joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4481d2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48838b
mov eax, dword fs:[0]
push eax
sub esp, 0x108
push ebx
push esi
push edi
mov eax, dword [0x4b2068]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
push 6
xor ebx, ebx
pop ecx
xor eax, eax
mov dword [esp + 0x18], ebx
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x34]
call fcn.00444740
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x120], ebx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edi, edi
inc edi
push edi
push ecx
sub eax, edx
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x1c], esp
push str.0_0__0__0
sub esi, ecx
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 1
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x49bb00
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
lea eax, [esp + 0x18]
push eax
push ebx
push 0x47
lea ecx, [esp + 0x40]
call fcn.004388d3
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov esi, 0x49c134
push esi
push eax
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 2
mov eax, esp
mov dword [esp + 0x20], esp
push str.margin_left
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push esi
push eax
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 3
mov eax, esp
mov dword [esp + 0x20], esp
push str.margin_right
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push esi
push eax
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 4
mov eax, esp
mov dword [esp + 0x20], esp
push str.margin_top
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push esi
push eax
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 5
mov eax, esp
mov dword [esp + 0x20], esp
push str.margin_bottom
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
push edi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.new_shadow
push eax
call fcn.00449823
push ecx
mov byte [esp + 0x12c], 6
mov eax, esp
mov dword [esp + 0x20], esp
push str.skin
push eax
call fcn.00449823
lea ecx, [esp + 0x40]
mov byte [esp + 0x12c], bl
call fcn.00444e26
push ebx
push dword [ebp + 8]
lea ecx, [esp + 0x3c]
push 0xf
call fcn.004388d3
or dword [esp + 0x120], 0xffffffff
mov eax, dword [esp + 0x110]
add eax, 0xfffffff0
call fcn.0040214e
lea ecx, [esp + 0x34]
call fcn.00438785
xor eax, eax
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448435
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov eax, esp
and dword [eax], 0
lea ebx, [esi - 0x3b4]
call fcn.0044a277
add esi, 0xfffffc50
push esi
call fcn.0044fb7e
cmp dword [0x4b4ed0], 0
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x448473
push 5
push dword [esi]
call edi
cmp dword [0x4b5034], 0
je 0x44848e
lea esi, [ebx + 0x524]
call fcn.004503af
push 0
push dword [ebx + 4]
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44864e
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x481f3f
call fcn.0048062c
lea eax, [ebp - 0x10]
call fcn.00408bff
and dword [ebp - 4], 0
push str.kavlog2.exe
lea eax, [ebp - 0x10]
push eax
call fcn.004021d8
mov eax, dword [ebp + 8]
push 5
push 0
push str._uplive
push dword [ebp - 0x10]
push 0x496ef8
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040214e
call fcn.00480704
ret 4

Function at 0x4489e3
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x481f3f
call fcn.0048062c
lea eax, [ebp - 0x10]
call fcn.00408bff
and dword [ebp - 4], 0
push str.kismain.exe
lea eax, [ebp - 0x10]
push eax
call fcn.004021d8
mov eax, dword [ebp + 8]
push 5
push 0
push str._Setting_Update:ProxySetting
push dword [ebp - 0x10]
push 0x496ef8
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040214e
call fcn.00480704
ret 4

