joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b10
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push 0x104
push 0x40e8f4
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x104
push 0x40e7f0
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x40e6ec
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x104
push 0x40e9f8
push 0
call esi
mov eax, dword [0x40ed04]
mov edi, dword [sym.imp.MSVCRT.dll__strlwr]
test eax, eax
je 0x402b7c
push 0x104
push 0x40ec00
push eax
call esi
push 0x40ec00
call edi
add esp, 4
push 0x40e9f8
call edi
push 0x40e9f8
call fcn.00402bc0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x40eafc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x402cf0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
je 0x402d98
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push esi
call edi
cmp eax, 0xffffffff
je 0x402d98
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0
push eax
push esi
call fcn.00402c70
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push 0
push str.TEMP
push edx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
lea eax, [esp + 8]
push 1
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileExA]
call esi
push 4
lea ecx, [esp + 0xc]
push 0
push ecx
call esi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x402db0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenProcess]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call fcn.00402be0
add esp, 4
mov esi, eax
push esi
push 0
push 1
call ebx
test eax, eax
je 0x402df4
push 0
push eax
call ebp
test eax, eax
je 0x402df4
test esi, esi
je 0x402dfb
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x402dc4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x45870d
Capabilities:
Encode data using xor

Disassembly:
sti
xchg ebx, eax
sub dword [esi + 0x63], ebx
cmpsb byte [esi], byte es:[edi]
push edx
cmp byte [edx], dh
out dx, eax
sub dword [ebp - 0x37], edx
aad 0x8f
cmp al, 0xb6
mov byte [0xd889b3e1], al
xor byte [ebx - 0x71dd5469], dh
salc
popfd
jno 0x4586f7
adc dword [ecx - 0x7f], ebp
fld qword [ecx + 0x556c0e60]
sbb edx, dword [ecx + 0x6c3e628b]
test byte [edi + 0x35], 0x4f
ja 0x458781
ror dword [ecx], cl
shl byte [esi + eax], 1
call [ecx - 6]
imul eax, dword [edx], 0xfffffffe
push edx
test byte [ebp + 0x62], cl
push ebx
jle 0x4587ba
leave
out 0xec, al
invalid
or edi, dword [ebx]
retf 0xb675
add ebx, dword [ebp - 0x2a]
dec dword [esi]
cmp al, 0x28
and edx, dword [esi - 0x47]
inc bx
test ecx, ebp
mov bl, 0x5e
pop ecx
sbb eax, 0x24fb0af7
into
sti
and al, 0xce
invalid
jmp 0x4587c4
jecxz 0x4587e5
fcom dword [edi + ecx*8 - 0x68]
cwde
mov byte [0x82f49e23], al
jecxz 0x4587f2
jge 0x458791
je 0x4587f0
lcall 0x295c, 0x2a185f80
test dword [edi + 0x43], edx
loop 0x458833
ret
mov dword [0x8a3899a1], eax
invalid
inc ecx
rol byte [0x6c0ded4a], 1
add eax, 0x6c0ded4a
mov eax, 0x6fc77af
or eax, 0xd729bf12
mov dl, 0xaf
inc ebx
shr al, 1
mov cl, 0x1a
scasb al, byte es:[edi]
in al, dx
fstp xword [ecx + 0x292e368f]
add byte [eax + 0x7f1cae8e], ch
dec byte [edi + 0x2d]
sbb ecx, dword [ebx + 0x39]
and byte [edi], cl
mov cl, 0xc9
jnp 0x4587c9
jle 0x4587a6
cmp dh, byte [ebp + 0x297ca2c4]
cdq
or byte [edx + ecx*4 - 3], bh
cmp dword [ebp + 0x74465012], esi
test eax, 0x52943fd
xor al, 0x7d
mov dl, 1
adc dl, byte [eax + 0x46]
je 0x4587e1
std
inc ebx
sub dword [0x1b27d34], eax
mov esi, 0x17b6ea33
sbb ah, ah

Function at 0x458f42
Capabilities:
Encode data using xor

Disassembly:
mov cs, word [ecx + 0x7d62d009]
dec eax
or eax, edx
bound edi, qword [ebp + 0x48]
stc
mov bh, 0x55
imul ebx, dword [ebx], 0x3276ecfc
sar dword [ebx + 0x28], cl
and byte [edx], 0xd4
jb 0x458f7e
popfd
sbb dword [edx + 0x65], edx
mov bl, 0x44
dec esp
aad 0x7d
imul edx, dword [esi], 0x13
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
ret
leave
ja 0x458fdb
pop edx
jg 0x458f80
cmp eax, 0x5ef35c46
jl 0x458fa1
leave
cmp dword [edi - 0x3f], ebp
adc esi, esi
inc ecx
mov al, byte [0x591f4739]
test byte [ecx - 0x60], 0x39
inc edi
pop ds
pop ecx
ljmp 0x1f93:0x56b81a39
mov eax, 0xb3ff1c49
cmp ebp, dword [ecx]
mov bh, byte [eax]
push dword [ebx + 0x388a293b]
leave
inc edi
xor ebx, ecx
xchg esi, eax
mov ch, 4
jl 0x458fa4
push ds
jae 0x458f40
retf 0x9127
aad 0x54
sbb al, 0xa4
movsb byte es:[edi], byte [esi]
add al, byte gs:[eax - 0x19]
mov edx, 0x73cd0657
out 0xef, eax
add ebx, dword [edx - 0x45]
lodsd eax, dword [esi]
xor byte [eax - 0x2fa1251f], cl
or byte [edx + 0x4a622527], cl
loop 0x458f90
loop 0x458fd7
invalid
Function at 0x469874
Capabilities:
Encode data using xor

Disassembly:
aad 0x55
add ecx, ebp
and ebx, edi
dec esi
xor al, 0xd
and al, 0x72
xor eax, 0xad4836db
pop esi
sahf
dec ecx
invalid
les edi, [ebp + 0x48]
je 0x469826
mov edx, 0x95379c0
ror byte [0xbd4e4424], 0xfe
adc bl, dl
jbe 0x4698b2
inc edi
inc ebx
push esp
xchg ebp, eax
and edx, dword [ebx - 0x57]
mov byte [0xabc936b], al
std
push ecx
imul edx, dword [edx], 0x3a418a6e
inc ebx
pop edx
xor al, 0xf1
dec eax
pushal
xchg edx, eax
out dx, eax
dec ecx
push cs
stosb byte es:[edi], al
fisubr dword [ecx + 0x691bc319]
cli
in eax, dx
nop dword [esi]
push ds
lea edx, [esi]
pop ds
pop edi
or al, 0xdb
dec edi
adc ch, byte [ecx - 0x13551623]
push cs
test al, 7
out 0xe8, al
cwde
shr dword [ecx - 0x64], 1
mov eax, 0x8ce1ccaa
wait
jns 0x46992c
push eax
in eax, dx
lodsb al, byte [esi]
lcall 0x930d, 0xdfdf1f39
sbb bh, byte [ecx + edx - 0x3cb5505]
fisttp word [0x11bc1a93]
sti
stosb byte es:[edi], al
xor al, 0xfc
and edx, ebp
dec edx
push 0x3d55728a
dec esp
cmpsd dword [esi], dword es:[edi]
mov edi, 0x45a492dd
sub al, 0x8e
popfd
dec eax
xchg ecx, eax
fstp xword [eax - 0x43e15273]
pop eax
mov eax, 0xee1838d4
pop edx
insd dword es:[edi], dx
cmp dh, al
out dx, eax
js 0x4698d8
outsd dx, dword [esi]
dec esi
mov ebx, 0x9e1e0c8d
into
outsd dx, dword [esi]
mov eax, dword [0x3fadc46a]
jmp 0x7ef464e9
push esi
push edx
or al, 0x89
out dx, al
jg 0x469950
xchg ebp, eax
fld st(2)
dec ebx
daa
and dword [edi - 0x33], esp
test bh, bh
or eax, 0x24c3d8a0
sub esp, esi
pop ss
jno 0x4699a9
push ebx
mov ebp, 0xfee19ee6
test ch, 0x8d
aam 0xda
popal
fcomp dword [ebx + 0x232f4b29]
mov bl, 0x1e
xchg esi, eax
les esp, [esi - 0x48d5983d]
push es
adc al, al
pop ebp
jmp 0x4699e8
outsd dx, dword [esi]
mov ss, word [edx - 0x573780be]
fcom qword [edx - 0x64]
mov bh, byte [0xae1ee8b7]
shld dword [ebp + 0x5f874203], esi, 0x4f
adc dl, dh
push edi
push ds
invalid
jecxz 0x46998c
wait
push ecx
ljmp 0xd75e
pop eax
lahf
dec eax
and dh, byte [ebx]
push 0xc00088d5
fucomi st(0)
ret 0x6095
Function at 0x46d4ac
Capabilities:
Encode data using xor

Disassembly:
iret
popal
sbb esp, dword [eax + eax*2 - 0x48dd983]
inc eax
jge 0x46d4d8
jb 0x46d4af
push esi
mov cl, 0xa6
pop esi
mov al, 0x31
out dx, al
lahf
out dx, eax
sub eax, 0x83c3d07b
pop eax
add eax, 0x87e6b020
push edx
jae 0x46d4af
fld dword [eax - 0x48649815]
fsub st(2), st(0)
jae 0x46d4d8
mov dword [0xa0c425c4], eax
cwde
sub eax, 0x205ca4c0
sub cl, al
movsd dword es:[edi], dword [esi]
les esp, [0x2d98a0c4]
shl byte [esp + ebx*2 - 0x3ed79be0], 0xa5
sbb edi, dword fs:[edi + 0x6b]
jns 0x46d46c
shl byte [esp + eax*8 - 0x85ad1a6], 0x4d
xchg ebx, eax
adc eax, 0x5ac0cd40
xchg byte [ebp - 0x7f3fce32], dl
and byte [ebx], 0xb6
shr al, 3
into
xor eax, eax
add byte [eax - 0x173f49dd], 3
inc eax
jle 0x46d4fc
movsb byte es:[edi], byte [esi]
mov word [eax - 0x5c1f5ef9], ds
shl dword [ebp + 0x74a871ad], 0xa3
jne 0x46d587
stosd dword es:[edi], eax
fisubr word [ebx - 0x67]
sub byte [ebx - 0x3bbf393b], ch
or byte [ebx - 0xb], ah
xchg esp, eax
or al, 0xa9
std
and eax, 0x7b0f31ca
das
jnp 0x46d560
jbe 0x46d57e
xor byte [eax + 0x2d], dh
inc eax
movsb byte es:[edi], byte [esi]
or dh, byte [edx]
out 0xf2, al
fcom dword [ebp + ebp*8 - 0x44]
dec esp
out 0x56, al
mov esi, 0xbc2fc098
fsub st(7), st(0)
je 0x46d52f
ror byte [ebp + 0x6d], 0x25
inc esp
mov bl, 0x24
mov dword [edi - 0x3a], esi
and eax, 0x6b64ad80
add al, 0xe7
and ah, byte [eax + eax*2]
in eax, 0x4f
aas
push ds
add eax, 0xa7a02905
pop eax
push ss
dec ebx
out dx, al
pop esp
sub ch, byte [edi + 0xd]
aad 0x81
cmc
inc ecx
inc ecx
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
sub esi, dword [ebp + ebp*2 - 0x25db9c75]
fbstp tbyte [ebp + 0x71]
insd dword es:[edi], dx
mov esp, dword [ebx + 0x24]
fcmovu st(0), st(7)
jne 0x46d5f7
test dword [esi + eax + 0x6d], esp
push es
insd dword es:[edi], dx
scasb al, byte es:[edi]
lodsb al, byte [esi]
add esi, ebp
push eax
xor ch, byte [ebx]
xor byte [esi - 0x3f], bh
ret 0x6380
pop esi
jmp 0xc821bb8e
loop 0x46d5e4
das
sub dword [eax], esp
push ecx
sub bl, ch
mov dl, dl
invalid

Function at 0x47d10f
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
add byte [ecx + 0x360fce7b], bl
adc al, 0x4c
inc edx
fistp dword [esi + edx*2]
pop edi
lcall 0x989c, 0x5c5bea7a
invalid
Function at 0x4986b1
Capabilities:
Encode data using xor

Disassembly:
push ss
rol dl, cl
inc edi
inc esp
in eax, dx
out dx, eax
loope 0x498727
add eax, 0xc1ae3185
rcr dword [ebx - 0xe], cl
adc al, byte fs:[ebx + 0x27]
inc esi
adc al, 0x79
dec ecx
loope 0x49870b
pop ebx
push esp
mov bl, 0xe5
push ecx
ret 0xf47c
out dx, al
push ss
mov ebp, 0xd9464806
cmp byte [edi - 0x31b198b], bl
rep outsb dx, byte [esi]
std
ljmp 0x8c71
cmp eax, 0xd8640995
sbb dword [ebp + 0x5a964de3], eax
out 0xa8, al
xchg edx, eax
mov cs, word [edx - 0x6bf371e4]
cmp dword [esi + ebx*8], esi
insd dword es:[edi], dx
push ss
xor eax, 0xb0d214f8
xlatb
push es
fsubrp st(4)
daa
sbb ecx, dword [eax]
sub al, 0x18
pop es
clc
xlatb
push ss
dec edi
sbb word [eax - 0x6c], bp
or byte [eax - 0x2af704d8], bl
xchg ebp, eax
cdq
out 0x98, eax
test al, 0x14
mov ebp, 0x5fa816c
pushfd
push esi
xor al, 0x12
xor eax, 0x58ba9a1
mov eax, 0xa80d0908
jp 0x498752
push edx
add dl, byte [ebx + 0x6469e754]
test eax, 0x1720b273
outsd dx, dword [esi]
or al, 0x92
retf 0xbafb

Function at 0x4ba510
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
push str.TCaption2212
push str.TCaption2212
call fcn.00417e10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ba55b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x4c7a9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp fcn.007346ac
Function at 0x4179f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004783a6

Function at 0x417b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x417b15
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x417b54
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x417b50
lea ebx, [ebx]
cmp esi, edx
jae 0x417b54
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x417b40
cmp esi, edx
jb 0x417b59
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41a590
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push 0
mov ebx, ecx
push 0
push 0x1009
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0x28
push 2
push 0x5f92ec
lea esi, [ebx + 0xbc]
push 0
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x3c
push 2
push 0x5f9520
push 1
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f952c
push 2
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push str.:d
push 3
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f931c
push 4
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x8c
push 2
push 0x5fa05c
push 5
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5fa064
push 6
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa070
push 7
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa07c
push 8
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa084
push 9
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa08c
push 0xa
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa094
push 0xb
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa0a0
push 0xc
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa0a8
push 0xd
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fa0b0
push 0xe
mov ecx, esi
call fcn.004701cc
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffdfc
or eax, 0x89
push eax
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x21
push 0x21
push 0x1036
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5f9568
push 0x7dd
mov ecx, ebx
call fcn.00477984
push 1
push 0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
ret
Function at 0x41db40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push 0
mov ebx, ecx
push 0
push 0x1009
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0x28
push 0
push 0x5f92ec
lea esi, [ebx + 0xbc]
push 0
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x3c
push 0
push 0x5f9520
push 1
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 0
push 0x5f952c
push 2
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 0
push str.:d
push 3
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 0
push 0x5f931c
push 4
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x8c
push 2
push 0x5fa05c
push 5
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 0
push 0x5fa6d0
push 6
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6d8
push 7
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6dc
push 8
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6e0
push 9
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6e4
push 0xa
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6ec
push 0xb
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6f4
push 0xc
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa6fc
push 0xd
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 0
push 0x5fa704
push 0xe
mov ecx, esi
call fcn.004701cc
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffdfc
or eax, 0x89
push eax
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x21
push 0x21
push 0x1036
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5f9568
push 0x8ae
mov ecx, ebx
call fcn.00477984
pop esi
pop ebx
ret
Function at 0x4307f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push 0
mov ebx, ecx
push 0
push 0x1009
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0x28
push 2
push 0x5f92ec
lea esi, [ebx + 0xbc]
push 0
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x3c
push 2
push 0x5f9520
push 1
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f952c
push 2
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push str.:d
push 3
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f931c
push 4
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x8c
push 2
push 0x5fa05c
push 5
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5fa6d0
push 6
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb04
push 7
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb0c
push 8
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb14
push 9
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb1c
push 0xa
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb24
push 0xb
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb2c
push 0xc
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb34
push 0xd
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb3c
push 0xe
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb44
push 0xf
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb4c
push 0x10
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fcb54
push 0x11
mov ecx, esi
call fcn.004701cc
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffdfc
or eax, 0x89
push eax
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x21
push 0x21
push 0x1036
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5f9568
push 0x972
mov ecx, ebx
call fcn.00477984
push 1
push 0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
ret
Function at 0x432d80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push 0
mov ebx, ecx
push 0
push 0x1009
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0x28
push 2
push 0x5f92ec
lea esi, [ebx + 0xbc]
push 0
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x3c
push 2
push 0x5f9520
push 1
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f952c
push 2
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push str.:d
push 3
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5f931c
push 4
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x8c
push 2
push 0x5fa05c
push 5
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x64
push 2
push 0x5fa6d0
push 6
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0a8
push 7
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0b4
push 8
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0bc
push 9
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0c8
push 0xa
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0d0
push 0xb
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0d8
push 0xc
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0e0
push 0xd
mov ecx, esi
call fcn.004701cc
push 0xffffffffffffffff
push 0x50
push 2
push 0x5fd0e8
push 0xe
mov ecx, esi
call fcn.004701cc
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffdfc
or eax, 0x89
push eax
push 0xfffffffffffffff0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x21
push 0x21
push 0x1036
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5f9568
push 0xa54
mov ecx, ebx
call fcn.00477984
push 1
push 0
push dword [ebx + 0xdc]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
ret
Function at 0x444c70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4357
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x628040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea ecx, [ebx + 4]
mov dword [ebx], vtable.CServerListData.0
mov dword [ecx], vtable.CMap_unsigned_short_int__unsigned_short_int__class_CGameTypeItem___class_CGameTypeItem___.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x11
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0xa
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], vtable.CMap_unsigned_short_int__unsigned_short_int__class_CGameKindItem___class_CGameKindItem___.0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0x11
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0xa
mov dword [ebx + 0x3c], vtable.CMap_unsigned_short_int__unsigned_short_int__class_CGameServerItem___class_CGameServerItem___.0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0x11
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0xa
mov dword [ebx + 0x58], vtable.CMap_unsigned_short_int__unsigned_short_int__class_CAgentGameKindItem___class_CAgentGameKindItem___.0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0x11
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0xa
mov dword [ebx + 0x74], vtable.CWHArray_class_CGameListItem___class_CGameListItem__const_const__.0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
push ecx
mov byte [ebp - 4], 4
push 0xb
mov dword [ebx + 0x88], 0
call fcn.00426420
push ecx
push 0x35
lea ecx, [ebx + 0x20]
call fcn.00426420
push ecx
push 0x3f1
lea ecx, [ebx + 0x3c]
call fcn.00426420
mov eax, dword [0x634c48]
test eax, eax
cmove eax, ebx
mov dword [0x634c48], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret