joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e320
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebx, 0x4a8e28
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4a09c0
xor ebp, ebp
push ebp
push str.rmudhack
push str.winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0x29a
je 0x43e38f
cmp dword [0x4a8e08], ebp
je 0x43e37e
push edi
xor edi, edi
cmp dword [0x4a8e0c], ebp
jle 0x43e37d
push esi
xor esi, esi
mov eax, dword [0x4a8e08]
lea ecx, [esi + eax]
call fcn.0043db2a
inc edi
add esi, 0x3c
cmp edi, dword [0x4a8e0c]
jl 0x43e363
pop esi
pop edi
mov dword [0x4a8e0c], ebp
mov dword [0x4a8e10], ebp
call fcn.0043d8f8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
ret

Function at 0x43faa6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [0x4ac3b4]
push ebx
push esi
xor esi, esi
cmp ecx, esi
push edi
je 0x43fbf1
push dword [ebp + 0xc]
xor edi, edi
inc edi
push edi
push 0x78
call fcn.0045cbb0
test al, al
je 0x43fbf1
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x43fb5d
push esi
push esi
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
call fcn.00402b8d
mov edi, dword [eax]
push esi
push esi
push 0x18
call fcn.004720ed
push eax
mov esi, 0x49fa68
push esi
push edi
push dword [0x4ac344]
call fcn.0040ea93
push dword [ebp - 8]
mov edi, dword [sym.imp.NSCRT.dll_free]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call edi
add esp, 0x20
test bl, bl
je 0x43fb4e
push 0
push esi
call fcn.00402cab
push dword [ebp + 0x14]
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043faa6
push ebx
mov dword [ebp - 4], eax
call edi
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
jmp 0x43fbf4
call fcn.0043d213
test eax, eax
je 0x43fb72
cmp dword [ebp + 0x10], edi
jge 0x43fb72
call fcn.0043e320
mov ebx, edi
mov eax, dword [ebp + 0x14]
cmp eax, esi
sete cl
neg eax
sbb eax, eax
and eax, 0x4a06b0
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004429e9
mov ecx, dword [0x4ac3b4]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0xd
call fcn.004666ac
cmp ebx, esi
je 0x43fbe5
push esi
call fcn.0041cfe5
cmp byte [0x49e0b0], 0
pop ecx
je 0x43fbc4
push 0xc4653600
call fcn.0043f851
pop ecx
push 0x4b1260
push 0x4b00e0
push 0x4b0a20
call fcn.0043ea28
add esp, 0xc
cmp dword [ebp + 0x10], esi
jne 0x43fbe5
call fcn.0041d50e
lea ecx, [ebp - 0x14]
call fcn.00442a67
xor eax, eax
jmp 0x43fbf4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4473f8
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc70
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x447410
xor eax, eax
jmp 0x44759e
cmp word [0x49f858], si
push ebx
push edi
mov dword [ebp - 4], esi
mov ebx, 0x49f228
je 0x4474c0
mov edi, 0x49f858
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x4474c3
push 0x104
lea eax, [ebp - 0x220]
push eax
push edi
push ebx
call fcn.0041c3c1
add esp, 0x10
test eax, eax
je 0x4474c3
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x220]
push eax
call fcn.0041c446
add esp, 0xc
test eax, eax
je 0x4474c3
cmp eax, 2
je 0x4474c3
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4474c3
push 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push edi
lea edi, [ebp - 0x18]
call fcn.00447359
add esp, 0x14
test eax, eax
je 0x4474c3
push dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, edi
push eax
call dword [ebp + 8]
test eax, eax
jne 0x4474c3
jmp 0x44759c
mov dword [ebp - 8], esi
push 0x4880a8
push ebx
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x447567
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
lea edi, [ebp - 0x18]
push eax
push 0x104
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x470]
and eax, 0x10
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00447359
add esp, 0x14
test eax, eax
je 0x447545
cmp dword [ebp - 0xc], 0
je 0x447537
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
test eax, eax
je 0x447559
lea eax, [ebp - 0x470]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4474f1
jmp 0x44755c
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x447595
and dword [ebp - 0x18], 0
push dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp - 4], eax
mov dword [ebp - 0x14], str.English__US_
sete al
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
mov esi, eax
neg esi
sbb esi, esi
inc esi
xor eax, eax
test esi, esi
sete al
pop edi
pop ebx
pop esi
leave
ret
Function at 0x447a4b
Capabilities:
Move file

Disassembly:
sub esp, 0x8a8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebp
mov ebp, dword [esp + 0x8b4]
cmp ebp, 0xffffffff
push esi
mov esi, 0x462
jne 0x447a7a
push 0
push 0
push 0x188
push esi
push edi
call ebx
mov ebp, eax
push 0
push ebp
push 0x199
push esi
push edi
call ebx
and dword [esp + 0x10], 0
push 0x4aa870
push ebp
push 0x189
push esi
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea eax, [esp + 0x29c]
push eax
push ebp
push 0x189
push esi
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [esp + 0xc]
dec eax
dec eax
jne 0x447ad7
push str..wlz
push 0x104
lea eax, [esp + 0x2a4]
push eax
call fcn.0047ac6c
lea eax, [esp + 0x29c]
push 0x49f858
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x447af8
mov dword [esp + 0x10], 1
cmp word [0x4aa870], 0
je 0x447c8a
push str.English__US_
push 0x4aa870
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x447c8a
push 0x104
push 0x4aa870
lea eax, [esp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0x44720e
push edi
push 0x104
call fcn.00471ec4
add esp, 0x10
test eax, eax
je 0x447c8a
lea eax, [esp + 0x4a4]
push 0x4aa870
push eax
call dword [sym.imp.NSCRT.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x447c8a
lea eax, [esp + 0x4a4]
push eax
push 0x49f228
lea eax, [esp + 0x6b4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x4aa870
push 0x49f228
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [esp + 0xc]
dec eax
dec eax
jne 0x447bd5
push str..wlz
push 0x104
lea eax, [esp + 0x6b4]
push eax
call fcn.0047ac6c
push str..wlz
push 0x104
lea eax, [esp + 0x1c]
push eax
call fcn.0047ac6c
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x6b0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x447c58
push 0
push ebp
push 0x182
push esi
push edi
call ebx
push 0x4aa870
push ebp
push 0x181
push esi
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push ebp
push 0x19a
push esi
push edi
call ebx
push 0
push ebp
push 0x186
push esi
push edi
call ebx
cmp dword [esp + 0x10], 0
je 0x447c8a
push 0
lea eax, [esp + 0x18]
push 0x48e668
push eax
call fcn.00418a7d
add esp, 0xc
inc eax
push 0x104
inc eax
push eax
push 0x49f858
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.00406242
jmp 0x447c8a
xor esi, esi
push esi
push 0x40
lea eax, [esp + 0x224]
push eax
push 0x182
call fcn.00472111
add esp, 0xc
push eax
push esi
push esi
push 0x181
call fcn.00472111
add esp, 0xc
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
pop ebp
pop ebx
add esp, 0x8a8
ret
Function at 0x44a3fa
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
xor eax, eax
cmp dword [ebp + 8], eax
jne 0x44a40c
leave
ret
cmp word [0x4a0298], ax
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ebx, 0x104
mov edi, 0x49e4d0
je 0x44a4b8
mov esi, 0x4a0298
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x44a4bb
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
push edi
call fcn.0041c3c1
add esp, 0x10
test eax, eax
je 0x44a4bb
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x220]
push eax
call fcn.0041c446
add esp, 0xc
test eax, eax
je 0x44a4bb
cmp eax, 2
je 0x44a4bb
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44a4bb
push 0
push ebx
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0044a2df
add esp, 0x18
test eax, eax
je 0x44a4bb
push dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x44a4bb
jmp 0x44a59b
mov dword [ebp - 8], eax
push 0x4880a8
push edi
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a553
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x470]
and eax, 0x10
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0044a2df
add esp, 0x18
test eax, eax
je 0x44a53a
cmp dword [ebp - 0xc], 0
je 0x44a52c
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
test eax, eax
je 0x44a54c
lea eax, [ebp - 0x470]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44a4e9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
cmp word [0x4aaa98], di
mov esi, 0x4aaa98
jne 0x44a573
push 0x40
push esi
push 0x174
call fcn.00472111
add esp, 0xc
push dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
sete al
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a5a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10808
call fcn.00483980
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.NSCRT.dll_fread]
push esi
push 1
lea eax, [ebp - 4]
push 3
push eax
mov byte [ebp - 5], 0
mov byte [ebp - 4], 0
mov byte [ebp - 3], 0
mov byte [ebp - 2], 0
call edi
add esp, 0x10
cmp eax, 1
jne 0x44a606
cmp byte [ebp - 4], 0xef
jne 0x44a606
cmp byte [ebp - 3], 0xbb
jne 0x44a606
cmp byte [ebp - 2], 0xbf
jne 0x44a606
mov byte [ebp - 5], al
push esi
lea edi, [ebp - 0x8408]
mov ebx, 0x400
push ebx
mov eax, edi
push eax
jmp 0x44a716
mov ebx, dword [sym.imp.NSCRT.dll_fseek]
push 0
push 0
push esi
call ebx
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call edi
add esp, 0x1c
cmp eax, 1
jne 0x44a632
cmp byte [ebp - 4], 0xff
jne 0x44a632
cmp byte [ebp - 3], 0xef
je 0x44a63e
push 0
push 0
push esi
call ebx
add esp, 0xc
jmp 0x44a5f1
push esi
lea edi, [ebp - 0x10808]
mov ebx, 0x400
push ebx
mov eax, edi
push eax
jmp 0x44a6a0
push edi
call dword [sym.imp.NSCRT.dll_wcslen]
cmp word [edi + eax*2 - 2], 0xa
pop ecx
jne 0x44a66e
push edi
call dword [sym.imp.NSCRT.dll_wcslen]
and word [edi + eax*2 - 2], 0
pop ecx
push 0x48edd8
push 0x8400
push edi
call fcn.0047ac6c
push edi
call dword [sym.imp.NSCRT.dll_wcslen]
lea edi, [edi + eax*2]
pop ecx
mov eax, edi
lea ecx, [ebp - 0x10808]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x10000
jg 0x44a6af
push esi
push ebx
push edi
call dword [sym.imp.NSCRT.dll_fgetws]
add esp, 0xc
test byte [esi + 0xc], 0x10
je 0x44a650
and word [ebp - 0x80a], 0
lea eax, [ebp - 0x10808]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x44a76b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + edi - 1], 0xa
jne 0x44a6e9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + edi - 1], 0
push 0x489824
push 0x8400
push edi
call fcn.00406279
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
mov eax, edi
lea ecx, [ebp - 0x8408]
sub eax, ecx
cmp eax, 0x8000
jg 0x44a725
push esi
push ebx
push edi
call dword [sym.imp.NSCRT.dll_fgets]
add esp, 0xc
test byte [esi + 0xc], 0x10
je 0x44a6cf
cmp byte [ebp - 5], 0
mov byte [ebp - 0x409], 0
lea eax, [ebp - 0x8408]
je 0x44a75e
push 0xfde9
push eax
call fcn.00402cab
pop ecx
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
call dword [sym.imp.NSCRT.dll_free]
pop ecx
jmp 0x44a76b
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44a770
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x59c
cmp word [0x4a0298], 0
push ebx
push esi
push edi
je 0x44a96d
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x661
push 0
mov ebx, 0x400
push ebx
push dword [0x4ac344]
call esi
mov edi, 0x10000
cmp eax, edi
jle 0x44a7c2
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x44a9b2
push 0x279
push 0
push ebx
push dword [0x4ac344]
call esi
cmp eax, edi
jg 0x44a9a3
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.readme.txt
mov edi, 0x49e6d8
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
mov ebx, dword [sym.imp.NSCRT.dll__wfopen]
lea eax, [ebp - 0x20c]
push 0x48a2e0
push eax
call ebx
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x44a939
push str.read_me.txt
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push 0x48a2e0
push eax
call ebx
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x44a939
push str.file_id.diz
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push 0x48a2e0
push eax
call ebx
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x44a939
push str..txt
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and word [ebp - 0x20c], 0
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x44a957
lea eax, [ebp - 0x470]
push str.pledit.txt
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x44a8e8
lea eax, [ebp - 0x470]
push str.viscolor.txt
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x44a8e8
lea eax, [ebp - 0x470]
push str.region.txt
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x44a8fe
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44a8a0
jmp 0x44a90f
lea eax, [ebp - 0x470]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [ebp - 0x20c], 0
jne 0x44a957
lea eax, [ebp - 0x20c]
push 0x48a2e0
push eax
call ebx
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x44a957
push 0x4b6
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0044a5a0
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_fclose]
add esp, 0x10
jmp 0x44a9b2
push 0
push 0
push 0x11e
call fcn.00472111
add esp, 0xc
jmp 0x44a7ae
push 0x49c918
push 0x40
lea eax, [ebp - 0x24c]
push eax
push 0x175
call fcn.004720ed
add esp, 0xc
push eax
lea eax, [ebp - 0x59c]
push 0x100
push eax
call fcn.00402528
add esp, 0x10
lea eax, [ebp - 0x59c]
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44d71c
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 4]
movzx eax, cx
push edi
mov edx, 0xe7
xor edi, edi
cmp eax, edx
jg 0x44d7a7
je 0x44d7a3
add edx, 0xffffffea
cmp eax, edx
jg 0x44d77a
je 0x44d7e0
sub eax, 0xb0
je 0x44d761
sub eax, 0x16
je 0x44d75d
dec eax
je 0x44d759
dec eax
dec eax
jne 0x44d80f
push 0x45
jmp 0x44d7a0
push 0x43
jmp 0x44d7a0
push 0x41
jmp 0x44d7a0
push 0x30
pop ecx
xor eax, eax
inc eax
cmp cx, ax
push 6
pop edi
jne 0x44d845
push 0xa
jmp 0x44d9f8
cmp eax, 0xdc
je 0x44d79e
cmp eax, 0xdf
jle 0x44d80f
cmp eax, 0xe2
jle 0x44d79a
cmp eax, 0xe6
jne 0x44d80f
push 0x61
jmp 0x44d809
push 0x55
pop ecx
jmp 0x44d81b
push 0x63
jmp 0x44d809
cmp eax, 0xfb
jg 0x44d7f0
cmp eax, 0xf9
jge 0x44d7ec
cmp eax, 0xe8
jl 0x44d80f
cmp eax, 0xeb
jle 0x44d7e8
cmp eax, 0xef
jle 0x44d7e4
mov edx, 0xf1
cmp eax, edx
je 0x44d7e0
jle 0x44d80f
cmp eax, 0xf4
jg 0x44d80f
push 0x6f
jmp 0x44d809
push 0x6e
jmp 0x44d809
push 0x69
jmp 0x44d809
push 0x65
jmp 0x44d809
push 0x75
jmp 0x44d809
sub eax, 0xfc
je 0x44d80c
sub eax, 3
je 0x44d807
sub eax, 0x93
jne 0x44d80f
push 0x66
jmp 0x44d809
push 0x79
pop ecx
jmp 0x44d83a
push 0x75
pop ecx
cmp cx, 0x5a
ja 0x44d826
cmp cx, 0x41
jb 0x44d826
movzx eax, cx
sub eax, 0x41
jmp 0x44d9f9
cmp cx, 0x7a
ja 0x44d764
cmp cx, 0x61
jb 0x44d764
movzx eax, cx
sub eax, 0x61
jmp 0x44d9f9
cmp cx, 0x2e
jne 0x44d852
push 0xb
jmp 0x44d9f8
cmp cx, 0x39
ja 0x44d869
cmp cx, 0x30
jb 0x44d869
movzx eax, cx
sub eax, 0x30
jmp 0x44d9f9
cmp cx, 0x3a
jne 0x44d876
push 0xc
jmp 0x44d9f8
cmp cx, 0x28
jne 0x44d883
push 0xd
jmp 0x44d9f8
cmp cx, 0x29
jne 0x44d890
push 0xe
jmp 0x44d9f8
cmp cx, 0x2d
jne 0x44d89d
push 0xf
jmp 0x44d9f8
cmp cx, 0x27
je 0x44d9f6
cmp cx, 0x60
je 0x44d9f6
cmp cx, 0x21
jne 0x44d8be
push 0x11
jmp 0x44d9f8
cmp cx, 0x5f
jne 0x44d8cb
push 0x12
jmp 0x44d9f8
cmp cx, 0x2b
jne 0x44d8d8
push 0x13
jmp 0x44d9f8
cmp cx, 0x5c
jne 0x44d8e5
push 0x14
jmp 0x44d9f8
cmp cx, 0x2f
jne 0x44d8f2
push 0x15
jmp 0x44d9f8
cmp cx, 0x5b
je 0x44d9f2
cmp cx, 0x7b
je 0x44d9f2
cmp cx, 0x3c
je 0x44d9f2
cmp cx, 0x5d
je 0x44d9ee
cmp cx, 0x7d
je 0x44d9ee
cmp cx, 0x3e
je 0x44d9ee
cmp cx, 0x7e
je 0x44d9ea
cmp cx, 0x5e
je 0x44d9ea
cmp cx, 0x26
jne 0x44d94f
push 0x19
jmp 0x44d9f8
cmp cx, 0x25
je 0x44d9cc
cmp cx, 0x2c
jne 0x44d962
push 0x1b
jmp 0x44d9f8
cmp cx, 0x3d
jne 0x44d96f
push 0x1c
jmp 0x44d9f8
cmp cx, 0x24
jne 0x44d979
push 0x1d
jmp 0x44d9f8
cmp cx, 0x23
jne 0x44d983
push 0x1e
jmp 0x44d9f8
cmp cx, 0xc5
push 0xc
pop edi
je 0x44d9e6
cmp cx, 0xe5
je 0x44d9e6
cmp cx, 0xd6
je 0x44d9f9
cmp cx, 0xf6
je 0x44d9f9
cmp cx, 0xc4
je 0x44d9e2
cmp cx, 0xe4
je 0x44d9e2
cmp cx, 0x3f
jne 0x44d9ba
push 3
jmp 0x44d9f8
cmp cx, 0x2a
jne 0x44d9c4
push 4
jmp 0x44d9f8
xor edi, edi
cmp cx, 0x22
jne 0x44d9d0
push 0x1a
jmp 0x44d9f8
xor eax, eax
cmp cx, 0x40
setne al
dec eax
and eax, 0xfffffffd
add eax, 0x1e
jmp 0x44d9f9
push 2
jmp 0x44d9f8
xor eax, eax
jmp 0x44d9f9
push 0x18
jmp 0x44d9f8
push 0x17
jmp 0x44d9f8
push 0x16
jmp 0x44d9f8
push 0x10
pop eax
mov ecx, dword [esp + 0xc]
lea eax, [eax + eax*4]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
mov dword [eax], edi
pop edi
ret
Function at 0x451343
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp dword [0x4abb54], ebx
je 0x451536
push esi
mov esi, dword [0x49bcec]
push edi
push dword [ebp + 8]
add esi, 0xffffffc6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], esi
call fcn.00454203
lea ecx, [ebp - 0x18]
call fcn.0047a850
push eax
call fcn.0044d2ff
push dword [0x4abb50]
call fcn.0044d325
mov eax, dword [0x49bcec]
add eax, 0xffffffc4
cdq
idiv dword [0x49c8ac]
pop ecx
pop ecx
mov edi, eax
call fcn.0043d213
mov ecx, eax
sub ecx, edi
cmp ecx, 1
jl 0x4513c7
cmp dword [ebp + 0x14], ecx
jle 0x4513b6
mov dword [ebp + 0x14], ecx
lea eax, [esi - 0x12]
imul eax, dword [ebp + 0x14]
cdq
idiv ecx
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x4513ca
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
add eax, 0xffffffe4
cmp eax, ebx
mov edi, 0xcc0020
jle 0x451413
push edi
push 0x2a
push 0x24
push dword [0x4ab9cc]
lea eax, [ebx + 0x14]
push 0x1d
push 8
push eax
mov eax, dword [0x49bce8]
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0047a850
push eax
call esi
mov eax, dword [ebp - 4]
add ebx, 0x1d
add eax, 0xffffffe4
cmp ebx, eax
jl 0x4513df
mov ecx, dword [ebp - 4]
lea edx, [ebx + 0x1d]
lea eax, [ecx + 0x12]
cmp eax, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
jle 0x45142a
add dword [ebp - 0xc], 0x1d
cmp ebx, ecx
jge 0x451456
mov eax, dword [0x49bce8]
push edi
push 0x2a
push 0x24
push dword [0x4ab9cc]
sub ecx, ebx
push ecx
push 8
add ebx, 0x14
push ebx
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0047a850
push eax
call esi
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
push edi
and eax, 9
push 0x35
add eax, 0x34
push eax
push dword [0x4ab9cc]
mov eax, dword [ebp - 4]
push 0x12
add eax, 0x14
push 8
push eax
mov eax, dword [0x49bce8]
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0047a850
push eax
call esi
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
cmp ecx, ebx
jge 0x4514d4
mov eax, dword [ebp - 8]
cmp ecx, eax
jge 0x4514d4
lea edx, [eax - 0x1d]
cmp ecx, edx
jge 0x4514a6
mov eax, ebx
push edi
mov edx, ecx
sub edx, ebx
add edx, 0x47
push edx
push 0x24
push dword [0x4ab9cc]
sub eax, ecx
push eax
mov eax, dword [0x49bce8]
push 8
add ecx, 0x14
push ecx
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0047a850
push eax
call esi
mov eax, dword [ebp - 8]
cmp ebx, eax
jge 0x451524
sub eax, ebx
mov dword [ebp - 0xc], eax
jmp 0x4514e5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, 0xffffffe3
cmp ebx, ecx
jge 0x4514f2
push 0x1d
pop eax
push edi
push 0x2a
push 0x24
push dword [0x4ab9cc]
lea ecx, [ebp - 0x18]
push eax
push 8
lea eax, [ebx + 0x14]
push eax
mov eax, dword [0x49bce8]
add eax, 0xfffffff1
push eax
call fcn.0047a850
push eax
call esi
sub dword [ebp - 0xc], 0x1d
add ebx, 0x1d
cmp ebx, dword [ebp - 8]
jl 0x4514e2
push 0
call fcn.0044d325
pop ecx
lea ecx, [ebp - 0x18]
call fcn.0045422c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4519b8
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x4844e4
call fcn.00483a50
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
push edi
push 0x12
mov esi, 0x4abb28
push esi
call fcn.0047aaff
xor ebx, ebx
push ebx
push ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.00402b8d
push 0x26e
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x400
push dword [0x4ac344]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4ac3d0]
push 0x13
push esi
call fcn.0045c832
cmp dword [0x4abb54], ebx
je 0x451a37
mov eax, dword [0x49bce8]
add eax, 0xffffff71
mov dword [ebp - 0x14], eax
mov eax, dword [0x49bcec]
add eax, 0xffffffe4
cmp dword [0x4ac330], ebx
mov dword [ebp - 0x20], eax
je 0x451a45
push dword [ebp - 0x10]
call dword [sym.imp.NSCRT.dll_free]
jmp 0x451afe
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
cmp eax, 0x12
lea eax, [ebp - 0x48]
jge 0x451a7f
push edi
push 0x13
push eax
call fcn.0047aaff
push edi
call esi
push 0x12
pop ecx
cmp eax, ecx
jge 0x451a8b
sub ecx, eax
lea edi, [ebp + eax*2 - 0x48]
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x451a8b
push 0x24
push edi
push eax
call sub.NSCRT.dll_memcpy
add esp, 0xc
push dword [ebp + 8]
call fcn.0044d2ff
push dword [0x4ab9b4]
call fcn.0044d325
pop ecx
pop ecx
xor esi, esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
mov ax, word [ebp + esi*2 - 0x48]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push eax
call fcn.0044d71c
add esp, 0xc
push 0xcc0020
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [0x4ab9cc]
push 6
push 5
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp - 0x14], 5
inc esi
cmp esi, 0x12
jl 0x451aa2
push ebx
call fcn.0044d325
push dword [ebp - 0x10]
call dword [sym.imp.NSCRT.dll_free]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret