joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d20f0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545cc4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
lea edx, [esi + 0x70]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 3
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 3
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x64], 3
mov dword [esi + 0x60], 7
mov dword [esi + 0x24], vtable.wui::view::ScrollImpl_class_CVMUISnapshotGrid_.0
mov dword [esi + 0x68], 3
mov dword [esi], vtable.CVMUISnapshotGrid.0
mov dword [esi + 0x24], vtable.CVMUISnapshotGrid.1.0
mov dword [esi + 0x6c], eax
mov dword [edx], ecx
test ecx, ecx
je 0x4d220e
mov eax, dword [ecx + 4]
add ecx, 4
push 0x422e80
push edx
mov eax, dword [eax + 4]
add ecx, eax
call dword [0x554854]
mov byte [ebp - 4], 5
mov dword [esi + 0x74], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
push 0xc
lfence
call fcn.00514bd0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x78], eax
mov byte [ebp - 4], 7
mov dword [esi + 0x80], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x84], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x88], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x8c]
call fcn.004d2330
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0xb0]
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
add ecx, 8
call dword [0x55535c]
mov byte [ebp - 4], 0xd
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 0
mov byte [ebp - 4], 0xe
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4d38b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x11
mov edi, ecx
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
mov si, ax
sar si, 0xf
push 0x10
mov word [ebp - 2], si
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 0x14]
mov cx, ax
mov eax, dword [ebp + 0xc]
sar cx, 0xf
add eax, 0xffffffe0
mov word [ebp - 4], cx
mov dword [edx], 1
cmp eax, 8
ja case.0x4d38fb.33
jmp dword [eax*4 + 0x4d3a74]
push 2
mov ecx, edi
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
push 0
mov ecx, edi
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
push 3
mov ecx, edi
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
push 1
mov ecx, edi
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
xor eax, eax
mov ecx, edi
test si, si
setne al
lea eax, [eax*2 + 4]
push eax
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
xor eax, eax
mov ecx, edi
test si, si
setne al
lea eax, [eax*2 + 5]
push eax
call fcn.004d3440
mov ebx, eax
jmp 0x4d39d5
mov eax, dword [edi + 0x9c]
mov dword [ebp - 8], eax
test cx, cx
je 0x4d398d
mov eax, 3
jmp 0x4d39c6
test si, si
je 0x4d39c1
mov eax, dword [eax]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x55604c]
mov ecx, dword [ebp - 8]
call esi
mov ecx, eax
call dword [0x554e2c]
push eax
lea ecx, [edi + 0x8c]
call fcn.004d2ae0
test al, al
mov eax, 2
jne 0x4d39c6
mov eax, 1
push dword [ebp - 8]
mov ecx, edi
push eax
call fcn.004d67d0
mov si, word [ebp - 2]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x10002
push 0x127
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x4d3a67
cmp word [ebp - 4], 0
je 0x4d3a03
mov eax, 3
jmp 0x4d3a10
xor eax, eax
mov ecx, 4
test si, si
cmovne eax, ecx
push ebx
push eax
mov ecx, edi
call fcn.004d67d0
mov ecx, dword [edi + 0x9c]
call fcn.004c6800
mov ecx, dword [edi + 0x9c]
mov esi, eax
call fcn.0047f0f0
cmp eax, 2
jb 0x4d3a4d
lea ecx, [eax - 2]
push ecx
push esi
mov ecx, edi
lfence
call fcn.004d2eb0
push eax
mov ecx, edi
call fcn.004d6520
push dword [edi + 0x9c]
mov ecx, edi
call fcn.004d6520
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [edx], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d73f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fcb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4d74dc
lea ecx, [esi + 0x44]
mov dword [esi + 0x20], 0x5703f0
mov dword [esi + 0x4c], 0x570408
mov dword [esi + 0x88], 0x570410
mov dword [esi + 0x9c], 0x57041c
mov dword [esi + 0xa4], 0x57042c
call dword [0x55484c]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x48]
push 0
mov dword [ebp - 0x10], 1
call dword [0x554a6c]
mov dword [ebp - 4], 1
lea ecx, [esi + 0x84]
push 0
mov dword [ebp - 0x10], 3
call dword [0x554a74]
mov dword [ebp - 4], 2
lea ecx, [esi + 0x98]
push 0
mov dword [ebp - 0x10], 7
call dword [0x555fe0]
mov dword [ebp - 4], 3
lea ecx, [esi + 0xa0]
push 0
mov dword [ebp - 0x10], 0xf
call dword [0x556004]
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0x1f
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x20]
mov dword [esi], vtable.wui::DialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__.0
mov eax, dword [eax + 8]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__.1.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__.2.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x10]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__.3.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x14]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotMgr__class_ATL::CWindow__.4.0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x64]
mov dword [ecx + esi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
lea eax, [ecx - 0x78]
mov dword [ecx + esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x40]
call dword [0x55484c]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4dc160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fcb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4dc24c
lea ecx, [esi + 0x44]
mov dword [esi + 0x20], 0x5710f4
mov dword [esi + 0x4c], 0x57110c
mov dword [esi + 0x88], 0x571114
mov dword [esi + 0x9c], 0x571120
mov dword [esi + 0xa4], 0x571130
call dword [0x55484c]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x48]
push 0
mov dword [ebp - 0x10], 1
call dword [0x554a6c]
mov dword [ebp - 4], 1
lea ecx, [esi + 0x84]
push 0
mov dword [ebp - 0x10], 3
call dword [0x554a74]
mov dword [ebp - 4], 2
lea ecx, [esi + 0x98]
push 0
mov dword [ebp - 0x10], 7
call dword [0x555fe0]
mov dword [ebp - 4], 3
lea ecx, [esi + 0xa0]
push 0
mov dword [ebp - 0x10], 0xf
call dword [0x556004]
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0x1f
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x20]
mov dword [esi], vtable.wui::DialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__.0
mov eax, dword [eax + 8]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__.1.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__.2.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x10]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__.3.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x14]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotTake__class_ATL::CWindow__.4.0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x64]
mov dword [ecx + esi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
lea eax, [ecx - 0x78]
mov dword [ecx + esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x40]
call dword [0x55484c]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4e8ed0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54abb4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x10], 0
je 0x4e8f31
lea ecx, [edi + 0x168]
mov dword [edi + 8], 0x572668
mov dword [edi + 0x68], 0x572670
call dword [0x55484c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
mov ecx, edi
call fcn.004de520
mov dword [ebp - 4], 3
lea ecx, [edi + 0x64]
push 0
call dword [0x556004]
mov byte [ebp - 4], 4
mov dword [edi], vtable.CVMUIStatusBase_class_CVMUIStatusLockedVM__1280_.0
mov dword [edi + 0x48], vtable.CVMUIStatusBase_class_CVMUIStatusLockedVM__1280_.1.0
mov dword [edi + 0x64], vtable.CVMUIStatusBase_class_CVMUIStatusLockedVM__1280_.2.0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [ebp - 4], 5
lea ecx, [edi + 0x7c]
push dword [ebp + 8]
mov dword [edi], vtable.CVMUIStatusLockedVM.0
mov dword [edi + 0x48], vtable.CVMUIStatusLockedVM.1.0
mov dword [edi + 0x64], vtable.CVMUIStatusLockedVM.2.0
call dword [0x55534c]
mov byte [ebp - 4], 6
lea edx, [edi + 0x9c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [edx], ecx
test ecx, ecx
je 0x4e8fc5
mov eax, dword [ecx + 4]
add ecx, 4
push 0x422e80
push edx
mov eax, dword [eax + 4]
add ecx, eax
call dword [0x554854]
mov byte [ebp - 4], 7
lea esi, [edi + 0xac]
mov dword [edi + 0xa0], 0
lea eax, [esi + 8]
mov dword [edi + 0xa4], 0
mov dword [ebp - 0x18], esi
mov dword [edi + 0xa8], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x1c], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [ebp - 4], 0xa
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 0xc
mov dword [esi], vtable.CVMUIStatusLbl.0
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 0xd
mov dword [esi + 0x28], 0
mov byte [ebp - 4], 0xe
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [0x555e28]
call dword [0x5556a4]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 0
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x108]
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 0
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
call dword [0x555e30]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f5370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54dd23
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x4f53c9
lea ecx, [ebx + 0xa8]
mov dword [ebx + 0x5c], 0x5735c4
call dword [0x55484c]
mov dword [ebp - 4], 0
mov eax, 1
mov dword [ebp - 0x10], eax
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 2
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 0x20], eax
mov dword [ebp - 4], 5
mov dword [ebx], vtable.wui::control::Subclassed_class_wui::control::CueEdit__class_WTL::CEditT_class_ATL::CWindow___class_ATL::CWinTraits_1442840576__0__.0
mov dword [ebx + 0x24], 0
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebx], vtable.wui::control::CueEdit.0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 7
mov word [ebx + 0x28], ax
mov byte [ebp - 4], 7
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], 7
mov word [ebx + 0x40], ax
mov dword [ebp - 4], 9
lea ecx, [ebx + 0x58]
push eax
call dword [0x556004]
mov byte [ebp - 4], 0xa
lea edi, [ebx + 0x60]
mov dword [ebx], vtable.wui::control::DirtyEdit.0
lea ecx, [edi + 0x10]
mov dword [ebx + 0x58], vtable.wui::control::DirtyEdit.1.0
mov dword [ebp - 0x1c], edi
mov dword [edi + 4], 0x573584
mov dword [edi + 0x14], 0x573594
mov dword [edi + 0x30], 0x57359c
call dword [0x55484c]
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x14]
or dword [ebp - 0x10], 2
push 0
call dword [0x555160]
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x10]
or eax, 4
mov dword [ebp - 0x10], eax
mov dword [edi + 0x2c], vtable.cui::PropertyTypeHelper_enum_wui::control::DirtyEdit::DirtyState_.0
mov dword [ebp - 4], 0xd
or eax, 8
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
mov dword [edi], vtable.cui::Property_enum_wui::control::DirtyEdit::DirtyState_.0
mov eax, dword [eax + 0xc]
mov dword [eax + edi + 4], vtable.cui::Property_enum_wui::control::DirtyEdit::DirtyState_.1.0
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x28]
mov dword [ecx + edi], eax
mov byte [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0xe
lea ecx, [ebx + 0x94]
call dword [0x5548b8]
mov byte [ebp - 4], 0xf
lea ecx, [ebx + 0x98]
mov dword [ebp - 0x20], ecx
call dword [0x55487c]
mov byte [ebp - 4], 0x12
lea ecx, [ebx + 0xa0]
mov dword [ebp - 0x24], ecx
call dword [0x55487c]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6a10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e1c6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [0x5dd1d0]
cmp byte [eax + 0x68], 0
je 0x4f6aa0
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4f6aa0
push str._____msg.vmui.vmuiStatusNone.noOpenTabs_There_are_no_open_virtual_machines._Select_an_item_in_the_library_to_open_it_in_a_tab.
lea ecx, [ebp - 0x34]
call dword [0x554a2c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call dword [0x554a3c]
push eax
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call dword [0x554a30]
mov eax, dword [esi + 0x5c]
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret 4
Function at 0x4f6b20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x820]
push edi
push 0
push eax
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x824], esi
push 0x42
mov edi, ecx
mov dword [ebp - 0x820], 0xc
movq qword [ebp - 0x81c], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x4f6b7a
test byte [ebp - 0x81c], 1
je 0x4f6b7a
mov bl, 1
jmp 0x4f6b7c
xor bl, bl
mov esi, dword [esi + 0x18]
push 0x12
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x555948]
mov dword [ebp - 0x828], eax
call dword [0x5556a4]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push dword [ebp - 0x828]
mov ecx, dword [ebp - 0x824]
add ecx, 0x1c
push ecx
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x824]
add eax, 0x1c
push eax
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
cmp byte [edi + 0x3c], 0
jne 0x4f6bf3
mov edx, dword [ebp - 0x824]
mov ecx, dword [ebp - 0x810]
add ecx, dword [edi + 0x38]
cmp ecx, dword [edx + 0x28]
cmovge ecx, dword [edx + 0x28]
mov dword [ebp - 0x808], ecx
jmp 0x4f6bf9
mov ecx, dword [ebp - 0x808]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4f6c60
test bl, bl
jne 0x4f6c60
mov edx, dword [ebp - 0x810]
sub ecx, edx
push 0xcc0020
push dword [edi + 0x30]
dec ecx
push dword [edi + 0x2c]
push 0
push 0
push eax
mov eax, dword [ebp - 0x80c]
push ecx
mov ecx, dword [ebp - 0x814]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 1]
push eax
lea eax, [ecx + 1]
push eax
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [edi + 0x34]
push esi
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x824]
add eax, 0x1c
push eax
push esi
call dword [sym.imp.USER32.dll_FrameRect]
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00515fd2
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4f6cbb
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
add dword [ebp - 0x814], 0xa
lea eax, [ebp - 0x814]
push 0x824
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005150f0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fef80
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550129
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4fefdb
lea ecx, [ebx + 0x1d0]
mov dword [ebx + 0x2c], 0x573fd0
call dword [0x55484c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 2
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 0x20], eax
mov dword [ebp - 4], 5
lea ecx, [ebx + 0x24]
call dword [0x555e9c]
mov byte [ebp - 4], 6
lea ecx, [ebx + 0x28]
push 0
call dword [0x556004]
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x30]
mov dword [ebx], vtable.CVMUITabStrip.0
mov dword [ebx + 0x24], vtable.CVMUITabStrip.1.0
mov dword [ebx + 0x28], vtable.CVMUITabStrip.2.0
mov dword [ebp - 0x1c], ecx
call dword [0x55489c]
mov byte [ebp - 4], 0xa
lea ecx, [ebx + 0x38]
mov dword [ebp - 0x20], ecx
call dword [0x55489c]
mov byte [ebp - 4], 0xd
lea ecx, [ebx + 0x40]
mov dword [ebp - 0x24], ecx
call dword [0x55489c]
mov byte [ebp - 4], 0x10
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0xffffffff
mov byte [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebx + 0x6c]
push 1
push 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
call fcn.004fee70
mov byte [ebp - 4], 0x12
lea ecx, [ebx + 0xdc]
push 1
push 0
call fcn.004fee70
mov byte [ebp - 4], 0x13
mov dword [ebx + 0x14c], 0
mov byte [ebp - 4], 0x14
mov dword [ebx + 0x150], 0
mov byte [ebp - 4], 0x15
mov dword [ebx + 0x154], 0
mov byte [ebp - 4], 0x16
mov dword [ebx + 0x158], 0
mov byte [ebp - 4], 0x17
lea eax, [ebx + 0x19c]
mov dword [ebx + 0x15c], 0
mov dword [ebx + 0x160], 0
mov dword [ebx + 0x164], 0
mov dword [ebx + 0x168], 0
mov dword [ebx + 0x16c], 0
mov dword [ebp - 0x28], eax
mov dword [eax], 0
mov byte [ebp - 4], 0x18
mov byte [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x19
mov dword [ebx + 0x1a8], 0
mov byte [ebp - 4], 0x1a
mov byte [ebx + 0x1ac], 1
mov dword [ebx + 0x1b0], 0
mov dword [ebx + 0x1b4], 0
mov dword [ebx + 0x1b8], 0
mov byte [ebp - 4], 0x1b
mov dword [ebx + 0x1bc], 0
mov byte [ebp - 4], 0x1c
mov dword [ebx + 0x1c0], 0
mov dword [ebx + 0x1c4], 0
mov dword [ebx + 0x1c8], 0
mov byte [ebp - 4], 0x1d
lea eax, [ebx + 0x170]
push 0x2c
push 0
push eax
mov dword [ebx + 0x1cc], 0
call fcn.00515fd2
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4