joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ef44
Capabilities:
Create directory
Delete directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0
jne 0x44ef6b
push 0
push 0
push dword [edi]
push 0
call fcn.00479438
jmp 0x44f07b
push 0
push 0x104
push ebx
push 1
push edi
call fcn.004e648f
test eax, eax
jge 0x44ef91
push 3
push 0
push dword [edi]
push 0
call fcn.00479438
jmp 0x44f07b
push ebx
call fcn.0042e725
push ebx
push ebx
call fcn.0042cf68
test eax, eax
jne 0x44efb4
push 3
push 0
push dword [edi]
push 0
call fcn.00479438
jmp 0x44f07b
cmp dword [ebp + 0x14], 0
jne 0x44effa
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 2
push ebx
call fcn.0042cbc2
test eax, eax
je 0x44efd8
mov eax, 1
jmp 0x44f07b
push ebx
push 0
push 0x348
call fcn.0042c771
push eax
push 0x5803c4
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
jmp 0x44f07b
mov byte [esi], 0
push esi
push 0x180
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.0054e28c
pop ecx
test eax, eax
jle 0x44f045
cmp byte [esi + eax - 1], 0x5c
jne 0x44f01f
mov byte [esi + eax - 1], 0
push ebx
push esi
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x44f045
push 0x5c
push esi
call fcn.0054e574
add esp, 8
test eax, eax
je 0x44f045
mov byte [eax], 0
push esi
call sub.KERNEL32.dll_SetCurrentDirectoryA
push ebx
call sub.KERNEL32.dll_RemoveDirectoryA
push 2
push ebx
call fcn.0042cbc2
test eax, eax
jne 0x44f05e
mov eax, 1
jmp 0x44f07b
push ebx
push 0
push 0x349
call fcn.0042c771
push eax
push 0x5803c4
call sub.USER32.dll_wsprintfA
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4525e1
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], 0
jne 0x45260e
push 0
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push 0
push 0x104
push ebx
push 1
push esi
call fcn.004e648f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x452639
push 3
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push ebx
push ebx
call fcn.0042cf68
test eax, eax
jne 0x452656
push 3
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push 1
push ebx
call fcn.0042cbc2
test eax, eax
jne 0x452673
push 1
push ebx
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push 0
push 0x104
push edi
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
call fcn.004e648f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4526a1
push 3
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push edi
push edi
call fcn.0042cf68
test eax, eax
jne 0x4526bb
push 3
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x45272c
push edi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
je 0x45270e
cmp dword [ebp + 0x18], 0
je 0x452707
push edi
push ebx
push 0
push 0x395
call fcn.0042c771
push eax
lea edx, [ebp - 0x3ec]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor ecx, ecx
mov dword [0x56cd18], ecx
push dword [0x5618e8]
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 8]
call fcn.004f0245
mov eax, 1
jmp 0x45272c
push edi
push ebx
push 0
push 0x396
call fcn.0042c771
push eax
push 0x5803c4
call sub.USER32.dll_wsprintfA
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x452735
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x45274d
cmp dword [ebx + 8], 0
jne 0x45275f
push 0
push 0
push dword [ebx]
push 0
call fcn.00479438
jmp 0x452912
push dword [ebx + 4]
call fcn.0054e28c
pop ecx
cmp eax, 0x5a
jbe 0x452774
mov eax, dword [ebx + 4]
mov byte [eax + 0x5a], 0
push dword [ebp + 0x14]
push dword [ebx + 4]
call fcn.00412c63
mov esi, eax
test esi, esi
jne 0x452797
push 7
push 0
push dword [ebx]
push 0
call fcn.00479438
jmp 0x452912
cmp dword [esi + 0x6bc], 9
je 0x4527b2
push 7
push 0
push dword [ebx]
push 0
call fcn.00479438
jmp 0x452912
push dword [ebx + 8]
call fcn.0054e28c
pop ecx
cmp eax, 0x5a
jbe 0x4527c7
mov eax, dword [ebx + 8]
mov byte [eax + 0x5a], 0
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x4527db
push eax
call fcn.0054e28c
pop ecx
cmp eax, 1
ja 0x4527ed
push 3
push 0
push dword [ebx]
push 0
call fcn.00479438
jmp 0x452912
push dword [ebp + 0x14]
push dword [ebx + 8]
call fcn.00412c63
test eax, eax
je 0x45282b
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0054e450
add esp, 8
test eax, eax
je 0x45282b
push 6
push 0
push 0
push 0x397
call fcn.0042c771
push eax
push 0
call fcn.00479438
jmp 0x452912
lea edx, [esi + 8]
mov ecx, dword [ebx + 8]
push esi
push edi
mov esi, edx
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
lea eax, [esi + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov esi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x4528c0
mov byte [edi], 0
push ebx
push edi
push 3
call fcn.004e56b5
cmp byte [edi], 0
je 0x4528ed
push 0x562879
push dword [ebp + 0xc]
call fcn.0054e1b0
add esp, 8
push edi
push dword [ebp + 0xc]
call fcn.0054e1b0
add esp, 8
push 0xf
push dword [ebp + 0xc]
call fcn.0050e7f8
jmp 0x4528ed
push 0x104
push edi
push dword [esi]
call sub.USER32.dll_GetWindowTextA
cmp byte [edi], 0
je 0x4528ed
push 0x20
push edi
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4528ed
push eax
push dword [ebp + 0xc]
call fcn.0054e1b0
add esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [esi + 0x700], 0
je 0x4528ff
cmp byte [eax], 0x40
jne 0x4528ff
inc eax
push eax
push dword [esi]
call sub.USER32.dll_SetWindowTextA
push esi
call fcn.004172e2
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x455108
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x56f018
mov eax, dword [ebx + 4]
test eax, eax
je 0x4552c2
cmp byte [eax], 0x2d
jne 0x4552c2
push 0x6f
push eax
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x455144
push 1
push dword [esi]
call fcn.0051fec8
jmp 0x45515e
push 0x70
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x45515e
push 0
push dword [esi]
call fcn.0051fec8
push 0x6e
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4551bc
mov ebx, dword [0x55f828]
xor eax, eax
mov dword [0x55f828], eax
mov edi, dword [0x55f820]
xor eax, eax
mov dword [0x55f820], eax
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
cmp dword [0x55f824], 0
je 0x4551ab
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
mov dword [0x55f828], ebx
mov dword [0x55f820], edi
jmp 0x4552c2
push 0x78
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4551f7
push 2
call fcn.0041b199
push 3
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x4552c2
push 0x73
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x455232
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x4552c2
push 0x72
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x455273
push 2
call fcn.0041b199
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push 9
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x4552c2
push 0x74
push dword [ebx + 4]
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x4552c2
mov ebx, dword [0x55f828]
mov dword [0x55f828], 1
cmp dword [0x55f820], 0
je 0x4552b3
push 1
call fcn.0041b199
test eax, eax
je 0x4552b3
push 0
push dword [esi]
call sub.USER32.dll_ShowWindow
jmp 0x4552bc
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
mov dword [0x55f828], ebx
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45632c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
jne 0x456363
mov byte [0x585a40], 0
push dword [0x56f018]
call fcn.004899ff
test eax, eax
jne 0x456359
call fcn.0042d118
mov eax, 1
jmp 0x4564bd
mov eax, dword [esi + 4]
cmp byte [eax], 0x40
jne 0x45642f
push dword [ebp + 0x14]
push eax
call fcn.00412c63
mov edi, eax
test edi, edi
jne 0x456390
push 7
push 0
push dword [esi]
push 0
call fcn.00479438
jmp 0x4564bd
lea eax, [edi + 8]
cmp dword [edi + 0x700], 0
je 0x45639d
inc eax
push eax
push 0x562b89
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push esi
push ebx
push 2
call fcn.004e56b5
push 0xf
push ebx
call fcn.0050e7f8
push 0xa
push ebx
call fcn.0050eaac
push 0xd
push ebx
call fcn.0050eaac
push dword [edi]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
push ebx
call fcn.0054e28c
pop ecx
cmp esi, eax
jne 0x45641d
push 0x3b5
push dword [ebp + 0x10]
push dword [edi]
call sub.USER32.dll_GetWindowTextA
mov eax, ebx
mov edx, dword [ebp + 0x10]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x45641d
test cl, cl
je 0x456411
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x45641d
add eax, 2
add edx, 2
test cl, cl
jne 0x4563f5
jne 0x45641d
mov eax, 1
jmp 0x4564bd
push ebx
push dword [edi]
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x4564bd
push 0x562b8e
push dword [esi + 4]
call fcn.0054e450
add esp, 8
test eax, eax
jne 0x45644a
mov eax, 2
jmp 0x45644f
mov eax, 1
cmp dword [esi + eax*4], 0
je 0x45649d
mov byte [ebx], 0
push esi
push ebx
push eax
call fcn.004e56b5
mov byte [ebx + 0xfa], 0
push 0xa
push ebx
call fcn.0050eaac
push 0xd
push ebx
call fcn.0050eaac
mov esi, 0x585a40
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4564a4
mov byte [0x585a40], 0
push dword [0x56f018]
call fcn.004899ff
test eax, eax
jne 0x4564b8
call fcn.0042d118
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x458f16
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.0041261f
test eax, eax
je 0x4591db
push dword [ebx]
call fcn.0051fafa
mov esi, eax
test esi, esi
je 0x4591db
mov edi, dword [ebx + 0x438]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x458f92
test al, 1
je 0x458f57
push ebx
push 0
call fcn.00458a4e
test byte [ebx + 0x14], 2
je 0x458f63
push ebx
call fcn.0050689d
test byte [ebx + 0x14], 4
je 0x458f6f
push ebx
call fcn.005068ef
test byte [ebx + 0x14], 8
je 0x458f8d
cmp dword [0x56c228], 0
je 0x458f8d
cmp dword [0x56c238], 0
je 0x458f8d
push ebx
call fcn.00506d1c
xor edx, edx
mov dword [ebx + 0x14], edx
cmp dword [ebp + 8], 0
jne 0x458fde
cmp dword [ebx + 0xc], 0
jne 0x458fa4
push ebx
call fcn.00506d1c
push 0x11
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
jne 0x458fc2
push ebx
call fcn.0050689d
push 0x10
call sub.USER32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
je 0x458fde
push ebx
call fcn.005068ef
push ebx
push 0
call fcn.0045931f
cmp dword [0x56f7e4], 0
jne 0x45902c
push ebx
push 1
call fcn.004591e2
cmp dword [esi + 0x684], 0
je 0x45900d
push dword [0x5618e8]
push dword [ebx]
call fcn.004ef455
push dword [0x5618e8]
push 0
push 0x5dd
call fcn.0042c771
push eax
push dword [ebx]
call fcn.004f0245
jmp 0x4591db
cmp byte [ebx + 0x994], 0
je 0x45905a
cmp byte [ebx + 0x9f8], 0
je 0x45905a
cmp byte [ebx + 0xa5c], 0
je 0x45905a
cmp byte [ebx + 0xb90], 0
je 0x45905a
cmp word [ebx + 0xd20], 0
ja 0x45908c
push ebx
push 1
call fcn.004591e2
push 0
call fcn.0042c6cc
mov dword [0x56c330], 1
push 0
push 0x67
push 0x111
push dword [0x56f018]
call sub.USER32.dll_PostMessageA
jmp 0x4591db
test edi, edi
je 0x4590e0
mov dword [ebx + 0x434], 1
cmp dword [ebx + 0x430], 2
jge 0x4590ad
mov dword [ebx + 0x430], 2
movzx edx, word [ebx + 0xd20]
push edx
lea ecx, [ebx + 0xb90]
push ecx
mov eax, dword [ebx + 0x430]
dec eax
push eax
push 0
push 0x5e3
call fcn.0042c771
push eax
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x459153
mov dword [ebx + 0x430], 1
mov dword [ebx + 0x434], 1
movzx edx, word [ebx + 0xd20]
push edx
lea ecx, [ebx + 0xb90]
push ecx
push 0
push 0x5e2
call fcn.0042c771
push eax
push 0x579f7a
call sub.USER32.dll_wsprintfA
add esp, 0x10
cmp dword [ebx + 0x98c], 0
je 0x45913b
push 0x2e
lea eax, [ebx + 0xb90]
push eax
call fcn.0054e1ec
add esp, 8
test eax, eax
jne 0x459153
cmp dword [0x56c228], 0
je 0x459153
cmp dword [0x56c238], 0
je 0x459153
push ebx
call fcn.00506d1c
lea edx, [ebx + 0xb90]
push edx
push 0x64
lea ecx, [ebx + 0xd22]
push ecx
call fcn.0042e5e3
cmp dword [esi + 0x684], 0
je 0x45917e
push dword [0x5618e8]
push dword [ebx]
call fcn.004ef455
xor eax, eax
mov dword [0x56cd18], eax
mov dword [0x56cd28], 1
push dword [0x5618e8]
push 0x579f7a
push dword [ebx]
call fcn.004ef55b
push dword [0x5618e8]
push dword [ebx]
call fcn.004ef455
push ebx
call fcn.0049689c
push 1
call fcn.00412ac8
cmp dword [ebx + 0x514], 0
jne 0x4591d5
cmp dword [0x56c210], 0
jne 0x4591d5
push ebx
call fcn.00527555
jmp 0x4591db
push ebx
call fcn.005278e4
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45a9dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
push 0x563088
push dword [ebp + 8]
call fcn.00551b7c
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45aa02
xor eax, eax
jmp 0x45aa79
push dword [ebp - 4]
push pe_nt_image_headers32
push 1
push 0x57f8c8
call fcn.00551e44
add esp, 0x10
mov esi, eax
test esi, esi
jbe 0x45aa56
xor edx, edx
mov eax, 0x57f8c8
cmp esi, edx
jbe 0x45aa4e
mov ecx, ebx
xor cl, byte [eax]
and ecx, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x562c88]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
inc eax
cmp esi, edx
ja 0x45aa2a
cmp esi, 0x200
jae 0x45aa02
mov eax, dword [ebp - 4]
test byte [eax + 0x12], 0x10
je 0x45aa6c
push dword [ebp - 4]
call fcn.005516ec
pop ecx
xor eax, eax
jmp 0x45aa79
push dword [ebp - 4]
call fcn.005516ec
pop ecx
not ebx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x45d7ba
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xfe8]
test eax, eax
je 0x45d7e2
cmp edx, dword [eax + 8]
je 0x45d7e2
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x45d7d6
test eax, eax
jne 0x45d7ed
xor eax, eax
jmp 0x45d9e4
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x45d7fe
mov eax, 1
jmp 0x45d9e4
push ebx
call sub.USER32.dll_IsWindowEnabled
test eax, eax
jne 0x45d81f
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x45d9e4
push ebx
push esi
call fcn.0045d661
test eax, eax
jne 0x45d841
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x45d9e4
lea edx, [ebp - 0x3f0]
push edx
push 0x3e7
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
cmp byte [ebp - 0x3f0], 0
je 0x45d972
push dword [esi + 0xc8]
call sub.USER32.dll_GetDC
mov edi, eax
test edi, edi
jne 0x45d87d
mov eax, 1
jmp 0x45d9e4
push 0
push 0
push 0x31
push dword [esi + 0xc8]
call sub.USER32.dll_SendMessageA
lea edx, [ebp - 0x42c]
push edx
push 0x3c
push eax
call sub.GDI32.dll_GetObjectA
test eax, eax
jne 0x45d8b7
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x45d9e4
mov byte [ebp - 0x417], 1
lea edx, [ebp - 0x42c]
push edx
call sub.GDI32.dll_CreateFontIndirectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45d8e9
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x45d9e4
push dword [ebp - 8]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
lea edx, [ebp - 0x43c]
push edx
push ebx
call sub.USER32.dll_GetWindowRect
push 2
lea ecx, [ebp - 0x43c]
push ecx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
cmp byte [ebp - 0x3f0], 0
je 0x45d953
push esi
push edi
lea esi, [ebp - 0x43c]
lea edi, [ebp - 0x44c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x2c10
lea eax, [ebp - 0x44c]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0x3f0]
push edx
push edi
call sub.USER32.dll_DrawTextA
push dword [ebp - 4]
push edi
call sub.GDI32.dll_SelectObject
push dword [ebp - 8]
call sub.GDI32.dll_DeleteObject
push edi
push dword [esi + 0xc8]
call sub.USER32.dll_ReleaseDC
jmp 0x45d9b3
lea ecx, [ebp - 0x44c]
push ecx
push ebx
call sub.USER32.dll_GetWindowRect
push 2
lea eax, [ebp - 0x44c]
push eax
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
mov edx, dword [ebp - 0x44c]
add edx, 0xa
mov dword [ebp - 0x444], edx
mov ecx, dword [ebp - 0x448]
add ecx, 0xa
mov dword [ebp - 0x440], ecx
push dword [ebp + 0x10]
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
push 1
lea eax, [ebp - 0x44c]
push eax
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45dcbe
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx edx, ax
mov dword [ebp - 0xc], edx
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 0xfe8]
test ebx, ebx
je 0x45de8b
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x20], eax
xor edx, edx
mov dword [ebx + 0x1c], edx
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x45de80
push esi
call sub.USER32.dll_IsWindowEnabled
test eax, eax
je 0x45de80
push esi
push edi
call fcn.0045d661
test eax, eax
je 0x45de80
lea eax, [ebp - 0x408]
push eax
push esi
call sub.USER32.dll_GetWindowRect
push 2
lea edx, [ebp - 0x408]
push edx
push dword [edi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x408]
push eax
call sub.USER32.dll_PtInRect
test eax, eax
je 0x45de80
push 0
push 0
push 0x31
push dword [edi + 0xc8]
call sub.USER32.dll_SendMessageA
mov esi, eax
test esi, esi
je 0x45dde6
push dword [edi + 0xc8]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45dde6
push esi
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
mov esi, eax
lea eax, [ebp - 0x3f8]
push eax
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 0x2c10
lea edx, [ebp - 0x408]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x3f8]
push ecx
push dword [ebp - 0x10]
call sub.USER32.dll_DrawTextA
push esi
push dword [ebp - 0x10]
call sub.GDI32.dll_SelectObject
push dword [ebp - 0x10]
push dword [edi + 0xc8]
call sub.USER32.dll_ReleaseDC
push dword [ebp - 8]
push dword [ebp - 0xc]
lea edx, [ebp - 0x408]
push edx
call sub.USER32.dll_PtInRect
test eax, eax
je 0x45de80
cmp dword [0x56336c], 0
jne 0x45de1a
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
mov dword [0x56336c], eax
cmp dword [0x56336c], 0
jne 0x45de35
push 0x32
push dword [0x56f014]
call sub.USER32.dll_LoadCursorA
mov dword [0x56336c], eax
mov eax, dword [0x56336c]
test eax, eax
je 0x45de80
push eax
call sub.USER32.dll_SetCursor
cmp dword [0x563370], 0
jne 0x45de52
mov dword [0x563370], eax
mov dword [ebp - 4], 1
mov dword [ebx + 0x1c], 1
cmp dword [edi + 0xfec], 0
jne 0x45de80
push 0
push 0x32
push 0x7d
push dword [edi + 0xc8]
call sub.USER32.dll_SetTimer
mov dword [edi + 0xfec], eax
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45dcf6
mov eax, dword [0x563370]
test eax, eax
je 0x45deb0
cmp dword [ebp - 4], 0
jne 0x45deb0
push eax
call sub.USER32.dll_SetCursor
xor edx, edx
mov dword [0x563370], edx
xor ecx, ecx
mov dword [0x56336c], ecx
mov ebx, dword [edi + 0xfe8]
test ebx, ebx
je 0x45dec9
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
jne 0x45dec9
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45deba
test ebx, ebx
je 0x45ded8
push dword [edi + 0xc8]
call fcn.0045d9ed
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45e742
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x45e832
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfdc]
je 0x45e827
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov edi, eax
push edi
push esi
call fcn.0045e1ff
test eax, eax
jne 0x45e78b
push edi
push esi
call fcn.0045d69f
test eax, eax
je 0x45e7cd
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowRect
sub dword [ebp - 0x10], 2
sub dword [ebp - 0xc], 2
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 2
lea edx, [ebp - 0x10]
push edx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push 1
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
jmp 0x45e7d7
push 0
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x45e827
push 0x588f74
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 0x26
push 0x588f74
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x45e827
mov byte [eax], 1
push 0x588f74
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45e75c
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x45e8e5
mov eax, dword [ebx + 0x10]
cmp eax, dword [esi + 0xfdc]
jne 0x45e8da
push dword [ebx + 0xc]
call sub.USER32.dll_GetDlgCtrlID
mov edi, eax
cmp dword [ebx + 0x1c], 0
je 0x45e88a
push edi
push esi
call fcn.0045e1ff
test eax, eax
jne 0x45e88a
push edi
push esi
call fcn.0045d69f
test eax, eax
jne 0x45e88a
push 8
push dword [ebx + 0xc]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x45e8da
push 0x588f74
push 0x3e7
push 0xd
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
push 1
push 0x588f74
call fcn.0054e1ec
add esp, 8
test eax, eax
je 0x45e8da
mov byte [eax], 0x26
push 0x588f74
push 0
push 0xc
push dword [ebx + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x45e84b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4