joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406abe
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1044
call fcn.00407360
mov eax, dword [0x412014]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1058]
lea eax, [esp + 0x84c]
push edi
mov edi, dword [esp + 0x1058]
mov ebp, 0x800
push ebp
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push ebx
push edi
push 0xffffffffffffffff
lea eax, [esp + 0x86c]
push 0x400
push eax
call fcn.00406cb5
add esp, 0x24
test eax, eax
jns 0x406b26
xor eax, eax
mov word [esp + 0x104e], ax
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esp + 0x1c]
push 0x20
push eax
call fcn.00406a3b
push 0x40dfec
lea eax, [esp + 0x28]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push ebp
lea eax, [esp + 0x74]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, edi
add esp, 0x2c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x406b65
sub ecx, edx
sar ecx, 1
cmp ecx, 6
jbe 0x406bb5
lea eax, [edi - 0xc]
mov edx, 0x40dff0
lea eax, [eax + ecx*2]
mov si, word [eax]
xor ecx, ecx
inc ecx
cmp si, word [edx]
jne 0x406bad
test si, si
je 0x406ba9
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x406bad
add eax, 4
add edx, 4
test si, si
jne 0x406b84
mov eax, ebx
jmp 0x406bb1
sbb eax, eax
or eax, ecx
test eax, eax
je 0x406bb7
mov ecx, ebx
lea esi, [esp + 0x10]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x406bbe
sub esi, edx
lea eax, [esp + 0x850]
push eax
sar esi, 1
mov edx, 0x40e010
test ecx, ecx
mov eax, str.Error:
cmove eax, edx
push eax
lea edi, [esi + esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x6c]
add eax, edi
push eax
call fcn.00406c96
add esp, 0x20
test eax, eax
jns 0x406c2e
mov dword [esp + 0x846], 0x2e002e
mov dword [esp + 0x84a], 0x2e
push edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x58]
push eax
call sub.VCRUNTIME140.dll_memcpy
lea edi, [esp + 0x5c]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x406c48
mov eax, dword [0x40e044]
mov dword [edi], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040728f
add esp, 0x1044
ret

Function at 0x407ac6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407b05
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407b05
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407b05
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407b05
cmp dword [ecx + 0x74], 0xe
jbe 0x407b05
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x446a90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x446ac8
mov eax, esi
call fcn.0042e0c8
test al, al
je 0x446ac8
mov eax, dword [ebx + 0x74]
call fcn.0042ddcc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x446ac8
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042ddcc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x449594
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004491f8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f88
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4495f2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x458970]
mov dl, 1
mov eax, dword [0x4490f0]
call fcn.00409f90
call fcn.00403590
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4495fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f88
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x449654
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x458b30]
mov dl, 1
mov eax, dword [0x4490f0]
call fcn.00409f90
call fcn.00403590
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00449228
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44a878
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f78
xor eax, eax
push ebp
push 0x44a8f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403f88
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44a8c1
mov eax, dword [ebx + 4]
call fcn.00403f88
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a8fd
lea eax, [ebp - 4]
call fcn.00403b44
ret
Function at 0x44b898
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44ba2f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040293c
cmp word [ebx + 0x9a], 0
je 0x44b8e1
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44b8f5
lea esi, [ebp - 8]
jmp 0x44b8f7
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44b901
xor edi, edi
jmp 0x44b90b
mov eax, dword [ebx + 0x78]
call fcn.00403f88
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00403f88
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044b02c
mov eax, dword [ebp - 0x14]
call fcn.00403f88
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00403f88
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403f88
push eax
mov eax, ebx
call fcn.0044b160
push eax
mov eax, ebx
call fcn.0044b134
push eax
mov eax, ebx
call fcn.0044b0e8
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044af00
mov eax, dword [ebp - 0x18]
call fcn.00403f88
push eax
mov eax, dword [ebx + 8]
call fcn.00403f88
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44b994
call fcn.0040aebc
xor edx, edx
push ebp
push 0x44ba0d
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44b9d2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44b9c8
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44b9f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ba14
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44ba40
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44ba6c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403f88
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44ba91
call fcn.0040aebc
xor eax, eax
push ebp
push 0x44bac8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44bab1
call fcn.0040aebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bacf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44d024
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d160
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44d178
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0044e2a4
mov eax, dword [ebp - 4]
call fcn.0044db34
xor edx, edx
push ebp
push 0x44d143
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x44d0e2
test si, si
jne 0x44d094
mov eax, dword [ebp - 8]
call fcn.00408e5c
mov esi, eax
cmp esi, 0xffff
jbe 0x44d094
call fcn.00402d78
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x44d0e2
cmp eax, 0xffffffff
jle 0x44d0c3
sub ebx, eax
jmp 0x44d0d2
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0044e1d8
test ebx, ebx
je 0x44d0e2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44d097
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44d12d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x44d190
mov dl, 1
mov eax, dword [0x44c544]
call fcn.00409e98
call fcn.00403590
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x44d12d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d14a
mov eax, dword [ebp - 4]
call fcn.0044db8c
ret
Function at 0x44d67c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44d7fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44d814
mov dl, 8
mov eax, ebx
call fcn.0044e2a4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00410844
cmp byte [ebx + 0x10088], 0
jne 0x44d7a9
xor eax, eax
mov dword [ebx + 0x10084], eax
mov eax, dword [ebp - 4]
call fcn.00410850
mov dword [ebx + 0x100b0], eax
mov eax, dword [ebp - 4]
call fcn.00410850
push eax
mov eax, dword [ebp - 4]
call fcn.00410834
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jle 0x44d6f8
mov eax, 0x10000
lea edx, [ebx + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x44d71f
call fcn.00402d78
lea eax, [ebx + eax + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x44d7e7
test eax, eax
jle 0x44d75f
sub esi, eax
add dword [ebx + 0x10084], eax
cmp word [ebx + 0x100c2], 0
je 0x44d76d
mov edx, ebx
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
jmp 0x44d76d
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.0044e1d8
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.00445e28
test esi, esi
je 0x44d786
cmp byte [ebx + 0x10088], 0
je 0x44d70b
mov eax, dword [ebp - 4]
call fcn.00410850
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00410834
cmp esi, eax
je 0x44d7a9
cmp byte [ebx + 0x10088], 0
je 0x44d6d7
cmp byte [ebx + 0x10088], 0
je 0x44d7e7
mov byte [ebx + 0x10088], 0
mov ecx, 0x44d828
mov dl, 1
mov eax, dword [0x44c544]
call fcn.00409e98
call fcn.00403590
cmp word [ebx + 0x10282], 0
je 0x44d7e7
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d804
lea eax, [ebp - 0xc]
call fcn.00403b44
ret
Function at 0x44e0e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x44e1ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x44e1c0
mov dl, 4
mov eax, ebx
call fcn.0044e2a4
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x44e196
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x44e188
test byte [ebx + 0x20], 8
jne 0x44e145
cmp word [ebx + 0x1004a], 0
je 0x44e145
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x44e196
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x44e168
call fcn.00402d78
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x44e196
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0044e1d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e1b3
lea eax, [ebp - 4]
call fcn.00403b44
ret

Function at 0x44e34c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x44e388
mov dl, 8
mov eax, ebx
call fcn.0044e2a4
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x44e37a
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x44e398
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x44e39f
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x44e3ec
mov dl, 8
mov eax, ebx
call fcn.0044e2a4
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x4526e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x452848
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d398]
call fcn.00402e08
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.0040270c
mov esi, eax
test ebx, ebx
jbe 0x452779
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cfc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004089c0
cmp dword [ebp - 0x10], 0
je 0x45276b
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403cfc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x45272f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x45281e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x45281e
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.004087ec
mov edx, dword [ebp - 0xc]
mov eax, 0x452860
call fcn.004040b0
test eax, eax
je 0x4527eb
mov eax, dword [ebp - 0xc]
call fcn.00403f88
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x452818
mov edx, dword [ebp - 0xc]
mov eax, 0x45287c
call fcn.004040b0
test eax, eax
je 0x452818
mov eax, dword [ebp - 0xc]
call fcn.00403f88
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x4527a3
mov eax, esi
call fcn.00402724
mov eax, dword [ebp - 4]
call fcn.00402e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45284f
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b68
ret
Function at 0x45297c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x452b68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov edi, eax
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push edi
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 4]
mov edx, edi
call fcn.00403cfc
mov eax, dword [ebp - 4]
mov edx, 0x452b80
call fcn.00403ed4
jne 0x452b3f
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cfc
mov eax, dword [ebp - 8]
mov edx, 0x452b90
call fcn.00403ed4
jne 0x452b3f
push 0
push 0x452b9c
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x452a2c
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x452bb0
call fcn.00403e10
mov edx, dword [ebp - 0xc]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d24
push 0
push 0x452bbc
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x452b3f
mov eax, dword [0x45891c]
mov eax, dword [eax]
mov edx, 0x452bcc
call fcn.00403ed4
jne 0x452ae4
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_SendMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x452bd8
call fcn.00403e10
mov edx, dword [ebp - 0x14]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
jmp 0x452b3f
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x452bd8
call fcn.00403e10
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
mov eax, edi
call fcn.00402724
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452b6f
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b68
ret
Function at 0x452cac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x452d35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cfc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004087ec
mov edx, dword [ebp - 4]
mov eax, 0x452d4c
call fcn.004040b0
dec eax
jle 0x452d13
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452d3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret

Function at 0x452d50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x452ed2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
push 0x452ee0
push 0x452ef0
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x452eb0
push 0
push 0x452ef8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x452db8
push 0
push 0x452ef8
push edi
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov esi, ebx
push esi
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x452f08
call fcn.00403e10
mov edx, dword [ebp - 8]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d24
mov eax, dword [0x45891c]
mov eax, dword [eax]
mov edx, 0x452f1c
call fcn.00403ed4
jne 0x452e4c
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x452f28
call fcn.00403e10
mov edx, dword [ebp - 0x10]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
jmp 0x452eb0
push 0
push 0
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x452f28
call fcn.00403e10
mov edx, dword [ebp - 0x18]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452ed9
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403b68
ret
Function at 0x4532c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x453487
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.0040270c
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403cfc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
mov edx, 0x4b
mov al, 0x20
call fcn.0040415c
mov edx, dword [ebp - 8]
pop eax
call fcn.00403ed4
jne 0x453465
push 0
push 0x453498
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x453465
push 0
push 0x4534a0
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x4534a0
push edi
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test edi, edi
je 0x453465
test esi, esi
je 0x453465
push ebx
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x4534b0
call fcn.00403e10
mov edx, dword [ebp - 0xc]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00427d24
mov eax, dword [0x45891c]
mov eax, dword [eax]
mov edx, 0x4534c0
call fcn.00403ed4
jne 0x45340a
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x4534cc
call fcn.00403e10
mov edx, dword [ebp - 0x14]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
jmp 0x453465
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cfc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4534cc
call fcn.00403e10
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x458ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00427d24
mov eax, ebx
call fcn.00402724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45348e
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b68
ret