joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442ac0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x442ae2
call fcn.00442e08
test eax, eax
jne 0x442ae2
push str.Cant_open_clipboard_for_writing.
jmp 0x442b6f
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x442afb
push ebx
mov ecx, esi
call fcn.00442a74
push 0x4587dc
jmp 0x442b6f
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x442b3f
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x442b4d
cmp byte [eax], bl
jne 0x442b1e
cmp dword [ebp + 8], 0xd
jne 0x442b18
cmp byte [eax + 1], bl
jne 0x442b1e
mov byte [ebp - 1], 1
jmp 0x442b21
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x442b4d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.00442a74
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x442b62
mov dword [esi + 4], ebx
jmp 0x442b3f
push ebx
mov ecx, esi
call fcn.00442a74
push 0x4587c8
mov ecx, esi
call fcn.00442a22
jmp 0x442b47

Function at 0x442ccb
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xc000
jb 0x442d80
cmp ebx, 0xffff
ja 0x442d80
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x108]
push str.Link_Source
push eax
call fcn.00441854
add esp, 0xc
test eax, eax
je 0x442d79
lea eax, [ebp - 0x108]
push str.ObjectLink
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x442d79
lea eax, [ebp - 0x108]
push str.OwnerLink
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x442d79
lea eax, [ebp - 0x108]
push str.Native
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x442d79
lea eax, [ebp - 0x108]
push str.Embed_Source
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
jne 0x442d87
xor eax, eax
jmp 0x442e03
mov byte [ebp - 0x108], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
jmp 0x442df6
cmp ebx, 0xf
je 0x442dff
lea eax, [ebp - 0x108]
push str.OwnerLink
push eax
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x442dff
mov eax, dword [0x463064]
cmp eax, 0xffffffff
je 0x442dda
test eax, eax
je 0x442dff
call edi
mov ecx, dword [0x463064]
mov edx, dword [ebp + 8]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x442dff
push 1
push 0x8000012f
mov byte [0x463069], 0
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
push ebx
call esi
test eax, eax
je 0x442d9c
jmp 0x442e01
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x442e08
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x442e16
xor eax, eax
inc eax
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
jmp 0x442e66
mov eax, dword [0x463064]
cmp eax, 0xffffffff
je 0x442e4a
test eax, eax
je 0x442e7a
call esi
mov ecx, dword [0x463064]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x442e7a
push 1
push 0x8000012f
mov byte [0x463069], 0
call fcn.0040b5c4
pop ecx
pop ecx
mov byte [0x463069], 1
push dword [0x465208]
call edi
test eax, eax
je 0x442e2b
xor eax, eax
inc eax
mov dword [ebx + 0x18], eax
jmp 0x442e7c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4431bb
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
jmp 0x4431c6
mov esi, dword [esi + 4]
cmp byte [esi + 0xf], 0
je 0x4431c3
mov edi, dword [esp + 0x14]
cmp byte [edi + 0xf], 0
jne 0x4431d9
mov edi, dword [edi + 4]
xor ebx, ebx
inc ebx
cmp byte [esi + 0xf], bl
jne 0x443212
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x44320e
push ebx
push 0
push dword [edi + 4]
mov ecx, esi
push 0
call fcn.00401592
test eax, eax
je 0x44325e
mov eax, dword [edi + 4]
inc eax
push eax
push dword [edi]
push dword [esi]
call fcn.00455650
add esp, 0xc
or byte [esi + 0xd], bl
mov eax, ebx
jmp 0x44325e
mov ecx, 0x466180
call fcn.00442e08
test eax, eax
jne 0x443236
push 0x4585d8
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x465c88
call fcn.0044a7cd
jmp 0x44325e
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi]
mov eax, dword [edi + 4]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x443269
push 0
mov ecx, 0x466180
call fcn.00442a74
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x443251
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x443251
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x443251
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4432ce
test ebx, ebx
je 0x4432b8
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4432f3
push ebx
push esi
push eax
call fcn.00455650
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x443265
jmp 0x443251
push 0
mov ecx, 0x466180
call fcn.00442a74
push 0x4585d8
push str.Out_of_memory.
mov ecx, 0x465c88
call fcn.0044a7cd
jmp 0x44325d
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
mov ecx, 0x466180
call fcn.00442a74
push 0x4585d8
push 0x458750
jmp 0x4432e4
Function at 0x443312
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.0044418e
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x44350d
test al, al
push esi
jne 0x443363
cmp byte [esp + 0x34], al
jne 0x443363
push 0x465130
xor esi, esi
push esi
push esi
push 0x44431c
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x4663b8], eax
je 0x4433fa
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x465130]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x44339e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x44337d
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x443404
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x443435
cmp dword [esp + 0x24], esi
je 0x443464
mov byte [esp + 0x13], 1
call fcn.0044418e
test al, al
jne 0x443464
cmp byte [esp + 0x40], al
jne 0x4434e0
mov byte [esp + 0x3c], al
jmp 0x4433af
call fcn.0044411b
jmp 0x44350c
cmp byte [esp + 0x40], 0
je 0x443418
call fcn.0044418e
xor esi, esi
test al, al
je 0x443464
jmp 0x443435
lea eax, [esp + 0x14]
push eax
push dword [0x4663b8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x44344e
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x443464
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4433af
push dword [0x4663b8]
call ebx
and dword [0x4663b8], 0
call fcn.0044411b
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x4434d9
cmp dword [0x465338], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x443490
test byte [esp + 0x12], 1
jne 0x4434a5
push str.AHK_Keybd
push esi
push esi
call edi
mov dword [0x466394], eax
jmp 0x4434a5
test byte [esp + 0x12], 1
je 0x4434a5
push dword [0x466394]
call ebx
mov dword [0x466394], esi
cmp dword [0x46533c], esi
je 0x4434c4
test byte [esp + 0x12], 2
jne 0x4434d9
push str.AHK_Mouse
push esi
push esi
call edi
mov dword [0x466398], eax
jmp 0x4434d9
test byte [esp + 0x12], 2
je 0x4434d9
push dword [0x466398]
call ebx
mov dword [0x466398], esi
cmp byte [esp + 0x13], 0
je 0x443509
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x459a88
mov byte [0x463069], 0
call fcn.0043b5df
add esp, 0x18
mov byte [0x463069], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4444af
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x4444b9
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4444ce
cmp byte [esp + 0xc], 0x10
jne 0x444523
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x444523
cmp byte [0x466387], cl
je 0x4444f1
call fcn.00444104
test al, al
jne 0x4444f1
mov byte [0x466387], cl
xor al, al
pop esi
ret
cmp byte [0x466381], cl
je 0x444523
xor eax, eax
mov ax, word [0x466384]
push eax
xor eax, eax
mov al, byte [0x466386]
push eax
call fcn.0044444b
add esp, 8
test al, al
je 0x444523
call esi
sub eax, dword [0x46637c]
cmp eax, 0x16
jb 0x4444ed
call esi
mov dword [0x46635c], eax
mov al, 1
pop esi
ret
Function at 0x4463ff
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x466380], 0
je 0x44647a
mov al, byte [0x466386]
cmp al, 0xa0
je 0x446418
cmp al, 0x10
jne 0x44647a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x46637c]
cmp eax, 0x16
jae 0x44647a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044444b
add esp, 8
cmp byte [0x466381], 0
jne 0x446452
call fcn.00444104
test al, al
je 0x44647a
mov byte [0x466387], 1
jmp 0x44645c
cmp byte [ebp + 0x14], 0
jne 0x446445
test al, al
je 0x44647a
mov al, byte [0x466378]
mov byte [0x465226], al
mov al, byte [0x466377]
mov byte [0x465238], al
mov al, byte [0x466376]
mov byte [0x4652c8], al
mov al, byte [0x465226]
mov ecx, dword [0x4663a8]
mov byte [0x466378], al
mov al, byte [0x465238]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x466377], al
mov al, byte [0x4652c8]
mov byte [0x466376], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x4465c4
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004444af
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x44656a
cmp byte [ebp + 0x18], 0
jne 0x4464fc
mov cl, bl
not cl
and byte [0x465224], cl
cmp byte [ebp + 0xb], 0
je 0x4464fc
and byte [0x465225], cl
test al, al
je 0x4465c4
not bl
and byte [0x465226], bl
sub esi, 0xa0
mov byte [esi + 0x4652c8], 0
je 0x446563
dec esi
je 0x446557
dec esi
je 0x44654b
dec esi
je 0x446544
dec esi
je 0x446535
dec esi
jne 0x4465c4
mov al, byte [0x4652cc]
jmp 0x44653a
mov al, byte [0x4652cd]
mov byte [0x46523a], al
jmp 0x4465c4
mov al, byte [0x4652ca]
jmp 0x446550
mov al, byte [0x4652cb]
mov byte [0x465239], al
jmp 0x4465c4
mov al, byte [0x4652c8]
mov byte [0x465238], al
jmp 0x4465c4
mov al, byte [0x4652c9]
jmp 0x44655c
cmp byte [ebp + 0x18], 0
jne 0x446582
or byte [0x465224], bl
cmp byte [ebp + 0xb], 0
je 0x446582
or byte [0x465225], bl
test al, al
je 0x4465c4
or byte [0x465226], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x465228], 0x80
jb 0x4465c4
cmp byte [ebp + 0xc], 0xa1
jbe 0x4465bd
cmp byte [ebp + 0xc], 0xa3
jbe 0x4465b4
cmp byte [ebp + 0xc], 0xa5
ja 0x4465c4
mov byte [0x46523a], 0x80
jmp 0x4465c4
mov byte [0x465239], 0x80
jmp 0x4465c4
mov byte [0x465238], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x466384], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x466386], al
mov byte [0x466381], cl
call fcn.004444af
add esp, 0xc
mov byte [0x466380], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x46637c], eax
pop ebx
pop ebp
ret
Function at 0x4468da
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44690e
cmp byte [0x466134], al
je 0x4469ab
push 1
push eax
push 0xffffffffffffffff
push 0x459f14
jmp 0x4469a0
cmp byte [0x466134], 0
push ebx
push ebp
push esi
mov ebp, 0x465b28
jne 0x446923
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x44697e
cmp byte [edi], 0
je 0x446989
cmp byte [edi + 1], 0x3a
jne 0x446989
cmp byte [edi + 2], 0
jne 0x446989
push ebp
push edi
call fcn.00441811
test eax, eax
pop ecx
pop ecx
je 0x446989
push edi
lea eax, [esp + 0x14]
push 0x45cd94
push eax
call fcn.00409d3b
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x446989
push ebp
push esi
call ebx
test eax, eax
jne 0x446989
push esi
push edi
push ebp
call fcn.00438c79
add esp, 0xc
cmp byte [0x466134], 0
pop esi
pop ebp
pop ebx
je 0x4469ab
push 1
push 0
push 0xffffffffffffffff
push 0x45871c
mov ecx, dword [0x465b20]
call fcn.00401592
pop edi
add esp, 0x10c
ret
Function at 0x44b13d
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f0
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x64], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44b16b
push 0x64
lea ecx, [ebp - 0x80]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44b16f
mov byte [ebp - 0x80], 0
push edi
push 0x1f
mov byte [ebp - 0x1c], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x44b1a9
cmp byte [edi + 0x11], 0
je 0x44b1a6
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x1c]
push 0x45ad08
push 0x7d
push eax
call fcn.00409cfa
add esp, 0x10
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x44b189
cmp byte [ebp - 0x1c], 0
je 0x44b1ea
lea eax, [ebp - 0x1c]
push eax
call fcn.00455c50
cmp eax, 0x7b
pop ecx
jbe 0x44b1de
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x1c]
push 0x45a098
push eax
call fcn.00438c79
add esp, 0xc
jmp 0x44b1ea
lea eax, [ebp + eax - 0x1d]
cmp byte [eax], 0x20
jne 0x44b1ea
mov byte [eax], 0
mov eax, dword [0x46535c]
cmp eax, 1
mov dword [ebp + 0x78], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
jg 0x44b2d2
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x78], 0x4585d8
cmp dword [0x46533c], 0
mov edi, 0x459a64
mov eax, 0x459a68
mov dword [ebp + 0x68], edi
je 0x44b223
mov dword [ebp + 0x68], eax
cmp dword [0x465338], 0
je 0x44b22e
mov edi, eax
lea eax, [ebp - 0x180]
push eax
push 1
call fcn.0040fd86
pop ecx
push eax
call fcn.00410b93
push eax
push dword [0x465358]
lea eax, [ebp - 0x1c]
push dword [0x46535c]
push dword [0x465360]
push dword [ebp + 0x78]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x80]
push dword [esi + 0x478]
push dword [ebp + 0x68]
push edi
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push dword [ebp + 0x7c]
push ebx
call fcn.00409c5f
mov esi, dword [ebp + 0x64]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.004441a7
push ebx
call fcn.00455c50
add esp, 0xc
add ebx, eax
cmp dword [0x465c34], 0
pop edi
mov eax, str._r_nPress__F5__to_refresh.
jne 0x44b2b7
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.00409c5f
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x44b20a
Function at 0x44b3b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x46308c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00438f35
test eax, eax
pop ecx
pop ecx
je 0x44b43d
cmp byte [eax], 0x3d
jne 0x44b436
cmp eax, esi
jbe 0x44b448
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44b436
mov eax, ecx
cmp eax, esi
jbe 0x44b448
dec eax
jmp 0x44b448
push esi
call fcn.00455c50
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00438e81
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44b474
cmp byte [ebp + 0x10], 0
je 0x44b470
push esi
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, ebx
call fcn.0044a7cd
xor eax, eax
jmp 0x44b484
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.00438c79
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44dc15
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c58
call fcn.004561f0
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44dc93
lea ecx, [ebp - 0x8c58]
call fcn.0043aeeb
mov al, byte [ebp + 8]
mov byte [ebp - 0x8414], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8410], eax
lea eax, [ebp - 0x8c58]
push eax
push 0x44e25b
mov dword [ebp - 0x8418], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8428], 0
je 0x44dc93
mov eax, dword [0x46518c]
cmp eax, 0xffffffff
jle 0x44dc93
cmp eax, 0x19
jge 0x44dc89
cmp byte [0x466341], 0
je 0x44dc89
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44dc93
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x44e115
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c5c
call fcn.004561f0
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x44e252
push ebx
call fcn.0044e45f
test eax, eax
je 0x44e255
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x465138
push eax
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.0044de97
test eax, eax
je 0x44e164
xor esi, esi
mov dword [0x468f6c], esi
jmp 0x44e16a
mov esi, dword [0x468f6c]
lea ecx, [ebp - 0x8c5c]
call fcn.0043aeeb
cmp byte [ebp + 8], bl
je 0x44e184
cmp esi, ebx
mov byte [ebp - 0x8434], bl
je 0x44e18b
mov byte [ebp - 0x8434], 1
mov eax, dword [0x468f68]
mov dword [ebp - 0x8424], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x841c], eax
lea eax, [ebp - 0x8c5c]
push eax
push 0x44e361
mov dword [ebp - 0x8420], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x842c], ebx
je 0x44e227
push dword [ebp - 0x842c]
call fcn.0043be36
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44e1e3
push dword [ebp - 0x842c]
call fcn.0044e42d
pop ecx
mov dword [ebp - 0x842c], esi
push dword [ebp - 0x842c]
call fcn.0043b79c
push dword [ebp - 0x842c]
call fcn.0044e42d
mov eax, dword [0x46518c]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x44e251
cmp eax, 0x19
jge 0x44e21b
cmp byte [0x466341], bl
je 0x44e21b
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44e251
push 1
push eax
call fcn.0040b5c4
pop ecx
pop ecx
jmp 0x44e251
mov eax, dword [0x468f6c]
cmp eax, ebx
je 0x44e251
cmp eax, 1
setg al
cmp al, bl
mov dword [0x468f6c], ebx
je 0x44e251
push dword [ebp - 4]
call fcn.0044e42d
pop ecx
push ebx
mov ecx, edi
call fcn.0044e115
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x44e551
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x467958], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x466f98
jne 0x44e571
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041357e
pop ecx
mov dword [0x4641d8], 0x270
mov dword [0x466f90], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e590
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e5c6
mov edx, dword [0x466f98]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e7cd
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x44e8f8
cmp byte [eax], bl
je 0x44e8f8
push 0x10
call fcn.0044be71
cmp eax, ebx
pop ecx
je 0x44e81b
mov dword [eax], 0x4585d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x44e81d
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x44e8f8
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004469b3
cmp eax, 1
jne 0x44e8f8
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b5f6
test eax, eax
je 0x44e8f8
push dword [0x465c2c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449a4c
test eax, eax
je 0x44e8f8
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b955
test eax, eax
je 0x44e8f8
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0041c17a
cmp eax, ebx
mov dword [0x465b20], eax
je 0x44e8f8
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
mov ecx, eax
call fcn.00401592
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.0041357e
mov eax, dword [esi + 8]
pop ecx
jmp 0x44e8fb
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x44eb05
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.0041357e
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x44eb2f
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.0041349c
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x44eb19
pop esi
pop edi
ret 0xc

Function at 0x44efa1
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x44efca
add edx, edx
xor edx, 0x4c11db7
jmp 0x44efcc
shl edx, 1
dec ecx
jne 0x44efb8
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x44efb0
pop edi
pop esi
ret

Function at 0x45037f
Capabilities:
Parse credit card information

Disassembly:
jmp 0x4503e2
cmp ecx, 0x4f
jne 0x450390
xor ecx, ecx
mov ch, byte [eax + 1]
mov cl, byte [eax + 2]
jmp 0x4503e0
cmp ecx, 0x5e
jne 0x4503ac
xor ecx, ecx
mov ch, byte [eax + 3]
mov cl, byte [eax + 4]
cmp ecx, dword [esp + 4]
je 0x4503eb
movzx ecx, byte [0x45f53e]
jmp 0x4503e0
cmp ecx, 0x38
jl 0x4503d9
cmp ecx, 0x3d
jle 0x4503ca
cmp ecx, 0x40
jle 0x4503c5
cmp ecx, 0x43
jle 0x4503ca
cmp ecx, 0x44
jne 0x4503d9
mov dl, byte [eax + 3]
jmp 0x4503cd
mov dl, byte [eax + 1]
cmp dl, 0xf
je 0x4503d7
cmp dl, 0xe
jne 0x4503d9
inc eax
inc eax
movzx ecx, byte [ecx + 0x45f4e0]
add eax, ecx
movzx ecx, byte [eax]
test ecx, ecx
jne 0x450381
xor eax, eax
ret