joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402712
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
jnp 0x402757
add bh, bh
xor eax, 0x4379b4
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b14]
add ecx, eax
add eax, dword [0x437a1c]
add edi, eax
push 2
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d18]
mov ecx, 0x80
mov eax, dword [0x437c08]
push dword [0x437b3c]
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c40]
mov eax, 0xcb
mov edi, dword [0x437a54]
mov esi, dword [0x437b4c]
mov dword [0x437c64], esi
push dword [0x437cc0]
push 0x90
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cd4]
mov eax, 0x7d
sub eax, eax
mov eax, dword [0x437990]
push dword [0x437c28]
mov dword [0x437958], esi
push 8
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d48]
add eax, esi
mov eax, 0x7b
mov eax, dword [0x437b44]
mov eax, 0xe9
push 2
push edi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437b64]
mov eax, 2
mov ecx, dword [0x437b34]
add eax, ecx
mov eax, 0x5d
mov dword [0x437a1c], edi
push dword [0x437958]
push 0x10
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c8c]
add edi, edx
mov edi, dword [0x437a10]
add ecx, esi
mov edx, 0x20
push 0x40
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
mov dx, 0x27
mov eax, dword [0x437b5c]
mov ax, 3
mov eax, 4
push 0x40
mov dword [0x4379dc], eax
push dword [0x437b28]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
mov edx, 0xb8
mov eax, dword [0x437a6c]
mov ax, 0xe3
mov edi, dword [0x437b4c]
sub esi, eax
push edi
mov dword [0x437bc8], edx
push 4
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d40]
sub ecx, esi
mov ecx, dword [0x437bb8]
mov ecx, 0x26
mov ecx, dword [0x437c90]
add eax, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d24]
add edx, edx
sbb esi, dword [0x437c4c]
mov eax, dword [0x437cb4]
mov esi, dword [0x437a30]
sub esi, eax
push esi
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379f4]
add edx, eax
mov ax, 0x20
add eax, eax
push 1
push dword [0x437c60]
call sub.USER32.dll_GetWindow
sub edx, dword [0x4379b4]
sub eax, eax
mov eax, dword [0x437d44]
mov ax, 0xd
push dword [0x437b5c]
push dword [0x437a30]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d24]
mov eax, 0x55
mov ecx, dword [0x437adc]
mov eax, dword [0x437a50]
mov dword [0x437958], edi
push dword [0x437d50]
mov dword [0x4379dc], eax
push 5
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ba8]
mov ax, 0x20
push edx
mov dword [0x437958], eax
push 0xa3
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b10]
mov ax, 0x10
mov edx, dword [0x437958]
add eax, esi
mov esi, dword [0x437a98]
push 8
push edi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437adc]
xor ecx, eax
mov esi, dword [0x437c50]
xor eax, eax
push ecx
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379d4]
mov edi, 0xde
sub edi, edi
add eax, eax
push eax
push esi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437c9c]
mov ax, 4
mov dx, 0xe6
mov edx, dword [0x437b28]
inc ebx
add byte [ecx], al
ror byte [ecx + 0x437ac40d], 0
Function at 0x40297c
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
inc ebx
add byte [ecx], al
ror byte [ecx + 0x437ac40d], 0
push 0x20
mov esi, dword [0x437c94]
mov esi, 0xca
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c14]
mov di, 4
mov ecx, 0x40
push ecx
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a0c]
mov eax, 0x86
or esi, dword [0x437ad0]
push esi
mov dword [0x4379d0], eax
push 0x80
call sub.USER32.dll_GetWindow
mov edi, dword [0x437c88]
mov cx, 0x43
sub eax, eax
mov edi, dword [0x437a38]
mov ax, 0x53
push edi
mov esi, 0xdd
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cd0]
add edx, ecx
sub eax, edi
mov ecx, dword [0x437a04]
sub esi, edx
push edx
xor dword [0x437d14], eax
push 0x40
call sub.USER32.dll_GetWindow
mov edx, dword [0x437d20]
mov ax, 0x30
and eax, esi
mov ecx, 0xf1
push ecx
push dword [0x437ca0]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
sub edi, edi
mov eax, dword [0x4379cc]
add esi, eax
push ecx
push ecx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437bc4]
mov eax, 0xa4
mov edi, dword [0x43796c]
mov edi, dword [0x437cdc]
add esi, eax
push 0x11
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ccc]
sub edi, eax
mov esi, dword [0x437c5c]
sbb ecx, dword [0x437acc]
push dword [0x437d10]
mov edi, 1
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c64]
add edx, edx
mov eax, dword [0x437c74]
mov esi, dword [0x437a74]
mov edx, 0xcf
mov edx, dword [0x437ad8]
push edx
mov eax, dword [0x437d04]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437984]
add esi, eax
mov edx, dword [0x437aa8]
mov eax, dword [0x437d20]
mov eax, 0xdd
push eax
push esi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437bb8]
add esi, eax
mov eax, 0xa7
push eax
mov dword [0x43795c], edx
push dword [0x437b28]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b8c]
sub edi, eax
mov eax, dword [0x437958]
mov eax, dword [0x437b3c]
sub edi, eax
add esi, eax
push esi
mov dword [0x437c48], edx
push 0x80
call sub.USER32.dll_GetWindow
invalid
invalid

Function at 0x402ec9
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
add eax, dword [eax]
mov eax, dword [0x437b74]
add eax, esi
mov eax, dword [0x4379a0]
mov eax, dword [0x437a84]
mov eax, dword [0x437c80]
push eax
mov di, 0xfa
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b3c]
mov edi, 0xdb
mov esi, 0x20
mov eax, dword [0x437d54]
or edi, edx
xor eax, dword [0x4379a8]
mov eax, 1
push eax
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437bf4]
sub ecx, eax
mov eax, dword [0x437d18]
mov eax, dword [0x437958]
add eax, ecx
push eax
push eax
call sub.USER32.dll_GetWindow
sbb edx, dword [0x437a4c]
add eax, edi
mov eax, dword [0x4379dc]
add eax, eax
mov eax, dword [0x437c3c]
mov esi, dword [0x437c48]
push esi
push 2

Function at 0x402f4c
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ccc]
add eax, eax
mov esi, dword [0x437a54]
push dword [0x437bc4]
add edx, esi
push edx
call sub.USER32.dll_GetWindow
sub eax, dword [0x43798c]
mov eax, 1
mov eax, dword [0x437b20]
add edx, eax
mov eax, dword [0x437958]
invalid
Function at 0x402f84
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
je 0x403001
inc ebx
add byte [eax - 0x75], dl
adc eax, 0x437c3c
Function at 0x403610
Capabilities:
Authenticate hmac

Disassembly:
inc esp
jnp 0x403656
add al, ch
lds esp, [edx]
add eax, dword [eax]
mov eax, dword [0x437b5c]
mov ecx, 8
mov ecx, dword [0x437d40]
sub ecx, esi
mov edx, dword [0x437c00]
sub esi, edi
mov dword [0x437b00], eax
push 0x40
push 0x20
call sub.USER32.dll_GetWindow
mov esi, dword [0x437c30]
sub esi, ecx
mov eax, dword [0x437d3c]
mov eax, dword [0x43797c]
mov dword [0x437958], eax
push dword [0x437adc]
inc ebx
add bh, bh
xor eax, 0x437adc
push eax
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a64]
sub eax, esi
mov ecx, dword [0x43799c]
invalid
invalid

Function at 0x403793
Capabilities:
Authenticate hmac

Disassembly:
jge 0x4037d8
add byte [ecx], al
shr byte [ecx], 0xf8
mov ecx, dword [0x437b20]
push ecx
mov edi, dword [0x437c10]
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c04]
sub eax, eax
mov edi, dword [0x437a48]
push eax
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x43795c]
mov ax, 0x5c
mov edi, dword [0x437af8]
mov edi, dword [0x437d44]
push edi
mov ecx, dword [0x437c5c]
or eax, 0x437c5c
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ccc]
mov eax, 0x73
mov eax, dword [0x437b40]
mov ecx, 1
push eax
push dword [0x437c3c]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c4c]
mov esi, 0x42
mov eax, dword [0x437958]
sub edi, edx
push 0x81
mov edx, dword [0x437958]
push edx
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437c80]
mov eax, 0xab
sub eax, edx
mov eax, dword [0x437958]
mov ax, 0x49
push eax
push dword [0x437ba4]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437bb8]
sub edx, eax
mov edi, dword [0x437958]
or esi, dword [0x437b10]
sub esi, ecx
push 0xaa
mov eax, 2
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437958]
sub eax, eax
mov edi, 0x8c
sub edx, esi
mov dword [0x437a40], ecx
push dword [0x437ab4]
or ecx, edx
push ecx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437af4]
add eax, eax
and eax, eax
mov eax, dword [0x4379f0]
sub esi, eax
push eax
mov esi, dword [0x4379ac]
add esi, edx
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b50]
sub edx, ecx
mov edi, dword [0x437958]
push eax
mov eax, dword [0x437d00]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b08]
add esi, edi
mov ax, 0x6a
mov ax, 4
push 0x80
push edx
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a58]
add eax, ecx
sub edi, eax
mov esi, dword [0x437ca0]
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a24]
sub ecx, eax
sub eax, edx
push eax
mov esi, dword [0x437b18]
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379d0]
sub eax, eax
mov ecx, dword [0x437b34]
add ecx, edx
push ecx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b90]
mov di, 4
sub ecx, ecx
mov ax, 0x10
push eax
push dword [0x437b78]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b60]
xor eax, edi
Function at 0x403947
Capabilities:
Authenticate hmac

Disassembly:
mov eax, 4
sub edi, edx
push esi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b30]
mov ax, 9
xor edi, dword [0x4379ac]
mov esi, 1
sbb eax, dword [0x437d3c]
push edx
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x4379e4]
mov eax, 4
mov eax, 0x48
add byte [eax], al
add byte [ecx], al
sar dword [eax + 8], 0x50

Function at 0x403983
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [ecx], al
sar dword [eax + 8], 0x50
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437a48]
sub edx, ecx
mov eax, dword [0x437b04]
mov eax, 0x10
push eax
mov dword [0x437a88], eax
push dword [0x437a20]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d14]
add eax, eax
mov eax, dword [0x437c74]
sub eax, esi
mov edi, dword [0x437d20]
add edi, ecx
push edi
mov eax, dword [0x437cd8]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c30]
mov eax, 0x4e
mov edi, dword [0x437c1c]
sub esi, eax
mov ecx, dword [0x437c48]
mov dword [0x437964], eax
push dword [0x437d14]
mov dword [0x437c08], eax
push dword [0x437cc0]
call sub.USER32.dll_GetWindow
mov edx, dword [0x4379f4]
mov ax, 2
mov edx, dword [0x437cf4]
mov esi, dword [0x437ba4]
mov ecx, 4
push dword [0x437958]
push 8
call sub.USER32.dll_GetWindow
mov esi, dword [0x437b08]
sub edx, eax
mov edx, dword [0x437a00]
mov eax, dword [0x437c78]
push edx
push eax
call sub.USER32.dll_GetWindow
adc edx, dword [0x437aa4]
mov di, 0x80
mov edx, dword [0x4379b0]
mov si, 0x40
mov eax, dword [0x43797c]
push eax
mov eax, dword [0x437af8]
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c74]
mov eax, 4
mov eax, dword [0x437958]
mov di, 1
mov di, 0x1c
push edi
push 0x51
call sub.USER32.dll_GetWindow
mov edx, dword [0x437be4]
mov edi, 0x20
mov eax, dword [0x437c14]
push 0x35
mov esi, dword [0x437abc]
push esi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437cd0]
mov esi, 0x20
add edi, eax
mov edi, dword [0x4379e0]
push edi
mov dword [0x437b28], edi
push 4
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379e4]
mov dx, 0x57
add edi, ecx
mov edi, dword [0x437aa4]
add eax, eax
push edx
push dword [0x4379c0]
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437c14]
sub edi, edx
add edi, eax
mov eax, dword [0x437c18]
add ecx, edx
invalid
invalid

Function at 0x403cf0
Capabilities:
Authenticate hmac

Disassembly:
add eax, ecx
mov eax, 4
push dword [0x437b2c]
mov dword [0x437b00], edi
push 0x4c
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437bdc]
mov edx, 0x40
mov si, 0x40
mov dword [0x437b3c], esi
push dword [0x437a1c]
invalid

Function at 0x403d26
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0xe8520010
scasd eax, dword es:[edi]
sbb eax, dword [ebx]
add byte [ebx + 0x4379583d], cl
add byte [esi - 0x48], ah
inc eax
add byte [ecx], al
shl byte [ebx + 0x4379dc], 0xff
xor eax, 0x437adc

Function at 0x403dec
Capabilities:
Authenticate hmac

Disassembly:
add byte [ebx + 0x437b0c35], cl
add byte [eax + 0x47], bh
mov edi, dword [0x437b64]
mov ecx, dword [0x437c20]
mov ecx, 2
push ecx
push dword [0x437d24]
call sub.USER32.dll_GetWindow
Function at 0x403e15
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [0x437a38]
mov edi, 0x20
mov eax, dword [0x437b88]
push eax
push 8
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437d08]
mov di, 2
mov si, 4
or eax, esi
push 0xaf
push ecx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437c7c]
sub eax, eax
mov edx, dword [0x437bc4]
mov ax, 1
sub ecx, eax
push edx
mov dword [0x437b04], eax
push dword [0x437b2c]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c08]
sub eax, ecx
mov eax, dword [0x437958]
push edx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x43799c]
mov eax, 0xb5
mov esi, dword [0x437b38]
mov eax, dword [0x437b40]
push 8
push esi
call sub.USER32.dll_GetWindow
adc edi, dword [0x437a2c]
mov ecx, 0xe0
sub esi, edi
push edi
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c84]
mov si, 0x20
mov edx, dword [0x437c54]
mov esi, dword [0x437a2c]
push dword [0x43796c]
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379b4]
mov eax, 8
mov esi, dword [0x437b38]
sub eax, eax
mov ecx, 0x80
push ecx
add eax, eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c30]
mov edi, 0xa4
mov esi, dword [0x437c0c]
add eax, esi
push eax
push dword [0x437958]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b34]
add edi, eax
mov eax, dword [0x437958]
sub eax, edx
mov ecx, dword [0x437d48]
sub ecx, eax
push ecx
adc eax, dword [0x437958]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x43795c]
mov eax, 0x2a
mov edx, dword [0x437c14]
sub eax, edx
mov eax, 2
and dword [0x437c5c], eax
push 4
push edx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437ce0]
Function at 0x403f5d
Capabilities:
Authenticate hmac

Disassembly:
add edi, edx
mov cx, 0x8d
add eax, eax
push eax
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ce0]
mov eax, 0x20
mov eax, dword [0x437958]
add esi, eax
add eax, ecx
push edx
sub eax, edx
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437d54]
mov edx, 0x56
mov eax, dword [0x437958]
add edx, eax
mov eax, dword [0x437958]
push edi
mov ax, 0x41
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, eax
mov esi, dword [0x437c40]
sub eax, eax
mov eax, dword [0x437d10]
mov ecx, 0x10
mov eax, dword [0x4379a0]
push eax
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379d4]
mov eax, 0x62
add eax, ecx
push 0xbd
push dword [0x437d2c]
call sub.USER32.dll_GetWindow
mov edi, dword [0x437d30]
sub ecx, eax
mov eax, dword [0x437c68]
mov esi, dword [0x437ce0]
mov eax, dword [0x437ab4]
push eax
mov edi, 2
push edi
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b50]
mov dx, 0x59
mov edx, dword [0x4379cc]
mov ecx, 0x46
mov ecx, dword [0x437acc]
mov eax, 0xdf
push eax
push 0x40
call sub.USER32.dll_GetWindow
mov esi, dword [0x437958]
mov esi, 0x80
push eax
push 0xc3
call sub.USER32.dll_GetWindow
mov eax, dword [0x437984]
mov di, 0x10
mov eax, dword [0x43797c]
mov edi, 0xca
mov eax, dword [0x437a04]
push dword [0x437aec]
push dword [0x437a68]
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a64]
sub eax, ecx
mov eax, dword [0x437af0]
sub edi, eax
mov edi, 0xe6
push 0xce
mov edx, 0xc7
push edx
call sub.USER32.dll_GetWindow
mov edi, dword [0x437998]
mov eax, 8
mov ecx, dword [0x437cfc]
add esi, eax
mov esi, dword [0x437b40]
sub esi, edi
push esi
mov di, 0x40
push edi
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a40]
mov ecx, 4
mov esi, dword [0x437d54]
adc edi, dword [0x437af4]
push dword [0x437c88]
mov eax, dword [0x437c60]
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437a84]
add eax, esi
mov eax, 0x40
mov eax, dword [0x437c88]
mov eax, dword [0x437b68]
mov ax, 0x83
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d34]
xor ecx, eax
mov edi, dword [0x437984]
mov eax, 0x79
push dword [0x437c84]
push dword [0x437be8]
call sub.USER32.dll_GetWindow
mov esi, dword [0x4379d4]
mov dx, 0x40
mov ecx, dword [0x437d50]
push eax
push dword [0x437980]
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437b90]
mov eax, 0xe6
sub edi, eax
push eax
push 0x7b
call sub.USER32.dll_GetWindow
invalid
invalid

Function at 0x404162
Capabilities:
Authenticate hmac

Disassembly:
mov esp, 0x1004379
jmp dword [ecx + 0x437a90]
Function at 0x404173
Capabilities:
Authenticate hmac

Disassembly:
xor eax, 0x437a24
mov dx, 0x20
push 8
push 0x10
call sub.USER32.dll_GetWindow
mov edx, dword [0x437b78]
add edi, eax
mov ecx, dword [0x437d30]
push eax
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d34]
mov ax, 0x1f
xor dword [0x437a28], 0xffffffff
push dword [0x437c30]
mov esi, dword [0x437c0c]
push esi
call sub.USER32.dll_GetWindow
adc edi, dword [0x437a88]
mov ecx, 1
mov eax, dword [0x437c60]
push eax
add eax, dword [0x437c80]
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437ce0]
mov ax, 0x5c
add edx, eax
add eax, ecx
push eax
mov edi, dword [0x437cd4]
push edi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437aa4]
add eax, ecx
add edi, dword [0x437d28]
mov esi, 1
mov esi, dword [0x437cf4]
sub edx, edx
push edi
push 4
call sub.USER32.dll_GetWindow
mov edi, dword [0x4379f0]
add esi, esi
push edi
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437978]
sub eax, eax
mov edi, 8
push eax
push dword [0x437964]
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379dc]
mov si, 4
mov si, 0x80
add esi, esi
push dword [0x437bbc]
push 0xe5
call sub.USER32.dll_GetWindow
sbb edx, dword [0x43795c]
mov eax, 0x62
push dword [0x437be4]
mov edx, dword [0x437958]
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ca8]
add edi, eax
mov eax, dword [0x437abc]
mov eax, dword [0x437a50]
sub ecx, ecx
push dword [0x437afc]
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437ba8]
add esi, edi
mov esi, dword [0x437958]
mov ax, 0xf9
push dword [0x437be8]
mov eax, dword [0x4379b8]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c34]
mov eax, 0x3f
sub ecx, ecx
mov eax, dword [0x4379c8]
push eax
push 0x2e
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437af8]
add eax, edi
mov eax, dword [0x437958]
mov si, 0xdf
push ecx
mov eax, dword [0x437a38]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a40]
sub esi, ecx
sub ecx, eax
mov edi, dword [0x437c38]
mov ecx, dword [0x437a04]
push ecx
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a98]
xor eax, edi
push edx
invalid
invalid
Function at 0x404831
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [0x437abc]
sub eax, edi
push 1
push edi
call sub.USER32.dll_GetWindow
mov edi, dword [0x437b60]
add edi, edi
mov ecx, dword [0x437d40]
mov esi, dword [0x437b38]
push esi
push dword [0x437cfc]
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a20]
mov cx, 0xe6
add ecx, ecx
sub eax, dword [0x437b8c]
push dword [0x437c10]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437b08]
mov ax, 0x40
mov eax, dword [0x437d14]
mov ecx, dword [0x437c00]
mov ax, 4
push 0x80
push esi
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c30]
mov ax, 0xa5
mov eax, dword [0x437d24]
mov ax, 4
mov ecx, dword [0x437c18]
push 0x10
mov dword [0x437a5c], eax
push 0x40
call sub.USER32.dll_GetWindow
mov eax, dword [0x437970]
mov dx, 4
mov esi, dword [0x437c2c]
sub eax, eax
push dword [0x437c84]
push 0xeb
call sub.USER32.dll_GetWindow
sub edi, dword [0x437ac0]
sub edx, ecx
mov eax, dword [0x437c34]
push 4
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x4379b4]
mov eax, 0xed
sub eax, edx
mov eax, dword [0x437bb8]
or edx, eax
push eax
push eax
call sub.USER32.dll_GetWindow
mov edx, dword [0x437bf4]
sub eax, eax
mov eax, dword [0x437b2c]
mov cx, 0xfa
mov edx, dword [0x437958]
push dword [0x437a80]
push 0x40
call sub.USER32.dll_GetWindow
mov eax, dword [0x437d38]
sub edi, eax
mov ecx, dword [0x437d1c]
add edx, eax
push 0x10
mov dword [0x437acc], esi
push 0xd
call sub.USER32.dll_GetWindow
add edx, dword [0x437c0c]
sub ecx, edx
mov ecx, dword [0x437ccc]
mov edi, dword [0x437b60]
push esi
mov edx, 4
push edx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437c34]
mov dx, 0x85
mov eax, dword [0x4379bc]
sub eax, edx
mov eax, dword [0x4379e4]
mov ax, 0xcd
push dword [0x437d24]
push 0x4b
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a10]
mov edi, 0x80
mov edx, dword [0x437d3c]
mov eax, dword [0x437970]
mov ax, 0x20
mov dword [0x437ab4], eax
push 0x40
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c60]
add edx, eax
mov edx, dword [0x4379e0]
mov dx, 0xa1
mov dword [0x437a14], eax
push dword [0x437b8c]
push eax
call sub.USER32.dll_GetWindow
mov edi, dword [0x437b60]
add edi, eax
mov eax, dword [0x437ac4]
sub eax, esi
push dword [0x437d34]
push 0xb4
call sub.USER32.dll_GetWindow
mov esi, dword [0x437a24]
add eax, eax
mov eax, 0xbb
add byte [ecx + 0x437c0c], ah
Function at 0x404a13
Capabilities:
Authenticate hmac

Disassembly:
add byte [ecx + 0x437c0c], ah
add edi, eax
xor eax, edi
push eax
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437aec]
mov ax, 0x33
mov eax, 8
push edi
push dword [0x437a20]
call sub.USER32.dll_GetWindow
mov esi, dword [0x437d48]
mov eax, 8
mov eax, dword [0x4379f8]
push ecx
push esi
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a3c]
sub eax, eax
mov edx, dword [0x437d14]
mov edi, 0x20
mov edi, dword [0x437ab0]
mov di, 8
push edi
mov eax, dword [0x437958]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437cb0]
sub edi, eax
mov ecx, dword [0x437ca0]
mov ax, 0xde
mov esi, 0xa0
add edx, eax
push edx
push 1
call sub.USER32.dll_GetWindow
mov eax, dword [0x437994]
mov edi, 8
mov edi, dword [0x437a08]
push 0x10
push 2
call sub.USER32.dll_GetWindow
mov edx, dword [0x437d18]
add eax, eax
adc eax, dword [0x437adc]
mov ax, 0x21
or esi, eax
push esi
push edx
call sub.USER32.dll_GetWindow
mov edx, dword [0x437afc]
add eax, eax
sub ecx, eax
push dword [0x43797c]
mov eax, dword [0x437b64]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437af8]
or esi, ecx
and eax, eax
mov cx, 0xb3
push eax
push edx
call sub.USER32.dll_GetWindow
mov esi, dword [0x437c88]
sub eax, eax
sub eax, edx
mov edx, 0x83
push edi
mov dword [0x437bb4], edx
push dword [0x437be8]
call sub.USER32.dll_GetWindow
mov edx, dword [0x437ad8]
add edx, eax
mov esi, dword [0x437970]
sub eax, esi
mov edx, dword [0x437b00]
push edx
mov edx, dword [0x437c8c]
push edx
call sub.USER32.dll_GetWindow
mov eax, dword [0x437958]
add eax, esi
mov edx, dword [0x437988]
mov eax, 0xaf
add byte [eax], al
add byte [eax - 1], dl
xor eax, 0x437b68

Function at 0x404b53
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax - 1], dl
xor eax, 0x437b68
call sub.USER32.dll_GetWindow
mov ecx, dword [0x437a78]
mov si, 4
mov edi, dword [0x437958]
xor edx, eax
push 4
push eax
call sub.USER32.dll_GetWindow
mov esi, dword [0x437b8c]
mov esi, 4
or esi, esi
sub edi, esi
push edi
mov eax, dword [0x4379e8]
push eax
call sub.USER32.dll_GetWindow
mov eax, dword [0x437c10]
mov cx, 0x32
mov esi, dword [0x43795c]
push dword [0x437b98]
push 0x20
call sub.USER32.dll_GetWindow
mov eax, dword [0x437a84]
inc ebx
add byte [ecx], al
invalid
mov eax, dword [0x4379b8]
xor ecx, eax
mov eax, dword [0x437a10]
mov si, 0x20
push edi
push edx
call sub.USER32.dll_GetWindow
invalid
invalid
invalid

Function at 0x404bd4
Capabilities:
Authenticate hmac

Disassembly:
jp 0x404c19
add byte [ecx], al
invalid
jnp 0x404c5e
add byte [esi - 0x42], ah
mov esi, 0xc8295100