joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451e1f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x9c], 0
je 0x451ea2
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x44]
push 0x104
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x44]
push eax
call fcn.004d9ab1
pop ecx
mov ecx, eax
mov eax, dword [esi + 0xa4]
cmp ecx, eax
jg 0x451e82
mov eax, dword [esi + 0xa0]
cmp ecx, eax
jge 0x451ea2
push eax
lea eax, [ebp - 0x44]
push 0x52268c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret

Function at 0x4520dd
Capabilities:
Get graphical window text

Disassembly:
push 0x21c
mov eax, 0x501c9f
call fcn.004e6cea
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov word [esi + 0xb8], bx
mov word [esi + 0xba], ax
mov eax, dword [0x548750]
mov dword [ebp - 0x220], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 1
test bl, 1
je 0x452130
push str.ALT_
lea ecx, [ebp - 0x220]
call fcn.004028f2
test bl, 2
je 0x452145
push str.CTRL_
lea ecx, [ebp - 0x220]
call fcn.00402a52
test bl, 4
je 0x45215a
push str.SHIFT_
lea ecx, [ebp - 0x220]
call fcn.00402a52
mov dl, byte [ebp + 0xc]
lea ecx, [ebp - 0x21c]
call fcn.0045225e
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.00402aef
lea ecx, [ebp - 0x21c]
call fcn.00403080
mov eax, dword [ebp - 0x224]
cmp dword [eax - 8], 0
jne 0x452198
xor eax, eax
mov word [esi + 0xba], ax
mov eax, dword [0x548750]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x220]
cmp dword [eax - 8], 0
jne 0x4521c5
push 0x5287b0
lea ecx, [ebp - 0x21c]
call fcn.004028f2
jmp 0x4521fc
lea eax, [ebp - 0x224]
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x228]
call fcn.00425480
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.00402aef
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.00403080
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x218]
call fcn.00452463
push dword [ebp - 0x21c]
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.00403080
lea ecx, [ebp - 0x224]
call fcn.00403080
lea ecx, [ebp - 0x220]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret 8
Function at 0x455cdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
cmp dword [ebx + 0x10], edi
je 0x455ecf
lea esi, [ebx + 0x74]
mov ecx, edi
mov eax, esi
cmp dword [eax], edi
je 0x455ecf
inc ecx
add eax, 4
cmp ecx, 4
jl 0x455cfc
push ecx
push dword [ebx + 0x50]
lea ecx, [esp + 0x40]
push dword [ebx + 0x4c]
call fcn.00415755
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x24]
call fcn.004156fb
mov ecx, dword [esi]
xor eax, eax
cmp dword [ebx + 0x14], edi
setne al
mov dword [esp + 0x1c], eax
call fcn.00415afa
mov ecx, dword [esi]
mov edi, eax
shr edi, 1
call fcn.00415ad3
mov ecx, dword [ebx + 0x80]
mov dword [esp + 0x14], eax
call fcn.00415afa
mov ecx, dword [ebx + 0x50]
sub esp, 0x10
shr eax, 1
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x38], eax
push dword [esp + 0x24]
mov dword [esp + 0x40], eax
push edi
push eax
mov eax, edi
mov dword [esp + 0x50], ecx
imul eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], edi
push eax
lea eax, [esp + 0x48]
push eax
push dword [esi]
call fcn.00415a84
mov esi, dword [ebx + 0x4c]
sub esi, dword [esp + 0xc]
mov ecx, dword [ebx + 0x78]
sub esi, edi
call fcn.00415afa
mov ecx, dword [ebx + 0x50]
sub esp, 0x10
and dword [esp + 0x3c], 0
cdq
sub eax, edx
mov dword [esp + 0x38], edi
mov edi, dword [esp + 0x24]
push edi
sar eax, 1
mov dword [esp + 0x44], esi
mov esi, dword [esp + 0x30]
push 1
imul eax, esi
push 0
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
push dword [ebx + 0x78]
call fcn.00415a84
mov ecx, dword [esp + 0xc]
sub esp, 0x10
mov eax, dword [ebx + 0x4c]
xor edx, edx
sub eax, ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x50]
push edi
push ecx
mov dword [esp + 0x44], edx
push edx
imul ecx, esi
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push ecx
lea ecx, [esp + 0x40]
push eax
cmp dword [ebx + 0x70], edx
je 0x455e1e
push dword [ebx + 0x7c]
jmp 0x455e24
push dword [ebx + 0x80]
call fcn.00415a84
mov edi, dword [ebx + 0x6c]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xff333333
mov dword [esp + 0x18], 0x41600000
mov esi, dword [edi - 8]
mov dword [esp + 0x1c], 0x41000000
call fcn.00415969
movss xmm2, dword [0x530bc8]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
push 1
push 0x513740
lea ecx, [esp + 0x24]
call fcn.004159da
push eax
push esi
push edi
lea ecx, [esp + 0x34]
call fcn.0044e068
push dword [esp + 0xc]
call dword [sym.imp.gdiplus.dll_GdipDeleteFont]
push dword [esp + 0x2c]
mov dword [esp + 0x2c], vtable.Gdiplus::Brush.0
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x44]
sub esp, 0x10
push dword [ebx + 0x50]
push dword [ebx + 0x4c]
push 0
push 0
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.00415a84
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [esp + 0x3c]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4564d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0xffffffffffffffeb
push eax
mov dword [ebp - 0x418], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, dword [ebp + 0xc]
mov edi, eax
cmp esi, 0x102
jne 0x4565e2
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004deff0
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
add esp, 0xc
push 0x104
push eax
push dword [edi + 0x6c]
call esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x102
push dword [ebp - 0x418]
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov dword [ebp - 0x418], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push dword [edi + 0x6c]
call esi
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4565be
test dx, dx
je 0x4565ba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4565be
add eax, 4
add ecx, 4
test dx, dx
jne 0x456598
xor eax, eax
jmp 0x4565c3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4565d7
mov eax, dword [edi]
lea ecx, [ebp - 0x414]
push ecx
push 0
mov ecx, edi
call dword [eax + 0x70]
mov eax, dword [ebp - 0x418]
jmp 0x4566ce
cmp esi, 0x100
jne 0x45664a
cmp dword [ebp + 0x10], 0xd
jne 0x4566b8
cmp dword [edi + 0x70], 0
jne 0x4566b8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi]
lea ecx, [ebp - 0x20c]
push ecx
push 1
mov ecx, edi
call dword [eax + 0x70]
mov ecx, edi
call fcn.00456896
jmp 0x4566b8
cmp esi, 7
jne 0x456674
mov eax, dword [edi]
mov ecx, edi
push 0
push 5
call dword [eax + 0x70]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x418]
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov esi, eax
jmp 0x456690
cmp esi, 8
jne 0x456686
mov eax, dword [edi]
mov ecx, edi
push 0
push 6
call dword [eax + 0x70]
jmp 0x4566b8
cmp esi, 0x203
jne 0x45669b
xor esi, esi
mov ecx, edi
call fcn.00456932
mov eax, esi
jmp 0x4566ce
cmp esi, 0x10d
jne 0x4566ac
mov dword [edi + 0x70], 1
jmp 0x4566b8
cmp esi, 0x10e
jne 0x4566b8
and dword [edi + 0x70], 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x418]
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x456814
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, str.backupelem
push edi
mov edi, ecx
mov cx, word [eax]
cmp cx, word [edx]
jne 0x456848
test cx, cx
je 0x456844
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x456848
add eax, 4
add edx, 4
test cx, cx
jne 0x456822
xor eax, eax
jmp 0x45684d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x456881
push ebx
push esi
mov ebx, 0x208
push ebx
call fcn.004d980f
push ebx
mov esi, eax
push 0
push esi
call fcn.004deff0
add esp, 0x10
push 0x104
push esi
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, esi
pop esi
pop ebx
jmp 0x456891
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044cd94
pop edi
pop ebp
ret 0xc

Function at 0x456896
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
xor ebx, ebx
push 0xffe
mov word [ebp - 0x1004], ax
mov edi, ecx
lea eax, [ebp - 0x1002]
push ebx
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4568ef
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x456922
push ecx
push ecx
push 0xb1
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret

Function at 0x456932
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0xffe
mov word [ebp - 0x1004], ax
mov esi, ecx
lea eax, [ebp - 0x1002]
push edi
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x45698b
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4569ae
push ecx
push edi
push 0xb1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x4592c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0xffe
mov word [ebp - 0x1004], ax
mov esi, ecx
lea eax, [ebp - 0x1002]
push edi
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x459321
sub ecx, edx
sar ecx, 1
js 0x459354
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x1008], ecx
push eax
push edi
push 0x437
push dword [esi + 0x6c]
mov dword [ebp - 0x100c], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret

Function at 0x459364
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push dword [esi + 0x130]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4593a3
mov ecx, esi
call fcn.00459243
push 0
push dword [esi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x1004], 0
je 0x4593f0
mov eax, dword [esi]
lea ecx, [ebp - 0x1004]
push ecx
push 1
mov ecx, esi
call dword [eax + 0x70]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x4593ff
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0xd
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffff8000
xor edi, edi
test cx, ax
je 0x459446
cmp dword [esi + 0xa0], edi
jne 0x459446
mov ecx, esi
call fcn.00459364
xor eax, eax
inc eax
jmp 0x45952e
mov ebx, dword [ebp + 8]
cmp ebx, 0x28
jne 0x459468
lea ecx, [esi + 0xb0]
call fcn.0045bd7e
mov ecx, esi
call fcn.00459243
mov dword [esi + 0x9c], edi
jmp 0x45943e
cmp ebx, 0x26
jne 0x45947a
lea ecx, [esi + 0xb0]
call fcn.0045be0a
jmp 0x459459
xor eax, eax
push 0xffe
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push edi
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x100c]
push 0x800
push eax
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [ebp - 0x100c]
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x4594b8
sub edi, ecx
sar edi, 1
cmp ebx, 0x25
je 0x4594da
cmp ebx, 0x27
je 0x4594da
cmp ebx, 8
jne 0x45952c
test edi, edi
jmp 0x459526
test edi, edi
je 0x45943e
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], edx
push eax
push edx
push 0x434
push dword [esi + 0x6c]
mov dword [ebp - 0x1010], edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1014]
cmp eax, dword [ebp - 0x1010]
jne 0x45952c
test eax, eax
jne 0x45951f
cmp ebx, 0x25
je 0x45943e
cmp eax, edi
jne 0x45952c
cmp ebx, 0x27
je 0x45943e
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret 4
Function at 0x459541
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50202d
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x1010], ax
push 0xffe
lea eax, [ebp - 0x100e]
mov dword [ebp - 0x1020], ebx
push ebx
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0x800
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x548750]
mov dword [ebp - 0x1014], eax
push 0x11
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffff8000
test cx, ax
je 0x45961e
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1014]
call fcn.004028f2
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x1014]
call fcn.00403080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d9731
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], ebx
push eax
push ebx
push 0x434
push dword [edi + 0x6c]
mov dword [ebp - 0x1018], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1018]
mov edx, dword [ebp - 0x101c]
cmp eax, edx
jne 0x4596b4
lea ecx, [ebp - 0x1010]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x459659
sub ecx, edi
lea eax, [ebp - 0x1010]
sar ecx, 1
cmp ecx, edx
jne 0x45968f
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1014]
push str._s_c
push eax
call fcn.0040306c
add esp, 0x10
jmp 0x4595e5
push eax
lea ecx, [ebp - 0x1014]
call fcn.004028f2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1014]
push dword [ebp - 0x101c]
call fcn.0045beb8
jmp 0x4595e5
add edx, edx
cmp edx, 0x1000
jae 0x4596f3
lea eax, [ebp + eax*2 - 0x1010]
xor ecx, ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1010]
mov word [ebp + edx - 0x1010], cx
push eax
lea eax, [ebp - 0x1014]
push str._s_c_s
push eax
call fcn.0040306c
add esp, 0x14
jmp 0x4595e5
call fcn.004dbe04
int3
Function at 0x45a27f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0x4fe0d6
call fcn.004e6cb7
mov edi, ecx
mov eax, dword [0x548750]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call ebx
test eax, eax
je 0x45a2b0
push 0xd
pop esi
jmp 0x45a2bb
push 1
call ebx
test eax, eax
je 0x45a32d
xor esi, esi
inc esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45a32d
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x45a2f3
inc ebx
cmp esi, ebx
je 0x45a327
push ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x45a327
push ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x45a327
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, 0xd
jne 0x45a30e
test eax, eax
je 0x45a320
push eax
lea ecx, [ebp - 0x10]
call fcn.004028f2
jmp 0x45a320
cmp esi, 1
jne 0x45a320
test eax, eax
je 0x45a320
push eax
lea ecx, [ebp - 0x10]
call fcn.00413d88
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x10]
call fcn.00403080
mov eax, edi
call fcn.004e6c85
ret
Function at 0x45ad44
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push dword [edi + 0x130]
or dword [edi + 0xd4], 0xffffffff
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45ad6e
xor eax, eax
jmp 0x45ae69
mov eax, dword [edi + 0x124]
sub eax, dword [edi + 0x120]
test eax, 0xfffffffc
jne 0x45ad91
push 0
push dword [edi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45ad67
cmp dword [ebp + 8], 0
je 0x45ae58
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [edi + 0x6c]
jne 0x45ad67
xor edx, edx
cmp dword [edi + 0xa0], edx
jne 0x45ad67
mov ecx, dword [edi + 0x68]
or dword [edi + 0xd4], 0xffffffff
push ebx
push esi
mov eax, dword [ecx]
push edx
push edx
push 0x65
call dword [eax]
mov esi, eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x50]
add eax, dword [edi + 0x48]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push esi
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [edi + 0x124]
sub ecx, dword [edi + 0x120]
mov eax, dword [edi + 0x154]
add eax, dword [ebp - 0x10]
mov ebx, dword [edi + 0x158]
add ebx, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
sar ecx, 2
imul ecx, dword [edi + 0x84]
mov edi, dword [edi + 0x150]
push 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push ecx
mov dword [ebp + 8], ecx
xor ecx, ecx
add edi, dword [eax + 0x4c]
push edi
push ecx
push ecx
push ecx
push dword [eax + 0xb4]
call esi
push 0x50
push dword [ebp + 8]
lea eax, [ebx + 2]
push edi
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push 0
push dword [eax + 0x130]
call esi
pop esi
pop ebx
jmp 0x45ae66
push 0
push dword [edi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x45ae93
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004eaef0
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
xor esi, esi
mov dword [ebp - 0x1010], edi
mov ebx, ecx
mov dword [ebp - 0x100c], esi
push esi
push 0x434
mov dword [ebp - 0x1008], esi
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0xffe
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push esi
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [ebp - 0x1004]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x45af1a
mov edx, edi
sub esi, ecx
sar esi, 1
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x45af30
mov edi, dword [ebp - 0x1008]
sub edx, ecx
mov ecx, dword [ebp - 0x100c]
sar edx, 1
cmp edi, ecx
jne 0x45af54
lea eax, [esi + 1]
jmp 0x45af5b
mov eax, esi
sub eax, edi
inc eax
add eax, ecx
cmp eax, edx
je 0x45af80
jge 0x45af8d
cmp edi, ecx
jne 0x45af7c
cmp esi, ecx
jne 0x45af72
inc ecx
mov dword [ebp - 0x1008], edx
jmp 0x45af87
inc ecx
inc edi
mov dword [ebp - 0x1008], edi
jmp 0x45af87
cmp edi, esi
je 0x45af69
inc ecx
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x100c], ecx
push dword [ebp - 0x1010]
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x100c]
push eax
xor eax, eax
push eax
push 0x437
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1008]
xor ecx, ecx
cmp eax, dword [ebp - 0x100c]
pop edi
setne cl
mov dword [ebx + 0x74], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret 4
Function at 0x45bc4d
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x501111
call fcn.004e6cb7
mov esi, ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
shr eax, 0x10
div dword [esi + 0x34]
push eax
mov dword [esi + 0x24], eax
call fcn.0045b9f3
test eax, eax
jne 0x45bcb4
mov eax, dword [0x548750]
mov dword [ebp + 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp + 0x10]
push eax
push dword [esi + 0x24]
mov ecx, esi
call fcn.0045bd4b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x54]
push dword [ebp + 0x10]
push 2
mov eax, dword [ecx]
call dword [eax + 0x70]
lea ecx, [ebp + 0x10]
call fcn.00403080
xor eax, eax
call fcn.004e6c85
ret 0x10

Function at 0x46002c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x118], 0
je 0x46005d
cmp dword [esi + 0xe0], 0
je 0x46005d
push 0x260
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp + 0xc], 1
jne 0x46006a
mov ecx, esi
call fcn.0044aab4
mov ecx, dword [0x54d9b4]
push dword [esi + 0xec]
lea ecx, [ecx + 0x86ec]
call fcn.00434f33
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x46057b
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0xf0]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x4605a1
call fcn.004138fb
lea ecx, [esi + 0x124]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x4605b8
call fcn.004138fb
mov edi, dword [esi + 0x130]
test edi, edi
je 0x4605d7
mov ecx, edi
call fcn.0043a565
push edi
call fcn.004d972c
and dword [esi + 0x130], 0
pop ecx
lea ecx, [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.0044aab4
pop edi
xor eax, eax
pop esi
ret 0x10