joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b95d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x482d90]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b9a0
cmp word [esi], dx
jne 0x41b9a0
or byte [edi + eax + 0x28], 4
jmp 0x41b9a5
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41baf8
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41bad8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41b9e7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41ba1d
cmp eax, edx
jae 0x41ba29
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41b9bf
jmp 0x41baf8
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41bad4
cmp dword [ebp - 0x14], 0
je 0x41bad4
mov eax, dword [ebx*4 + 0x482d90]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41baac
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41ba75
mov word [esi], cx
jmp 0x41baa8
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x482d90]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x482d90]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x482d90]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41baf8
pop ebx
cmp word [ebp - 4], bx
jne 0x41babd
cmp esi, dword [ebp + 0xc]
jne 0x41babd
mov word [esi], bx
jmp 0x41baf5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041c391
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41baf8
push 0xd
jmp 0x41baf1
mov ecx, dword [ebx*4 + 0x482d90]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41baef
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41baf8
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x405067
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0xa
push 1
mov ebx, 0x1c
mov eax, 0x45a230
call fcn.0044e000
add esp, 0x10
mov dword [ebp - 0xc], eax
push str.driversetcHOSTS
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040119e
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4050cc
push ebx
call fcn.0044dbce
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4050e0
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405106
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x405179
push 0
push 0
push 0
push 0x80000301
push 0
push 4
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x405138
mov eax, 0x499305
push eax
push 3
mov ebx, 0x270
call fcn.0044e790
add esp, 0x28
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405174
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x278
call fcn.0044e870
add esp, 0x10
jmp 0x4051da
push 0
push 0
push 0
push 0x80000301
push 0
push 4
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40519e
mov eax, 0x499305
push eax
push 3
mov ebx, 0x270
call fcn.0044e790
add esp, 0x28
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4051da
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x278
call fcn.0044e870
add esp, 0x10
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4051ea
push ebx
call fcn.0044dbce
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x405d78
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 1
push 1
push 0x4b5b21
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe8]
push reloc.WSOCK32.dll_connect
push 0
push str..datamainRoleRegist.dat
push 1
mov ebx, 0x268
call fcn.00450d50
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x405dd5
mov eax, 0x499775
push eax
push 1
mov ebx, 8
mov eax, 0x454360
call fcn.0044e000
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405e00
push ebx
call fcn.0044dbce
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x405e14
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov dword [ebp - 4], eax
push str.b869706b42f0c202e5667f22da1c9cf5
push dword [ebp - 4]
call fcn.00401096
add esp, 8
cmp eax, 0
je 0x405ed4
mov dword [ebp - 8], esp
push str.C:WINDOWS_roleat.dat
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405e55
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x405ed4
call fcn.0040205e
mov dword [ebp - 8], eax
push str.datamainRoleRegist.dat
push dword [ebp - 8]
mov ecx, 2
call fcn.0040119e
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405e92
push ebx
call fcn.0044dbce
add esp, 4
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x405ea5
mov eax, 0x499305
push eax
push reloc.WSOCK32.dll_connect
push 0
push str.C:WINDOWS_roleat.dat
push 2
mov ebx, 0x23c
call fcn.0044e330
add esp, 0x1c
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x405ed4
push ebx
call fcn.0044dbce
add esp, 4
push 1
push 0
push 0x4b5b21
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xe8]
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x405efd
push ebx
call fcn.0044dbce
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x407666
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x4b5ae5]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4076b3
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4076ca
mov eax, 0x499775
jmp 0x4077c8
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x4b5ae5]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4076f2
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x407709
mov eax, 0x499775
jmp 0x4077c8
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40772b
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407742
mov eax, 0x499775
jmp 0x4077c8
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00450870
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x407775
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40778c
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4077a9
push 6
call fcn.0044dbd4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4077c3
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044dbc8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4077c8
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4077d9
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa86
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
push 8
call fcn.0044dbc8
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x499775
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 1
push 0x14
call dword [0x4b5c89]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40aaf9
push 6
call fcn.0044dbd4
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.0040ac8b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push eax
lea eax, [ebp - 0xc]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x40ab86
mov ebx, dword [ebp - 8]
call fcn.004029aa
push ebx
push ecx
mov eax, dword [ebp - 0xc]
dec eax
jns 0x40ab3c
push 4
call fcn.0044dbd4
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x40ab4f
push 1
call fcn.0044dbd4
add esp, 4
shl eax, 2
add ebx, eax
mov ebx, dword [ebx]
mov dword [ebp - 0x14], ebx
mov eax, dword [0x4b5ba9]
mov ebx, dword [ebp - 0x14]
cmp dword [ebx], eax
jne 0x40ab7a
mov dword [ebp - 0x10], 1
jmp 0x40ab86
mov dword [ebp - 0x10], 0
pop eax
pop ebx
pop ecx
jmp 0x40ab11
add esp, 0xc
cmp dword [ebp - 0x10], 0
jne 0x40ac32
mov dword [ebp - 0x14], esp
push dword [0x4b5b25]
call dword [sym.imp.USER32.dll_IsWindowVisible]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40abb8
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40abf4
mov dword [ebp - 0x14], esp
push 1
push dword [0x4b5b25]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40abef
push 6
call fcn.0044dbd4
add esp, 4
jmp 0x40ac1e
mov dword [ebp - 0x14], esp
push 0
push dword [0x4b5b25]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40ac1e
push 6
call fcn.0044dbd4
add esp, 4
push 0
push 0x4b5b61
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x14]
mov ebx, dword [ebp - 8]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40ac50
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40ac4c
imul eax, dword [ebx]
jmp 0x40ac41
mov ecx, eax
test ecx, ecx
je 0x40ac7f
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x40ac6e
push ebx
call fcn.0044dbce
add esp, 4
pop ebx
call fcn.0044dbce
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40ac56
call fcn.0044dbce
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4146b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [0x4b5b0d]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
push 1
push 0x499305
push 0x499305
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4146ff
push 6
call fcn.0044dbd4
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x415d0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x48
call fcn.0044dbc8
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x12
rep stosd dword es:[edi], eax
push 0x10
call fcn.0044dbc8
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebx], 0x12
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x415dbd
push 6
call fcn.0044dbd4
add esp, 4
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x415dea
push 6
call fcn.0044dbd4
add esp, 4
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x415e14
push 6
call fcn.0044dbd4
add esp, 4
mov ebx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
jmp 0x415e27
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0044dbce
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x415e53
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov ebx, dword [0x4b5b0d]
add ebx, 8
mov dword [ebp - 8], ebx
push 1
push dword [ebp - 8]
push 1
push 0x40
mov eax, 0x4b2822
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x4b5b09
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10c]
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x415ea9
push ebx
call fcn.0044dbce
add esp, 4
mov eax, str.DA7DDF26A941AC2ADB27C937FA0AF66CD166C679A65CE028DF70843FE70BEE6DD7389A67F00DB27B876DCF64A05BB62383399B6FF15BBB20
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004029ca
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x415ecd
push ebx
call fcn.0044dbce
add esp, 4
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x415ee0
mov eax, 0x499305
push eax
push 1
mov ebx, 0x1c
mov eax, 0x45a420
call fcn.0044e000
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x415f0b
push ebx
call fcn.0044dbce
add esp, 4
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x415f1e
mov eax, 0x499775
push eax
push 1
mov ebx, 0x168
call fcn.0044e9f0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x415f44
push ebx
call fcn.0044dbce
add esp, 4
mov eax, 0x4b28cc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, 0x4b28d2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00416034
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x415f78
push ebx
call fcn.0044dbce
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x415f88
push ebx
call fcn.0044dbce
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x415f98
push ebx
call fcn.0044dbce
add esp, 4
lea eax, [ebp - 0x20]
push eax
call fcn.004029ca
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x415fb4
push ebx
call fcn.0044dbce
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x415fc8
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x499305
push dword [ebp - 4]
call fcn.00401096
add esp, 8
cmp eax, 0
je 0x416020
mov dword [ebp - 8], esp
push 1
push 0x499305
push 0x499305
push dword [ebp - 4]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x416020
push 6
call fcn.0044dbd4
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x416030
push ebx
call fcn.0044dbce
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41c029
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c064
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00451740
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c0c7
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044e0a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c0eb
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00451740
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c14e
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044e0a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41c172
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00451740
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41c1d5
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0044e0a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x41c1dd
mov esp, ebp
pop ebp
ret
Function at 0x4205b9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4205ff
push 6
call fcn.0044dbd4
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x499338]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.00401e95
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0044e6d0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420652
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42068b
push 6
call fcn.0044dbd4
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4206a7
push eax
mov ebx, eax
call fcn.00401133
inc eax
push eax
call fcn.0044dbc8
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4206ac
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4206bd
push ebx
call fcn.0044dbce
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x44e0f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00452ef0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x44e240
test ecx, ecx
je 0x44e240
inc ecx
push ecx
call fcn.00486699
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004763d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x44e169
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44e22d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.00486699
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x44e1f1
cmp eax, 0xea
jne 0x44e219
push esi
call fcn.004866c2
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00486699
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44e1bc
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x44e1ff
cmp eax, 2
jne 0x44e219
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00452e60
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.004866c2
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.004866c2
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x44e26e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x44e27a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x44e27a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00452e60
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret