joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a4dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0044a140
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x44a53a
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x456dac]
mov dl, 1
mov eax, dword [0x44a038]
call fcn.0040ac40
call fcn.00403588
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44a544
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x44a59c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x456f80]
mov dl, 1
mov eax, dword [0x44a038]
call fcn.0040ac40
call fcn.00403588
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044a170
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44a7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44a863
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403b3c
mov eax, dword [ebp - 4]
call fcn.00403dbc
test al, al
jbe 0x44a84d
mov byte [ebp - 9], al
mov bl, 1
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00403ce4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00403dc4
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 9]
jne 0x44a80f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a86a
lea eax, [ebp - 0x10]
call fcn.00403b3c
ret
Function at 0x44a874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44a924
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00403b3c
xor eax, eax
push ebp
push 0x44a904
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403dbc
test al, al
jbe 0x44a8fa
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov dl, byte [edi + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00403ce4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00403dc4
mov eax, dword [ebp + 8]
xor eax, eax
mov al, bl
movzx eax, byte [edi + eax - 1]
add esi, eax
imul esi, dword [ebp - 4]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x44a8bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44a90e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a92b
lea eax, [ebp - 0xc]
call fcn.00403b3c
ret

Function at 0x44bdb0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f70
xor eax, eax
push ebp
push 0x44be2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403f80
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44bdf9
mov eax, dword [ebx + 4]
call fcn.00403f80
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44be35
lea eax, [ebp - 4]
call fcn.00403b3c
ret
Function at 0x44cdd0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44cf67
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040292c
cmp word [ebx + 0x9a], 0
je 0x44ce19
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44ce2d
lea esi, [ebp - 8]
jmp 0x44ce2f
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44ce39
xor edi, edi
jmp 0x44ce43
mov eax, dword [ebx + 0x78]
call fcn.00403f80
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00403f80
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044c564
mov eax, dword [ebp - 0x14]
call fcn.00403f80
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00403f80
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403f80
push eax
mov eax, ebx
call fcn.0044c698
push eax
mov eax, ebx
call fcn.0044c66c
push eax
mov eax, ebx
call fcn.0044c620
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044c438
mov eax, dword [ebp - 0x18]
call fcn.00403f80
push eax
mov eax, dword [ebx + 8]
call fcn.00403f80
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44cecc
call fcn.0040bd4c
xor edx, edx
push ebp
push 0x44cf45
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44cf0a
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44cf00
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44cf2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cf4c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44cf78
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44cfa4
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403f80
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44cfc9
call fcn.0040bd4c
xor eax, eax
push ebp
push 0x44d000
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44cfe9
call fcn.0040bd4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d007
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44e188
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x44e211
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4578b8
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x44e1fb
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040a308
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x44e228
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x456e90]
mov dl, 1
mov eax, dword [0x44da44]
call fcn.0040ac40
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e218
lea eax, [ebp - 0x1c]
call fcn.00403b3c
ret

Function at 0x44e880
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0044e7a4
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040300c
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x44e8e4
call fcn.0044e0d0
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x44e8d6
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040300c
pop esi
pop ebx
ret

Function at 0x44e908
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00403f80
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402b0c
test ebx, ebx
je 0x44e953
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x44ea30
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44ea61
mov ecx, dword [0x456de4]
mov dl, 1
mov eax, dword [0x44da44]
call fcn.0040ac04
call fcn.00403588
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44ea8e
mov ecx, dword [0x456d94]
mov dl, 1
mov eax, dword [0x44da44]
call fcn.0040ac04
call fcn.00403588
xor eax, eax
push ebp
push 0x44eb0d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040300c
cmp byte [ebp + 8], 0
je 0x44eae9
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044e998
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0044e880
jmp 0x44eb03
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044e3bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44eb2a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ed0c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044e63c
xor edx, edx
push ebp
push 0x44ee6c
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x44ee56
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44ed56
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44ed60
call fcn.00403628
jmp 0x44ee73
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00411844
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x44ee4b
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x44ee09
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x44edf9
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040300c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0044ecc4
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x44ee7c]
cmp dl, byte [eax + 0x28]
je 0x44ee52
call fcn.0040aaec
jmp 0x44ee52
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00411854
jmp 0x44ee52
cmp eax, ebx
jge 0x44ee22
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00411854
jmp 0x44ed60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00411844
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00411860
cmp ebx, eax
jne 0x44ed60
push ebp
call fcn.0044ecc4
pop ecx
jmp 0x44ee52
push ebp
call fcn.0044ecc4
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ee73
mov eax, dword [ebp - 4]
call fcn.0044e648
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ee80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44efa2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044e63c
xor eax, eax
push ebp
push 0x44ef85
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44eed0
call fcn.00403628
jmp 0x44ef8c
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44ef6f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44ef6f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040300c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44ef6f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040a308
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44efbc
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x456e90]
mov dl, 1
mov eax, dword [0x44da44]
call fcn.0040ac40
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ef8c
mov eax, dword [ebp - 4]
call fcn.0044e648
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44efa9
lea eax, [ebp - 0x28]
call fcn.00403b3c
ret
Function at 0x44fe80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov ebx, eax
mov eax, 0x10000
call fcn.004026fc
mov dword [ebx + 0x2dc], eax
mov edi, ebp
test edi, edi
jle 0x44febc
mov esi, 1
mov eax, ebp
dec eax
call fcn.00402b2c
inc eax
mov edx, dword [ebx + 0x2dc]
mov word [edx + esi*2 - 2], ax
inc esi
dec edi
jne 0x44fea4
mov esi, ebp
cmp esi, 1
jl 0x44ff30
mov eax, dword [ebx + 0x2dc]
movzx eax, word [eax + esi*2 - 2]
mov ecx, dword [ebx + 0x2d4]
mov al, byte [ecx + eax - 1]
mov edx, dword [ebx + 0x2d4]
cmp al, byte [edx + esi - 1]
je 0x44ff2b
mov ecx, dword [ebx + 0x2dc]
movzx ecx, word [ecx + esi*2 - 2]
mov edi, dword [ebx + 0x2d4]
xor byte [edx + esi - 1], al
mov edx, dword [ebx + 0x2dc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2d4]
mov cl, byte [eax + esi - 1]
xor byte [eax + edx - 1], cl
mov edx, dword [ebx + 0x2dc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2d4]
mov dl, byte [eax + edx - 1]
xor byte [eax + esi - 1], dl
dec esi
test esi, esi
jne 0x44fec3
mov edx, 0x10000
mov eax, dword [ebx + 0x2dc]
call fcn.00402714
mov edi, ebp
test edi, edi
jle 0x44ffb8
mov esi, 1
mov eax, dword [ebx + 0x2d4]
mov dl, byte [eax + esi - 1]
mov byte [eax + esi - 1], dl
mov eax, dword [ebx + 0x2d4]
mov al, byte [eax + esi - 1]
mov byte [esp], al
mov al, byte [ebx + 0x37]
xor al, byte [ebx + 0x36]
xor al, byte [ebx + 0x35]
xor al, byte [ebx + 0x34]
mov byte [esp + 1], al
mov eax, 0xff
call fcn.00402b2c
mov edx, dword [ebx + 0x2d4]
mov dl, byte [edx + esi - 1]
xor dl, byte [esp + 1]
xor al, dl
mov edx, dword [ebx + 0x2d4]
mov byte [edx + esi - 1], al
xor eax, eax
mov al, byte [esp]
add eax, dword [ebx + 0x34]
add eax, dword [ebx + 0x30]
imul dword [ebx + 0x2ec]
add eax, dword [ebx + 0x2f0]
mov dword [ebx + 0x34], eax
inc esi
dec edi
jne 0x44ff4b
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4503cc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450530
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40e258]
call fcn.00402e00
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
test ebx, ebx
jbe 0x450461
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00407f58
cmp dword [ebp - 0x10], 0
je 0x450453
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403cf4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x450417
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x450506
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x450506
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00407d84
mov edx, dword [ebp - 0xc]
mov eax, 0x450548
call fcn.004040a8
test eax, eax
je 0x4504d3
mov eax, dword [ebp - 0xc]
call fcn.00403f80
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x450500
mov edx, dword [ebp - 0xc]
mov eax, 0x450564
call fcn.004040a8
test eax, eax
je 0x450500
mov eax, dword [ebp - 0xc]
call fcn.00403f80
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x45048b
mov eax, esi
call fcn.00402714
mov eax, dword [ebp - 4]
call fcn.00402e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450537
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b60
ret
Function at 0x450668
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450854
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push edi
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 4]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 4]
mov edx, 0x45086c
call fcn.00403ecc
jne 0x45082b
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov eax, dword [ebp - 8]
mov edx, 0x45087c
call fcn.00403ecc
jne 0x45082b
push 0
push 0x450888
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x450718
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x45089c
call fcn.00403e08
mov edx, dword [ebp - 0xc]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428d70
push 0
push 0x4508a8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x45082b
mov eax, dword [0x456d48]
mov eax, dword [eax]
mov edx, 0x4508b8
call fcn.00403ecc
jne 0x4507d0
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_SendMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4508c4
call fcn.00403e08
mov edx, dword [ebp - 0x14]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
jmp 0x45082b
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4508c4
call fcn.00403e08
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x456f0c]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428d70
mov eax, edi
call fcn.00402714
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45085b
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b60
ret