joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426610
Capabilities:
Terminate process

Disassembly:
jmp 0x42a810
mov ecx, dword [0x4c02c0]
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ecx + 0x18]
mov ebx, edx
and ebx, 4
jne 0x42a896
or dl, 4
mov ebx, eax
mov dword [ecx + 0x18], edx
or edx, 0xffffffff
mov eax, dword [0x4c02c0]
mov eax, dword [eax + 0x30]
mov esi, eax
call fcn.0041f5d8
test eax, eax
mov eax, ebx
je 0x42a85b
mov edx, 0xa2
mov eax, 0x460e64
call fcn.00421570
mov eax, ebx
mov ebx, eax
mov eax, esi
call fcn.0041f5e8
test eax, eax
mov eax, ebx
je 0x42a87b
mov edx, 0xa3
mov eax, 0x460e6c
call fcn.00421570
mov eax, ebx
mov edi, esi
lea eax, [eax]
mov ebx, dword [edi + 0xc]
test ebx, ebx
jle 0x42a896
xchg ebx, eax
lea ecx, [eax - 1]
mov dword [edi + 0xc], ecx
call dword [edi + eax*4 + 0xc]
mov eax, ebx
jmp 0x42a880
add esp, 0xc
pop esi
pop edi
pop ebx
jmp fcn.00427470

Function at 0x4278d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
sub esp, 0xc
cmp dword [0x430078], 1
jne 0x427a4f
mov ecx, dword [0x4c02c0]
test byte [ecx + 0x18], 2
jne 0x427a4f
mov eax, dword [0x460554]
call fcn.0042a040
mov eax, dword [0x460558]
call fcn.0042a040
mov eax, 0x430080
call fcn.0042808c
test eax, eax
jne 0x427a4f
mov eax, dword [0x4c02c0]
mov edx, 0x1e
add eax, 0x18
call fcn.00427748
call fcn.004245d0
mov ecx, dword [0x4c02c0]
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov edi, ebx
test ebx, ebx
je 0x42796d
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x42795d
call fcn.00425ca0
mov dword [ebx + 0x58], 0
mov ebx, edi
mov eax, ebx
call fcn.00429590
mov eax, ebx
call fcn.0041e0b0
xor edx, edx
mov eax, dword [0x460550]
call fcn.00427c10
xor edx, edx
mov eax, dword [0x460554]
call fcn.00427c10
xor edx, edx
mov eax, dword [0x460558]
call fcn.00427c10
mov eax, dword [0x4c02c0]
mov eax, dword [eax + 0x24]
call fcn.0041e0b0
call fcn.00426270
mov eax, dword [0x4c02c0]
mov eax, dword [eax + 0x28]
call fcn.0041e0b0
call fcn.004277b6
call fcn.004278b9
call fcn.004278b3
mov eax, dword [0x43023c]
call fcn.004299d6
call fcn.00427026
mov eax, dword [0x4c02c0]
add eax, 0x60
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x68
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x70
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x78
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x80
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x88
call fcn.00425ba0
mov eax, dword [0x4c02c0]
add eax, 0x90
call fcn.00425ba0
mov eax, dword [0x4c02c0]
mov eax, dword [eax + 0x30]
call fcn.00425ba0
mov ebx, dword [0x4c02c0]
mov edx, dword [ebx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsFree]
add esp, 0xc
pop edi
pop ebx
ret
Function at 0x429530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [0x4c02c0]
push ebx
sub esp, 4
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x429579
mov edx, dword [ebx + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.00429590
mov eax, ebx
call fcn.0041e0b0
mov eax, dword [0x4c02c0]
push 0
mov edx, dword [eax + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
call fcn.0042ac00
add esp, 4
pop ebx
ret

Function at 0x429860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0xc
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
or edx, 0xffffffff
mov eax, 0x430210
mov dword [ebp + 0x10], ecx
call fcn.0041f5d8
test eax, eax
je 0x429887
add esp, 0xc
pop edi
pop ebp
ret
mov ecx, dword [0x4c0304]
mov eax, 0x430210
cmp dword [ebp + 8], ecx
setae cl
and ecx, 0xff
neg ecx
and ecx, 6
mov edi, ecx
call fcn.0041f5e8
test eax, eax
je 0x4298b4
add esp, 0xc
pop edi
pop ebp
ret
cmp edi, 0
jne 0x4298e6
push 0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [0x43009c]
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
mov eax, dword [ecx + edx*8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4298e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
add esp, 0xc
pop edi
pop ebp
ret
Function at 0x90c1c30
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
push edi
add esp, 0xfffffef4
mov edi, dword [esp + 0x11c]
mov al, byte [edi]
test al, al
je 0x90c1c52
xor esi, esi
inc esi
mov al, byte [edi + esi]
test al, al
jne 0x90c1c48
jmp 0x90c1c54
xor esi, esi
test esi, esi
je 0x90c1cfe
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebp, eax
cmp ebp, 0xffffffff
je 0x90c1ca5
call fcn.090c2020
test al, al
jne 0x90c1ca5
push 0
lea eax, [esp + 0x10c]
push eax
push esi
push edi
push ebp
mov dword [esp + 0x11c], esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [esp + 0x10c]
push ecx
push 2
push 0x90c4c38
push ebp
call sub.KERNEL32.DLL_WriteFile
jmp 0x90c1cef
push 0
mov dword [esp + 0x10c], esi
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
jne 0x90c1ccb
mov byte [esp], 0
push 0x90c4c48
call sub.KERNEL32.DLL_LoadLibraryA
push str.MessageBoxA
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x12010
lea ecx, [esp + 4]
push ecx
push edi
push 0
call eax
mov eax, dword [0x90c6010]
test eax, eax
je 0x90c1cfe
push edi
call fcn.090c1fc0
sub esp, 0xfffffef4
pop edi
pop esi
pop ebp
ret 4

Function at 0x90c1eb0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
add esp, 0xfffffaec
mov al, byte [0x90c6014]
test al, al
je 0x90c1ec6
mov al, 1
jmp 0x90c1fb6
push dword [0x90c6010]
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
lea ecx, [esp + 0x11c]
push ecx
call fcn.090c1bc0
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x11c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x13c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0xfffffff4
test eax, eax
je 0x90c1f1b
xor al, al
jmp 0x90c1fb6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 8]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
je 0x90c1fb4
lea eax, [esp + 4]
push eax
call fcn.090c22c0
inc eax
push eax
lea ecx, [esp + 8]
push ecx
push 2
push 0
push str.EventMessageFile
mov eax, dword [esp + 0x120]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ecx, eax
mov eax, dword [esp + 0x10c]
test ecx, ecx
je 0x90c1f74
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0x90c1fb6
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0
push str.TypesSupported
push eax
mov dword [esp + 0x18], 7
call sub.ADVAPI32.DLL_RegSetValueExA
mov edx, eax
mov eax, dword [esp + 0x10c]
test edx, edx
je 0x90c1fa9
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0x90c1fb6
mov byte [0x90c6014], 1
mov al, 1
jmp 0x90c1fb6
xor al, al
sub esp, 0xfffffaec
ret

Function at 0x90c2040
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp word [edi], 0x5a4d
je 0x90c2056
push str.Invalid_DOS_signature
call fcn.090c1d10
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
je 0x90c206b
push str.Invalid_PE_signature
call fcn.090c1d10
mov eax, edi
pop edi
ret 4
Function at 0x4015c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004476d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401609
push ebx
call fcn.00445688
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x401634
push 6
call fcn.0044568e
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x401650
push eax
mov ebx, eax
call fcn.00401181
inc eax
push eax
call fcn.00445682
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x401655
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401666
push ebx
call fcn.00445688
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402bf1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.004476d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402c36
push ebx
call fcn.00445688
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402c64
push 6
call fcn.0044568e
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x402c80
push eax
mov ebx, eax
call fcn.00401181
inc eax
push eax
call fcn.00445682
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402c85
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402c96
push ebx
call fcn.00445688
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40a082
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x40a09d
call fcn.0040a10d
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40a0c9
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40a0f3
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x40a107
mov esp, ebp
pop ebp
ret 8
Function at 0x40c73a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40c77d
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40c7a7
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40c7db
push 6
call fcn.0044568e
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x40c7e3
mov esp, ebp
pop ebp
ret 4

Function at 0x410947
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x410966
mov dword [ebp + 0x14], 0
jmp 0x410983
cmp dword [ebp + 0x14], 2
jne 0x41097c
mov dword [ebp + 0x14], 7
jmp 0x410983
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x4534d1
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4109be
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x4109da
mov eax, 0
jmp 0x4109e4
mov eax, 1
jmp 0x4109e4
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4127c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.004476d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412809
push ebx
call fcn.00445688
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x412834
push 6
call fcn.0044568e
add esp, 4
push 0x45350c
push dword [ebp - 4]
mov ecx, 2
call fcn.004011ec
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x412854
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412865
push ebx
call fcn.00445688
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x413aaf
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 2
jne 0x413bf7
mov dword [ebp - 8], esp
push str.Comet_Thread
push dword [ebp + 8]
call dword [0x457fe5]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413af0
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413b46
mov dword [ebp - 8], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413b24
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413b46
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Image
push dword [ebp + 8]
call dword [0x457fe5]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413b6d
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413b9c
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413b9c
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Stream
push dword [ebp + 8]
call dword [0x457fe5]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413bc3
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413bf2
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413bf2
push 6
call fcn.0044568e
add esp, 4
jmp 0x413cbe
cmp dword [ebp + 0xc], 0x201
jne 0x413cbe
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x457fe9]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413c2f
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push str.CometHitMove
push dword [ebp + 8]
call dword [0x457fe5]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413c59
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x413cb6
mov dword [ebp - 8], esp
call dword [0x457fed]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413c85
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 8], esp
push 0
push 2
push 0xa1
push dword [ebp + 8]
call dword [0x457ff1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413cb6
push 6
call fcn.0044568e
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x413cee
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x457fe9]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413ce9
push 6
call fcn.0044568e
add esp, 4
jmp 0x413cee
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427f50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x427f8b
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044aec0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x427fee
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00449c40
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x428012
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044aec0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x428075
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00449c40
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x428099
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0044aec0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4280fc
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00449c40
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x428104
mov esp, ebp
pop ebp
ret
Function at 0x42c3f1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42c437
push 6
call fcn.0044568e
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x453773]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401c96
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.004476d0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42c48a
push ebx
call fcn.00445688
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42c4c3
push 6
call fcn.0044568e
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42c4df
push eax
mov ebx, eax
call fcn.00401181
inc eax
push eax
call fcn.00445682
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42c4e4
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42c4f5
push ebx
call fcn.00445688
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x447710
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x447779
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00447190
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x4497d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0044bd90
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x449920
test ecx, ecx
je 0x449920
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x449849
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44990d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x4498d1
cmp eax, 0xea
jne 0x4498f9
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44989c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x4498df
cmp eax, 2
jne 0x4498f9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.0044b6e0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x44994e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x44995a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x44995a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.0044b6e0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret