joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470790
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ce0b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004c1978
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004c7011
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004c852d
test eax, eax
je 0x4708ac
mov ecx, dword [esp + 0x3c]
call fcn.004c703e
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x470870
push edi
mov ecx, esi
call fcn.004c46a3
mov ecx, esi
call fcn.00470a50
cmp dword [esp + 0x38], 1
jne 0x4708a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004c47de
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x472a90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x472ac3
push esi
call fcn.00480da0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x472abc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x472b49
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x472b32
mov eax, dword [esi + 8]
test eax, eax
je 0x472ae7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x472b2e
cmp eax, 2
je 0x472b32
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x472ada
cmp eax, 3
je 0x472b0d
cmp eax, 1
jne 0x472ada
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x472ada
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x472ada
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00472b70
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x472b58
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00472b70
add esp, 4
pop esi
ret

Function at 0x4733f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x473411
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x473411
mov eax, dword [eax + 0x44]
test eax, eax
je 0x473411
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x48e360
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
push esi
push edi
mov eax, dword [ebp]
mov edi, dword [ebp + 4]
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x48e463
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x48e3e6
mov edx, dword [esp + 0x20]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x48e446
mov eax, dword [ebp + 0x34]
mov edx, dword [ebx - 4]
push eax
mov ecx, edi
push 4
push 0x1000
add ecx, edx
push esi
push ecx
call dword [ebp + 0x1c]
add esp, 0x14
test eax, eax
je 0x48e46e
mov eax, dword [ebx - 4]
mov ecx, esi
mov edx, ecx
add edi, eax
xor eax, eax
mov dword [ebx - 8], edi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x48e442
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x1c]
add ecx, eax
push ecx
push edx
call fcn.0048e340
add esp, 8
test eax, eax
je 0x48e46e
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebx]
push eax
mov eax, dword [ebx - 4]
mov edx, edi
push 4
push 0x1000
add edx, eax
push ecx
push edx
call dword [ebp + 0x1c]
add esp, 0x14
test eax, eax
je 0x48e46e
mov ecx, dword [ebx - 4]
mov esi, dword [ebx + 4]
mov eax, edi
mov edi, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [ebx]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov edi, dword [esp + 0x24]
mov ecx, dword [ebp]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add ebx, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x48e393
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x48e480
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [edi]
mov cx, word [eax + 0x14]
lea esi, [ecx + eax + 0x18]
mov ecx, dword [edi + 0x3c]
push ecx
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call fcn.0048e5d0
push esi
push edi
mov dword [esp + 0x28], eax
call fcn.0048e5e0
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
mov edx, dword [esi + 0x24]
mov eax, 1
add esp, 0x10
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
add esi, 0x28
cmp word [ecx + 6], ax
mov dword [esp + 0x10], eax
jbe 0x48e59b
mov ecx, dword [edi + 0x3c]
mov eax, dword [esi + 8]
push ecx
push eax
mov dword [esp + 0x34], eax
call fcn.0048e5d0
push esi
push edi
mov ebx, eax
call fcn.0048e5e0
mov edx, dword [esp + 0x24]
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x48e545
mov eax, dword [esp + 0x1c]
add eax, edx
cmp eax, ebx
ja 0x48e545
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.0048e610
add esp, 8
test eax, eax
je 0x48e5bb
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x24]
mov dword [esp + 0x20], eax
jmp 0x48e57a
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
test eax, 0x2000000
je 0x48e563
test ecx, 0x2000000
je 0x48e563
or ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x48e56e
or eax, ecx
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
sub ebp, edx
add ebp, eax
mov dword [esp + 0x1c], ebp
mov ecx, dword [edi]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x48e4e1
mov eax, 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0048e610
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x49b150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xcf77a8]
xor edx, edx
cmp eax, edx
jne 0x49b176
xor eax, eax
mov byte [eax + 0xcf76a8], al
inc eax
cmp eax, 0x100
jl 0x49b15e
mov dword [0xcf77a8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xcf76a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x49b207
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49b1da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x49b1a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49b210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x49b263
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49b24a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1c10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce5be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a2530
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xcaa524
call fcn.004c010b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4a1ca3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c010b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4a1c9c
push 0
mov ecx, eax
call fcn.00498d80
mov dword [esi + 0xc], eax
jmp 0x4a1ca5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4a1ca5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4c276e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c27a6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c0825
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c07fd
jmp 0x4c27b2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c3e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c3ea2
call fcn.004c9918
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c3ea2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c3e99
xor eax, eax
jmp 0x4c3eaa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c3eb0
pop edi
pop esi
pop ebx
ret 4
Function at 0x4c9e48
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c9e76
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c9e94
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c9dae
jmp 0x4c9e94
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c9e94
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c9dae
test edi, edi
mov eax, edi
jne 0x4c9e7e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0xda1fad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x10], ecx
jmp 0xd3f62c
je 0xd18496
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 1
seta bh
mov ecx, dword [ebp + 8]
bswap edi
cdq
mov edx, dword [ebp - 8]
lahf
movzx eax, sp
cmove esi, edi
mov dword [ecx + 0x28], edx
movsx esi, si
mov eax, 1
cmovbe di, ax
mov esi, 0x39632fef
pop edi
jmp 0xd31621
push esi
rcl dh, 0x3e
shr edx, cl
bt edx, 0x38
push edi
ror eax, 0x32
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0xd88f3f
pop esi
movsx ebx, bx
mov ebx, 0x73a6233a
jmp 0x42756e
mov ecx, dword [ebp - 0x14]
clc
test cx, 0x155f
jmp 0xd88f34
push dword [ebp - 0x10]
jmp 0xd761e4
mov ecx, dword [eax + edx*4 + 0x10]
jmp 0xd14c0e
mov eax, dword [ebp + 8]
jmp 0xd4d423
call fcn.00d9c80c
mov dword [ebp - 4], eax
jmp 0xda4673
jmp 0xd3b994
jmp 0xd184a4
lea ecx, [ecx - 1]
test esi, eax
cmp edx, ecx
mov dword [ebp - 0x14], ecx
stc
cmp dword [ebp - 0x14], 0
jmp 0xd95df2
jne 0xd2b5c9
sub eax, eax
jmp 0xd7af6e
jl 0xd9c848
mov edx, dword [ebp - 0x14]
not ecx
jmp 0xd5a27a
call dword [ebp - 4]
pop edi
not si
adc dl, 0x3c
pop esi
bts edx, esp
setge dl
bsr edx, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
rol edx, cl
sar edx, 0xed
btr dx, si
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1e4], 0
cmp dword [ebp - 0xc], 0
jmp 0xd1846d
push ebp
mov ebp, esp
test esp, 0x32254c3b
rcr ah, cl
sub esp, 0x18
mov dx, 0x2330
rdtsc
movsx ax, bl
push ebx
movsx edx, bx
movzx edx, di
setb al
push esi
cwd
push edi
sets ah
mov dword [ebp - 0x18], ecx
rdtsc
xchg dx, ax
not dh
mov eax, dword [ebp + 8]
movsx edx, si
cmovae dx, dx
sete cl
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov edx, 0x543c4097
bswap edx
push eax
xchg dh, ch
mov ecx, dword [ebp + 8]
mov ax, 0x314b
mov edx, dword [ecx + 4]
cmovne ax, dx
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
jmp 0xda3f6b
mov ecx, dword [ebp - 0x18]
jmp 0xd671ef
cmp dword [ebp - 4], 0
jmp 0xd91024
Function at 0x32001866
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3205cfc4]
jne 0x32001870
repz ret
jmp fcn.32043968

Function at 0x32014352
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x32014361
pop dword [ebp - 0x10]
mov eax, 0x32014361
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x59f35177
sub dword [ebp - 0x20], 0xba10c2c
mov dword [ebp - 0x1c], 0x7cb66cee
add dword [ebp - 0x1c], 0xb57cdf57
mov dword [ebp - 0x18], 0x1cdf4236
sub dword [ebp - 0x18], 0xd092fe08
mov dword [ebp - 0x14], 0x7e8753c9
sub dword [ebp - 0x14], 0x7e8753c9
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x160ddbdf
add dword [ebp - 0x20], 0x5e648d77
mov dword [ebp - 0x1c], 0xf1942c05
sub dword [ebp - 0x1c], 0xb027ca90
mov dword [ebp - 0x18], 0xdf5781b5
sub dword [ebp - 0x18], 0x7be81549
mov dword [ebp - 0x14], 0x937ee8d1
sub dword [ebp - 0x14], 0x937ee8d1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x2ed84324
sub eax, 0xfcd3b284
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x45027
push 0
call eax
mov ecx, 0x41dd
xor edi, edi
add edi, eax
mov ebx, 0x3206fe00
add ebx, dword [ebp - 0x10]
mov edx, 0x2e5a00c
sub edx, 0x3948f624
mov dword [ebp - 8], 0x9e6a1777
mov esi, dword [ebx]
xor dword [ebp - 8], esi
add esi, edx
add dword [ebp - 4], edi
mov dword [edi], esi
add dword [ebp - 0xc], ecx
add edi, 0x14bc8b2c
add edi, 0xeb4374d8
add ebx, 0x6f249949
add ebx, 0x90db66bb
loop 0x3201446f
add eax, 0xdd22608d
sub eax, 0xdd216646
mov ebx, eax
add eax, 5
mov ecx, 0x32000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x414d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x4d0b90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [0x4d25a4], 0
push 0x4d2648
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
mov ecx, 0x27
mov esi, 0x4d2648
mov edi, 0x4d25a8
rep movsd dword es:[edi], dword [esi]
cmp dword [0x4d26b4], 0x500
jb 0x414d87
cmp dword [0x4d26b8], 0x2d0
jae 0x414da8
push 0
mov ecx, 0x489f1d0
call fcn.00411310
push eax
push 0x4c3938
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004a1801
mov dword [ebp - 0xa8], 0
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x414ddd
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
jmp 0x414db2
mov eax, dword [ebp - 0xa8]
add eax, 1
xor ecx, ecx
mov edx, 0x9c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d9d0
add esp, 4
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
imul ecx, dword [ebp - 0xa8], 0x9c
add ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
je 0x414e50
mov eax, dword [ebp - 0xa8]
add eax, 1
mov dword [ebp - 0xa8], eax
jmp 0x414e1b
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xac], 0
jmp 0x414e75
mov ecx, dword [ebp - 0xac]
add ecx, 1
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
cmp edx, dword [ebp - 0xa8]
jge 0x414f76
imul eax, dword [ebp - 0xac], 0x9c
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + eax + 0x6c], 0x500
jne 0x414f71
imul edx, dword [ebp - 0xac], 0x9c
mov eax, dword [ebp - 0xa4]
cmp dword [eax + edx + 0x70], 0x2d0
jne 0x414f71
imul ecx, dword [ebp - 0xac], 0x9c
mov edx, dword [ebp - 0xa4]
cmp dword [edx + ecx + 0x68], 0x20
jne 0x414f71
push 0x4d2648
imul eax, dword [ebp - 0xac], 0x9c
add eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x414f71
push 2
imul ecx, dword [ebp - 0xac], 0x9c
add ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
test eax, eax
jne 0x414f71
imul esi, dword [ebp - 0xac], 0x9c
add esi, dword [ebp - 0xa4]
mov ecx, 0x27
mov edi, 0x4d2648
rep movsd dword es:[edi], dword [esi]
mov dword [0x4d2644], 1
cmp dword [ebp - 0xa4], 0
je 0x414f6f
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0xb4]
push eax
call fcn.0049d9cb
add esp, 4
mov dword [ebp - 0xa4], 0
jmp 0x414fa4
jmp 0x414e66
cmp dword [ebp - 0xa4], 0
je 0x414fa4
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb8]
push edx
call fcn.0049d9cb
add esp, 4
mov dword [ebp - 0xa4], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d708
mov esp, ebp
pop ebp
ret
Function at 0x43b4c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x4d0b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1b4], ecx
push 0x64
lea eax, [ebp - 0x194]
push eax
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ecx + 0x234]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x19c], 0
mov ecx, 1
imul edx, ecx, 0
mov dword [ebp - 0x1a4], edx
cmp dword [ebp - 0x1a4], 0xc8
jae 0x43b538
jmp 0x43b53d
call fcn.0049dafa
mov eax, dword [ebp - 0x1a4]
mov byte [ebp + eax - 0xcc], 0
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [ebp - 0x1b8]
jge 0x43b650
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x194]
and eax, 0xff
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x81
jl 0x43b58e
cmp dword [ebp - 0x1a0], 0x9f
jle 0x43b5ae
cmp dword [ebp - 0x1a0], 0xe0
jl 0x43b63c
cmp dword [ebp - 0x1a0], 0xfc
jg 0x43b63c
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x198]
mov al, byte [ebp + edx - 0x194]
mov byte [ebp + ecx - 0xcc], al
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x198]
add edx, 1
mov dword [ebp - 0x198], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x198]
mov dl, byte [ebp + ecx - 0x194]
mov byte [ebp + eax - 0xcc], dl
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], ecx
cmp dword [ebp - 0x1a8], 0xc8
jae 0x43b629
jmp 0x43b62e
call fcn.0049dafa
mov edx, dword [ebp - 0x1a8]
mov byte [ebp + edx - 0xcc], 0
mov eax, dword [ebp - 0x198]
add eax, 1
mov dword [ebp - 0x198], eax
jmp 0x43b54b
lea ecx, [ebp - 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x43b663
jmp 0x43b6a4
lea edx, [ebp - 0xcc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x64
jle 0x43b6a4
mov eax, 1
imul ecx, eax, 0x64
mov dword [ebp - 0x1ac], ecx
cmp dword [ebp - 0x1ac], 0xc8
jae 0x43b691
jmp 0x43b696
call fcn.0049dafa
mov edx, dword [ebp - 0x1ac]
mov byte [ebp + edx - 0xcc], 0
mov ecx, 0x4d2930
call fcn.0041f770
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0xcc]
push eax
imul ecx, dword [ebp + 8], 0x3c998
mov edx, dword [ebp - 0x1b0]
lea eax, [edx + ecx + 9]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x43b6d9
jmp 0x43b702
lea ecx, [ebp - 0xcc]
push ecx
imul edx, dword [ebp + 8], 0x3c998
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax + edx + 9]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x4d2930
call fcn.0046e540
mov ecx, dword [ebp - 0x1b4]
call fcn.004392d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d708
mov esp, ebp
pop ebp
ret 4
Function at 0x45fc10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4d0b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ecx
mov eax, dword [0x4c5f44]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x109], 0x61
jmp 0x45fc4c
mov cl, byte [ebp - 0x109]
add cl, 1
mov byte [ebp - 0x109], cl
movsx edx, byte [ebp - 0x109]
cmp edx, 0x7a
jg 0x45fce7
push 5
movzx eax, byte [ebp - 0x109]
push eax
mov ecx, dword [ebp - 0x110]
call fcn.0045fd00
movzx ecx, al
cmp ecx, 1
jne 0x45fce2
mov edx, 1
imul eax, edx, 0
mov cl, byte [ebp - 0x109]
mov byte [ebp + eax - 0x114], cl
push 0
push 0
push 0
push 0
push 0
push 0x104
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x110]
add ecx, 0x38
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0x38]
mov edx, dword [eax + 0xc]
call edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x45fce2
mov al, byte [ebp - 0x109]
jmp 0x45fce9
jmp 0x45fc3d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d708
mov esp, ebp
pop ebp
ret

Function at 0x45fd00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x4c5f48]
mov dword [ebp - 4], eax
mov ecx, 1
imul edx, ecx, 0
mov al, byte [ebp + 8]
mov byte [ebp + edx - 4], al
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, dword [ebp + 0xc]
jne 0x45fd33
mov al, 1
jmp 0x45fd35
xor al, al
mov esp, ebp
pop ebp
ret 8