joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8640
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x18]
test ecx, ecx
jne 0x4c8665
xor eax, eax
jmp 0x4c872c
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x4c8675
xor eax, eax
jmp 0x4c872c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.00449060
mov dword [ebp - 0x14], esp
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x4c86a8
xor eax, eax
jmp 0x4c872c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x10]
add ecx, 0x1dc
call fcn.0044b2d0
push 0
push 0
push 0
push str.textchanged
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00458a00
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x10]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00451830
movzx ecx, al
test ecx, ecx
je 0x4c872a
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x10]
call fcn.0045c570
xor eax, eax
lea esp, [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447de7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ce250
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x202
mov word [ebp - 0x29c], ax
lea ecx, [ebp - 0x294]
push ecx
movzx edx, word [ebp - 0x29c]
push edx
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4ce28e
xor eax, eax
jmp 0x4ce331
push 0xff
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.005175d0
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x104]
push ecx
call sub.WS2_32.dll_gethostname
lea edx, [ebp - 0x104]
push edx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x4ce2d4
xor eax, eax
jmp 0x4ce331
push 4
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + ecx]
push ecx
lea edx, [ebp - 0x298]
push edx
call fcn.00516ad0
add esp, 0xc
movzx eax, byte [ebp - 0x298]
shl eax, 0x18
movzx ecx, byte [ebp - 0x297]
shl ecx, 0x10
add eax, ecx
movzx edx, byte [ebp - 0x296]
shl edx, 8
add eax, edx
movzx ecx, byte [ebp - 0x295]
add eax, ecx
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447de7
mov esp, ebp
pop ebp
ret
Function at 0x4ce4d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c8fb
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x10]
mov dword [eax + 0x5a8], 0
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + 4], 0
jne 0x4ce609
mov dword [ebp - 0xc0], 8
mov dword [ebp - 0xbc], 0x800
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x4ce5c3
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xa8]
call fcn.004cde30
mov dword [ebp - 0xb0], 0x40030000
push 0
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0xc], eax
push 0
mov ecx, dword [ebp - 0xb0]
push ecx
push 0
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00451350
push eax
mov ecx, dword [ebp - 0xa8]
call fcn.00497910
push 1
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx + 0x10]
call fcn.0048ac20
push eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00450ba0
mov ecx, dword [eax]
push ecx
push 0x30
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xb8]
call fcn.0044c160
mov byte [ebp - 0xa9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.0044b190
movzx edx, byte [ebp - 0xa9]
test edx, edx
je 0x4ce684
call fcn.004ce250
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x10]
mov dword [edx + 0x5a0], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x5a0]
push edx
push 0
push 0x465
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447de7
mov esp, ebp
pop ebp
ret 4
Function at 0x4ce750
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4ce795
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 4]
jne 0x4ce786
mov edx, dword [ebp + 0x14]
mov dword [edx], 1
xor eax, eax
jmp 0x4ce80d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 8], eax
jmp 0x4ce762
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x5a8], 0
jne 0x4ce7fb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add eax, 0x5a0
push eax
push 0
push 0x466
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov dword [ecx + 0x5a8], 1
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x10]
call fcn.004ce840
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4d5dc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68d7ab
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x732694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00497570
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004d5f50
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], vtable.DuiLib::INotifyUI.0
mov edx, dword [ebp - 0x10]
add edx, 0x1c
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.DuiLib::IDialogBuilderCallback.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.DuiLib::CMenuWnd.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], vtable.DuiLib::CMenuWnd.1.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], vtable.DuiLib::CMenuWnd.2.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], vtable.DuiLib::CMenuWnd.3.0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
add eax, 0x2c
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0x692be4
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0044da40
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x784], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x788], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78c], 6
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4d8fb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x24], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x784], ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x788], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x2c], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 0x20]
mov dword [edx + 0x78c], eax
cmp dword [ebp + 8], 0
jne 0x4d903e
call fcn.004d8b00
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x30]
mov edx, dword [eax + 0xc]
call edx
cmp dword [ebp + 0x1c], 0
je 0x4d903e
call fcn.004d8b00
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x14]
call eax
cmp dword [ebp - 0x28], 0
je 0x4d904f
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
mov dword [ebp - 0x38], ecx
jmp 0x4d9056
mov dword [ebp - 0x38], 0
call fcn.004d8b00
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x784], 0
jne 0x4d9087
mov ecx, dword [ebp + 0x18]
call fcn.00451350
mov dword [ebp - 0x40], eax
jmp 0x4d90aa
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x784]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x784]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call fcn.00451350
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x24]
call fcn.0044aef0
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
push 0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
push 0x88
push SysReAllocString
push 0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.00497910
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4d9125
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x2c], eax
jmp 0x4d9108
push 5
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447de7
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e54e5
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x68e113
call fcn.00448f45
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
push 0x44
pop edi
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x98]
push esi
push eax
call fcn.005175d0
mov dword [ebp - 0x98], edi
xor eax, eax
lea edi, [ebp - 0x54]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 1
test eax, eax
je 0x4e5593
push eax
lea ecx, [ebp - 0x40]
call fcn.00402340
cmp dword [ebp - 0x30], esi
je 0x4e5593
push 0x692be8
lea ecx, [ebp - 0x28]
call fcn.00402340
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402d70
push 0x6aa1cc
lea ecx, [ebp - 0x28]
call fcn.00402d70
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.00402da0
jmp 0x4e559c
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402340
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x98]
push ecx
push esi
push esi
push esi
push 1
push esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4e55cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4e55fb
cmp byte [ebp + 0x10], 0
je 0x4e55e8
or eax, 0xffffffff
cmp dword [ebp + 0x14], 0
cmovg eax, dword [ebp + 0x14]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x50]
call esi
xor esi, esi
inc esi
lea ecx, [ebp - 0x40]
call fcn.00401e90
lea ecx, [ebp - 0x28]
call fcn.00401e90
mov eax, esi
call fcn.00448f00
ret
Function at 0x4e57fa
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x692be4
mov dword [ebp - 0x440], eax
call fcn.00402340
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005175d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4e589e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x4e589e
xor ecx, ecx
lea esi, [edi + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00447e5d
mov ebx, eax
xor eax, eax
push esi
push eax
push ebx
call fcn.005175d0
add esp, 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x4e58af
push ebx
call fcn.00447e66
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447de7
leave
ret
mov eax, dword [0x6aa1c4]
mov dword [ebp - 0xc], eax
mov ax, word [0x6aa1c8]
push 0x208
mov word [ebp - 8], ax
call fcn.00447e5d
mov edi, eax
mov dword [ebp - 0x43c], ebx
movzx eax, word [ebx]
pop ecx
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x4e5924
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4e59c3
push edi
call fcn.00447e66
push 2
call fcn.00447e5d
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0xc]
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4e59c3
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x4e592b
sub esi, ecx
lea eax, [ebp - 0x218]
sar esi, 1
push esi
push edi
push eax
call fcn.0051b428
add esp, 0xc
test eax, eax
je 0x4e5973
mov esi, dword [ebp - 0x43c]
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x4e5955
movzx eax, word [esi]
mov dword [ebp - 0x43c], esi
test ax, ax
je 0x4e59c3
jmp 0x4e58d7
lea eax, [ebp - 0x218]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x6966d0
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00427300
add esp, 0x14
lea eax, [ebp - 0x420]
lea ecx, [ebp - 0x438]
push eax
call fcn.004027c0
mov ecx, dword [ebp - 0x440]
push eax
call fcn.0041cdd0
lea ecx, [ebp - 0x438]
call fcn.00401e90
push ebx
call fcn.00447e66
push edi
call fcn.00447e66
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4e58a0
Function at 0x4e59d9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4e5a5f
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.005175d0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4e5a5f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4e5a54
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0051b2b3
pop ecx
pop ecx
test eax, eax
je 0x4e5a6f
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4e5a34
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00447de7
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x4e5a61

Function at 0x4e5be3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4e5c67
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.005175d0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4e5c67
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4e5c54
cmp dword [ebp - 0x228], edi
je 0x4e5c5a
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4e5c3f
jmp 0x4e5c5c
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x4e5c69
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447de7
leave
ret

Function at 0x4e5d9c
Capabilities:
Terminate process

Disassembly:
push 0x20
mov eax, 0x6892d8
call fcn.00448f45
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4e5e27
cmp esi, 0xffffffff
je 0x4e5e27
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.004e57fa
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004e5c78
add esp, 0x10
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00401e90
test bl, bl
je 0x4e5e27
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4e5e27
cmp byte [ebp + 0x14], 0
je 0x4e5e27
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp - 0x2c], 0
test esi, esi
je 0x4e5e45
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4e5e45
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
call fcn.00448f00
ret
Function at 0x4e5e4d
Capabilities:
Enumerate processes
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4e5ee9
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4e5ee9
push edi
xor edi, edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push ebx
push eax
push dword [ebp - 0x228]
call fcn.004e5d9c
add esp, 0x10
test al, al
je 0x4e5eb1
inc edi
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4e5e93
test edi, edi
jle 0x4e5ee4
push str.Shell_TrayWnd
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, edi
pop edi
jmp 0x4e5eec
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00447de7
leave
ret

Function at 0x4e5f6b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x732694]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.005175d0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004e5f20
mov eax, dword [ebp - 0x11c]
add esp, 0xc
cmp eax, 5
jne 0x4e5fea
cmp dword [ebp - 0x118], ebx
jbe 0x4e6030
cmp dword [ebp - 0x118], 1
setne bl
inc ebx
jmp 0x4e6030
cmp eax, 6
jne 0x4e6015
cmp byte [ebp - 6], 1
jne 0x4e6010
mov eax, dword [ebp - 0x118]
sub eax, ebx
je 0x4e600c
sub eax, 1
je 0x4e6008
push 7
jmp 0x4e6012
push 5
jmp 0x4e6012
push 3
jmp 0x4e6012
push 4
pop ebx
jmp 0x4e6030
push 0xa
pop ecx
cmp eax, ecx
jne 0x4e602d
cmp dword [ebp - 0x114], 0x55f0
sbb ebx, ebx
add ebx, 9
jmp 0x4e6030
cmova ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00447de7
leave
ret