joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x7c]
mov ebp, ecx
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x46e302
sub edx, ecx
sar edx, 1
cmp edx, 0x104
ja 0x46e460
mov esi, dword [esp + 0x78]
xor edx, edx
movzx ebx, word [edi]
mov ecx, 0x800
test bx, bx
movzx eax, word [esi + 0x1e]
cmovne ecx, edx
and eax, 0xfffff6fb
or ecx, eax
cmp dword [ebp + 0x30], edx
jne 0x46e356
push edi
push esi
mov word [esi + 0x1e], cx
call fcn.0046e470
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8
xor edx, edx
mov dword [esp + 0x10], 0x30
test bx, bx
je 0x46e37d
movzx eax, word [esi + 0x1e]
test eax, 0x800
je 0x46e37d
movzx eax, word [esi + 0x1c]
mov edx, 1
mov dword [esp + 0x1c], eax
push 9
push dword [esi]
or edx, 0x10
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], edi
call fcn.0049515e
mov ebx, eax
push 9
push edi
mov dword [esp + 0x8c], ebx
call fcn.0049515e
add esp, 0x10
test ebx, ebx
je 0x46e3bf
test eax, eax
je 0x46e3bf
push eax
push ebx
call fcn.004979b3
add esp, 8
mov ebx, eax
jmp 0x46e3c8
xor ebx, ebx
cmp dword [esp + 0x7c], eax
setne bl
lea eax, [esp + 0x10]
push eax
push 0
push dword [esi + 0x14]
push dword [ebp + 0x30]
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
cmp dword [ebp + 0x2c], 2
mov dword [esp + 0x7c], eax
jne 0x46e3fa
cmp dword [0x4dbc78], 0
je 0x46e3fa
mov ecx, dword [ebp + 0x30]
call fcn.004607e0
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x46e460
push edi
push esi
call fcn.0046e470
test eax, eax
je 0x46e460
mov ax, word [esp + 0x18]
mov word [esi + 0x1e], ax
test ebx, ebx
je 0x46e41d
mov ecx, ebp
call fcn.0046ebc0
cmp word [edi], 0
je 0x46e451
mov eax, dword [esi + 0x24]
test eax, eax
je 0x46e451
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x40]
push eax
push 0
push dword [esi + 0x14]
mov dword [esp + 0x4c], 0x30
push dword [ebp + 0x30]
mov dword [esp + 0x54], 0x80
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret 8
Function at 0x476e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10014
call fcn.004ac150
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov edi, ecx
push eax
lea eax, [ebp - 0x10010]
mov dword [ebp - 4], edi
push eax
push 0x8000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
xor edx, edx
lea ecx, [ebp - 0x10010]
mov esi, 1
call fcn.0047b930
mov ebx, dword [ebp + 0x10]
add esp, 4
test al, al
jne 0x476f63
push 0
push 0
push esi
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x476f60
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x476ee7
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx*2 + 2]
mov dword [ebp + 0x10], eax
lea eax, [ebx + ecx*2]
mov ecx, 0x5d
mov dword [ebp - 8], eax
mov word [eax], cx
lea eax, [ebp + 0xc]
push eax
push 4
push 0x4d0c38
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x476f49
cmp dword [ebp + 0xc], 4
jne 0x476f49
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x476f49
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0xc], eax
je 0x476f4b
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg eax
sbb eax, eax
and esi, eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 4]
test esi, esi
je 0x476ff8
mov eax, dword [ebp + 0x14]
cmp word [eax], 0
je 0x476f88
lea ecx, [ebp - 0x10010]
push ecx
push dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x476fe3
push ecx
mov ecx, edi
call fcn.0041eb50
lea eax, [eax*2 + 4]
call fcn.004ac040
mov edi, dword [ebp + 8]
mov eax, esp
mov dword [ebp + 0xc], eax
mov edx, eax
movzx ecx, word [edi]
test cx, cx
je 0x476fd0
mov esi, ecx
sub edi, eax
xor ecx, ecx
movzx eax, si
cmp si, 0xa
cmovne ecx, eax
mov word [edx], cx
add edx, 2
movzx esi, word [edi + edx]
test si, si
jne 0x476fb2
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x10010]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov esi, eax
lea eax, [ebp - 0x10010]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d78c8]
mov dword [ecx + 0x38], eax
test esi, esi
jne 0x477025
push eax
mov ecx, 0x4dcd68
call fcn.00428850
lea esp, [ebp - 0x10020]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
lea esp, [ebp - 0x10020]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x477880
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x477937
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4d78c8]
mov eax, dword [eax + 0x84]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x477944
mov ecx, dword [esp + 0x14]
call fcn.00477880
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x477944
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x477944
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x4778c1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
Function at 0x47b930
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
sub esp, 0x250
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
push esi
push edi
test ebx, ebx
je 0x47ba86
cmp word [ebx], 0
je 0x47ba86
push 4
push str.__
push ebx
call fcn.0049ecf3
add esp, 0xc
test eax, eax
je 0x47b96a
mov eax, ebx
mov edi, eax
jmp 0x47b973
lea eax, [ebx + 8]
mov edi, eax
test eax, eax
je 0x47b9b1
movzx eax, word [eax]
test ax, ax
je 0x47b9b1
mov esi, eax
nop dword [eax]
mov ecx, 0x4ce26c
mov edx, 0x3f
nop word [eax + eax]
cmp si, dx
je 0x47b9e7
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x47b990
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x47b980
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [esp + 0x264]
test edx, edx
je 0x47b9cf
mov ecx, eax
and ecx, edx
cmp ecx, edx
jne 0x47ba86
test ebp, ebp
je 0x47b9d6
mov dword [ebp], eax
cmp eax, 0xffffffff
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47ba86
cmp word [esp + 0x3c], 0x2e
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jne 0x47ba3c
nop dword [eax]
mov ax, word [esp + 0x3e]
test ax, ax
je 0x47ba28
cmp ax, 0x2e
jne 0x47ba3c
cmp word [esp + 0x40], 0
jne 0x47ba3c
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
je 0x47ba86
cmp word [esp + 0x3c], 0x2e
je 0x47ba10
mov esi, dword [esp + 0x264]
test esi, esi
je 0x47ba67
mov eax, dword [esp + 0x10]
and eax, esi
cmp eax, esi
je 0x47ba67
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
je 0x47ba86
mov eax, dword [esp + 0x10]
and eax, esi
cmp eax, esi
jne 0x47ba51
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
je 0x47ba79
mov eax, dword [esp + 0x10]
mov dword [ebp], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x250
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x250
ret

Function at 0x47c090
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004ac150
push esi
push edi
push 0x7fff
lea eax, [esp + 0xc]
mov edi, edx
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x47c0da
lea ecx, [esi*2 + 2]
push ecx
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00497340
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x10000
ret
xor eax, eax
mov word [edi], ax
mov eax, esi
pop edi
pop esi
add esp, 0x10000
ret
Function at 0x47c0f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x1c]
or eax, 1
push eax
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x47c193
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x47c193
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47c193
shr eax, 1
lea ecx, [eax - 1]
mov dword [esp + 0x18], ecx
cmp word [edi + ecx*2], 0
jne 0x47c17b
mov eax, ecx
test ecx, ecx
je 0x47c198
cmp word [edi + ecx*2 - 2], 0
jne 0x47c198
add ecx, 0xffffffff
mov eax, ecx
mov dword [esp + 0x18], ecx
jne 0x47c165
pop edi
pop ecx
ret
mov dword [esp + 0x18], eax
cmp eax, 0x104
jae 0x47c193
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [esp + 0x18]
pop edi
pop ecx
ret
xor eax, eax
mov word [edi], ax
pop edi
pop ecx
ret
Function at 0x47c950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
push edi
mov edi, edx
mov dword [esp + 0x24], edi
test ebp, ebp
je 0x47c97b
push 2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [esp + 0x1c], eax
jmp 0x47c985
mov esi, dword [0x4dbca0]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x47cb16
test edi, edi
jns 0x47c99a
mov eax, edi
neg eax
movzx eax, ax
jmp 0x47c9cb
test edi, edi
mov dword [esp + 0x2c], ebx
mov eax, 1
mov dword [esp + 0x30], 0x4de0d4
cmovne eax, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 0x47c920
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [esp + 0x30]
cmp eax, 0x4de0d4
je 0x47caef
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47caef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47caef
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x47caef
cmp dword [esp + 0x38], 0xffffffff
mov ebx, dword [esp + 0x3c]
cmovne ebx, dword [esp + 0x38]
test ebx, ebx
jne 0x47ca2d
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x18]
mov ebx, eax
lea eax, [ecx + 6]
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
xor ebp, ebp
movzx eax, word [ecx + 4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x47cae9
mov edi, dword [esp + 0x20]
mov esi, 0x100
movzx edx, byte [edi]
test edx, edx
cmove edx, esi
xor ecx, ecx
cmp edx, ebp
jle 0x47ca6c
cmp ebp, ebx
setl cl
jmp 0x47ca71
cmp edx, ebx
setge cl
test ecx, ecx
mov eax, edi
cmove eax, dword [esp + 0x14]
add edi, 0xe
test ecx, ecx
mov dword [esp + 0x14], eax
cmove edx, ebp
sub dword [esp + 0x18], 1
mov ebp, edx
jne 0x47ca57
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
test eax, eax
je 0x47cae9
movzx eax, word [eax + 0xc]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x47cae9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47cae9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x47cae9
push 0
push 0
push 0
push 0x30000
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ebx, eax
jmp 0x47caeb
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x47cb07
test ebx, ebx
je 0x47cb07
mov dword [eax], esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret
test ebp, ebp
je 0x47cb12
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x47cafd
test edi, edi
jle 0x47cb2f
lea eax, [edi - 1]
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
xor eax, eax
cmp edi, 0xffffffff
cmovl eax, edi
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x47ede0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
cmp byte [esp + 8], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x47ee4b
lea eax, [esp + 0x10]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x47ee58
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47ee58
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x47ee58
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47ee58
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x47eeb1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edx, 1
mov dword [esp + 0x18], eax
mov ecx, 0x8000012f
call fcn.00401950
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push esi
call ebp
test eax, eax
je 0x47eeb1
add edi, dword [esp + 0x18]
nop
call ebx
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x47eeb1
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401950
push esi
call ebp
test eax, eax
jne 0x47ee90
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x47f0c0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.004ac150
push ebx
mov ebx, edx
mov edx, dword [esp + 0x11c6c]
push esi
mov esi, dword [esp + 0x11c74]
push edi
movzx eax, word [ebx]
mov edi, ecx
mov ecx, dword [esp + 0x11c7c]
cmp eax, 0x41
je 0x47f0f3
cmp eax, 0x61
jne 0x47f16e
cmp word [ebx + 2], 0
jne 0x47f16e
cmp word [edx], 0
jne 0x47f16e
cmp word [esi], 0
jne 0x47f16e
cmp word [ecx], 0
jne 0x47f16e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x47f151
cmp byte [edi + 0x93], 0
jne 0x47f151
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47f14f
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0xe
push esi
call dword [sym.imp.dwmapi.dll_DwmGetWindowAttribute]
test eax, eax
js 0x47f151
cmp dword [esp + 0xc], 0
je 0x47f151
xor esi, esi
cmp byte [esp + 0x11c84], 0
je 0x47f162
test esi, esi
je 0x47f162
mov dword [edi + 0x20], esi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret
test ax, ax
jne 0x47f193
cmp word [edx], ax
jne 0x47f193
cmp word [esi], ax
jne 0x47f193
cmp word [ecx], ax
jne 0x47f193
mov ecx, edi
call fcn.0047f320
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret
push ecx
push esi
push edx
push ebx
lea eax, [edi + 0x58]
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x102c], 0x4b431c
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x184d], 0
movups xmmword [esp + 0x1850], xmm0
mov dword [esp + 0x1860], 0
mov dword [esp + 0x1864], 0
mov dword [esp + 0x1870], 0
mov dword [esp + 0x1874], 0
call fcn.0047ffa0
test eax, eax
je 0x47f2d4
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov byte [esp + 0x1839], al
mov eax, dword [esp + 0x11c88]
mov dword [esp + 0x1848], eax
mov eax, dword [esp + 0x11c8c]
mov dword [esp + 0x184c], eax
je 0x47f2e0
mov esi, dword [esp + 0x102c]
cmp esi, 0xffff
je 0x47f2ac
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47f2d4
cmp byte [edi + 0x93], 0
mov esi, dword [esp + 0x102c]
jne 0x47f2ac
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47f28f
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0xe
push esi
call dword [sym.imp.dwmapi.dll_DwmGetWindowAttribute]
test eax, eax
js 0x47f2a5
cmp dword [esp + 0xc], 0
je 0x47f2a5
push 0xfffffffffffffff0
push dword [esp + 0x1030]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x47f2d4
mov esi, dword [esp + 0x102c]
cmp dword [esp + 0x1860], esi
je 0x47f2c5
lea ecx, [esp + 0x10]
mov dword [esp + 0x1860], esi
call fcn.004803c0
push 0
lea ecx, [esp + 0x14]
call fcn.00480480
test eax, eax
jne 0x47f2f0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret
lea eax, [esp + 0x10]
push eax
push 0x47f3d0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [esp + 0x11c84], 0
mov eax, dword [esp + 0x1840]
je 0x47f2d6
test eax, eax
je 0x47f2d6
mov dword [edi + 0x20], eax
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret
Function at 0x4803c0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x48047d
mov eax, dword [esi]
test eax, eax
je 0x48047d
push edi
test al, 1
jne 0x4803ed
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x480407
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x480407
mov word [edi], ax
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test al, 4
je 0x480424
lea eax, [esi + 0x1854]
push eax
push dword [esi + 0x1850]
call edi
mov eax, dword [esi]
test al, 0x20
je 0x48045f
lea eax, [esp + 8]
push eax
push dword [esi + 0x1850]
call edi
test eax, eax
je 0x48045f
movzx eax, byte [esi + 0x1828]
lea edx, [esi + 0x11a58]
push eax
push ecx
mov ecx, dword [esp + 0x10]
call fcn.004509a0
add esp, 8
test eax, eax
jne 0x48045f
mov word [esi + 0x11a58], ax
test byte [esi], 8
pop edi
je 0x48047d
push 0x101
lea eax, [esi + 0x11856]
push eax
push dword [esi + 0x1850]
call dword [sym.imp.USER32.dll_GetClassNameW]
pop esi
pop ecx
ret

Function at 0x480d50
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.004ac150
mov eax, dword [ecx + 8]
xorps xmm0, xmm0
mov dword [esp + 0x1840], eax
mov eax, dword [esp + 0x11c68]
mov dword [esp + 0x1844], eax
mov eax, dword [esp + 0x11c6c]
mov dword [esp + 0x1848], eax
lea eax, [esp]
push eax
push 0x481410
mov dword [esp + 8], 0
mov dword [esp + 0x1014], 0x4b431c
mov byte [esp + 0x1831], 0
movups xmmword [esp + 0x1834], xmm0
mov dword [esp + 0x1844], 0
mov dword [esp + 0x1854], 0
mov dword [esp + 0x1858], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1830], 0
je 0x480df7
mov eax, dword [0x4d78c8]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle 0x480df7
mov edx, 1
call fcn.00401950
add esp, 0x11c64
ret 8
Function at 0x480ff0
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
mov eax, 0x11c64
call fcn.004ac150
push ebx
push esi
mov esi, ecx
push edi
mov byte [esi], 0
cmp dword [0x4dcd24], esi
je 0x48101a
mov dword [0x4dcd24], esi
mov dword [0x4dcd2c], 0
cmp dword [0x4dcd28], 0
jne 0x481042
mov ecx, 0x7d0
call fcn.00477ed0
mov dword [0x4dcd28], eax
test eax, eax
jne 0x481042
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
push 4
push edi
call ebx
test eax, eax
je 0x48106b
nop dword [eax]
push 4
push eax
mov edi, eax
call ebx
test eax, eax
jne 0x481060
mov eax, dword [0x4d78c8]
mov ecx, esi
add eax, 0x58
push eax
push edi
call fcn.00481200
mov ecx, dword [0x4dcd2c]
xor edx, edx
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x101c], 0x4b431c
cmovne ecx, edx
mov dword [esp + 0x183c], edx
mov dword [0x4dcd2c], ecx
mov dword [esp + 0x1840], edx
mov dword [esp + 0x1844], edx
mov dword [esp + 0x185c], edx
mov dword [esp + 0x1860], edx
cmp byte [esp + 0x11c74], dl
je 0x4810d5
mov byte [esp + 0x1839], dl
test ecx, ecx
je 0x4810dd
mov byte [esp + 0x1839], 1
mov eax, dword [0x4dcd28]
mov dword [esp + 0x1848], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1850], eax
lea eax, [esp + 0x10]
push eax
push 0x4812e0
mov dword [esp + 0x1854], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
test eax, eax
je 0x481184
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ecx, eax
call fcn.0047eb40
mov ecx, dword [0x4dcd2c]
xor eax, eax
mov edx, dword [esp + 0x1840]
mov esi, dword [0x4dcd28]
test ecx, ecx
jle 0x48114a
nop dword [eax]
cmp dword [esi + eax*4], edx
je 0x48115c
inc eax
cmp eax, ecx
jl 0x481140
cmp ecx, 0x1f4
jge 0x48115c
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4dcd2c], ecx
mov eax, dword [0x4d78c8]
mov ecx, dword [eax + 0x64]
cmp ecx, 0xffffffff
jle 0x4811e0
mov edx, 1
call fcn.00401950
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret 4
mov eax, dword [0x4dcd2c]
test eax, eax
je 0x4811cc
cmp eax, 1
mov dword [0x4dcd2c], 0
setg al
test al, al
je 0x4811e0
mov eax, dword [0x4dcd28]
mov ecx, esi
push 0
mov dword [0x4dcd2c], 1
mov dword [eax], edi
call fcn.00480ff0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x11c64
ret 4
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, eax
call fcn.0047eb40
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4