joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.004cdac0
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
lea eax, [ebp - 0x1000c]
mov dword [ebp - 4], esi
push eax
push 0x8000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x1000c]
call fcn.004b2290
mov ebx, dword [ebp + 0x10]
test al, al
jne 0x4a6e13
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x1000c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a6e10
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a6d90
sub ecx, edx
sar ecx, 1
lea eax, [ebx + ecx*2]
push 0
mov dword [ebp + 0x10], eax
lea edi, [ecx*2 + 2]
mov ecx, 0x5d
mov word [eax], cx
lea eax, [ebp + 0xc]
push eax
push 4
push 0x4f13cc
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a6dea
cmp dword [ebp + 0xc], 4
jne 0x4a6dea
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a6dea
cmp dword [ebp + 0xc], edi
je 0x4a6df1
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg eax
mov ecx, 0
sbb eax, eax
and eax, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov word [eax], cx
je 0x4a6ecf
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp word [eax], 0
je 0x4a6e30
lea ecx, [ebp - 0x1000c]
push ecx
push dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x4a6e91
push 0
mov ecx, esi
call fcn.0043ffc0
lea eax, [eax*2 + 4]
call fcn.004cdaf0
mov edi, dword [ebp + 8]
mov eax, esp
mov dword [ebp + 0x10], eax
mov edx, eax
movzx ecx, word [edi]
test cx, cx
je 0x4a6e7e
mov esi, ecx
sub edi, eax
nop dword [eax + eax]
xor ecx, ecx
movzx eax, si
cmp si, 0xa
cmovne ecx, eax
mov word [edx], cx
add edx, 2
movzx esi, word [edi + edx]
test si, si
jne 0x4a6e60
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x1000c]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov esi, eax
lea eax, [ebp - 0x1000c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test esi, esi
je 0x4a6ecf
mov ecx, dword [0x4fb9cc]
push 1
push 0
push 0xffffffffffffffff
push 0x4cfd08
call fcn.004b5b70
lea esp, [ebp - 0x10018]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4f90f4]
test byte [eax + 0x100], 1
jne 0x4a6f02
mov ecx, dword [0x4fb9cc]
push 1
push 0
push 0xffffffffffffffff
push 0x4e613c
call fcn.004b5b70
lea esp, [ebp - 0x10018]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
push 0x4cfc40
push 0
push 0x4e613c
call fcn.0044e3e0
lea esp, [ebp - 0x10018]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a7690
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x4a7756
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4f90f4]
mov eax, dword [eax + 0xd0]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4a7760
mov ecx, dword [esp + 0x14]
call fcn.004a7690
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a7760
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4a7760
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x4a76e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a7770
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
test ebp, ebp
je 0x4a7865
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x4a7797
cmp word [edi], 0
jne 0x4a779f
test ebx, ebx
je 0x4a7865
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x4f90f4]
mov eax, dword [eax + 0xd0]
or eax, 0x2001f
push eax
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4a786a
test ebx, ebx
jne 0x4a784c
mov ecx, dword [esp + 0x18]
call fcn.004a7690
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a786a
mov eax, dword [0x5000f4]
test al, 1
jne 0x4a781c
push str.RegDeleteKeyExW
or eax, 1
push 0x4efbd8
mov dword [0x5000f4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x5000f8], ecx
jmp 0x4a7822
mov ecx, dword [0x5000f8]
mov eax, dword [0x4f90f4]
mov eax, dword [eax + 0xd0]
test eax, eax
je 0x4a7840
test ecx, ecx
je 0x4a7840
push 0
push eax
push edi
push ebp
call ecx
mov esi, eax
jmp 0x4a786a
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x4a786a
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a786a
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.0044e5c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4b2290
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov ebx, ecx
test ebx, ebx
je 0x4b236a
cmp word [ebx], 0
je 0x4b236a
push 4
push 0x4f1a14
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4b22d1
mov eax, ebx
mov edi, eax
jmp 0x4b22da
lea eax, [ebx + 8]
mov edi, eax
test eax, eax
je 0x4b2321
movzx eax, word [eax]
test ax, ax
je 0x4b2321
mov esi, eax
nop dword [eax]
nop dword [eax + eax]
mov ecx, 0x4eef80
mov edx, 0x3f
nop word [eax + eax]
cmp si, dx
je 0x4b233d
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4b2300
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x4b22f0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test ebp, ebp
je 0x4b232f
mov dword [ebp], eax
cmp eax, 0xffffffff
setne al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4b236a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
je 0x4b2360
mov eax, dword [esp + 0x10]
mov dword [ebp], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b29c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
or eax, 1
push eax
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x4b2a79
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4b2a79
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4b2a79
shr ecx, 1
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
cmp word [edi + eax*2], si
jne 0x4b2a5f
test eax, eax
je 0x4b2a7e
mov esi, eax
mov edx, eax
mov ecx, eax
nop dword [eax + eax]
cmp word [edi + ecx*2 - 2], 0
mov eax, edx
jne 0x4b2a7e
lea eax, [esi - 1]
mov ecx, eax
mov dword [esp + 0x1c], eax
mov esi, eax
mov edx, eax
test ecx, ecx
jne 0x4b2a40
pop edi
pop esi
pop ecx
ret
mov dword [esp + 0x1c], ecx
cmp ecx, 0x104
jae 0x4b2a79
xor eax, eax
mov word [edi + ecx*2], ax
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ecx
ret
xor eax, eax
mov word [edi], ax
pop edi
pop esi
pop ecx
ret
Function at 0x4b4970
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x84c
push ebx
push 0x800
lea eax, [esp + 0x54]
mov dword [esp + 8], edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4b4b49
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4b4b49
movaps xmm0, xmmword [0x4f3250]
movups xmmword [esp + 0x14], xmm0
push esi
movaps xmm0, xmmword [0x4f3240]
mov esi, dword [esp + 0x858]
mov dword [esp + 0x48], 0x37
mov dword [esp + 0x4c], 0xaf
mov dword [esp + 0x50], 0x1e
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4f3210]
movups xmmword [esp + 0x38], xmm0
test esi, esi
je 0x4b4a4f
cmp dword [esi], 0
je 0x4b4a4f
push edi
lea edi, [esp + 0x1c]
xor edx, edx
mov ecx, esi
sub edi, esi
cmp esi, 0x4fa234
jne 0x4b4a3b
mov eax, dword [edi + ecx]
lea eax, [eax*2 + 0x4f2920]
jmp 0x4b4a3d
mov eax, dword [ecx]
mov ax, word [eax]
add ecx, 4
mov word [esp + edx*2 + 0x58], ax
inc edx
cmp edx, 0xf
jb 0x4b4a27
pop edi
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
pop esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b4a57
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4b4b49
push 0x800
lea eax, [esp + 0x54]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x868]
add esp, 0xc
cmp ecx, 0x80
jne 0x4b4aad
mov eax, 0x660e
jmp 0x4b4abd
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea edx, [esp + 0xc]
shl ecx, 0x10
push edx
push ecx
push dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4b4b49
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x4b4b49
cmp byte [esp + 0x858], 0
je 0x4b4b11
mov eax, dword [esp + 4]
add eax, 0x10
push eax
lea eax, [esp + 8]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x24]
call dword [0x4fba14]
jmp 0x4b4b27
lea eax, [esp + 4]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x20]
call dword [0x4fba10]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 4]
pop ebx
add esp, 0x84c
ret
xor eax, eax
pop ebx
add esp, 0x84c
ret
Function at 0x4b59a0
Capabilities:
Write clipboard data

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, 0x4fe6d8
push esi
mov esi, edx
call fcn.00406ed0
test eax, eax
jne 0x4b59d1
push 0x4cfc40
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4fdb78
call fcn.0044ec90
pop esi
pop ebx
add esp, 8
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + esi]
lea esi, [ebx + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
ja 0x4b5a59
mov ecx, dword [ebx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4b5a59
mov edi, esi
add esi, 4
cmp esi, eax
ja 0x4b5a59
mov edi, dword [edi]
mov ebx, esi
add esi, edi
cmp esi, eax
ja 0x4b5a59
xor eax, eax
test edi, edi
sete al
add eax, edi
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4b5b0d
test edi, edi
je 0x4b5a43
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4b5aa8
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, esi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [esp + 0x14]
lea esi, [ebx + 4]
cmp esi, eax
jbe 0x4b59e7
cmp dword [0x4fe6f0], 0
je 0x4b5a9b
cmp dword [0x4fe6e0], 0
je 0x4b5a81
push dword [0x4fe6d8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4fe6e0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4fe6f0], 0
mov dword [0x4fe6d8], 0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4fe6f0], 0
je 0x4b5af1
cmp dword [0x4fe6e0], 0
je 0x4b5ad7
push dword [0x4fe6d8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4fe6e0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4fe6f0], 0
mov dword [0x4fe6d8], 0
push 0x4cfc40
push 0x4d022c
mov ecx, 0x4fdb78
call fcn.0044ec90
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x4fe6f0], 0
je 0x4b5b4f
cmp dword [0x4fe6e0], 0
je 0x4b5b35
push dword [0x4fe6d8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4fe6e0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4fe6f0], 0
mov dword [0x4fe6d8], 0
push 0x4cfc40
push 0x4e3bcc
mov ecx, 0x4fdb78
call fcn.0044ec90
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x4b6910
Capabilities:
Check for foreground window switch
Log keystrokes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
push esi
push edi
mov edi, edx
movzx eax, word [edi]
cmp eax, 0x41
je 0x4b6929
cmp eax, 0x61
jne 0x4b6991
cmp word [edi + 2], 0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
jne 0x4b6999
cmp word [ecx], 0
jne 0x4b6999
cmp word [eax], 0
jne 0x4b6999
cmp word [ebp], 0
jne 0x4b6999
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4b6991
cmp byte [ebx + 0xea], 0
jne 0x4b6976
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b6991
mov ecx, esi
call fcn.004b7de0
test al, al
jne 0x4b6991
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b698a
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
test dl, dl
jne 0x4b69d0
cmp word [edi], 0
jne 0x4b69d0
cmp word [ecx], 0
jne 0x4b69d0
cmp word [eax], 0
jne 0x4b69d0
cmp word [ebp], 0
jne 0x4b69d0
mov ecx, ebx
call fcn.004b7290
test eax, eax
je 0x4b69ee
mov ecx, eax
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004b6a00
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push edx
push ebp
push eax
push ecx
mov edx, edi
mov ecx, ebx
call fcn.004b70d0
add esp, 0x1c
test eax, eax
jne 0x4b69c5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4b6e50
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x4b6eba
lea eax, [esp + 0xc]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4b6ec7
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b6ec7
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4b6ec7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b6ec7
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x4b6f33
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword fs:[0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
nop word [eax + eax]
cmp dword [0x4fd2ec], ebx
jne 0x4b6f09
mov edx, 1
mov ecx, 0x8000012f
call fcn.004018f0
jmp 0x4b6f0d
push 0xa
call ebp
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b6f2b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jg 0x4b6ef0
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x4b70d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c6c
call fcn.004cdac0
mov eax, edx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], eax
movzx eax, word [eax]
push edi
mov edi, ecx
cmp eax, 0x41
je 0x4b7101
cmp eax, 0x61
jne 0x4b7164
mov ecx, dword [esp + 0xc]
cmp word [ecx + 2], 0
jne 0x4b7164
cmp word [ebx], 0
jne 0x4b7164
cmp word [edx], 0
jne 0x4b7164
cmp word [esi], 0
jne 0x4b7164
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4b714b
cmp byte [edi + 0xea], 0
jne 0x4b714b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b7149
mov ecx, esi
call fcn.004b7de0
test al, al
je 0x4b714b
xor esi, esi
cmp byte [ebp + 0x18], 0
je 0x4b715b
test esi, esi
je 0x4b715b
mov dword [edi + 0xc4], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x4b7186
cmp word [ebx], ax
jne 0x4b7186
cmp word [edx], ax
jne 0x4b7186
cmp word [esi], ax
jne 0x4b7186
mov ecx, edi
call fcn.004b7290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.00450720
push esi
push edx
push ebx
push dword [esp + 0x18]
push edi
call fcn.004b7f30
test eax, eax
je 0x4b7252
test byte [esp + 0x10], 2
mov al, byte [ebp + 0x14]
mov byte [esp + 0x183d], al
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x184c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x1850], eax
je 0x4b725b
mov esi, dword [esp + 0x102c]
cmp esi, 0xffff
je 0x4b722a
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b7252
cmp byte [edi + 0xea], 0
mov esi, dword [esp + 0x102c]
jne 0x4b722a
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b720d
mov ecx, esi
call fcn.004b7de0
test al, al
je 0x4b7223
push 0xfffffffffffffff0
push dword [esp + 0x1030]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4b7252
mov esi, dword [esp + 0x102c]
cmp dword [esp + 0x1864], esi
je 0x4b7243
lea ecx, [esp + 0x10]
mov dword [esp + 0x1864], esi
call fcn.004b8470
push 0
lea ecx, [esp + 0x14]
call fcn.004b8550
test eax, eax
jne 0x4b726b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push 0x4b7330
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp + 0x18], 0
mov eax, dword [esp + 0x1844]
je 0x4b7254
test eax, eax
je 0x4b7254
mov dword [edi + 0xc4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8470
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1854]
test ecx, ecx
je 0x4b8545
mov eax, dword [esi]
test eax, eax
je 0x4b8545
push edi
test al, 1
jne 0x4b849d
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4b84b7
push 0x7fff
lea edi, [esi + 0x1860]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4b84b7
mov word [edi], ax
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x4b84d1
lea eax, [esi + 0x185c]
push eax
push dword [esi + 0x1854]
call edi
test byte [esi], 0x20
je 0x4b850d
lea eax, [esp + 8]
push eax
push dword [esi + 0x1854]
call edi
test eax, eax
je 0x4b850d
movzx eax, byte [esi + 0x182c]
lea edx, [esi + 0x11a60]
push eax
push ecx
mov ecx, dword [esp + 0x10]
call fcn.0047bd80
add esp, 8
test eax, eax
jne 0x4b850d
mov word [esi + 0x11a60], ax
test byte [esi], 8
pop edi
je 0x4b852b
push 0x101
lea eax, [esi + 0x1185e]
push eax
push dword [esi + 0x1854]
call dword [sym.imp.USER32.dll_GetClassNameW]
test dword [esi], 0x100
je 0x4b8545
push dword [esi + 0x1854]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esi + 0x1858], eax
pop esi
pop ecx
ret

Function at 0x4b8f50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c68
call fcn.004cdac0
mov edx, dword [ecx + 8]
test edx, edx
je 0x4b8feb
lea ecx, [esp]
call fcn.00450720
mov al, byte [ebp + 8]
mov byte [esp + 0x1848], al
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x184c], eax
mov eax, ecx
push eax
push 0x4b9730
mov dword [esp + 0x184c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1834], 0
je 0x4b8feb
mov eax, dword [0x4f90f4]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4b8feb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4fd2ec], eax
je 0x4b8fd8
mov eax, dword [0x4f90f4]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4f90f4]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.004018f0
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4b92d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c74
call fcn.004cdac0
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x4b94c0
push 0
call fcn.004b94d0
test eax, eax
jne 0x4b9303
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x4f90f4]
mov ebx, eax
mov ecx, esi
push ebx
call fcn.004b9570
mov edx, dword [0x4fd2e4]
xor ecx, ecx
test eax, eax
cmovne edx, ecx
lea ecx, [esp + 0x18]
mov dword [0x4fd2e4], edx
call fcn.00450720
cmp byte [ebp + 8], 0
je 0x4b9347
mov byte [esp + 0x1845], 0
test edx, edx
je 0x4b934f
mov byte [esp + 0x1845], 1
mov eax, dword [0x4fd2e0]
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x185c], eax
lea eax, [esp + 0x18]
push eax
push 0x4b9600
mov dword [esp + 0x1860], edx
call edi
mov eax, dword [esp + 0x184c]
test eax, eax
je 0x4b9488
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x4b7da0
mov dword [esp + 0x1c], 0
call edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4b93eb
mov ecx, dword [0x4fd2e4]
xor eax, eax
mov edx, dword [esp + 0x184c]
mov esi, dword [0x4fd2e0]
test ecx, ecx
jle 0x4b93d0
cmp dword [esi + eax*4], edx
je 0x4b93e2
inc eax
cmp eax, ecx
jl 0x4b93c6
cmp ecx, 0x1f4
jge 0x4b93e2
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4fd2e4], ecx
mov dword [esp + 0x184c], edi
jmp 0x4b93f2
mov edi, dword [esp + 0x184c]
mov ecx, edi
call fcn.004b6a00
mov ecx, dword [0x4fd2e4]
xor eax, eax
mov edx, dword [esp + 0x184c]
mov esi, dword [0x4fd2e0]
test ecx, ecx
jle 0x4b941c
cmp dword [esi + eax*4], edx
je 0x4b942e
inc eax
cmp eax, ecx
jl 0x4b9412
cmp ecx, 0x1f4
jge 0x4b942e
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4fd2e4], ecx
mov eax, dword [0x4f90f4]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4b94c0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4fd2ec], eax
je 0x4b9467
mov eax, dword [0x4f90f4]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4f90f4]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.004018f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4fd2e4]
test eax, eax
je 0x4b94c0
cmp eax, 1
mov dword [0x4fd2e4], 0
setg al
test al, al
je 0x4b94c0
mov ecx, dword [0x4fd2e0]
push 0
mov dword [0x4fd2e4], 1
mov dword [ecx], ebx
mov ecx, esi
call fcn.004b92d0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4