joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x470004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov dword [ebp - 0x324], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x320], ecx
push edi
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x403369
lea eax, [ebp - 0x314]
push eax
push 0x459520
push 1
push 0
push 0x459550
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x403369
mov eax, dword [ebp - 0x314]
lea edx, [ebp - 0x318]
push edx
push 0x459540
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x40337c
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b44
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x403397
lea eax, [ebp - 0x31c]
push eax
call fcn.00443ce4
add esp, 4
push dword [ebp - 0x31c]
jmp 0x403398
push esi
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test ebx, ebx
je 0x4033b5
mov eax, dword [ebp - 0x314]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test edi, edi
je 0x4033c6
mov eax, dword [ebp - 0x314]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x314]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [ebp - 0x320]
lea eax, [ebp - 0x108]
push dword [ebp - 0x324]
push str._s_s
push eax
call fcn.00404030
add esp, 0x10
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x310]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x318]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x314]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setns al
xor ecx, ebp
pop esi
pop ebx
call fcn.00405b44
mov esp, ebp
pop ebp
ret
Function at 0x40832c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x40834f
or esi, 2
push 1
call edi
test ax, ax
jns 0x40835b
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x408367
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x408373
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x40a2c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x210]
call fcn.00406aa3
mov edi, dword [ebp + 8]
test eax, eax
jle 0x40a31a
push ebx
lea ecx, [esi + 0x210]
mov byte [ebp + 0xb], 0
call fcn.0040de4a
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x40a386
lea ecx, [esi + 0x210]
inc ebx
call fcn.00406aa3
cmp ebx, eax
jl 0x40a2e3
sub edi, 0x100
je 0x40a3ed
sub edi, 4
je 0x40a38a
dec edi
sub edi, 1
jne 0x40a3e4
cmp dword [esi + 0xa0], edi
je 0x40a3e4
push dword [ebp + 0xc]
xor eax, eax
mov word [ebp + 8], ax
call fcn.00445d6d
pop ecx
mov ecx, dword [esi + 0xa0]
lea edx, [ebp + 8]
push 0x80000012
mov byte [ebp + 8], al
push edx
mov eax, dword [ecx]
push 0x40b9ea
call dword [eax + 0x104]
mov esi, eax
test esi, esi
je 0x40a3e4
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf8]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
mov al, 1
jmp 0x40a3e6
mov edx, dword [esi + 0xa4]
test edx, edx
je 0x40a3e4
xor eax, eax
lea edi, [ebp - 0x20]
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0xc], al
mov eax, dword [esi + 0xb4]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xb8]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], eax
call fcn.0040832c
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xa4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x110]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x40a3e4
mov ecx, dword [esi + 0xa4]
test ecx, ecx
je 0x40a446
mov eax, dword [ecx]
call dword [eax + 0xd0]
test al, al
je 0x40a446
mov ecx, dword [esi + 0xa4]
mov eax, dword [ecx]
call dword [eax + 0xdc]
test al, al
je 0x40a446
mov ecx, dword [esi + 0xa4]
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.RichEditUI
push eax
call fcn.00446513
pop ecx
pop ecx
test eax, eax
je 0x40a446
mov ecx, dword [esi + 0xa4]
call fcn.004160b5
test al, al
jne 0x40a3e4
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.0040b45a
jmp 0x40a386
Function at 0x40b0a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x40b0cf
cmp eax, dword [edi + 0x44]
je 0x40b0cf
cmp esi, dword [edi + 0xa4]
je 0x40b0cf
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xa4]
cmp esi, eax
je 0x40b1b9
test eax, eax
je 0x40b138
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x14
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xa4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x110]
push 1
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0xa4]
call fcn.0040ad57
and dword [edi + 0xa4], 0
test esi, esi
je 0x40b1b9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp eax, edi
jne 0x40b1b9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd0]
test al, al
je 0x40b1b9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xdc]
test al, al
je 0x40b1b9
xorps xmm0, xmm0
mov dword [edi + 0xa4], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xa4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x110]
push 1
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0xa4]
call fcn.0040ad57
pop edi
pop esi
leave
ret 8

Function at 0x40ed5d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40ed8f
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4176f6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x444], edi
je 0x417761
cmp dword [ebp + 8], 0x100
jne 0x417750
cmp byte [ebp + 0xc], 0xd
jne 0x417750
cmp byte [esi + 0x44a], 0
je 0x417735
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x417750
cmp byte [esi + 0x44b], 0
jne 0x417750
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41774c
push 1
push edi
push edi
push edi
push str.return
push esi
call fcn.0040ad57
xor eax, eax
jmp 0x417764
mov eax, dword [esi + 0x444]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x417b3e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x470004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x417bdc
mov al, byte [esi]
test al, al
je 0x417bdc
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x417b70
cmp al, 0x5c
jne 0x417b72
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x417b68
cmp edi, esi
je 0x417baf
sub edi, esi
lea eax, [ebp - 0x108]
push edi
push esi
push eax
call fcn.0044642e
add esp, 0xc
cmp edi, 0x104
jae 0x417bea
lea eax, [ebp - 0x108]
mov byte [ebp + edi - 0x108], 0
push eax
push ebx
call fcn.00417b3e
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004499a0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004499b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00405b44
leave
ret
call fcn.00405c76
int3

Function at 0x4180aa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x418126
cmp dword [edi + 4], 0xffffffff
jne 0x418126
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x45ba4c
push esi
call fcn.004499b0
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4180f8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4180f8
mov eax, 0x2000000
jmp 0x41812b
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041a57d
add esp, 0x10
test eax, eax
jne 0x418116
mov eax, dword [ebp - 4]
jmp 0x41812b
push eax
call fcn.0041ac9a
mov dword [edi], eax
mov eax, dword [0x471e38]
pop ecx
jmp 0x41812b
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x41a68a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x41a6bd
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a6b8
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x41a6e7
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0043e5c0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x41a875
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x41a883
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x41a942
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
sub edi, 1
jne 0x41a89b
pop edi
test esi, esi
je 0x41a95e
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x45b318]
inc edx
sub esi, 1
jne 0x41a946
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x41b914
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x180
mov eax, 0x457f89
call fcn.00456899
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0041bcf8
call fcn.00408054
push eax
lea ecx, [ebp - 0x54]
call fcn.0040dc39
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040805a
mov ecx, eax
call fcn.0040e373
test al, al
je 0x41ba21
push ebx
lea ecx, [ebp - 0x54]
call fcn.0040def8
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x54]
call fcn.0040de59
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18c], eax
push edi
cmp eax, 0xffffffff
jne 0x41b992
push str.Error_opening_file
jmp 0x41baf9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x41ba92
cmp edi, 0x400000
ja 0x41baa3
and dword [ebp - 0x184], 0
push edi
call fcn.00405d8e
pop ecx
mov ebx, eax
lea eax, [ebp - 0x184]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x18c]
mov dword [ebp - 0x188], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x184], edi
je 0x41ba0a
push ebx
call fcn.00456907
pop ecx
mov ecx, esi
call fcn.0041bcf8
push 0
push str.Could_not_read_file
jmp 0x41baf9
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0041bb41
push dword [ebp - 0x188]
jmp 0x41bb27
call fcn.0040805a
push eax
lea ecx, [ebp - 0x54]
call fcn.0040debb
call fcn.0040820e
test al, al
je 0x41ba3f
call fcn.00408060
jmp 0x41ba53
push 2
push edi
lea ecx, [ebp - 0x54]
call fcn.0040de59
push eax
call fcn.00418130
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x41ba64
push eax
push str.Error_opening_zip_file
jmp 0x41baf9
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x188]
push eax
push 1
push ebx
push edi
call fcn.00417c74
add esp, 0x14
test eax, eax
je 0x41ba8b
push 0
push str.Could_not_find_ziped_file
jmp 0x41baf9
mov ebx, dword [ebp - 0x58]
test ebx, ebx
jne 0x41ba9b
push 0
push str.File_is_empty
jmp 0x41baf9
cmp ebx, 0x400000
jbe 0x41baac
push 0
push str.File_too_large
jmp 0x41baf9
push ebx
call fcn.00405d8e
push 3
push ebx
push eax
push dword [ebp - 0x188]
mov dword [ebp - 0x184], eax
push edi
call fcn.0041849b
add esp, 0x18
test eax, eax
je 0x41bb04
cmp eax, 0x600
je 0x41bb04
push dword [ebp - 0x184]
call fcn.00456907
pop ecx
call fcn.0040820e
test al, al
jne 0x41baf2
push edi
call fcn.00417aec
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0041bd20
mov bl, al
jmp 0x41bb2f
call fcn.0040820e
test al, al
jne 0x41bb14
push edi
call fcn.00417aec
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x184]
mov ecx, esi
push ebx
push edi
call fcn.0041bb41
push edi
mov bl, al
call fcn.00456907
pop ecx
lea ecx, [ebp - 0x54]
call fcn.0040dd52
mov al, bl
call fcn.00456854
ret 8
Function at 0x425c31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x425c5f
cmp eax, edi
jge 0x425c53
push esi
call fcn.0042212a
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x425c82
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x425c68
mov dword [esi + 8], edx
jmp 0x425c97
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x425c8d
xor dl, dl
jmp 0x425c92
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x425c82
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x425cd1
push str.zlib_corrupt
call fcn.00422055
add esp, 4
jmp 0x425d11
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x425ce1
push str.read_past_buffer
jmp 0x425cc7
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x425cfb
push edi
push ecx
push esi
call fcn.0042874d
add esp, 0xc
test eax, eax
je 0x425d11
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0043e5c0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4378c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x470004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x437951
cmp dword [esi + 0x10], 0
je 0x437951
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
mov eax, edi
call fcn.00456910
mov ebx, esp
test ebx, ebx
je 0x437951
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x15c
call fcn.0040ddee
mov ecx, dword [esi + 0x10]
xor eax, eax
push 1
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x20]
mov ecx, eax
call fcn.0040ad57
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, eax
call fcn.0040821b
test al, al
je 0x437951
mov ecx, dword [esi + 0x10]
call fcn.0040c545
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b44
leave
ret 0x10

Function at 0x43a458
Capabilities:
Hide graphical window

Disassembly:
push 0x5c
mov eax, 0x4588da
call fcn.00456899
mov edi, ecx
mov dword [ebp - 0x58], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x490], ebx
cmp dword [edi + 4], ebx
jne 0x43a4db
lea eax, [ebp - 0x68]
push eax
call fcn.0043a0b1
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0x68]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.0040803b
mov edi, dword [ebp - 0x58]
mov ecx, edi
push eax
call fcn.0040ea0e
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.0041e22a
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov ecx, eax
call fcn.00407c31
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0040e373
lea ecx, [ebp - 0x54]
mov bl, al
call fcn.0040dd52
mov esi, 0x480
test bl, bl
je 0x43a510
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.00456854
ret 4
Function at 0x43d510
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x188
mov eax, 0x458bb8
call fcn.00456899
mov dword [ebp - 0x194], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x188], ebx
call fcn.00408054
push eax
lea ecx, [ebp - 0x54]
call fcn.0040dc39
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040805a
mov ecx, eax
call fcn.0040e373
test al, al
je 0x43d5ef
push ebx
lea ecx, [ebp - 0x54]
call fcn.0040def8
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x54]
call fcn.0040de59
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43d595
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040dd52
jmp 0x43d6c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x43d584
push esi
mov dword [ebp - 0x184], edi
call fcn.00405d8e
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x184]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x184], esi
je 0x43d6b2
push edi
call fcn.00456907
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040dd52
jmp 0x43d6c2
call fcn.0040805a
push eax
lea ecx, [ebp - 0x54]
call fcn.0040debb
call fcn.0040820e
test al, al
je 0x43d60d
call fcn.00408060
jmp 0x43d621
push 2
push edi
lea ecx, [ebp - 0x54]
call fcn.0040de59
push eax
call fcn.00418130
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x43d584
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
push eax
push 1
push dword [ebp - 0x188]
push ebx
call fcn.00417c74
add esp, 0x14
test eax, eax
jne 0x43d584
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x43d584
push esi
call fcn.00405d8e
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x190]
push ebx
call fcn.0041849b
add esp, 0x18
test eax, eax
je 0x43d6a2
cmp eax, 0x600
je 0x43d6a2
push edi
call fcn.00456907
pop ecx
call fcn.0040820e
test al, al
jne 0x43d5de
push ebx
call fcn.00417aec
jmp 0x43d5dd
call fcn.0040820e
test al, al
jne 0x43d6b2
push ebx
call fcn.00417aec
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040dd52
test edi, edi
jne 0x43d736
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp - 0x188]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43d732
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x43d732
push esi
mov dword [ebp - 0x18c], edi
call fcn.00405d8e
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x18c]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18c], esi
je 0x43d72e
push edi
call fcn.00456907
pop ecx
xor edi, edi
test edi, edi
jne 0x43d736
xor eax, eax
jmp 0x43d751
mov ecx, dword [ebp - 0x194]
push esi
push edi
call fcn.0043d759
push 1
push edi
mov esi, eax
call fcn.00405d80
pop ecx
pop ecx
mov eax, esi
call fcn.00456854
ret 4

Function at 0x44df60
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044dddf