joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x410d2b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x410d26
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x410d58
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x410d3c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00489f40
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x410d6c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x410d63
cmp byte [esi + 8], 0
je 0x410d63
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x410ef4
cmp byte [edi + 1], 0
je 0x410eed
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x410efa
xor eax, eax
pop edi
mov esp, ebp
pop ebp
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x410f1d
cmp byte [edi + 1], 0
je 0x410f16
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x410f20
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x410f2f
mov eax, dword [edi + 0x18]
mov ebx, 0xffff
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jae 0x410f34
mov ebx, eax
mov dword [ebp - 0xc], eax
push esi
push 0x404
call fcn.00491699
mov esi, eax
add esp, 4
test esi, esi
jne 0x410f4f
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0
cmp ebx, eax
jbe 0x41104a
mov edx, dword [ebp - 4]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x410fae
cmp byte [edi + 1], 0
je 0x41104a
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x410fb1
mov dword [edi + 0x18], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x410fd9
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x410fd4
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x411002
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x410fec
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.00489f40
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x41104a
lea eax, [ebx - 3]
test eax, eax
jle 0x41103c
dec eax
cmp byte [eax + esi], 0x50
jne 0x41102e
cmp byte [eax + esi + 1], 0x4b
jne 0x41102e
cmp byte [eax + esi + 2], 5
jne 0x41102e
cmp byte [eax + esi + 3], 6
je 0x411034
test eax, eax
jg 0x411012
jmp 0x41103c
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
jne 0x41104a
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
jb 0x410f63
push esi
call fcn.00491497
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x411fe8
cmp dword [esi + 4], 0xffffffff
jne 0x411fe8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x411f80
cmp dword [ebp + 0x10], 1
mov eax, dword [0x4b39bc]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x411fb3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x411fb3
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00410b20
add esp, 8
test eax, eax
jne 0x411fd4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.00411060
mov dword [esi], eax
mov eax, dword [0x4cc5bc]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc

Function at 0x413d90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov edx, ecx
mov byte [edx + 0x199], al
test al, al
jne 0x413dbe
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x413dbe
cmp dword [ecx + 0x84], edx
jne 0x413dbe
mov dword [ebp + 8], 0
pop ebp
jmp fcn.00408e90
pop ebp
ret 4

Function at 0x417ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x674], 0
je 0x417f2c
cmp dword [ebp + 8], 0x100
jne 0x417f1c
cmp word [ebp + 0xc], 0xd
jne 0x417f1c
cmp byte [esi + 0x67a], 0
je 0x417efe
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x417f1c
cmp byte [esi + 0x67b], 0
jne 0x417f1c
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x417f15
push ecx
push 0
push 0
push str.return
push esi
call fcn.004098f0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x674]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x41b240
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
push edi
mov edi, edx
test ecx, ecx
jne 0x41b26a
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
call fcn.0040a9a0
mov esi, dword [ebp - 4]
add esp, 4
mov dword [edi], eax
jmp 0x41b2e9
mov eax, dword [0x4cc580]
test eax, eax
push ecx
push dword [ebp + 8]
cmove eax, dword [0x4cc584]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x41b2ed
mov eax, dword [0x4cc580]
test eax, eax
push ebx
cmove eax, dword [0x4cc584]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41b2e2
mov eax, dword [0x4cc580]
test eax, eax
push ebx
cmove eax, dword [0x4cc584]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi], eax
test eax, eax
je 0x41b2e2
push eax
call fcn.00487e40
add esp, 4
mov esi, eax
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.00489f40
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x41b361
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41b36a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
je 0x41b356
push eax
mov dword [ebp - 4], 0
call fcn.00487e40
mov esi, eax
add esp, 4
test esi, esi
je 0x41b356
push 0
lea eax, [ebp - 4]
push eax
push dword [edi]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
je 0x41b356
push esi
call fcn.00487e49
add esp, 4
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41b36a
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x4c90b4]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword fs:[0x2c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x24], edx
mov edx, ecx
mov ecx, dword [eax]
mov eax, dword [0x4cc7e4]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
cmp eax, dword [ecx + 4]
jle 0x41ba75
push 0x4cc7e4
call fcn.0048846f
add esp, 4
cmp dword [0x4cc7e4], 0xffffffff
jne 0x41ba71
push 0x4b43ac
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4cc7e4
mov dword [0x4cc7e8], eax
call fcn.00488430
add esp, 4
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4cc7e8]
mov ecx, 0x41aca0
test eax, eax
cmove eax, ecx
cmp dword [esp + 0x2c], 0
mov dword [0x4cc7e8], eax
je 0x41cbe1
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esp + 0x2c]
mov dword [esp + 0x24], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
push dword [esp + 0x20]
mov dword [esp + 0x60], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
cmp dword [0x4cc7e8], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x5c], xmm0
je 0x41c49b
cmp byte [ebp + 0x18], 0
mov al, byte [ebp + 0x1c]
jne 0x41bae5
cmp al, 0xff
jae 0x41c49b
cmp byte [ebp + 0x20], 0
mov word [esp + 0x24], 0
mov byte [esp + 0x26], al
mov byte [esp + 0x27], 1
mov esi, dword [esp + 0x24]
jne 0x41bedb
mov esi, dword [esp + 0x18]
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
mov eax, dword [esi]
mov edx, dword [esi + 4]
lea ecx, [eax + edi]
mov dword [esp + 0x5c], ecx
lea ecx, [edx + ebx]
mov dword [esp + 0x60], ecx
mov ecx, dword [esi + 8]
mov esi, dword [esp + 0x10]
sub ecx, dword [esi + 8]
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, edi
mov edi, esi
add ecx, dword [esp + 0x5c]
mov dword [esp + 0x64], ecx
lea ecx, [edx + ebx]
mov eax, dword [eax + 0xc]
sub eax, dword [edi + 0xc]
sub eax, edx
sub eax, ebx
add eax, ecx
mov dword [esp + 0x68], eax
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x2c]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
mov esi, dword [esp + 0x24]
test eax, eax
je 0x41bed9
cmp byte [ebp + 0x24], 0
jne 0x41bcd0
cmp byte [ebp + 0x28], 0
jne 0x41bc04
mov eax, dword [esp + 0x5c]
sub dword [esp + 0x64], eax
mov eax, dword [esp + 0x60]
sub dword [esp + 0x68], eax
mov eax, edi
mov ecx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
mov edi, dword [eax + 4]
mov ebx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov eax, dword [eax + 0xc]
sub eax, dword [esi + 0xc]
sub eax, ecx
sub eax, edi
push eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
sub eax, dword [esi + 8]
sub eax, edx
invalid
Function at 0x4215a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4c90b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push edi
push 0x2c
mov dword [ebp - 0x3c], eax
mov edi, ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], edi
push 0
push eax
mov ebx, edx
call fcn.0048a4c0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x2c], ebx
neg eax
imul ebx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push 0
push 0
mov dword [ebp - 0x30], 0x28
mov dword [ebp - 0x24], 0x200001
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebx*4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x421631
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487e4e
mov esp, ebp
pop ebp
push esi
xor esi, esi
test ebx, ebx
jle 0x421713
mov edx, dword [ebp + 0xc]
nop
mov eax, dword [ebp - 0x34]
mov cl, byte [edi + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
mov eax, dword [ebp - 0x34]
cmp byte [eax + esi*4 + 3], 0xff
lea edi, [eax + esi*4]
mov eax, dword [ebp - 0x38]
jae 0x4216bd
movzx ecx, byte [eax + esi*4 + 2]
movzx eax, byte [eax + esi*4 + 3]
imul ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
mov byte [edi], dl
mov edi, dword [ebp - 0x38]
movzx eax, byte [edi + esi*4 + 3]
movzx ecx, byte [edi + esi*4 + 1]
imul ecx, eax
mov eax, 0x80808081
mul ecx
mov eax, dword [ebp - 0x34]
shr edx, 7
mov byte [eax + esi*4 + 1], dl
movzx eax, byte [edi + esi*4 + 3]
movzx ecx, byte [edi + esi*4]
imul ecx, eax
mov eax, 0x80808081
mul ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
shr edx, 7
mov byte [eax + esi*4 + 2], dl
mov edx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x4216e0
mov al, byte [eax + esi*4 + 2]
mov byte [edi], al
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
movzx ecx, byte [edi + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov eax, dword [ebp - 0x34]
movzx ecx, byte [edi + esi*4]
mov byte [eax + esi*4 + 2], cl
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp dword [eax + esi*4], edx
jne 0x421707
mov byte [eax + esi*4], 0
mov eax, dword [ebp - 0x34]
mov byte [eax + esi*4 + 1], 0
mov eax, dword [ebp - 0x34]
mov byte [eax + esi*4 + 2], 0
mov eax, dword [ebp - 0x34]
mov byte [eax + esi*4 + 3], 0
mov byte [ecx], 1
inc esi
cmp esi, ebx
jl 0x421640
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00487e4e
mov esp, ebp
pop ebp
ret
Function at 0x426600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
shr edx, 0x10
mov esi, ecx
push edi
test edx, edx
je 0x426651
cmp word [eax], 0x3c
jne 0x426637
push eax
call fcn.00429c10
test al, al
jne 0x4266ea
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push ecx
push eax
call fcn.00429dc0
test al, al
jne 0x4266ea
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x4cc580]
test ecx, ecx
mov ebx, dword [ebp + 0xc]
cmove ecx, dword [0x4cc584]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x42662c
mov eax, dword [0x4cc580]
test eax, eax
push edi
cmove eax, dword [0x4cc584]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4266a2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x140], eax
mov eax, dword [0x4cc580]
test eax, eax
push ecx
cmove eax, dword [0x4cc584]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.00429ce0
test al, al
je 0x42662c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [esi + 0x144], ebx
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00426710
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x432aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
mov ebx, ecx
and ebx, 7
je 0x432aeb
cmp ecx, ebx
jge 0x432ae3
mov edx, dword [esi]
mov edi, dword [esi + 0xc]
nop dword [eax]
cmp edx, dword [esi + 4]
jb 0x432ac9
xor eax, eax
jmp 0x432ad1
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
shl eax, cl
add ecx, 8
or edi, eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
cmp ecx, 0x18
jle 0x432ac0
mov ecx, ebx
shr dword [esi + 0xc], cl
sub dword [esi + 8], ebx
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x432b1d
mov edi, dword [esi + 0xc]
nop word [eax + eax]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx - 4], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x432b00
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x432b3c
mov edi, dword [esi + 4]
mov edx, dword [esi]
cmp edx, edi
jb 0x432b2a
xor eax, eax
jmp 0x432b32
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x432b22
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx ebx, ah
movzx eax, al
shl ebx, 8
add ebx, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, ebx
xor eax, 0xffff
cmp ecx, eax
je 0x432b6b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, ebx
cmp eax, dword [esi + 4]
ja 0x432b62
mov ecx, dword [esi + 0x10]
mov edi, dword [esi + 0x18]
lea eax, [ecx + ebx]
cmp eax, edi
jbe 0x432bbc
cmp dword [esi + 0x1c], 0
je 0x432b62
mov edx, dword [esi + 0x14]
sub ecx, edx
sub edi, edx
mov dword [ebp - 4], ecx
lea eax, [ecx + ebx]
cmp eax, edi
jle 0x432b9e
add edi, edi
cmp eax, edi
jg 0x432b98
push edi
push edx
call fcn.004916a4
add esp, 8
test eax, eax
je 0x432b62
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [esi + 0x14], eax
add eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], eax
push ebx
push dword [esi]
push dword [esi + 0x10]
call fcn.00489f40
add dword [esi], ebx
add esp, 0xc
add dword [esi + 0x10], ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b820
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x4c90b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push esi
mov esi, ecx
push edi
push eax
mov dword [esi + 0x10], ebx
call fcn.0043ba00
mov ecx, dword [esi + 0x10]
mov edi, 0x400000a0
mov eax, 0x40000080
cmp byte [ecx + 0x7c9], 0
cmove edi, eax
cmp byte [ecx + 0x9f0], 0
je 0x43b873
and edi, 0xffffff7f
or edi, 4
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0xa4]
sub esp, 0x10
mov ecx, esp
push ecx
push 0
push edi
push ecx
push dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esi
call fcn.0040b0f0
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx + 0x648]
cmp edi, 0xffffffff
je 0x43b8cc
mov eax, dword [ecx]
call dword [eax + 0x1c]
test edi, edi
js 0x43b8bf
cmp edi, dword [eax + 0x24c]
jge 0x43b8bf
mov eax, dword [eax + 0x248]
mov eax, dword [eax + edi*4]
jmp 0x43b8c6
mov ecx, eax
call fcn.00409c00
mov eax, dword [eax]
test eax, eax
jne 0x43b8dd
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00409c00
mov eax, dword [eax]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x10]
push 0
push dword [eax + 0x7c4]
push 0xc5
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x10]
cmp byte [eax + 0x7c9], 0
je 0x43b922
movzx eax, word [eax + 0x7ca]
push 0
push eax
push 0xcc
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
cmp eax, ecx
je 0x43b955
push eax
call fcn.00491497
add esp, 4
push 0
push 0
push 0xb9
push dword [esi + 4]
call edi
push 0
push 3
push 0xd3
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xf0]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x10]
xor ecx, ecx
push 0
cmp byte [eax + 0x7c8], 1
sete cl
push ecx
push 0xcf
push dword [esi + 4]
call edi
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebx + 0x9e4]
or ecx, eax
push ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 8]
pop edi
mov byte [esi + 0x18], 1
xor ecx, ebp
pop esi
pop ebx
call fcn.00487e4e
mov esp, ebp
pop ebp
ret 4
Function at 0x43be80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4c90b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x43beed
cmp dword [esi + 0x10], 0
je 0x43beed
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0049d630
mov ebx, esp
test ebx, ebx
je 0x43beed
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1bc
call fcn.00404b20
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004098f0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487e4e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44c870
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4c90b4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], eax
mov dword [eax + 0x7c8], 0
cmp dword [esi + 4], 0
jne 0x44c8fa
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0x18]
sub esp, 0x10
mov ecx, esp
push ecx
push 0
push 0x40000000
push ecx
push dword [eax]
movups xmmword [ecx], xmm0
mov ecx, esi
call fcn.0040b0f0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push dword [ecx + 0x648]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040a0e0
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0xa4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0xa0]
mov eax, dword [eax]
movzx ebx, word [eax]
mov eax, dword [ebp - 0xa4]
cmp eax, ecx
je 0x44c927
push eax
call fcn.00491497
add esp, 4
test bx, bx
jne 0x44c93b
mov eax, dword [esi + 0x10]
add eax, 0x7b8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, 0x7b8
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 8]
mov byte [esi + 0x18], 1
xor ecx, ebp
pop esi
pop ebx
call fcn.00487e4e
mov esp, ebp
pop ebp
ret 4

Function at 0x44d250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [ecx + 0x199], al
test al, al
jne 0x44d27e
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x44d295
cmp dword [eax + 0x84], ecx
jne 0x44d295
mov dword [ebp + 8], 0
mov ecx, eax
pop ebp
jmp fcn.00408e90
cmp byte [ecx + 0x198], 0
je 0x44d295
mov eax, dword [ecx]
push dword [ecx + 0x7cc]
call dword [eax + 0x158]
pop ebp
ret 4