joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bdf
Capabilities:
Authenticate hmac

Disassembly:
sub eax, eax
push dword [0x437a0c]
push dword [0x437bec]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b38]
add eax, ecx
mov eax, dword [0x437cd4]
push 8
mov eax, dword [0x437a08]
push eax
call sub.USER32.dll_GetWindow
add esi, dword [0x437c50]
mov eax, 2
mov eax, dword [0x437bd4]
mov si, 0xbe
push ecx
sub eax, ecx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c80]
mov eax, 1
mov ecx, dword [0x4379bc]
sub eax, eax
push eax
push 0x10
call sub.USER32.dll_GetWindow
adc eax, dword [0x437958]
sub eax, esi
mov eax, dword [0x437bc4]
push eax
push 1
call sub.USER32.dll_GetWindow
mov edi, dword [0x437a08]
sub edi, edx
mov eax, dword [0x437990]
mov esi, dword [0x437958]
add eax, esi
push dword [0x437b08]
mov edx, dword [0x437b90]
mov edx, 0x20
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b48]
sub eax, eax
mov ecx, 0x10
mov esi, 0x10
push esi
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a80]
add eax, esi
mov edx, dword [0x437a30]
mov eax, 0x80
push 2
mov esi, dword [0x4379f4]
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
mov esi, 4
mov eax, dword [0x437d38]
sub eax, esi
mov eax, 0x80
push 0x80
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bbc]
sub edx, edx
mov eax, dword [0x4379b0]
mov edx, dword [0x4379d4]
and edx, eax
and eax, ecx
push eax
mov ecx, dword [0x437bdc]
mov ecx, 0xa
push ecx
call sub.USER32.dll_GetWindow
add eax, dword [0x437d10]
mov eax, 0x40
mov dx, 0x29
mov esi, dword [0x437a24]
push 0x80
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379fc]
add eax, edx
mov edi, dword [0x437ccc]
push esi
mov dword [0x437b64], ecx
push dword [0x437ae0]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437d28]
sub edi, eax
adc eax, dword [0x437d18]
add eax, esi
mov dword [0x437b04], edx
push 0x80
push 0x7b
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a40]
mov si, 2
add eax, eax
sub eax, edx
mov dword [0x437ca0], edi
push dword [0x437cfc]
mov dword [0x437c50], eax
push dword [0x437b68]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437958]
mov ax, 2
mov edi, dword [0x437bdc]
sub edx, esi
push edx
push dword [0x437990]
invalid
xor byte [ebx], cl

Function at 0x404e56
Capabilities:
Authenticate hmac

Disassembly:
shr byte [ecx], 0xc0
push eax
sub eax, edi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379bc]
sub edi, eax
mov esi, dword [0x4379bc]
push dword [0x437c18]
add edi, eax
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cd0]
mov edx, 4
sub eax, eax
mov dword [0x437980], eax
push dword [0x437cb8]
push edx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b2c]
mov eax, 0x81
mov esi, dword [0x437984]
mov ax, 0x20
mov eax, dword [0x437b24]
mov eax, dword [0x437d54]
push eax
mov dword [0x437b98], eax
push 0x29
call sub.USER32.dll_GetWindow
Function at 0x404ec6
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [0x4379bc]
mov ecx, 0x40
mov esi, dword [0x437958]
mov eax, 0x20
mov eax, 0x10
mov dword [0x437bfc], esi
push dword [0x437958]
mov dword [0x437ce0], eax
push dword [0x437cd0]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437990]
sub eax, esi
mov eax, dword [0x437a20]
add eax, esi
adc ecx, dword [0x437b78]
push ecx
xor edi, ecx
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a10]
mov ax, 0x3c
mov edx, dword [0x437958]
push dword [0x437b50]
push dword [0x437a50]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c60]
mov edi, 0x88
mov eax, dword [0x437b60]
push 8
push 2
call sub.USER32.dll_GetWindow
mov eax, dword [0x43795c]
or esi, edx
mov cx, 0x30
add eax, ecx
mov edx, dword [0x437a24]
mov edx, 0xb0
push edx
push eax
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437d2c]
sub ecx, esi
mov edx, dword [0x437c40]
sub ecx, edi
push dword [0x437b28]
push dword [0x437a64]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437bc8]
mov eax, 0xec
and edx, edx
mov eax, dword [0x437c14]
push dword [0x437c34]
push dword [0x437ba4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b24]
mov ax, 8
or eax, edx
add edi, eax
push 0x44
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c74]
sub eax, edx
add eax, esi
mov esi, dword [0x437958]
mov dx, 0xa5
push 1
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov edi, dword [0x4379e0]
add esi, eax
mov edi, dword [0x437c94]
mov ecx, dword [0x437958]
add byte [ecx], ch
ror byte [ebx + 0x437a043d], 0
Function at 0x405616
Capabilities:
Authenticate hmac

Disassembly:
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379c0]
add eax, eax
mov eax, dword [0x437a14]
mov esi, 2
mov dword [0x437be8], esi
push dword [0x437be8]
mov dword [0x437b20], eax
push 0xc0
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d4c]
dec esp
jge 0x40568e
add byte [ecx], al
ret 0x1ca1
jp 0x405695
inc ebx
add byte [eax + 1], bh

Function at 0x405648
Capabilities:
Authenticate hmac

Disassembly:
dec esp
jge 0x40568e
add byte [ecx], al
ret 0x1ca1
add byte [edi + 0x8b], bh

Function at 0x405651
Capabilities:
Authenticate hmac

Disassembly:
inc ebx
add byte [eax + 1], bh
mov ecx, dword [0x437d44]
push 4
mov edi, dword [0x437a5c]
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a54]
add edx, edi
mov eax, dword [0x437958]
push 2
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437c3c]
mov ax, 0x20
mov eax, dword [0x437a6c]
mov edi, 0x8b
mov eax, dword [0x437bd8]
push eax
or dword [0x437978], 0xffff00ff
push dword [0x437a98]
call sub.USER32.dll_GetWindow
adc ecx, dword [0x437ba8]
mov eax, 2
mov eax, dword [0x437b34]
add eax, eax
push 0x8b
mov ecx, dword [0x437bf8]
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a68]
mov cx, 0x40
mov ax, 1
mov dword [0x437958], eax
push 0x80
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c1c]
sub eax, esi
mov eax, dword [0x437b10]
sub eax, eax
mov edi, dword [0x4379ac]
push edi
push 2
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c84]
sub ecx, eax
mov eax, dword [0x437bf4]
mov edx, dword [0x437c88]
push 0x20
push 8
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d44]
add eax, eax
mov eax, dword [0x437c8c]
push edi
sub ecx, edx
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ad8]
mov ax, 0x13
mov ecx, dword [0x437964]
invalid
add al, byte [eax]

Function at 0x405812
Capabilities:
Authenticate hmac

Disassembly:
add byte [ebx], al
add byte [ebx + 0x437a1035], cl
add byte [ecx], al
invalid

Function at 0x4058df
Capabilities:
Authenticate hmac

Disassembly:
mov edi, dword [0x437c70]
push edi
push esi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437acc]
int3
jp 0x405934
add byte [edx + 0x70], bh
Function at 0x4058ef
Capabilities:
Authenticate hmac

Disassembly:
jp 0x405934
add byte [edx + 0x70], bh
mov ecx, dword [0x4379fc]
mov ax, 4
mov eax, dword [0x437d08]
add eax, ecx
push eax
push dword [0x437cb4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a28]
mov edx, 2
mov ecx, 0xbe
push 0x2b
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c8c]
mov edi, 0x20
add byte [edi + 0x20], bh
mov ax, 0x20
mov ecx, dword [0x437c64]
add edx, eax
push 0x20
mov ecx, dword [0x437a30]
sub ecx, eax
push ecx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a24]
add eax, edi
mov esi, dword [0x437c9c]
add edi, edi
push eax
push dword [0x437d40]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c68]
mov edi, 0x34
mov ecx, dword [0x437a50]
mov ax, 0xb7
and ecx, dword [0x437c68]
sub eax, esi
mov dword [0x437d0c], eax
push dword [0x437b9c]
push 0x4b
call sub.USER32.dll_GetWindow
mov edi, dword [0x437d44]
mov ax, 2
mov edx, dword [0x437ccc]
mov eax, 4
push 0x10
push dword [0x437a90]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bb4]
xor eax, eax
push dword [0x437acc]
push ecx
call sub.USER32.dll_GetWindow
mov edi, dword [0x437bf4]
sub eax, eax
mov edi, dword [0x437cb0]
sub eax, eax
mov esi, dword [0x4379ec]
add esi, eax
push esi
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bcc]
xor eax, ecx
mov eax, dword [0x437c34]
sub eax, eax
add ecx, eax
mov eax, dword [0x437c70]
push eax
mov ax, 0x20
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, eax
mov eax, dword [0x4379a8]
sub eax, eax
mov edi, 7
push edi
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437cf8]
sub edi, edx
mov eax, dword [0x437958]
mov eax, dword [0x437af4]
mov ecx, dword [0x437c54]
push ecx
push eax
invalid
xchg ecx, eax
inc byte [edx]
Function at 0x405a5c
Capabilities:
Authenticate hmac

Disassembly:
mov edi, dword [0x437d4c]
mov ax, 0x49
push eax
push 0x38
call sub.USER32.dll_GetWindow
mov edi, dword [0x437aac]
sub ecx, eax
mov edi, dword [0x437c18]
xor eax, ecx
push dword [0x437c4c]
push edx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b68]
and eax, ecx
sub edi, ecx
mov edx, dword [0x437b14]
add edi, eax
or eax, dword [0x437d28]
sub eax, eax
push eax
push edi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437a20]
sub edi, eax
mov eax, dword [0x437ae0]
sub ecx, eax
push ecx
mov eax, 0x80
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cf8]
add ecx, eax
mov ecx, dword [0x437958]
sub eax, edi
mov eax, dword [0x437a7c]
and eax, esi
push eax
mov dword [0x437cb4], eax
push dword [0x437c18]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437ad8]
mov eax, 0x20
mov eax, dword [0x437c74]
add eax, edx
push eax
mov ecx, dword [0x437b38]
push ecx
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437bc8]
mov ax, 0x43
mov edx, dword [0x437958]
sub eax, eax
sub eax, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b78]
mov ax, 4
mov ecx, dword [0x437d24]
mov cx, 0x20
add esi, eax
push 4
push dword [0x437974]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a40]
mov si, 4
mov eax, dword [0x437ad8]
push eax
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379ec]
add eax, esi
mov eax, dword [0x4379bc]
push dword [0x437bc8]
push 1
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a24]
sub eax, eax
mov eax, 0x56
mov edx, dword [0x437b78]
add eax, eax
push 8
push 4
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a04]
add al, 0x7a
inc ebx
add byte [esi - 0x48], ah
pushfd
add byte [ecx + 0x437b60], ah

Function at 0x405b97
Capabilities:
Authenticate hmac

Disassembly:
add al, 0x7a
inc ebx
add byte [esi - 0x48], ah
pushfd
add byte [ecx + 0x437b60], ah
sub eax, ecx
mov dx, 0x5b
sub esi, eax
push esi
mov cx, 2
push ecx
call sub.USER32.dll_GetWindow
or eax, dword [0x437a40]
mov ax, 0x10
mov eax, 1
mov eax, 0x10
mov dword [0x437b24], eax
push dword [0x437a00]
push 0x20
call sub.USER32.dll_GetWindow
mov esi, dword [0x437958]
mov si, 8
mov eax, dword [0x437ba4]
sub esi, ecx
mov ecx, dword [0x437bfc]
invalid

Function at 0x405bf5
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], 0
add bh, bh
xor eax, 0x437ae4

Function at 0x405c9e
Capabilities:
Authenticate hmac

Disassembly:
cld
jnp 0x405ce4
add byte [eax - 1], dl
xor eax, 0x437bc8
idiv bl
add al, byte [eax]
Function at 0x405d99
Capabilities:
Authenticate hmac

Disassembly:
add byte [ecx], ch
shl byte [ecx + 0x437c1c], 1
or esi, eax
push dword [0x437a7c]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x43795c]
add edi, esi
mov ecx, dword [0x437b24]
sub edi, eax
mov eax, dword [0x4379ec]
add eax, edi
push eax
push 0x20
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b94]
mov ax, 0x45
sub edx, eax
sub eax, dword [0x437958]
add eax, eax
push 0x6e
push 0x80
call sub.USER32.dll_GetWindow
mov esi, dword [0x437b5c]
sub eax, ecx
mov eax, dword [0x437c5c]
sub eax, edi
mov ecx, dword [0x437958]
sub eax, eax
push ecx
mov ax, 0xd5
push eax
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b50]
mov esi, 0x20
mov eax, dword [0x437ab4]
mov eax, dword [0x437b2c]
push esi
push edx
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b4c]
mov eax, 9
and eax, dword [0x437cc8]
mov si, 0x20
mov eax, dword [0x437c90]
mov dword [0x437b38], eax
Function at 0x406246
Capabilities:
Authenticate hmac

Disassembly:
add byte [edx + 8], ch
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437c8c]
sub eax, eax
mov ax, 0x3e
add eax, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b60]
mov ecx, 0x80
mov ecx, dword [0x437d18]
mov eax, 0xb6
mov ecx, dword [0x4379e4]
mov cx, 0x80
push eax
mov dword [0x437958], eax
push 0x80
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ccc]
mov edi, 0xff
mov esi, dword [0x437b48]
push esi
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437aa4]
sub edx, edi
push edi
push esi
call sub.USER32.dll_GetWindow
xor eax, dword [0x437b34]
sub edx, eax
add edi, edi
mov eax, dword [0x437958]
mov ecx, 0x40
mov esi, dword [0x437bc8]
mov esi, 8
push esi
push edi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a90]
mov ax, 0xdc
sub esi, eax
mov dword [0x437a60], edi
push dword [0x437c00]
push dword [0x437c18]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d30]
add eax, eax
mov esi, dword [0x437d20]
mov eax, dword [0x437990]
push esi
push eax
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437afc]
mov eax, 0x10
mov eax, 0xf
mov ecx, 4
push eax
mov dword [0x437d34], eax
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d44]
mov esi, 0x27
mov eax, dword [0x437a98]
mov ecx, dword [0x437d1c]
push 0x20
push dword [0x437b9c]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437ae4]
mov di, 0x20
mov edi, dword [0x437ad0]
mov esi, dword [0x437ba8]
xor esi, ecx
push esi
push 6
call sub.USER32.dll_GetWindow
mov esi, dword [0x437978]
mov esi, 9
push eax
mov cx, 0x5f
push ecx
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437c38]
add ecx, eax
mov ecx, dword [0x437a84]
mov esi, 0x67
push 0xab
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a04]
add edx, eax
mov eax, dword [0x437c40]
mov edi, 0x40
push eax
push dword [0x437c10]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c20]
mov eax, 0x20
mov eax, dword [0x437958]
mov eax, 2
add eax, edx
add eax, eax
push eax
push dword [0x437c74]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437be8]
mov eax, 0x40
mov eax, dword [0x437a28]
push edi
add edx, edx
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bf8]
mov eax, 0x6f
mov eax, dword [0x437cd4]
aam 0x7c
inc ebx
add byte [eax - 0x5d], dl
invalid
jl 0x406467
add bh, bh
xor eax, 0x437c64
call sub.USER32.dll_GetWindow
mov edi, dword [0x437d18]
mov eax, 0x66
mov edx, dword [0x437abc]
add ecx, eax
mov eax, dword [0x437c50]
push ecx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b2c]
sub eax, eax
mov eax, dword [0x4379c0]
xor eax, esi
mov ax, 0x63
mov dword [0x437ad0], esi
push dword [0x437bbc]
mov dword [0x437970], ecx
push 0x4e
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d2c]
mov esi, 2
push eax
push 0x4b
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b94]
sub ecx, esi
mov eax, dword [0x437a94]
mov eax, 0x10
push 0x80
push dword [0x437be8]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a2c]
mov eax, 0xbc
mov eax, dword [0x437c30]
push edi
push edx
call sub.USER32.dll_GetWindow
add eax, dword [0x437958]
mov dx, 0x1a
Function at 0x4064ce
Capabilities:
Authenticate hmac

Disassembly:
push 0x10
push 4
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, esi
mov ax, 0x80
mov ecx, dword [0x437c70]
push eax
push 0x40
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bf8]
mov dx, 0x62
mov eax, dword [0x437958]
mov eax, dword [0x4379dc]
push ecx
push 0x40
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379fc]
sub ecx, esi
mov ecx, dword [0x437afc]
mov eax, dword [0x437c30]
add edi, eax
push edi
push eax
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a48]
sub ecx, eax
push 0x6b
mov dword [0x437a54], eax
push dword [0x437c48]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a28]
mov edx, 0x2c
mov eax, 8
mov eax, dword [0x437958]
push edx
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d10]
mov eax, 0x40
mov esi, dword [0x437988]
mov eax, dword [0x437bec]
push eax
mov dword [0x437bc4], eax
push 0x40

Function at 0x406579
Capabilities:
Authenticate hmac

Disassembly:
call sub.USER32.dll_GetWindow
mov eax, dword [0x437af4]
xor eax, eax
mov edi, 4
push dword [0x437c78]
mov edi, dword [0x437c78]
mov di, 0x27
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
sub eax, eax
invalid

Function at 0x406755
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x2b80040
add byte [eax], al
add byte [eax + 0x66], dl
mov ecx, 0xe8510020
jbe 0x406757
add byte [eax + 2], bh
push eax
mov cx, 0x20
push ecx
call sub.USER32.dll_GetWindow
add al, byte [eax]
mov edx, dword [0x437ac4]
mov edi, 2
add ecx, edx
mov eax, dword [0x437bdc]
push dword [0x437a6c]
mov esi, dword [0x437c88]
push esi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a74]
sub eax, eax
mov esi, dword [0x437b20]
sub esi, eax
mov ax, 1
and esi, eax
invalid

Function at 0x4067a1
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 0x2b80040
add byte [eax], al
add byte [eax + 0x66], dl
mov ecx, 0xe8510020
jbe 0x406757
add byte [eax + 2], bh
push eax
mov cx, 0x20
push ecx
call sub.USER32.dll_GetWindow
add al, byte [eax]
mov edx, dword [0x437ac4]
mov edi, 2
add ecx, edx
mov eax, dword [0x437bdc]
push dword [0x437a6c]
mov esi, dword [0x437c88]
push esi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a74]
sub eax, eax
mov esi, dword [0x437b20]
sub esi, eax
mov ax, 1
and esi, eax
invalid
Function at 0x4068a4
Capabilities:
Authenticate hmac

Disassembly:
and byte [ebx + eax*2], bh
call sub.USER32.dll_GetWindow
mov edi, dword [0x437b8c]
mov ax, 0xf7
mov edi, dword [0x437a94]
mov eax, dword [0x437cf4]
sub eax, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437c3c]
mov edi, 0x10
mov eax, dword [0x437958]
mov si, 4
push dword [0x437ac0]
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c3c]
sub edi, edx
mov edi, dword [0x437ccc]
sub edi, eax
push esi
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379bc]
add esi, eax
adc eax, dword [0x437b68]
mov edx, 0x27
mov eax, dword [0x437c4c]
mov edx, dword [0x437c0c]
push edx
push 0xf5
call sub.USER32.dll_GetWindow
mov edi, dword [0x437a6c]
add ecx, eax
mov cx, 0x6c
mov eax, dword [0x437994]
push 0x20
push dword [0x437c10]
call sub.USER32.dll_GetWindow
adc esi, dword [0x437a0c]
add eax, edi
mov dword [0x437c08], ecx
push dword [0x437af8]
push dword [0x437bf4]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b98]
mov cx, 0xf2
add eax, eax
mov edx, dword [0x4379d4]
mov edx, 0x73
push edx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437aa4]
mov ax, 8
mov eax, 8

Function at 0x4068a5
Capabilities:
Authenticate hmac

Disassembly:
jl 0x4068ea
add al, ch
xor eax, esi
add al, byte [eax]
add byte [ecx + 0x437c3c], ah

Function at 0x406993
Capabilities:
Authenticate hmac

Disassembly:
push eax
mov eax, dword [0x437b00]
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437958]
mov eax, 0x20
mov eax, dword [0x437958]
add edi, eax
push 0x70
mov dword [0x437bf8], eax
push 2
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b74]
add eax, edi
mov dx, 0x1d
mov eax, dword [0x437958]
sub eax, edx
push 0x30
mov dword [0x437cc8], edx
push 2
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a80]
mov ax, 0xb8
mov edx, 0x98
mov dx, 8
push edx
push 0x10
call sub.USER32.dll_GetWindow
or eax, dword [0x437acc]
add eax, edi
mov eax, dword [0x437ab4]
mov dword [0x437958], eax
push dword [0x437b9c]
push 0x10
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c80]
sub esi, ecx
mov eax, dword [0x437c34]
sub edx, eax
mov esi, dword [0x437ba4]
mov cx, 0x20
push 0x81
push 0xb7
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d40]
add eax, ecx
mov eax, 0x37
mov eax, dword [0x437ba8]
mov dword [0x437c08], edx
push dword [0x437bc4]
push edx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437aec]
and esi, eax
invalid
xor byte [ebx + 0x43], bh
Function at 0x406dc8
Capabilities:
Authenticate hmac

Disassembly:
sub ecx, edi
mov eax, dword [0x437b9c]
mov di, 8
push edi
push 0xff
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ba4]
sub eax, esi
push edx
push dword [0x4379fc]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a74]
sub eax, edx
mov ax, 4
push dword [0x437c08]
push dword [0x437958]
call sub.USER32.dll_GetWindow
and edi, dword [0x437a58]
sub eax, esi
sub eax, ecx
sub eax, eax
push esi
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b7c]
mov ax, 0x40
add eax, edx
mov edi, 0xe3
push dword [0x437aac]
push edx
call sub.USER32.dll_GetWindow
mov edi, dword [0x437be8]
mov eax, 0x80
mov eax, dword [0x437bc4]
mov di, 2
push esi
push 0x10
call sub.USER32.dll_GetWindow
mov eax, dword [0x437af4]
sub ecx, eax
mov eax, dword [0x4379c0]
mov edi, 4
mov eax, dword [0x437b24]
add eax, edi
push eax
push 8
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437974]
add esi, ecx
mov eax, dword [0x437bb4]
mov si, 0x38
mov dword [0x437b24], edx
push 8
push dword [0x437afc]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
mov cx, 0x40
mov edx, dword [0x437c04]
mov esi, 2
mov edi, dword [0x437958]
push edi
push 0x80
call sub.USER32.dll_GetWindow
mov eax, dword [0x437acc]
xor eax, eax
mov eax, dword [0x437bf4]
mov eax, dword [0x4379e0]
sub ecx, eax
push eax
push dword [0x4379c0]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437b14]
mov ax, 0xae
mov ecx, dword [0x4379d4]
mov edi, 0xa7
mov ecx, dword [0x437a54]
push ecx
push dword [0x437af4]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437958]
sub edx, eax
mov ax, 0xa6
and eax, dword [0x437ab4]
push dword [0x437d40]
mov dword [0x437ca0], eax
push 1
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c8c]
mov cx, 0x86
mov ecx, dword [0x437a0c]
mov ecx, 0xc7
or edx, dword [0x437ca0]
invalid
Function at 0x4071c8
Capabilities:
Authenticate hmac

Disassembly:
jl 0x40720d
add al, ch
push cs
out 2, eax
add byte [ecx + 0x437b90], ah
sub eax, eax
mov edi, dword [0x437b9c]
add edi, eax
push 2
mov dword [0x437978], edx
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379f4]
add edi, eax
mov eax, dword [0x437958]
mov eax, dword [0x437bec]
mov esi, dword [0x437a64]
mov si, 0x83
push esi
push dword [0x437958]
pop eax
jns 0x407252
add al, ch
leave
out 2, al
add byte [ebx + 0x437b583d], cl
add byte [ecx], ch
jmp dword [ecx + 0x437a28]
mov esi, 0x20
push edi
mov dword [0x437d18], eax
push 0xcf
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b34]
add eax, edx
mov eax, dword [0x437a98]
add edx, eax
mov edi, dword [0x437b34]
push edi
push 0x59
call sub.USER32.dll_GetWindow
jns 0x407252
add al, ch
leave
out 2, al
add byte [ebx + 0x437b583d], cl
add byte [ecx], ch
jmp dword [ecx + 0x437a28]
add al, byte [eax]
mov eax, dword [0x437c5c]
mov ax, 0x80
mov eax, dword [0x437aa8]
push 0xae
sbb eax, dword [0x437b28]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a1c]
sub eax, ecx
mov eax, dword [0x437958]
and edx, eax
push eax
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379dc]
mov eax, 0x7f
mov eax, dword [0x43797c]
mov esi, 0xba
push 0x10
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b94]
add eax, esi
mov edi, dword [0x437a50]
mov dword [0x437a30], eax
push dword [0x437b14]
push edi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437be4]
sub esi, eax
mov edi, 2
mov eax, dword [0x437b8c]
or eax, eax
push eax
push dword [0x437a48]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437964]
mov edi, 0x10
mov eax, dword [0x437c30]
add eax, eax
push dword [0x437b64]
push edi
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b00]
mov ax, 0x80
mov eax, 0x80
mov dword [0x437980], eax
push dword [0x437c4c]
push dword [0x437ca0]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b4c]
add eax, eax
mov edi, dword [0x437bd4]
sub edi, esi
push edi
push 0xaf
call sub.USER32.dll_GetWindow
mov eax, dword [0x43797c]
add eax, edx
mov esi, dword [0x437a5c]
sub eax, ecx
mov ecx, dword [0x437b88]
mov esi, dword [0x437d40]
push esi
sub eax, eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ac4]
mov ax, 4
push eax
push edi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437cb4]
mov eax, 0x80
mov eax, dword [0x437c80]
add edx, eax
invalid