joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429a53
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x56c5a4
call fcn.00539438
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov esi, 0x56c5a4
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x54affc], 0
je 0x429aa7
push 0x56c5a4
call fcn.0040c5d0
push 0x56c5a4
call fcn.005395b8
pop ecx
mov esi, eax
push 0
call fcn.00548d28
pop ecx
mov dword [ebx + 0x874], eax
mov edi, dword [ebx + 0x878]
cmp edi, 0xffffffff
jne 0x429ad4
xor eax, eax
jmp 0x429b70
push 0
push esi
push 0x56c5a4
push edi
call sub.WSOCK32.dll_send
cmp esi, eax
je 0x429b6b
cmp dword [ebx + 0x53c], 0
jne 0x429b67
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x429b39
push 0
push 0
push 0x56c5a4
push dword [ebx + 0x870]
call fcn.004b0c4c
test eax, eax
je 0x429b1d
mov dword [ebx + 0x870], eax
push 0x23
push 0x41d
push dword [0x55b3c8]
push dword [ebx + 0x878]
call sub.WSOCK32.dll_WSAAsyncSelect
xor eax, eax
jmp 0x429b70
push ebx
push 0
push 0x528
call fcn.0041c35b
push eax
call fcn.0042793c
cmp dword [0x558a48], 0
je 0x429b67
push ebx
call fcn.00427805
test eax, eax
je 0x429b67
push ebx
push dword [ebx]
call fcn.00519f29
xor eax, eax
jmp 0x429b70
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x429e30
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x54ce4c
mov esi, 0x56d584
push str.mirc.ini
push 0x104
push esi
lea eax, [ebx + 0x10]
push eax
lea edx, [ebx + 8]
push edx
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x104
lea ecx, [esi + 0x104]
push ecx
lea eax, [ebx + 0x23]
push eax
lea edx, [ebx + 0x1c]
push edx
lea ecx, [ebx + 0x14]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x104
lea eax, [esi + 0x208]
push eax
lea edx, [ebx + 0x38]
push edx
lea ecx, [ebx + 0x2f]
push ecx
lea eax, [ebx + 0x27]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x104
lea edx, [esi + 0x30c]
push edx
lea ecx, [ebx + 0x4e]
push ecx
lea eax, [ebx + 0x44]
push eax
lea edx, [ebx + 0x3c]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push str.mirc.ini
push 0x104
lea ecx, [esi + 0x410]
push ecx
lea eax, [ebx + 0x62]
push eax
lea edx, [ebx + 0x5a]
push edx
lea ecx, [ebx + 0x52]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [esi], 0
jne 0x429eee
push esi
mov edi, esi
lea esi, [ebx + 0x66]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
cmp byte [esi + 0x104], 0
jne 0x429f08
push esi
lea edi, [esi + 0x104]
lea esi, [ebx + 0x6f]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x208], 0
jne 0x429f21
push esi
lea edi, [esi + 0x208]
lea esi, [ebx + 0x7a]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
cmp byte [esi + 0x30c], 0
jne 0x429f3e
push esi
lea edi, [esi + 0x30c]
lea esi, [ebx + 0x84]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
cmp byte [esi + 0x410], 0
jne 0x429f72
push esi
lea edi, [esi + 0x104]
add esi, 0x410
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
pop esi
pop ebx
ret

Function at 0x42af7f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
push 1
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x42af99
or dword [ebx], 1
push 2
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x42afa8
or dword [ebx], 2
push 4
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x42afb7
or dword [ebx], 0x10
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x42afc6
or dword [ebx], 8
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x42afd5
or dword [ebx], 4
pop ebx
pop ebp
ret 4
Function at 0x42c300
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, 0x54d044
mov ebp, 0x57943f
xor esi, esi
push esi
push edi
lea eax, [esp + 8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0x54c538
push 0x3e7
push ebp
lea edx, [edi + 0xd]
push edx
lea ecx, [esp + 0x10]
push ecx
lea eax, [edi + 5]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [ebp], 0
je 0x42c364
call fcn.0042c020
mov ebx, eax
test ebx, ebx
je 0x42c361
push ebp
push ebx
call fcn.0042c120
test eax, eax
jne 0x42c361
push ebx
call fcn.0042c0b4
inc esi
jmp 0x42c313
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42eb44
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x54d348
xor ebx, ebx
mov esi, 0x56ecb4
push ebx
push edi
push 0x569f83
call sub.USER32.dll_wsprintfA
add esp, 0xc
push str.mirc.ini
push 0x3e7
push 0x569b9c
lea eax, [edi + 0xa]
push eax
push 0x569f83
lea edx, [edi + 5]
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x569b9c], 0
je 0x42ebae
push 0xa
lea ecx, [ebp - 4]
push ecx
push 0x569b9c
call fcn.00544304
add esp, 0xc
push eax
push dword [ebp + 8]
call sub.GDI32.dll_GetNearestColor
mov dword [esi], eax
inc ebx
add esi, 4
cmp ebx, 0x10
jl 0x42eb57
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x42f7f5
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
call fcn.0042efcc
push str.mirc.ini
push 0x3e7
push 0x569b9c
push 0x54d597
push 0x54d593
push 0x54d58a
call sub.KERNEL32.dll_GetPrivateProfileStringA
cmp byte [0x569b9c], 0
je 0x42f8b8
xor ebp, ebp
mov esi, 0x569b9c
mov ebx, 0x56e980
jmp 0x42f874
push 0x2c
push esi
call fcn.00539518
add esp, 8
mov edi, eax
test edi, edi
je 0x42f851
mov byte [edi], 0
inc edi
push esi
call fcn.00542dbc
pop ecx
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
jl 0x42f865
cmp eax, 0x10
jle 0x42f869
xor edx, edx
mov dword [ebx], edx
inc ebp
add ebx, 0x1c
cmp ebp, 0x1e
jge 0x42f87d
mov esi, edi
test esi, esi
je 0x42f87d
cmp byte [esi], 0
jne 0x42f83c
cmp ebp, 0x18
jne 0x42f8b8
mov eax, dword [0x56ec04]
mov dword [0x56ec20], eax
mov edx, dword [0x56ebe8]
mov dword [0x56ec04], edx
mov ecx, dword [0x56ebcc]
mov dword [0x56ebe8], ecx
mov eax, dword [0x56ebb0]
mov dword [0x56ebcc], eax
mov dword [0x56ebb0], 1
call fcn.0042f3ea
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430fd6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
push 0x57c4a0
push 0x3e7
push 0xd
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x57c4a0], 0
cmp dword [ebp - 8], 0
jne 0x431012
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, edx
jmp 0x431102
push 0
push 0
push 0xb0
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, eax
movzx eax, bx
mov dword [ebp - 0x10], eax
push 0x57c4a0
call fcn.005395b8
pop ecx
cmp eax, dword [ebp - 0x10]
jae 0x431040
xor edx, edx
mov dword [ebp - 0x10], edx
mov esi, ebx
shr esi, 0x10
and si, 0xffff
movzx esi, si
push 0x57c4a0
call fcn.005395b8
pop ecx
cmp esi, eax
jbe 0x43105e
xor esi, esi
push dword [ebp + 0xc]
call sub.USER32.dll_GetDC
mov edi, eax
push dword [0x55b3d4]
call fcn.00516145
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43108e
mov eax, dword [ebp - 0xc]
push dword [eax + 0x7a0]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x57c4a0], 0
push 0x57c4a0
call fcn.005395b8
pop ecx
push eax
push 0x57c4a0
push edi
call fcn.004df9d7
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x57c4a0], 0x20
cmp esi, dword [ebp - 8]
jae 0x4310c9
mov byte [esi + 0x57c4a1], 0
jmp 0x4310d0
mov byte [esi + 0x57c4a0], 0
push 0x57c4a0
call fcn.005395b8
pop ecx
push eax
push 0x57c4a0
push edi
call fcn.004df9d7
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x4310f9
push dword [ebp - 0x14]
push edi
call sub.GDI32.dll_SelectObject
push edi
push dword [ebp + 0xc]
call sub.USER32.dll_ReleaseDC
lea edx, [ebp - 0x24]
push edx
push dword [ebp + 0xc]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x24]
add ebx, eax
add dword [ebp - 4], eax
lea edx, [ebp - 0x34]
push edx
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
mov esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x28]
sub edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
sub eax, edi
add eax, 0xfffffffd
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 4]
sub edx, ebx
mov eax, esi
sub eax, edx
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x43115f
mov ecx, 2
mov eax, dword [ebp - 0x34]
cdq
idiv ecx
mov dword [ebp - 0x34], eax
sub ebx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ebx
jmp 0x431170
mov ecx, 0xfffffffe
mov eax, dword [ebp - 0x34]
cdq
idiv ecx
mov dword [ebp - 0x34], eax
add dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x34]
jle 0x431180
mov edx, eax
add edx, 3
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x34]
add ecx, esi
mov edx, dword [ebp - 0x1c]
sub edx, eax
add edx, eax
cmp ecx, edx
jle 0x4311a1
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
sub eax, esi
add eax, 0xfffffffd
mov dword [ebp - 0x34], eax
push 0
push edi
push esi
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp + 8]
call sub.USER32.dll_MoveWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4311bc
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x54d340]
call sub.USER32.dll_ShowWindow
mov eax, dword [0x54d340]
test eax, eax
je 0x4311d8
push eax
call sub.USER32.dll_DestroyWindow
xor edx, edx
mov dword [0x54d340], edx
ret
Function at 0x43d315
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x43d34a
mov edi, dword [ebx + 4]
test edi, edi
je 0x43d41e
cmp byte [edi], 0x2d
jne 0x43d41e
push 0x68
push edi
call fcn.00539518
add esp, 8
test eax, eax
je 0x43d3b8
push 0x5a
push esi
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x43d3ae
xor eax, eax
mov dword [0x557880], eax
mov byte [0x55781c], 0
push esi
mov edi, esi
mov esi, 0x5577b8
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x5577b8
call fcn.004ff072
call fcn.0051b083
push 0x33
push 0
push 0x5577b8
push 0x54dbf2
push 0
call fcn.0045f440
mov eax, 1
jmp 0x43d4ed
push 0x75
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x43d41e
push 2
call fcn.00447ae4
test eax, eax
jne 0x43d3e6
push 0xc
push 0
push dword [ebx]
push 0
call fcn.00467118
jmp 0x43d4ed
mov dword [0x5550f8], 1
imul edx, dword [0x557490], 0x64
add edx, 0x5573c8
push edx
push 0x54dbf6
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.0051b8a5
mov eax, 1
jmp 0x43d4ed
mov eax, dword [ebx + 4]
test eax, eax
je 0x43d4e8
push eax
call fcn.005395b8
pop ecx
cmp eax, 0x5a
jbe 0x43d43c
mov edx, dword [ebx + 4]
mov byte [edx + 0x5a], 0
mov ecx, dword [ebx + 4]
mov esi, 0x5577b8
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5577b8
call fcn.004ff072
mov eax, dword [ebx + 8]
test eax, eax
je 0x43d4e3
push eax
call fcn.005395b8
pop ecx
cmp eax, 0x5a
jbe 0x43d487
mov edx, dword [ebx + 8]
mov byte [edx + 0x5a], 0
push dword [ebx + 8]
call sub.WSOCK32.dll_inet_addr
mov esi, eax
mov dword [0x557880], esi
cmp esi, 0xffffffff
jne 0x43d4ac
xor eax, eax
mov dword [0x557880], eax
mov byte [0x55781c], 0
jmp 0x43d4e3
push dword [0x557880]
call sub.WSOCK32.dll_htonl
mov dword [0x557880], eax
mov edx, dword [ebx + 8]
mov esi, 0x55781c
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0051b083
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x440ee6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x440f01
cmp dword [ebx + 8], 0
jne 0x440f13
push 0
push 0
push dword [ebx]
push 0
call fcn.00467118
jmp 0x4410cc
push dword [ebx + 4]
call fcn.005160e8
mov dword [0x56f80c], eax
cmp dword [0x56f80c], 0
je 0x440f3c
mov eax, dword [0x56f80c]
mov al, byte [eax + 0x64c]
cmp al, 9
je 0x440f4e
cmp al, 0xa
je 0x440f4e
push 7
push 0
push dword [ebx]
push 0
call fcn.00467118
jmp 0x4410cc
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x440f62
push eax
call fcn.005395b8
pop ecx
cmp eax, 1
ja 0x440f74
push 3
push 0
push dword [ebx]
push 0
call fcn.00467118
jmp 0x4410cc
push dword [ebx + 8]
call fcn.005160e8
test eax, eax
je 0x440f9d
push 6
push 0
push 0
push 0x397
call fcn.0041c35b
push eax
push 0
call fcn.00467118
jmp 0x4410cc
push dword [ebx + 8]
call fcn.005395b8
pop ecx
cmp eax, 0x5a
jbe 0x440fb2
mov edx, dword [ebx + 8]
mov byte [edx + 0x5a], 0
mov ecx, dword [0x56f80c]
add ecx, 4
mov eax, dword [ebx + 8]
push esi
push edi
mov esi, ecx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [0x56f80c]
add eax, 4
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x441049
mov byte [esi], 0
push ebx
push esi
push 3
call fcn.004d5691
cmp byte [esi], 0
je 0x441081
push 0x54e009
push edi
call fcn.005394dc
add esp, 8
push esi
push edi
call fcn.005394dc
add esp, 8
push 0xf
push edi
call fcn.004fec28
jmp 0x441081
push 0x104
push esi
mov eax, dword [0x56f80c]
push dword [eax]
call sub.USER32.dll_GetWindowTextA
cmp byte [esi], 0
je 0x441081
push 0x20
push esi
call fcn.00539518
add esp, 8
mov ebx, eax
mov dword [0x56f810], ebx
test ebx, ebx
je 0x441081
push ebx
push edi
call fcn.005394dc
add esp, 8
mov dword [0x56f810], edi
mov eax, dword [0x56f80c]
cmp byte [eax + 0x66a], 0
je 0x4410a6
mov edx, dword [0x56f810]
cmp byte [edx], 0x40
jne 0x4410a6
inc dword [0x56f810]
push dword [0x56f810]
push dword [eax]
call sub.USER32.dll_SetWindowTextA
cmp dword [0x55a3c0], 0
je 0x4410c7
push dword [0x56f80c]
call fcn.005010e4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x443c27
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x55b3c8
mov eax, dword [ebx + 4]
test eax, eax
je 0x443e02
cmp byte [eax], 0x2d
jne 0x443e02
push 0x6f
push eax
call fcn.00539518
add esp, 8
test eax, eax
je 0x443c62
push 1
push dword [esi]
call fcn.005141b2
jmp 0x443c7c
push 0x70
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443c7c
push 0
push dword [esi]
call fcn.005141b2
push 0x6e
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443cf0
mov edx, dword [0x55ad90]
mov dword [0x56f910], edx
xor ecx, ecx
mov dword [0x55ad90], ecx
mov eax, dword [0x55ad88]
mov dword [0x56f914], eax
xor edx, edx
mov dword [0x55ad88], edx
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
cmp dword [0x55ad8c], 0
je 0x443cd5
push 2
call fcn.0050d634
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x56f910]
mov dword [0x55ad90], ecx
mov eax, dword [0x56f914]
mov dword [0x55ad88], eax
jmp 0x443e02
push 0x78
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443d2b
push 2
call fcn.0050d634
push 3
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x443e02
push 0x73
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443d66
push 2
call fcn.0050d634
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x443e02
push 0x72
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443da7
push 2
call fcn.0050d634
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push 9
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x443e02
push 0x74
push dword [ebx + 4]
call fcn.00539518
add esp, 8
test eax, eax
je 0x443e02
mov edx, dword [0x55ad90]
mov dword [0x56f910], edx
mov dword [0x55ad90], 1
cmp dword [0x55ad88], 0
je 0x443ded
push 1
call fcn.0050d634
test eax, eax
je 0x443ded
push 0
push dword [esi]
call sub.USER32.dll_ShowWindow
jmp 0x443df6
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x56f910]
mov dword [0x55ad90], ecx
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x444f73
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x444faf
mov byte [0x57f650], 0
push dword [0x55b3c8]
call fcn.00476e1b
test eax, eax
jne 0x444fa5
push edi
push esi
call fcn.0041cf41
mov eax, 1
jmp 0x445130
mov edx, dword [ebx + 4]
cmp byte [edx], 0x40
jne 0x445097
push dword [ebx + 4]
call fcn.005160e8
mov dword [0x56f958], eax
cmp dword [0x56f958], 0
jne 0x444fe3
push 7
push 0
push dword [ebx]
push 0
call fcn.00467118
jmp 0x445130
mov eax, dword [0x56f958]
mov edx, eax
add edx, 4
mov dword [0x56f95c], edx
cmp byte [eax + 0x66a], 0
je 0x445002
inc dword [0x56f95c]
push dword [0x56f95c]
push 0x54e2f5
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
push esi
push 2
call fcn.004d5691
push 0xf
push esi
call fcn.004fec28
mov ecx, dword [0x56f958]
push dword [ecx]
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esi
call fcn.005395b8
pop ecx
cmp ebx, eax
jne 0x44507f
push 0x3b5
push edi
mov eax, dword [0x56f958]
push dword [eax]
call sub.USER32.dll_GetWindowTextA
mov eax, esi
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x44507f
test cl, cl
je 0x445073
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x44507f
add eax, 2
add edx, 2
test cl, cl
jne 0x445057
jne 0x44507f
mov eax, 1
jmp 0x445130
push esi
mov edx, dword [0x56f958]
push dword [edx]
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x445130
push 0x54e2fa
push dword [ebx + 4]
call fcn.0053977c
add esp, 8
test eax, eax
jne 0x4450b7
mov dword [0x56f960], 2
jmp 0x4450c1
mov dword [0x56f960], 1
mov edx, dword [0x56f960]
cmp dword [ebx + edx*4], 0
je 0x44510e
mov byte [esi], 0
push ebx
push esi
push dword [0x56f960]
call fcn.004d5691
mov byte [esi + 0xfa], 0
push esi
push edi
mov edi, esi
mov esi, 0x57f650
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x445115
mov byte [0x57f650], 0
push dword [0x55b3c8]
call fcn.00476e1b
test eax, eax
jne 0x44512b
push edi
push esi
call fcn.0041cf41
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x44a408
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
push 0x54e800
push dword [ebp + 8]
call fcn.0053d174
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a42e
xor eax, eax
jmp 0x44a4a5
push dword [ebp - 4]
push pe_nt_image_headers32
push 1
push 0x56fcb8
call fcn.0053d43c
add esp, 0x10
mov esi, eax
test esi, esi
jbe 0x44a482
xor edx, edx
mov eax, 0x56fcb8
cmp esi, edx
jbe 0x44a47a
mov ecx, ebx
xor cl, byte [eax]
and ecx, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x54e400]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
inc eax
cmp esi, edx
ja 0x44a456
cmp esi, 0x200
jae 0x44a42e
mov eax, dword [ebp - 4]
test byte [eax + 0x12], 0x10
je 0x44a498
push dword [ebp - 4]
call fcn.0053ca10
pop ecx
xor eax, eax
jmp 0x44a4a5
push dword [ebp - 4]
call fcn.0053ca10
pop ecx
not ebx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x44ce7f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, 0x5703bc
mov eax, dword [ebx + 0xfe8]
mov dword [edx], eax
jmp 0x44cea4
cmp ecx, dword [eax + 8]
je 0x44ceaa
mov eax, dword [eax + 0x34]
mov dword [edx], eax
mov eax, dword [edx]
test eax, eax
jne 0x44ce9a
mov ecx, dword [edx]
test ecx, ecx
jne 0x44ceb7
xor eax, eax
jmp 0x44d0f4
mov eax, dword [ecx + 0xc]
mov dword [0x570428], eax
test eax, eax
jne 0x44cecd
mov eax, 1
jmp 0x44d0f4
push eax
call sub.USER32.dll_IsWindowEnabled
test eax, eax
jne 0x44cef3
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x570428]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x44d0f4
push dword [0x570428]
push ebx
call fcn.0044ccd2
test eax, eax
jne 0x44cf1f
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x570428]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x44d0f4
push 0x5706f0
push 0x3e7
push 0xd
push dword [0x570428]
call sub.USER32.dll_SendMessageA
cmp byte [0x5706f0], 0
je 0x44d080
push dword [ebx + 0xc8]
call sub.USER32.dll_GetDC
mov esi, eax
mov dword [0x57042c], esi
test esi, esi
jne 0x44cf64
mov eax, 1
jmp 0x44d0f4
push 0
push 0
push 0x31
push dword [ebx + 0xc8]
call sub.USER32.dll_SendMessageA
mov esi, eax
mov dword [0x5703c0], esi
push 0x5703cc
push 0x3c
push esi
call sub.GDI32.dll_GetObjectA
test eax, eax
jne 0x44cfa9
push dword [0x57042c]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x44d0f4
mov byte [0x5703e1], 1
push 0x5703cc
call sub.GDI32.dll_CreateFontIndirectA
mov esi, eax
mov dword [0x5703c8], esi
test esi, esi
jne 0x44cfe1
push dword [0x57042c]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x44d0f4
push dword [0x5703c8]
push dword [0x57042c]
call sub.GDI32.dll_SelectObject
mov dword [0x5703c4], eax
push 0x570408
push dword [0x570428]
call sub.USER32.dll_GetWindowRect
push 2
push 0x570408
push dword [ebx + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
cmp byte [0x5706f0], 0
je 0x44d051
mov esi, 0x570408
mov edi, 0x570418
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push 0x2c10
push 0x570418
push 0xffffffffffffffff
push 0x5706f0
push dword [0x57042c]
call sub.USER32.dll_DrawTextA
push dword [0x5703c4]
push dword [0x57042c]
call sub.GDI32.dll_SelectObject
push dword [0x5703c8]
call sub.GDI32.dll_DeleteObject
push dword [0x57042c]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
jmp 0x44d0c0
push 0x570418
push dword [0x570428]
call sub.USER32.dll_GetWindowRect
push 2
push 0x570418
push dword [ebx + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
mov eax, dword [0x570418]
add eax, 0xa
mov dword [0x570420], eax
mov edx, dword [0x57041c]
add edx, 0xa
mov dword [0x570424], edx
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x570428]
call sub.USER32.dll_SendMessageA
push 1
push 0x570418
push dword [ebx + 0xc8]
call sub.USER32.dll_InvalidateRect
push dword [ebx + 0xc8]
call sub.USER32.dll_UpdateWindow
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc