joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4363ee
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x17c
push ebx
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x48f139
lea eax, [esp + 8]
push eax
push eax
call fcn.0043b500
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x64
lea eax, [esp + 0x110]
push eax
push 0x48f138
push 0x48f130
push 0x48f129
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
neg eax
sbb eax, eax
neg eax
mov ebx, eax
mov eax, 1
cmp bx, ax
jne 0x4365c3
lea ecx, [esp + 0x108]
mov dword [esp + 0x16c], ecx
lea ecx, [esp + 0x170]
push ecx
lea ecx, [esp + 0x170]
push ecx
call fcn.00433563
add esp, 8
test ax, ax
je 0x436490
mov eax, dword [esp + 0x16c]
inc dword [esp + 0x16c]
cmp byte [eax], 0x2e
je 0x436494
xor eax, eax
jmp 0x436499
mov eax, 1
mov ebx, eax
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x170]
push eax
call fcn.00433563
add esp, 8
test ax, ax
je 0x4364cb
mov eax, dword [esp + 0x16c]
inc dword [esp + 0x16c]
cmp byte [eax], 0x2e
je 0x4364cf
xor eax, eax
jmp 0x4364d4
mov eax, 1
and bx, ax
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x170]
push eax
call fcn.00433563
add esp, 8
test ax, ax
je 0x436507
mov eax, dword [esp + 0x16c]
inc dword [esp + 0x16c]
cmp byte [eax], 0x2e
je 0x43650b
xor eax, eax
jmp 0x436510
mov eax, 1
and bx, ax
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x170]
push eax
call fcn.00433563
add esp, 8
test ax, ax
je 0x436545
lea eax, [esp + 0x16c]
push eax
call fcn.004345dc
add esp, 4
test ax, ax
je 0x436549
xor eax, eax
jmp 0x43654e
mov eax, 1
and bx, ax
cmp bx, 1
jne 0x4365c3
cmp dword [esp + 0x184], 0
je 0x436571
mov al, byte [esp + 0x170]
mov ecx, dword [esp + 0x184]
mov byte [ecx], al
cmp dword [esp + 0x188], 0
je 0x43658b
mov al, byte [esp + 0x174]
mov ecx, dword [esp + 0x188]
mov byte [ecx], al
cmp dword [esp + 0x18c], 0
je 0x4365a7
mov ax, word [esp + 0x178]
mov ecx, dword [esp + 0x18c]
mov word [ecx], ax
cmp dword [esp + 0x190], 0
je 0x4365c3
mov ax, word [esp + 0x17c]
mov ecx, dword [esp + 0x190]
mov word [ecx], ax
mov eax, ebx
pop ebx
add esp, 0x17c
ret

Function at 0x436bcb
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], 0x20
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [esp + 0xc]
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 8]
mov dword [ebx + 0x18], eax
pop ebx
add esp, 0x20
ret
Function at 0x4382ac
Capabilities:
Set global application hook

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
push 0
mov ecx, dword [esp + 0x10]
call fcn.00434e23
mov eax, dword [esp + 0xc]
mov dword [eax], 0x48f39c
push 0
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [esp + 0x10], eax
mov ecx, 0x50
cdq
idiv ecx
mov dword [esp + 0x18], eax
push 1
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [esp + 0x14], eax
mov ecx, 0x3c
cdq
idiv ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov eax, ecx
mov ebx, 0x28
cdq
idiv ebx
sub ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
push eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, eax
pop eax
sub eax, edx
mov dword [esp + 0x24], eax
xor edx, edx
mov esi, dword [esp + 0xc]
mov dword [esi + 0x34], edx
mov dword [esi + 0x30], edx
mov al, dl
mov byte [esi + 0x78], al
mov byte [esi + 0x58], al
mov byte [esi + 0x38], al
mov dword [esi + 0x94], edx
mov dword [esi + 0x8c], edx
mov dword [esi + 0x88], edx
mov edi, 0xffffffff
mov dword [esi + 0x90], edi
mov dword [esi + 0x9c], edx
mov dword [esi + 0x98], edx
xor eax, eax
mov word [esi + 0xa2], ax
mov word [esi + 0xa0], ax
mov ax, word [esp + 0x38]
mov word [esi + 0xa4], ax
test byte [esp + 0x34], 1
jne 0x43838e
xor ebx, ebx
mov word [esi + 0xae], bx
mov byte [esi + 0x84], dl
mov dword [esi + 0x80], edx
push dword [esp + 0x3c]
mov ecx, esi
call fcn.00439c20
xor eax, eax
mov word [esi + 0xa6], ax
mov word [esi + 0xa8], ax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
dec eax
mov word [esi + 0xb0], ax
mov word [esi + 0xb2], ax
mov word [esi + 0xb4], ax
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], 0
push 0
push dword [0x489ab0]
push 0x48f372
push dword [0x489ab0]
call dword [sym.imp.USER32.DLL_LoadMenuA]
push eax
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0x2cf0000
push dword [esp + 0x54]
push 0x49b3b0
push 0
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov dword [esi + 4], eax
push dword [0x48f354]
push eax
call fcn.00436232
mov dword [esi + 0x258], 0
push 0
push 0
push 0x800
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.DLL_GetSystemMenu]
mov dword [esp + 0x3c], eax
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0x48f35c
push 0xf800
push 0
push dword [esp + 0x3c]
call dword [sym.imp.USER32.DLL_AppendMenuA]
add esp, 8
push 0
call fcn.004365cd
add esp, 4
cmp eax, 2
jne 0x4384aa
push 0
push dword [0x489ab0]
push 0x439e05
push 3
call dword [sym.imp.USER32.DLL_SetWindowsHookExA]
mov dword [0x48f358], eax
push dword [esp + 0xc]
push 0
mov eax, dword [esp + 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.DLL_SetWindowLongA]
push 0
push 0
mov ecx, dword [esp + 0x14]
call fcn.0043922e
push 0
push 0
push 0x501
mov eax, dword [esp + 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x20
ret 0x10
Function at 0x438e59
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ebx, ecx
cmp dword [esp + 0x410], 0
je 0x438e79
call dword [sym.imp.USER32.DLL_GetActiveWindow]
cmp eax, dword [ebx + 4]
je 0x438e85
mov ecx, ebx
call fcn.00439da6
jmp 0x438f28
cmp dword [0x489acc], 0
je 0x438ea4
push 0x3e8
lea eax, [esp + 0x10]
push eax
push dword [0x489acc]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push dword [esp + 0x410]
lea eax, [esp + 0x10]
push eax
call fcn.0047160c
add esp, 8
test eax, eax
je 0x438f28
mov eax, 0xffffffff
mov word [ebx + 0xb2], ax
mov word [ebx + 0xb0], ax
mov eax, dword [esp + 0x410]
mov dword [ebx + 0xd0], eax
mov esi, dword [esp + 0x414]
lea edi, [ebx + 0xd4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_KillTimer]
cmp dword [ebx + 0xd0], 0
je 0x438f28
cmp dword [esp + 0x418], 0
jne 0x438f14
mov ecx, ebx
call fcn.00439c5b
jmp 0x438f28
push 0
push dword [esp + 0x41c]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_SetTimer]
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0xc
Function at 0x439c5b
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
push 4
lea eax, [ebx + 4]
push dword [eax]
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.DLL_KillTimer]
lea eax, [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x439d9f
cmp byte [ecx], 0
je 0x439d9f
mov ecx, dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.USER32.DLL_IsWindowEnabled]
test ax, ax
je 0x439d9f
call dword [sym.imp.USER32.DLL_GetActiveWindow]
mov ecx, dword [esp + 0xc]
cmp eax, dword [ecx]
mov eax, 1
je 0x439cbb
xor eax, eax
test ax, ax
je 0x439d9f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
lea eax, [ebx + 0xd4]
push eax
call dword [sym.imp.USER32.DLL_PtInRect]
test eax, eax
je 0x439d9f
push 0
push 0
push dword [0x489ac4]
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.004371bc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov ecx, ebx
call fcn.00439da6
lea esi, [ebx + 0xd4]
lea edi, [ebx + 0xe4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push dword [0x489ab0]
push 0
push 0
mov eax, dword [esp + 0x40]
add eax, 8
push eax
mov eax, dword [esp + 0x40]
add eax, 8
push eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff4
sub eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x4c]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
pop eax
sub eax, ecx
push eax
push 0x80800000
mov eax, dword [esp + 0x44]
push dword [eax]
push 0x49b3c8
push 0
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov dword [0x489acc], eax
push 8
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
movsx eax, word [ebx + 0xcc]
push eax
push 5
push dword [0x489abc]
call dword [sym.imp.USER32.DLL_SetTimer]
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x445a45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x50], ecx
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0x94]
test esi, esi
je 0x445c58
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x54]
add ecx, 0x10
mov edx, dword [ecx]
mov dword [esp + 0x48], ecx
call dword [edx + 0x1c]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x8c]
sub eax, dword [ecx]
imul eax, edi
cdq
idiv esi
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x58]
sub eax, dword [ecx + 4]
imul eax, edi
cdq
idiv esi
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x5c]
sub eax, dword [esp + 0x54]
imul eax, edi
cdq
idiv esi
inc eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x60]
sub eax, dword [esp + 0x58]
imul eax, edi
cdq
idiv esi
inc eax
mov dword [esp + 0x70], eax
push dword [esp + 0x98]
mov edx, dword [esp + 0x54]
push dword [edx + 0x13c]
call dword [sym.imp.GDI32.DLL_SetROP2]
cmp dword [esp + 0x70], 0
js 0x445c58
mov ecx, dword [esp + 0x8c]
add ecx, 4
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x7c], ecx
mov edx, dword [esp + 0x50]
add edx, 0x13c
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x6c]
add edx, dword [esp + 0x64]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x50]
add eax, 0x78
mov dword [esp + 0x30], eax
mov ebx, ecx
lea ecx, [ecx + 0xd0]
mov dword [esp + 0x34], ecx
lea ecx, [ebx + 0xe8]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x50]
add ecx, 0xac
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x70]
add ecx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x3c]
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x34]
fld qword [ecx]
mov eax, dword [esp + 0x1c]
imul eax, esi
cdq
idiv edi
mov ecx, dword [esp + 0x14]
add eax, dword [ecx]
mov ecx, dword [esp + 0x30]
sub eax, dword [ecx]
mov dword [esp + 0x48], eax
fimul dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
fld qword [ecx]
fdivp st(1)
call fcn.00470bcb
add ebp, eax
cmp dword [esp + 0x6c], 0
js 0x445c46
mov ebx, dword [esp + 0x64]
mov ecx, dword [esp + 0x7c]
add ecx, 0x64
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x80]
add ecx, 0xc8
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x80]
add ecx, 0xe8
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x84]
add ecx, 0x98
mov dword [esp + 0x2c], ecx
push dword [esp + 0x9c]
push ebp
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x2c]
fld qword [edx]
mov eax, ebx
imul eax, esi
cdq
idiv edi
mov edx, dword [esp + 0x94]
add eax, dword [edx]
mov edx, dword [esp + 0x28]
sub eax, dword [edx]
mov dword [esp + 0x50], eax
fimul dword [esp + 0x50]
mov edx, dword [esp + 0x30]
fld qword [edx]
fdivp st(1)
call fcn.00470bcb
add ecx, eax
push ecx
mov ecx, dword [esp + 0x1c]
push dword [ecx]
call dword [sym.imp.GDI32.DLL_SetPixel]
inc ebx
cmp ebx, dword [esp + 0x18]
jle 0x445bf0
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x1c]
jge 0x445b6a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret 0x14
Function at 0x44c9ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x70]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x74]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x74], eax
xor ebp, ebp
test eax, eax
js 0x44cb59
mov eax, dword [esp + 0x30]
add eax, 0x58
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x34], eax
mov ebx, dword [esp + 0x74]
sub ebx, ebp
cmp ebx, dword [esp + 0x7c]
jge 0x44ca65
mov eax, dword [esp + 0x78]
push eax
mov eax, ebx
imul eax, dword [esp + 0x7c]
cdq
idiv dword [esp + 0x80]
mov ecx, eax
pop eax
sub eax, ecx
sub dword [esp + 0x34], eax
test ebp, ebp
jne 0x44cab8
push dword [esp + 0x80]
mov ecx, dword [esp + 0x70]
mov ebx, dword [ecx]
mov dword [esp + 0x1c], ebx
add ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov edi, dword [ecx]
mov dword [esp + 0x20], edi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x38]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
call dword [edx]
jmp 0x44cb4c
push dword [esp + 0x80]
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
add ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
sub ebx, ebp
mov dword [esp + 0x28], ebx
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
sub edi, dword [esp + 0x38]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ebx
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
call dword [ebx]
push dword [esp + 0x80]
mov eax, dword [esp + 0x70]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
add eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
add ecx, ebp
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
sub esi, dword [esp + 0x38]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
lea eax, [esp + 0x5c]
push eax
mov ecx, dword [esp + 0x38]
call dword [ebx]
inc ebp
mov eax, ebp
cmp eax, dword [esp + 0x74]
jle 0x44ca34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x18
Function at 0x453bfb
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [ecx + 0x70]
shr eax, 7
test al, 1
je 0x453d46
push dword [edi + 4]
call dword [sym.imp.USER32.DLL_IsWindow]
test eax, eax
je 0x453d46
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, eax
lea ecx, [edi + 0x50]
mov edx, 0xfffffffb
cmp dword [ecx], edx
jle 0x453c38
inc edx
mov dword [ecx], edx
mov esi, ebx
add esi, dword [esp + 0x38]
lea edx, [edi + 4]
mov dword [esp + 0x10], edx
lea edx, [edi + 0x5c]
mov dword [esp + 0x14], edx
mov ebp, ecx
xor ebx, ebx
cmp dword [esp + 0x38], ebx
je 0x453c7e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp eax, esi
ja 0x453c8e
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.DLL_PeekMessageA]
mov ebx, eax
test ax, ax
jne 0x453c8e
jmp 0x453c58
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.DLL_GetMessageA]
mov ebx, eax
test bx, bx
je 0x453d2b
cmp dword [0x48ed70], 2
jne 0x453cad
lea ecx, [esp + 0x18]
push ecx
call fcn.0043581c
add esp, 4
mov ebx, 1
cmp dword [esp + 0x1c], 0x100
jne 0x453cfc
cmp word [esp + 0x20], 9
jne 0x453cfc
push 0x11
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
cwde
test ah, 0x80
je 0x453cfc
push 0
push 0x10
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
cwde
and eax, 0x8000
push eax
push 0x606
mov ecx, dword [esp + 0x1c]
push dword [ecx]
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 4]
neg eax
sbb eax, eax
inc eax
mov ebx, eax
test bx, bx
je 0x453d3c
lea ecx, [esp + 0x18]
push ecx
push dword [edi + 0x68]
call dword [sym.imp.USER32.DLL_IsDialogMessageA]
test eax, eax
jne 0x453d3c
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.DLL_TranslateMessage]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.DLL_DispatchMessageA]
jmp 0x453d3c
mov ecx, dword [esp + 0x14]
mov dword [ecx], 0xffffffff
mov dword [ebp], 0xfffffffe
cmp dword [ebp], 0xfffffffc
jle 0x453c50
mov eax, dword [edi + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x453d53
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, ecx
mov eax, dword [ecx + 0x70]
shr eax, 6
test al, 1
je 0x453e12
push 0
push dword [ebx + 0x5c]
push 0x603
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, ax
je 0x453d8f
push 0
push 0
push 0x605
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x604
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov ecx, 1
mov dword [ebx + 0x6c], ecx
push 0xfffffffffffffff8
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_GetWindowLongA]
mov esi, eax
mov ecx, dword [ebx + 0x70]
shr ecx, 7
test cl, 1
je 0x453dd5
push esi
call dword [sym.imp.USER32.DLL_IsWindow]
test eax, eax
je 0x453dd5
push 1
push esi
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebx + 0x70]
shr eax, 7
test al, 1
je 0x453e02
push dword [ebx + 0x64]
call dword [sym.imp.USER32.DLL_SetFocus]
mov eax, dword [ebx + 0x60]
mov dword [0x489ad0], eax
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x50], 0xffffffff
lea edx, [ebx + 0x70]
mov eax, dword [edx]
and al, 0xbf
mov dword [edx], eax
pop esi
pop ebx
ret

Function at 0x453e15
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x68
push ebx
push esi
mov dword [esp + 8], ecx
lea ebx, [esp + 0xc]
mov esi, dword [esp + 0x74]
push 0x64
lea ecx, [esp + 0x10]
push ecx
mov edx, dword [esp + 0x10]
push dword [edx + 4]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
test eax, eax
jne 0x453e53
mov ecx, dword [esp + 8]
add ecx, 0x10
push ecx
lea ecx, [esp + 0x10]
push ecx
call fcn.0047165c
add esp, 8
cmp byte [esp + 0xc], 0
je 0x453e99
mov ecx, 1
cmp dword [0x493d1c], ecx
jle 0x453e7e
push 0x107
movsx edx, byte [ebx]
push edx
call fcn.00474674
add esp, 8
test eax, eax
je 0x453e93
jmp 0x453e8e
movsx edx, byte [ebx]
mov eax, dword [0x493d9c]
test word [eax + edx*2], 0x107
je 0x453e93
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
inc ebx
cmp byte [ebx], 0
jne 0x453e5a
mov byte [esi], 0
mov eax, dword [esp + 0x74]
pop esi
pop ebx
add esp, 0x68
ret 4
Function at 0x457903
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0xa
push dword [esp + 0x1c]
push dword [0x489ab0]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test eax, eax
je 0x457990
push esi
push dword [0x489ab0]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
push esi
push dword [0x489ab0]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebp, eax
push eax
lea ecx, [ebx + 0x24]
push dword [ecx]
mov dword [esp + 0x18], ecx
call fcn.004768f8
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov edx, ebp
shr edx, 2
mov dword [ebx + 0x28], edx
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
mov ecx, dword [esp + 0x20]
push dword [ecx]
call fcn.00471320
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push 0x457b4b
push 4
push dword [ebx + 0x28]
mov ecx, dword [esp + 0x30]
push dword [ecx]
call fcn.00473018
add esp, 0x24
mov eax, dword [ebx + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
ret 4
Function at 0x45bd14
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x24]
push 0
mov ecx, edi
call fcn.00434e23
mov dword [edi], 0x49250c
push 0
push dword [0x489ab0]
push dword [esp + 0x30]
push dword [esp + 0x2c]
mov ecx, dword [esi + 0xc]
inc ecx
mov edx, dword [esi + 4]
sub ecx, edx
push ecx
mov ecx, dword [esi + 8]
inc ecx
mov eax, dword [esi]
sub ecx, eax
push ecx
push edx
push eax
push 0x40000000
push 0
push 0x49b398
push 0
call dword [sym.imp.USER32.DLL_CreateWindowExA]
lea ecx, [edi + 4]
mov dword [ecx], eax
push 0x40
mov dword [esp + 0x14], ecx
call fcn.00472b58
add esp, 4
mov ebx, eax
test eax, eax
je 0x45bd9d
push 3
push 0x10014040
push 0x101
mov ecx, dword [esp + 0x1c]
push dword [ecx]
mov ecx, ebx
call fcn.0045ad9e
mov ebx, eax
lea ecx, [edi + 0x10]
mov dword [ecx], ebx
push 0
push 8
push 2
mov dword [esp + 0x20], ecx
mov ecx, ebx
call fcn.0045afb0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
or dword [edx + 0x18], 0x40090
push 0x80
push 0x800000
push dword [ecx]
call fcn.0045b0e6
push edi
push 0
mov ecx, dword [esp + 0x24]
push dword [ecx]
call dword [sym.imp.USER32.DLL_SetWindowLongA]
mov ebp, dword [esi + 8]
inc ebp
sub ebp, dword [esi]
mov ecx, dword [esi + 0xc]
inc ecx
sub ecx, dword [esi + 4]
mov dword [esp + 0x24], ecx
movzx ecx, word [esp + 0x24]
shl ecx, 0x10
movzx edx, bp
or ecx, edx
push ecx
push 0
push 5
mov ecx, dword [esp + 0x28]
push dword [ecx]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 5
mov ecx, dword [esp + 0x20]
push dword [ecx]
call dword [sym.imp.USER32.DLL_ShowWindow]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x45d438
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x45d455
cmp byte [ebx], 0x3d
jne 0x45d455
lea eax, [ebx + 1]
jmp 0x45d457
xor eax, eax
mov dword [esp + 0x1c], eax
test eax, eax
je 0x45d5e5
push 0x3f
push 0x492554
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004334a5
lea eax, [esp + 0x30]
push eax
call fcn.004724a8
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 0x10], eax
cmp word [esp + 0x7c], 0
mov eax, 0x20000000
jne 0x45d49f
mov eax, dword [ecx + 0x18]
or eax, 0x20000000
mov dword [ecx + 0x18], eax
add esp, 0x14
push 0x2c
lea eax, [esp + 0x20]
push eax
call fcn.0043451f
add esp, 8
test ax, ax
je 0x45d5e3
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
test al, al
je 0x45d5d4
cmp al, 0x2c
je 0x45d5d4
mov ebx, dword [esp + 0x18]
add ebx, 0x18
mov esi, dword [esp + 0x18]
add esi, 0x14
mov edi, dword [esp + 0x18]
add edi, 4
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movsx eax, byte [ecx]
cmp eax, 0x21
je 0x45d544
cmp eax, 0x31
je 0x45d54c
cmp eax, 0x32
je 0x45d554
cmp eax, 0x33
je 0x45d55c
cmp eax, 0x34
je 0x45d564
cmp eax, 0x44
je 0x45d56c
cmp eax, 0x45
je 0x45d571
cmp eax, 0x46
je 0x45d579
cmp eax, 0x48
je 0x45d57e
cmp eax, 0x4c
je 0x45d595
cmp eax, 0x52
je 0x45d59a
cmp eax, 0x53
je 0x45d5a0
cmp eax, 0x54
je 0x45d5a5
cmp eax, 0x55
je 0x45d5ab
cmp eax, 0x58
je 0x45d5b0
jmp 0x45d5b5
or dword [ebx], 0x20000
jmp 0x45d5bd
or dword [ebx], 0x1000000
jmp 0x45d5bd
or dword [ebx], 0x2000000
jmp 0x45d5bd
or dword [ebx], 0x4000000
jmp 0x45d5bd
or dword [ebx], 0x8000000
jmp 0x45d5bd
or byte [ebx], 1
jmp 0x45d5bd
or dword [ebx], 0x10000
jmp 0x45d5bd
or byte [esi], 0x43
jmp 0x45d5bd
push 0
push dword [edi]
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0
push dword [ebp]
call dword [sym.imp.USER32.DLL_ShowWindow]
jmp 0x45d5bd
or byte [ebx], 0x10
jmp 0x45d5bd
or byte [ebx + 1], 0x10
jmp 0x45d5bd
or byte [ebx], 0x40
jmp 0x45d5bd
or byte [ebx + 1], 0x20
jmp 0x45d5bd
or byte [ebx], 2
jmp 0x45d5bd
or byte [ebx], 4
jmp 0x45d5bd
push 0
call dword [sym.imp.USER32.DLL_MessageBeep]
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov cl, byte [ecx]
test cl, cl
je 0x45d5d4
cmp cl, 0x2c
jne 0x45d4f0
push 0x2c
lea eax, [esp + 0x20]
push eax
call fcn.0043451f
add esp, 8
jmp 0x45d5f3
push ebx
mov eax, dword [esp + 0x1c]
push dword [eax + 4]
call dword [sym.imp.USER32.DLL_SetWindowTextA]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8