecx
sub eax, esi
cmp ecx, 1
push eax
mov eax, str.__preempted:_they_will_resume_when_the_current_thread_finishes_
mov ecx, 0x4d26e8
cmovle eax, edx
cmp dword [0x4e7ef0], 0
push eax
push edi
lea eax, [esp + 0x28]
mov edx, 0x4d26e0
push eax
push dword [0x4e95c4]
mov eax, ecx
push dword [0x4e95c8]
cmovne eax, edx
cmp dword [0x4e7ef4], 0
push eax
cmovne ecx, edx
lea eax, [esp + 0x138]
push ecx
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push 0xfffe
push ebx
call fcn.004814a0
mov edi, 0xfffe
add esp, 0x3c
mov edx, edi
sub edx, eax
lea esi, [ebx + eax*2]
mov ecx, esi
call fcn.00413480
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d010
sub ecx, edx
mov eax, str._r_nPress__F5__to_refresh.
sar ecx, 1
cmp dword [0x4e7cd8], 0
lea esi, [esi + ecx*2]
mov ecx, str._r_nKey_History_has_been_disabled_via_KeyHistory_0_.
cmove eax, ecx
push eax
mov eax, esi
sub eax, ebx
sar eax, 1
sub edi, eax
push edi
push esi
call fcn.004814a0
add esp, 0xc
lea eax, [esi + eax*2]
pop edi
pop esi
pop ebx
add esp, 0x3d0
ret 8
Function at 0x44ebe0
Capabilities:
Check if file exists
Get file attributes
Set current directory

Disassembly:
sub esp, 0x51c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebp
push esi
push edi
push dword [0x4e95f8]
mov edi, ecx
mov byte [esp + 0x17], dl
mov ebp, edi
mov esi, 0x4cdea8
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x44ecb3
xor esi, esi
lea eax, [esp + 0x118]
push esi
push ecx
push eax
push str.InstallDir
mov edx, str.SOFTWAREAutoHotkey
call fcn.00482ad0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x44ec6b
nop dword [eax]
test esi, esi
jne 0x44ec6b
mov esi, 0x100
lea eax, [esp + 0x118]
push esi
push ecx
push eax
push str.InstallDir
mov edx, str.SOFTWAREAutoHotkey
call fcn.00482ad0
mov edx, eax
add esp, 0x10
test edx, edx
je 0x44ec40
xor ecx, ecx
nop dword [eax]
movzx eax, word [esp + ecx + 0x118]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x31e], ax
test ax, ax
jne 0x44ec70
test edx, edx
je 0x44ed42
lea eax, [esp + 0x320]
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44ed42
mov eax, dword [esp + 0x14]
mov esi, 0x4cdea8
cmp byte [esp + 0x13], 0
je 0x44ecde
cmp eax, 0xffffffff
je 0x44ecde
push edi
push str._script__s
lea eax, [esp + 0x20]
push 0x40
push eax
call fcn.004814a0
mov ebp, dword [0x4e95f4]
lea esi, [esp + 0x28]
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push ebp
mov ecx, 0x4e8f30
call fcn.0044d060
test eax, eax
jne 0x44ed2a
push edi
push str.Could_not_launch__s
lea eax, [esp + 0xa0]
push 0x40
push eax
call fcn.004814a0
push 0
push 0
xorps xmm3, xmm3
lea ecx, [esp + 0xb0]
mov edx, 0x10
call fcn.00486910
add esp, 0x18
mov eax, dword [0x4e4e9c]
mov ecx, 0x4cdea8
test eax, eax
je 0x44ed3f
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x51c
ret

Function at 0x4500a0
Capabilities:
Set current directory

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
movzx eax, word [esi]
test ax, ax
je 0x4500d6
cmp word [esi + 2], 0x3a
jne 0x4500d6
cmp word [esi + 4], 0
jne 0x4500d6
mov word [esp + 4], ax
lea esi, [esp + 4]
xor eax, eax
mov dword [esp + 6], 0x5c003a
mov word [esp + 0xa], ax
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4500eb
mov eax, 0xa0070000
pop esi
add esp, 8
ret
cmp byte [0x4e9604], 0
je 0x4500fb
mov ecx, esi
call fcn.00450110
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x450110
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10000
call fcn.004b5400
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
lea ecx, [esp + 4]
cmove ecx, esi
pop esi
test ecx, ecx
je 0x450147
push ecx
push ecx
mov ecx, 0x4e4e98
call fcn.0044da30
add esp, 0x10000
ret
Function at 0x450150
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10000
call fcn.004b5400
lea eax, [esp]
push eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x450180
lea eax, [esp]
push eax
call fcn.004a922e
add esp, 4
add esp, 0x10000
ret
xor eax, eax
add esp, 0x10000
ret

Function at 0x454860
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, cl
test bl, bl
jne 0x45486b
xor al, al
pop ebx
ret
sub edx, 1
je 0x454890
movzx eax, bl
push eax
sub edx, 1
je 0x454886
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
pop ebx
ret
mov al, bl
dec al
cmp al, 5
ja 0x45489d
cmp bl, 3
jne 0x4548a5
mov al, bl
add al, 0x66
cmp al, 5
ja 0x4548bc
cmp dword [0x4e7ef0], 0
movzx eax, bl
je 0x4548ed
mov al, byte [eax + 0x4e7f00]
shr al, 7
pop ebx
ret
cmp dword [0x4e7ef4], 0
je 0x4548ea
push 0
xor edx, edx
call fcn.0041c350
add esp, 4
test al, al
je 0x4548dc
mov cl, 1
call fcn.0041c110
movzx eax, bl
pop ebx
mov al, byte [eax + 0x4e7f00]
shr al, 7
ret
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
pop ebx
ret
Function at 0x457ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x43c
cmp word [ecx], 0
push ebx
push ebp
push esi
mov esi, edx
je 0x457d2b
cmp word [esi], 0
je 0x457d2b
mov ebp, dword [esp + 0x44c]
cmp ebp, 1
je 0x457af4
cmp ebp, 2
je 0x457af4
xor bh, bh
jmp 0x457af6
mov bh, 1
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0x30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457b13
sub ecx, edx
sar ecx, 1
je 0x457b33
cmp word [esp + ecx*2 + 0x2e], 0x5c
jne 0x457b33
xor eax, eax
mov word [esp + ecx*2 + 0x2e], ax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x240]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0x23c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457b56
sub ecx, edx
sar ecx, 1
je 0x457b7c
cmp word [esp + ecx*2 + 0x23a], 0x5c
jne 0x457b7c
xor eax, eax
mov word [esp + ecx*2 + 0x23a], ax
mov bl, byte [esp + 0x450]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test bl, bl
je 0x457c15
lea eax, [esp + 0x30]
push eax
call esi
cmp eax, 0xffffffff
je 0x457d2b
test al, 0x10
je 0x457d2b
movzx eax, word [esp + 0x30]
mov ecx, eax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x457bbc
or ecx, 0x20
movzx eax, word [esp + 0x23c]
mov edx, eax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x457bd2
or edx, 0x20
cmp cx, dx
jne 0x457bdf
cmp word [esp + 0x32], 0x3a
je 0x457c15
movzx eax, bh
lea edx, [esp + 0x23c]
push 0
push eax
lea ecx, [esp + 0x38]
call fcn.00457ac0
add esp, 8
test al, al
je 0x457d2b
mov dl, 1
lea ecx, [esp + 0x30]
call fcn.00457d40
pop esi
pop ebp
pop ebx
add esp, 0x43c
ret
lea eax, [esp + 0x23c]
push eax
call esi
cmp eax, 0xffffffff
je 0x457c3a
test al, 0x10
je 0x457d2b
test bh, bh
je 0x457d2b
test bl, bl
jne 0x457c85
jmp 0x457c52
test bl, bl
jne 0x457c85
lea ecx, [esp + 0x23c]
call fcn.0041fec0
test al, al
je 0x457d2b
lea ecx, [esp + 0x30]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x457c60
mov eax, dword [str..]
mov dword [ecx], eax
mov eax, dword [0x4d8fc4]
mov dword [ecx + 4], eax
mov ax, word [0x4d8fc8]
mov word [ecx + 8], ax
lea ecx, [esp + 0x30]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457c90
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x32], ax
lea ecx, [esp + 0x23c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457cb0
xor eax, eax
sub ecx, edx
sar ecx, 1
xorps xmm0, xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x2a], eax
movlpd qword [esp + 0x22], xmm0
mov word [esp + ecx*2 + 0x23e], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x23c]
mov dword [esp + 0x1c], eax
movzx eax, bl
xor eax, 1
inc eax
mov dword [esp + 0x14], eax
mov eax, 0x614
mov word [esp + 0x20], ax
cmp ebp, 2
jne 0x457d11
mov eax, 0x615
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
test eax, eax
pop ebp
sete al
pop ebx
add esp, 0x43c
ret
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x43c
ret
Function at 0x457d40
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x230
cmp word [ecx], 0
je 0x457e3e
test dl, dl
jne 0x457d6c
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x457e3e
mov al, 1
add esp, 0x230
ret
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457d90
sub ecx, edx
sar ecx, 1
je 0x457db0
cmp word [esp + ecx*2 + 0x22], 0x5c
jne 0x457db0
xor eax, eax
mov word [esp + ecx*2 + 0x22], ax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x457e3e
test al, 0x10
je 0x457e3e
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457dd0
sub ecx, edx
mov dword [esp + 0xc], 0
sar ecx, 1
xor eax, eax
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x12], 0
mov word [esp + ecx*2 + 0x26], ax
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x10], ax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
add esp, 0x230
ret
xor al, al
add esp, 0x230
ret
Function at 0x458440
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
push ebx
push ebp
push esi
push edi
push ecx
mov byte [esp + 0x1b], dl
mov ebp, ecx
push 0
push 1
xor edx, edx
call fcn.004812b0
add esp, 0xc
test eax, eax
je 0x4584e2
mov ecx, ebp
call fcn.00481c30
mov ebx, eax
test ebx, ebx
je 0x4584e4
cmp byte [esp + 0x17], 0
jne 0x4584e4
push ebx
push 0
push 0x101000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4584bb
push esi
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, ebx
jne 0x4584a4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x45855d
cmp edi, 0x102
je 0x4584d5
cmp byte [esp + 0x24c], 0
jne 0x4584e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x4584e4
test bl, 3
jne 0x4584e4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
xor ebx, ebx
push 0
push 2
mov dword [esp + 0x20], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
je 0x458556
test ebx, ebx
je 0x458520
cmp ebx, dword [esp + 0x20]
je 0x45856a
lea eax, [esp + 0x3c]
push 0x5c
push eax
call fcn.0049c5ce
add esp, 8
test eax, eax
je 0x458538
add eax, 2
jmp 0x45853c
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.0049eae1
add esp, 8
test eax, eax
je 0x458588
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x458516
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 0
cmovne ebx, dword [esp + 0x30]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 0
mov eax, dword [esp + 0x20]
cmovne eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x238
ret
Function at 0x4643b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0x147
push dword [ebx + 0x18]
mov dword [esp + 0x1c], eax
call eax
push dword [ebx + 0x18]
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [esp + 0x10], eax
lea edx, [eax*2 + 2]
push edx
call fcn.0049ebfd
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x46440e
mov ecx, esi
call fcn.0040db00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
inc eax
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp edi, 0xffffffff
je 0x464459
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x18]
test ecx, ecx
jne 0x464446
push ecx
push edi
push 0x149
push edx
call dword [esp + 0x1c]
test eax, eax
jmp 0x464457
push ebx
lea eax, [edi - 1]
push eax
push 0x158
push edx
call dword [esp + 0x1c]
cmp edi, eax
je 0x464494
mov eax, dword [ebp + 0xc]
push ebx
push 0xffffffffffffffff
push 0x158
push dword [eax + 0x18]
call dword [esp + 0x1c]
mov edi, eax
cmp edi, 0xffffffff
jne 0x464494
cmp dword [ebp + 0x10], 0
je 0x464494
mov eax, dword [esp + 0x10]
mov dword [esi + 8], 0
mov dword [esi + 0x14], ebx
mov dword [esi], ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push ebx
call fcn.0049ebe2
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
je 0x46454c
mov ebx, dword [ebp + 0xc]
cmp eax, 2
jne 0x4644b9
test byte [ebx + 0x31], al
jne 0x46454c
push 0
push edi
push 0x149
push dword [ebx + 0x18]
call dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x46455c
lea ecx, [eax + eax]
mov dword [esp + 0x10], ecx
cmp eax, 0xff
ja 0x4644e8
mov eax, dword [esi + 0x10]
jmp 0x46450c
lea eax, [ecx + 2]
push eax
call fcn.0049ebfd
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
jne 0x464508
mov ecx, esi
call fcn.0040db00
test eax, eax
je 0x46455c
jmp 0x46451b
mov ecx, dword [esp + 0x10]
mov dword [esi], eax
xor edx, edx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
push dword [esi]
push edi
push 0x148
push dword [ebx + 0x18]
call dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x46455c
mov dword [esi + 8], 0
mov dword [esi], 0x4cdea8
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edi + 1]
mov dword [esi + 8], 1
cdq
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc