joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c080
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0xa3
mov dword [0x4e99bc], eax
call fcn.004411b0
push eax
push 0x16a
call fcn.004411f0
mov ecx, dword [0x4e99bc]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 0xc
push eax
push ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov esi, 0x4cb44c
movsx edx, word [esi + 2]
push edx
call fcn.004411b0
mov ecx, dword [0x4e99bc]
add esp, 4
push eax
movsx eax, word [esi]
push eax
push ecx
call edi
add esi, 4
cmp esi, 0x4cb468
jb 0x43c0bf
push 4
call fcn.00428790
push eax
push 0x4cb474
push str.citizen
call fcn.0044d020
push 0x4c51ec
push str.citizen
mov dword [0x4e99f0], eax
call fcn.0044cf60
mov edx, dword [0x4e99bc]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x18
mov dword [0x4e99c8], eax
push 0x5dd
push edx
call esi
mov dword [0x4e99d4], eax
mov eax, dword [0x4e99bc]
push 0x5de
push eax
call esi
mov ecx, dword [0x4e99d4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x10
push 0xc5
push ecx
mov dword [0x4e99d0], eax
call edi
mov edx, dword [0x4e99d0]
push 0
push 0xc
push 0xc5
push edx
call edi
mov eax, dword [0x4e99d0]
push 0
push 0x2a
push 0xcc
push eax
call edi
mov ecx, dword [0x4e99bc]
push 0x5e0
push ecx
call esi
mov edx, dword [0x4e99c8]
mov dword [0x4e9a08], eax
mov eax, dword [0x4e99d4]
push edx
push eax
call ebx
mov ecx, dword [0x4e99f0]
mov edx, dword [0x4e99d0]
push ecx
push edx
call ebx
mov eax, dword [0x4e99bc]
mov edi, dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
push 0x5e1
push eax
call edi
push 0x18
call fcn.0040d2a0
add esp, 4
test eax, eax
jne 0x43c240
push 0xd
call fcn.0040d2a0
add esp, 4
test eax, eax
je 0x43c22a
call fcn.0041d7d0
test eax, eax
jne 0x43c22a
push 0x389
call fcn.004411b0
mov ecx, dword [0x4e99bc]
add esp, 4
push eax
push 0x5e2
push ecx
call esi
push eax
call ebx
push 0x44
call fcn.004411b0
push eax
push 0x38a
call fcn.004411f0
mov edx, dword [0x4e9a08]
add esp, 0xc
push eax
push edx
call ebx
jmp 0x43c240
mov eax, dword [0x4e99bc]
push 0
push 0x5e2
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4e99c4]
test eax, eax
je 0x43c27e
cmp eax, 0xd
jne 0x43c26c
mov ecx, dword [0x4e99f0]
cmp byte [ecx], 0
jne 0x43c26c
mov edx, dword [0x4e99d0]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [0x4e99c8]
push ecx
push eax
call fcn.0043c2d0
add esp, 8
jmp 0x43c298
mov edx, dword [0x4e99f0]
cmp byte [edx], 0
je 0x43c298
mov eax, dword [0x4e99bc]
push 1
push 0x5e1
push eax
call edi
cmp dword [0x4e99cc], 0xa
jl 0x43c2b8
push 0xda
call fcn.004411b0
mov ecx, dword [0x4e9a08]
add esp, 4
push eax
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x43c4d0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
and eax, 0xffff
cmp eax, 0x5df
jg 0x43c5a7
je 0x43c59e
dec eax
je 0x43c595
dec eax
je 0x43c575
sub eax, 0x5db
jne 0x43c5b5
call fcn.00455980
test eax, eax
je 0x43c56f
mov ecx, dword [0x4e99d4]
lea eax, [esp]
push 0x11
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x4e99c8]
test eax, eax
je 0x43c557
lea edx, [esp]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x43c557
push eax
mov eax, dword [0x4e99bc]
push 1
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
add esp, 0x14
ret
mov ecx, dword [0x4e99bc]
push 1
push 1
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
add esp, 0x14
ret
mov edx, dword [0x4e99bc]
push 0x197
push edx
mov dword [0x4e99c4], 0x197
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x14
ret
call fcn.0043c5e0
add esp, 0x14
ret
call fcn.0043c6e0
add esp, 0x14
ret
cmp eax, 0x5e2
je 0x43c5cd
cmp eax, 0x1388
je 0x43c5bb
xor eax, eax
add esp, 0x14
ret
mov eax, dword [0x4e99bc]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x14
ret
call fcn.0043c8c0
add esp, 0x14
ret

Function at 0x43c5e0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4e99cc]
push esi
cmp eax, 0xa
jl 0x43c60c
push 0xda
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4e9a08]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
ret
mov ecx, dword [0x4e99d4]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x11
push 0x4e99dc
push ecx
call esi
mov al, byte [0x4e99dc]
test al, al
jne 0x43c64d
push 0x8e
call fcn.004411b0
mov edx, dword [0x4e9a08]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
ret
mov eax, dword [0x4e99d0]
push 0xd
push 0x4e99f4
push eax
call esi
push 0x9a
call fcn.004411b0
mov ecx, dword [0x4e9a08]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x4e99f4
push 0x4e99dc
call fcn.0047c1c0
add esp, 8
test eax, eax
je 0x43c6a2
push 0x4e99dc
push eax
call fcn.0043c2d0
add esp, 8
mov eax, 1
pop esi
ret
mov edx, dword [0x4e99bc]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 1
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov eax, dword [0x4e99bc]
push 0
push 0x5e2
push eax
call esi
push eax
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x43c6e0
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e99d4]
sub esp, 0x14
lea eax, [esp]
push esi
push 0x11
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 4]
test al, al
jne 0x43c725
push 0x8e
call fcn.004411b0
mov edx, dword [0x4e9a08]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
add esp, 0x14
ret
lea eax, [esp + 4]
push 0
push eax
push 0xb6
call fcn.004411f0
add esp, 8
push eax
push 0xb5
call fcn.004411b0
add esp, 4
push eax
call fcn.0044d230
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x43c760
mov eax, 1
pop esi
add esp, 0x14
ret
push edi
push 0x9c
call fcn.004411b0
mov ecx, dword [0x4e9a08]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 4
push eax
push ecx
call edi
lea edx, [esp + 8]
push edx
push 0x1b
call fcn.0040d240
push esi
push 0x1d
call fcn.0040d240
push 0x43c800
push 0xb
call fcn.0040d490
add esp, 0x18
call fcn.00410590
test eax, eax
je 0x43c7e7
cmp eax, 0x194
je 0x43c7d3
push eax
push 0x9e
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e9a08]
push eax
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
push 2
call fcn.004411b0
mov ecx, dword [0x4e9a08]
add esp, 4
push eax
push ecx
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x43de80
Capabilities:
Check http status code

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x10]
push 0x355
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x30
mov dword [esp + 0x18], 0x12
mov dword [esp + 0x24], 0x7d0
mov dword [esp + 0x1c], eax
call fcn.004411b0
push 0x355
mov dword [esp + 0x3c], eax
call fcn.004411b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov ebp, dword [sym.imp.USER32.dll_InsertMenuItemA]
lea eax, [esp + 0x10]
not ecx
dec ecx
push eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [0x4e9a50]
push 1
push 0
push ecx
call ebp
mov eax, dword [0x4e9a50]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push eax
mov dword [esp + 0x28], 0x800
call ebp
mov esi, 0x1e
mov ebx, 2
lea ecx, [ebx + 0x7cf]
push esi
push 0x20
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], 0
call fcn.004411f0
mov dword [esp + 0x3c], eax
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
mov eax, dword [0x4e9a50]
push edx
not ecx
push 1
dec ecx
push ebx
push eax
mov dword [esp + 0x48], ecx
call ebp
add esi, 0xa
inc ebx
cmp esi, 0xc8
jle 0x43df16
mov ecx, dword [0x4e9a50]
push 8
push 0x7d0
push ecx
mov dword [0x4e9a64], 0x13
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x441560
Capabilities:
Identify system language via api

Disassembly:
push str.messages
push str.general
call fcn.0044cf60
mov cl, byte [eax]
add esp, 8
test cl, cl
je 0x441583
push eax
call fcn.00441270
add esp, 4
jmp 0x441588
call fcn.004415a0
cmp eax, 0x1b0
jne 0x441590
ret
xor eax, eax
ret
Function at 0x4415a0
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
and eax, 0x3ff
add eax, 0xfffffffc
cmp eax, 0x15
ja case.0x4415bf.15
xor ecx, ecx
mov cl, byte [eax + 0x4416ac]
jmp dword [ecx*4 + 0x44167c]
push str.danish
call fcn.00441270
add esp, 4
ret
push str.francais
call fcn.00441270
add esp, 4
ret
push str.italiano
call fcn.00441270
add esp, 4
ret
push str.norsk
call fcn.00441270
add esp, 4
ret
push str.portuguese
call fcn.00441270
add esp, 4
ret
push str.castellano
call fcn.00441270
add esp, 4
ret
push str.suomi
call fcn.00441270
add esp, 4
ret
push str.shiftjis
call fcn.00441270
add esp, 4
ret
push str.big5
call fcn.00441270
add esp, 4
ret
push str.korea
call fcn.00441270
add esp, 4
ret
push str.russian
call fcn.00441270
add esp, 4
ret
push str.default
call fcn.00441360
add esp, 4
neg eax
sbb eax, eax
and eax, 0xfffffe50
add eax, 0x1b0
ret

Function at 0x4429c0
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x4cba98
push edi
mov dword [ebx], edi
call dword [sym.imp.MSVCRT.dll_strpbrk]
mov esi, dword [esp + 0x1c]
add esp, 8
test eax, eax
mov dword [esi], eax
jne 0x442a18
mov al, byte [0x4ed414]
test al, al
jne 0x442a07
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
push 0x4ed414
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov dword [ebx], 0x4ed414
mov dword [esi], edi
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov byte [eax], 0
mov edx, dword [esi]
inc edx
mov dword [esi], edx
mov esi, edx
mov al, byte [esi]
test al, al
je 0x442a39
cmp al, 0x5c
je 0x442a39
cmp al, 0x2f
je 0x442a39
pop edi
pop esi
mov eax, 1
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x442b90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, 0xaaaaaaab
push esi
lea ecx, [ebp + 3]
mov esi, dword [esp + 0x14]
mul ecx
shr edx, 1
lea edx, [edx + ebp + 4]
push edx
push esi
call fcn.00442960
add esp, 8
test eax, eax
jne 0x442bbb
pop esi
pop ebp
ret
push esi
call fcn.00442510
mov ecx, eax
add esp, 4
xor eax, eax
test ebp, ebp
jbe 0x442c46
lea edx, [ebp + 2]
mov eax, 0xaaaaaaab
mul edx
mov esi, dword [esp + 0xc]
push ebx
push edi
mov edi, edx
shr edi, 1
lea eax, [edi + edi*2]
xor edx, edx
xor ebx, ebx
mov dl, byte [esi]
add esi, 3
shr edx, 2
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_NTLM]
mov byte [ecx - 1], dl
mov dl, byte [esi - 3]
mov bl, byte [esi - 2]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
xor ebx, ebx
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_NTLM]
mov byte [ecx - 1], dl
mov dl, byte [esi - 2]
mov bl, byte [esi - 1]
and edx, 0xf
shl edx, 2
shr ebx, 6
or edx, ebx
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_NTLM]
mov byte [ecx - 1], dl
mov dl, byte [esi - 1]
and edx, 0x3f
inc ecx
dec edi
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_NTLM]
mov byte [ecx - 1], dl
jne 0x442be3
pop edi
pop ebx
lea edx, [ebp + 1]
cmp eax, edx
jne 0x442c5c
mov byte [ecx - 1], 0x3d
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebp
ret
add ebp, 2
cmp eax, ebp
jne 0x442c6b
mov al, 0x3d
mov byte [ecx - 1], al
mov byte [ecx - 2], al
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebp
ret
Function at 0x442d70
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
lea eax, [esp + 0x104]
mov dword [esp + 0x104], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x442f0e
mov eax, dword [esp + 0x114]
cmp eax, 2
jne 0x442dcc
mov ecx, dword [str.security.dll]
mov edx, dword [0x4cbb7c]
mov eax, dword [0x4cbb80]
mov dword [esp], ecx
mov cl, byte [0x4cbb84]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov byte [esp + 0xc], cl
jmp 0x442df2
cmp eax, 1
jne 0x442f0e
mov edx, dword [str.secur32.dll]
mov eax, dword [0x4cbb70]
mov ecx, dword [0x4cbb74]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
mov dword [0x4ed450], eax
je 0x442f0e
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.FreeCredentialsHandle
push eax
call esi
mov dword [0x4ed428], eax
mov eax, dword [0x4ed450]
push str.QuerySecurityPackageInfoA
push eax
call esi
mov ecx, dword [0x4ed450]
push str.AcquireCredentialsHandleA
push ecx
mov dword [0x4ed430], eax
call esi
mov edx, dword [0x4ed450]
push str.FreeContextBuffer
push edx
mov dword [0x4ed42c], eax
call esi
mov dword [0x4ed434], eax
mov eax, dword [0x4ed450]
push str.InitializeSecurityContextA
push eax
call esi
mov ecx, dword [0x4ed450]
push str.CompleteAuthToken
push ecx
mov dword [0x4ed438], eax
call esi
mov edx, dword [0x4ed450]
push str.EnumerateSecurityPackagesA
push edx
mov dword [0x4ed43c], eax
call esi
mov dword [0x4ed440], eax
mov eax, dword [0x4ed450]
push str.DeleteSecurityContext
push eax
call esi
mov dword [0x4ed444], eax
mov eax, dword [0x4ed428]
test eax, eax
pop esi
je 0x442ef7
mov eax, dword [0x4ed430]
test eax, eax
je 0x442ef7
mov eax, dword [0x4ed42c]
test eax, eax
je 0x442ef7
mov eax, dword [0x4ed434]
test eax, eax
je 0x442ef7
mov eax, dword [0x4ed438]
test eax, eax
je 0x442ef7
mov eax, dword [0x4ed440]
test eax, eax
je 0x442ef7
mov dword [0x4ed44c], 0
mov dword [0x4ed448], 0
mov eax, 1
add esp, 0x198
ret
mov ecx, dword [0x4ed450]
push ecx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [0x4ed450], 0
xor eax, eax
add esp, 0x198
ret

Function at 0x4431a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0xc8
call esi
test eax, eax
jne 0x44321b
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push 0x20019
push eax
push str.DirectX
push edx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x443214
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push eax
push 0x4ed5b8
push 0
push 0
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov eax, 0x4ed5b8
pop esi
add esp, 0xc
ret
Function at 0x443860
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4ed68c]
test eax, eax
je 0x4438e0
mov eax, dword [0x4ed690]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x14
push 0x4ed698
push eax
call esi
mov ecx, dword [0x4ed6c0]
push 0x14
push 0x4ed6ac
push ecx
call esi
mov esi, 0x4ed6ac
mov eax, 0x4ed698
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4438bd
test cl, cl
je 0x4438b9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4438bd
add eax, 2
add esi, 2
test cl, cl
jne 0x443899
xor eax, eax
jmp 0x4438c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
je 0x4438d1
mov eax, dword [0x4ed694]
push 0
push eax
jmp 0x4438da
mov ecx, dword [0x4ed694]
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esp + 4]
and eax, 0xffff
dec eax
je 0x443900
dec eax
jne 0x443921
mov edx, dword [0x4ed68c]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
jmp 0x44390e
mov eax, dword [0x4ed68c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
call dword [0x4ed688]
add esp, 4
mov dword [0x4ed68c], 0
xor eax, eax
ret

Function at 0x4448d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4ed6f0]
test eax, eax
je 0x4448f6
mov dword [0x4ed6d0], 0
call fcn.00444410
mov eax, dword [0x4ed6f0]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x444f80
Capabilities:
Get memory capacity

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x20
test eax, eax
je 0x444f99
push str.perform_init
call fcn.0043bb00
add esp, 4
lea eax, [esp]
mov dword [esp], 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [0x510ae0]
test eax, eax
je 0x444fc7
mov ecx, dword [esp + 8]
push ecx
push str.memory.dwTotalPhys:_0x_x
call fcn.0043bb00
add esp, 8
push str.avatars
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 0xffffffff
je 0x444fe3
mov dword [0x4cbfc8], eax
push str.lifeforms
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 0xffffffff
je 0x444fff
mov dword [0x4cbfcc], eax
push str.framerate
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 5
mov dword [0x4ed738], eax
jl 0x445020
cmp eax, 0x64
jle 0x44502a
mov dword [0x4ed738], 0x1e
push str.visibility
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 0x1e
mov dword [0x4ed734], eax
jl 0x44504d
cmp eax, 0xc8
jle 0x445064
call fcn.0047e220
sub eax, 2
neg eax
sbb eax, eax
and eax, 0x14
add eax, 0x28
mov dword [0x4ed734], eax
push str.mipmaps
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 0xffffffff
mov dword [0x4ed728], eax
jne 0x44508a
mov dword [0x4ed728], 1
push str.max_framerate
push str.performance
call fcn.0044cec0
add esp, 8
cmp eax, 5
mov dword [0x4ed744], eax
jl 0x4450ab
cmp eax, 0x64
jle 0x4450b5
mov dword [0x4ed744], 0x21
add esp, 0x20
ret
Function at 0x445ce0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0xc
test eax, eax
je 0x445cf9
push str.pick
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4ed768]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x445f04
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [esp + 0x14], 0
call edi
mov ebp, dword [esp + 0x20]
mov si, ax
and si, 0xfffe
neg si
sbb esi, esi
neg esi
test ebp, ebp
je 0x445efb
call fcn.00433260
cmp ebp, eax
je 0x445efb
push 0x11
call edi
mov di, ax
mov eax, dword [0x4ed8ac]
and di, 0xfffe
push eax
neg di
sbb edi, edi
neg edi
call fcn.00433620
mov ecx, dword [0x4ed8ac]
push ecx
call fcn.0043b840
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x445d98
mov edx, dword [ebx]
push edx
call fcn.0042d780
add esp, 4
cmp ebp, eax
je 0x445dfc
mov eax, dword [0x4ed8ac]
push eax
call fcn.0043b840
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x445d75
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
call fcn.0047f140
add esp, 0x10
test eax, eax
je 0x445eff
test esi, esi
jne 0x445dc5
push esi
call fcn.00445400
add esp, 4
mov ecx, dword [0x4ed8ac]
push ecx
call fcn.00433670
add esp, 4
cmp eax, 0x80
mov eax, dword [esp + 0x10]
jl 0x445e85
test eax, eax
je 0x445f04
push eax
call fcn.0047ef10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test ebx, ebx
je 0x445d98
test edi, edi
je 0x445e16
mov cx, word [ebx + 8]
mov dword [esp + 0x18], ecx
mov dx, word [ebx + 0xa]
mov dword [esp + 0x14], edx
jmp 0x445db8
test esi, esi
je 0x445e2c
push ebx
call fcn.00445450
push 5
call fcn.00468670
add esp, 8
jmp 0x445e5d
push 0x44
call fcn.0040d2a0
add esp, 4
test eax, eax
je 0x445e5d
push 4
mov dword [0x4ed8b4], 1
call fcn.00440b20
add esp, 4
call fcn.00477370
mov dword [0x4ed8b0], eax
call fcn.0047e730
call fcn.00446110
mov eax, dword [0x4ed8ac]
push eax
call fcn.0043b7e0
add esp, 4
test eax, eax
je 0x445f04
call fcn.0047fc90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test eax, eax
je 0x445ec7
push 2
call fcn.00468670
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x445ec7
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.00445f10
add esp, 0xc
test eax, eax
jne 0x445ec7
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0047ef10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test edi, edi
je 0x445ee4
push 2
call fcn.00468670
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
call fcn.004461c0
add esp, 0xc
call fcn.00446110
call fcn.0047fc20
call fcn.00446230
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x445f04
call fcn.004453a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x446b80
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x20
test eax, eax
je 0x446b99
push str.pick:_duplicate
call fcn.0043bb00
add esp, 4
push ebx
push ebp
push esi
push edi
call fcn.00477370
cmp dword [0x4ed8c8], eax
ja 0x446d08
mov eax, dword [0x4ed8ac]
push eax
call fcn.00433670
mov ebp, eax
mov dword [esp + 0x18], ebp
lea ecx, [ebp*4]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x10], ebx
je 0x446d08
mov edx, dword [0x4ed8ac]
push edx
call fcn.00433620
mov eax, dword [0x4ed8ac]
push eax
call fcn.0043b840
mov esi, eax
add esp, 8
test esi, esi
je 0x446c22
mov edi, ebx
mov ecx, dword [esi]
push ecx
call fcn.0042d490
mov dword [edi], eax
mov edx, dword [0x4ed8ac]
push edx
add edi, 4
call fcn.0043b840
mov esi, eax
add esp, 8
test esi, esi
jne 0x446c00
push 0
call fcn.00445400
add esp, 4
xor edi, edi
test ebp, ebp
jle 0x446c5e
mov eax, dword [ebx]
push eax
push 0
push 0
call fcn.00445f10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x446d08
inc edi
add ebx, 4
cmp edi, ebp
mov dword [esi + 0x34], 1
jl 0x446c32
mov ebx, dword [esp + 0x10]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
call fcn.00446110
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and al, 0xfe
test ax, ax
je 0x446cce
mov eax, dword [esi]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.0042d8c0
add esp, 4
push eax
call fcn.00440800
fld dword [esp + 0x2c]
fsub dword [esp + 0x38]
fld dword [esp + 0x24]
fsub dword [esp + 0x30]
add esp, 0xc
fstp dword [esp + 0x10]
fcom dword [esp + 0x10]
fnstsw ax
test ah, 0x41
je 0x446cbf
fstp st(0)
fld dword [esp + 0x10]
fcom dword [0x4bf748]
fnstsw ax
test ah, 1
je 0x446d10
fstp st(0)
fld dword [0x4bf748]
sub esp, 8
fstp qword [esp]
push 0
call fcn.004468f0
add esp, 0xc
call fcn.00477370
fild dword [esp + 0x14]
mov esi, eax
fmul dword [0x4bfe0c]
fmul dword [0x4bfe08]
call sub.MSVCRT.dll__ftol
sub esi, eax
mov dword [0x4ed8c8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
fmul dword [0x4bfe04]
fadd dword [0x4bf770]
call sub.MSVCRT.dll__ftol
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [0x4bf748]
jmp 0x446cd4

Function at 0x447810
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x447826
push str.pick_reset
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4ed8ac]
push fcn.00445370
push eax
call fcn.0043b7f0
add esp, 8
jmp fcn.00444900