joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0640
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x4c0650
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4c0665
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4c0768
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004c06d4
mov esi, eax
mov eax, ebx
call fcn.004038d0
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4c52ac
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x506728], 0
mov eax, dword [0x508560]
cmp dword [eax], 2
jne 0x4c5485
mov eax, dword [0x507f40]
cmp dword [eax], 5
jl 0x4c5485
call fcn.004c2448
test al, al
jne 0x4c52dd
call fcn.004c2454
call fcn.004c2440
mov dword [0x506730], eax
push 0x4c5488
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5066f4], eax
cmp dword [0x5066f4], 0
jne 0x4c5338
mov edx, 0x8000
mov eax, 0x4c549c
call fcn.0040f9d4
mov dword [0x50672c], eax
mov eax, dword [0x50672c]
mov dword [0x506730], eax
push 0x4c5488
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5066f4], eax
cmp dword [0x5066f4], 0
je 0x4c5480
push 0x4c54a8
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5066f8], eax
cmp dword [0x5066f8], 0
je 0x4c5480
push 0x4c54b4
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5066fc], eax
cmp dword [0x5066fc], 0
je 0x4c5480
mov byte [0x506728], 1
push 0x4c54c4
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506700], eax
push 0x4c54d0
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506704], eax
push 0x4c54dc
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506708], eax
push 0x4c54ec
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x50670c], eax
push 0x4c54fc
mov eax, dword [0x506730]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506710], eax
mov edx, 0x8000
mov eax, 0x4c5514
call fcn.0040f9d4
mov dword [0x506734], eax
cmp dword [0x506734], 0
je 0x4c5485
push 0x4c5524
mov eax, dword [0x506734]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506714], eax
push 0x4c5540
mov eax, dword [0x506734]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506718], eax
push 0x4c5560
mov eax, dword [0x506734]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x50671c], eax
push 0x4c557c
mov eax, dword [0x506734]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506720], eax
push 0x4c5594
mov eax, dword [0x506734]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x506724], eax
ret
call fcn.004c522c
ret
Function at 0x4c7bb8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c7ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c7aa4
mov eax, dword [esi]
call fcn.00405990
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4c0fec]
call fcn.00405b6c
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402d80
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402d80
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00405990
mov dword [ebp - 0xc], eax
mov eax, dword [0x508440]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.004c1280
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403250
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00405990
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.004c11b0
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004c11ac
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004c1278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7ce7
lea eax, [ebp - 8]
mov edx, dword [0x4c0fec]
call fcn.00405c98
ret

Function at 0x4e76e4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x506c6c]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4e7720
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4e7738
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4e7731
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403250
xor edx, edx
mov eax, 0x506e6c
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4e77a2
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4e7756
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4e79e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4e79f9
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4e79f2
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4e7a0b
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4e7a04
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004e75d4
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4e7a25
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004e76e4
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4e7aaa
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4e7ac7
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004e7664
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4e7af0
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e7b08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4e7b21
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4e7b1a
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4e7b35
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e74cc
test bl, bl
jne 0x4e7c08
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x50a290
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4e7b6c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4e7b80
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e79e0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4e7bb2
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4e7b61
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4e7bd5
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4e7be6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4e7bfa
jmp 0x4e7cc3
cmp bl, 1
jne 0x4e7cc3
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x50a2ea
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4e7c28
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4e7c3c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e79e0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4e7c6e
sub ebx, 6
inc dword [ebp - 8]
jne 0x4e7c1d
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4e7c95
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4e7ca6
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4e7cba
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e7550
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4eb56f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x507a92
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4eb5c7
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x507ab3
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4eb5bd
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4eb5cb
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4f6f9c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f70c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040471c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404bdc
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4f70a5
mov eax, ebx
call fcn.00402b4c
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404bdc
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f70d8
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00409500
push dword [ebp - 0x14]
push 0x4f70e4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00409500
push dword [ebp - 0x18]
push 0x4f70e4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00409500
push dword [ebp - 0x1c]
push 0x4f70e4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00409500
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call fcn.00404a9c
mov eax, esi
call fcn.00402b7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f70cf
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404740
lea eax, [ebp - 4]
call fcn.0040471c
ret
Function at 0x4f714c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f726a
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x110]
mov edx, 4
mov eax, 0x4f7280
call fcn.00447290
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
mov edx, 2
mov eax, 0x4f72b0
call fcn.00447290
mov edx, dword [ebp - 0x114]
pop eax
call fcn.00404b28
jne 0x4f71c9
lea edx, [ebp - 0x118]
mov eax, 0x4f72c0
call fcn.00408dc0
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x4f72c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4f730c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4f7228
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040498c
jmp 0x4f7234
mov eax, ebx
mov edx, 0x4f7318
call fcn.00404770
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov edx, 0x4f7350
mov eax, 0x4f7380
call fcn.0040e798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7271
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00404740
ret
Function at 0x4f73a8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f7620
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x4f7638
mov edx, 0x4f7648
mov eax, 0x4f7654
call fcn.004471f4
xor ebx, ebx
push 0
push 0x4f767c
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f75f5
push 0
push 0x4f7684
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f75f5
push 0
push 0x4f7694
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f76a8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x4f75f5
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f748d
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f75f5
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f98a0
lea ecx, [ebp - 0x410]
mov edx, 5
mov eax, 0x4f76b8
call fcn.00447290
mov eax, dword [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
xor edx, edx
mov eax, 0x4f7638
call fcn.00447290
mov edx, dword [ebp - 0x414]
pop eax
call fcn.00404b28
jne 0x4f74fd
lea edx, [ebp - 0x418]
mov eax, 0x4f76e8
call fcn.00408dc0
mov eax, dword [ebp - 4]
mov edx, 0x4f76f8
call fcn.00404b28
jne 0x4f753f
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f75d3
mov bl, 1
jmp 0x4f75d3
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x420]
call fcn.0040991c
test al, al
jne 0x4f75f5
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f75d3
push 0x32
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x428]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x428]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
push 0x4014
push 0xc5d63000
push 0
call fcn.0042f028
cmp eax, 0x9549a8
jne 0x4f75f5
mov eax, 0x4f7708
call fcn.00446774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7627
lea eax, [ebp - 0x428]
mov edx, 8
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret
Function at 0x4f7710
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f7955
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400f
push 0xd0208000
push 0
call fcn.0042f028
cmp eax, 0xd1cb19
jne 0x4f7775
mov eax, 0x4f796c
call fcn.00446774
xor ebx, ebx
push 0
push 0x4f7974
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f792a
push 0
push 0x4f797c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f792a
push 0
push 0x4f798c
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f79a0
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0x4015
push 0x9039a200
push 0
call fcn.0042f028
cmp eax, 0x9184f3
jne 0x4f77e9
mov eax, 0x4f79b0
call fcn.00446774
test esi, esi
je 0x4f792a
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f7806
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f792a
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f98a0
mov edx, 0x4f79c0
mov eax, 0x4f79ec
call fcn.0040e798
mov eax, dword [ebp - 4]
mov edx, 0x4f7a1c
call fcn.00404b28
jne 0x4f787b
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x40c]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f7908
mov bl, 1
jmp 0x4f7908
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x410]
call fcn.0040991c
test al, al
jne 0x4f792a
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f7908
lea eax, [ebp - 0x418]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x418]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
push 0x4012
push 0xa6a50000
push 0
call fcn.0042f028
cmp eax, 0x96bad5
jne 0x4f792a
mov eax, 0x4f7a2c
call fcn.00446774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f795c
lea eax, [ebp - 0x418]
mov edx, 4
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret
Function at 0x4f7a34
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404bcc
xor eax, eax
push ebp
push 0x4f7c95
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4014
push 0xca90b400
push 0
call fcn.0042f028
cmp eax, 0xc58898
jne 0x4f7aa5
mov eax, 0x4f7cac
call fcn.00446774
xor ebx, ebx
push 0
push 0x4f7cb4
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7c6a
push 0
push 0x4f7cbc
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f7c6a
push 0
push 0x4f7ccc
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f7cdc
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
push 0
push 0x4f7ce8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x4f7cf8
mov edx, 0x4f7d08
mov eax, 0x4f7d14
call fcn.004471f4
test esi, esi
je 0x4f7c6a
call fcn.004f70e8
cdq
push edx
push eax
mov eax, esi
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4f7b40
cmp eax, dword [esp]
pop edx
pop eax
je 0x4f7c6a
lea eax, [ebp - 0x408]
push eax
push 0x3ff
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
call fcn.004f98a0
mov edx, 0x4f7d44
mov eax, 0x4f7d74
call fcn.0040e798
mov eax, dword [ebp - 4]
mov edx, 0x4f7da4
call fcn.00404b28
jne 0x4f7bb5
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jle 0x4f7c4f
mov bl, 1
jmp 0x4f7c4f
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov eax, dword [ebp - 0x414]
call fcn.0040991c
test al, al
jne 0x4f7c6a
mov eax, dword [ebp - 4]
mov edx, 0x4f7da4
call fcn.00404b28
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x408]
mov ecx, 0x400
call fcn.0040498c
mov edx, dword [ebp - 0x418]
mov eax, dword [ebp - 8]
call fcn.0040e798
test eax, eax
jne 0x4f7c4f
lea eax, [ebp - 0x41c]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c3c
mov eax, dword [ebp - 0x41c]
push eax
push 0x3ff
push 0xc
push esi
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x420]
push eax
mov ecx, 0x4f7db4
mov edx, 0x4f7dc4
mov eax, 0x4f7dd0
call fcn.004471f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7c9c
lea eax, [ebp - 0x420]
mov edx, 6
call fcn.00404740
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404740
ret