Function at 0x448a39
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp dword [0x4b5034], 0
push ebx
push esi
je 0x448a4e
mov ecx, edi
call fcn.00449765
jmp 0x448a8c
cmp eax, 0x201
je 0x448a6a
cmp eax, 0x204
je 0x448a6a
cmp eax, 0x202
je 0x448a6a
cmp eax, 0x405
jne 0x448a8c
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x568]
call ebx
lea esi, [edi + 0x524]
call fcn.004502b7
push 1
push dword [edi + 4]
call ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x448bde
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
call fcn.00409e32
and dword [edi + 0x550], 0
lea esi, [edi + 0x524]
call fcn.004502b7
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov ebp, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push ebp
mov dword [esp + 0x1c], eax
call ebx
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor esi, esi
push esi
push dword [esp + 0x14]
push ebp
call ebx
mov dword [edi + 0x3d8], esi
mov dword [0x4b4ed0], esi
mov ecx, dword [edi + 0x3c8]
cmp ecx, esi
je 0x448c64
mov eax, dword [ecx]
call dword [eax + 0x14]
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
pop ecx
ret
Function at 0x449eab
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp ebp, esi
push edi
mov ebx, eax
mov dword [esp + 0x18], esi
jne 0x449ee2
mov eax, dword [0x4b5124]
cmp eax, esi
je 0x449ed0
mov ebp, dword [eax + 4]
jmp 0x449ed2
xor ebp, ebp
cmp ebp, esi
jne 0x449ee2
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x449f07
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x449f07
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x449f07
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x18], 1
push ecx
mov eax, esp
mov dword [ebx + 0x3ac], esi
push ebp
mov dword [eax], esi
call fcn.0044b15d
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x14], ecx
jne 0x449f32
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x44a021
mov eax, dword [0x4b5124]
cmp eax, esi
mov dword [esp + 0x1c], esi
je 0x449f49
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov dword [eax + 4], ecx
mov eax, ebp
call fcn.0044b82e
cmp dword [ebx + 0x3a0], esi
je 0x449fc0
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp edi, dword [esp + 0x24]
je 0x449fa4
push 1
push edi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp edi, dword [esp + 0x24]
je 0x449fc0
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, ebx
call fcn.0044b305
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x3ac], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x18], esi
je 0x44a005
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x44a005
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x44a005
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4b5124]
cmp eax, esi
je 0x44a015
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x44a41c
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [0x4b5124]
xor esi, esi
cmp eax, esi
push edi
mov dword [esp + 0x1c], esi
je 0x44a439
mov ebp, dword [eax + 4]
jmp 0x44a43b
xor ebp, ebp
cmp ebp, esi
jne 0x44a44b
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
cmp ebp, esi
je 0x44a470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebp, eax
je 0x44a470
push ebp
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x44a470
push esi
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push ecx
mov eax, esp
mov dword [ebx + 0x3ac], esi
push ebp
mov dword [eax], esi
call fcn.0044b686
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x18], ecx
jne 0x44a49b
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x44a58a
mov eax, dword [0x4b5124]
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x44a4b2
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov dword [eax + 4], ecx
mov eax, ebp
call fcn.0044b82e
cmp dword [ebx + 0x3a0], esi
je 0x44a529
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp edi, dword [esp + 0x14]
je 0x44a50d
push 1
push edi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp edi, dword [esp + 0x14]
je 0x44a529
push esi
push edi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, ebx
call fcn.0044b305
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x3ac], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x44a56e
push 1
push ebp
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebp, esi
je 0x44a56e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x44a56e
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x4b5124]
cmp eax, esi
je 0x44a57e
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x44c5c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x2f4]
cmp dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x44c5f3
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov eax, dword [esi + 0x2e8]
cmp eax, ebx
je 0x44c6d1
push eax
call fcn.004384b4
mov edi, eax
cmp edi, ebx
pop ecx
je 0x44c686
mov eax, dword [edi]
push 2
push ebx
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x44c62b
push 1
push edi
call fcn.0044bb92
mov eax, dword [esi + 0x2e8]
cmp eax, dword [esi + 0x2e4]
jne 0x44c686
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.004388d3
mov eax, dword [edi + 0x40]
cmp eax, ebx
je 0x44c675
cmp word [eax], bx
je 0x44c675
push 1
push ebx
push ebx
push eax
push 0x496ef8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x44c686
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x44c686
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [esi + 0x2e8], ebx
je 0x44c6d1
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44d231
Capabilities:
Log keystrokes via polling

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x44d278
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x44d271
cmp dword [esp + 4], 0x1b
jne 0x44d258
push 0
push 2
jmp 0x44d263
cmp dword [esp + 4], 0xd
jne 0x44d271
push 0
push 1
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x3b0], 0
ret 4
Function at 0x4566f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, eax
sub ecx, dword [esi + 0x18]
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push edi
push 1
push ecx
xor ebx, ebx
mov dword [ebp + 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov edi, dword [esi + 0xfc]
cmp edi, ebx
mov dword [ebp - 0x10], eax
je 0x45683b
push edi
call fcn.004384b4
mov ebx, eax
test ebx, ebx
pop ecx
je 0x45680b
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x456771
lea eax, [ebx + 0x14]
push eax
call fcn.00438e28
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.004388d3
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xfc], eax
jne 0x4567c8
mov eax, dword [ebx + 0x40]
xor ecx, ecx
cmp eax, ecx
je 0x4567ba
cmp word [eax], cx
je 0x4567ba
push 1
push ecx
push ecx
push eax
push 0x496ef8
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45680b
cmp dword [ebx + 0x10], ecx
je 0x45680b
mov dword [ebp - 4], 1
jmp 0x45680b
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x4567e7
lea eax, [ebx + 0x14]
push eax
call fcn.00438e28
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.004388d3
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xfc], ecx
je 0x45681c
push 0x67
jmp 0x456834
cmp dword [ebp - 8], ecx
je 0x45683b
cmp dword [ebp - 0xc], ecx
je 0x45683b
lea eax, [esi + 0xf8]
cmp edi, dword [eax]
jne 0x456832
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00456321
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4583de
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x4819b7
call fcn.0048062c
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00402357
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.004049e9
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040214e
call fcn.00480704
ret 4
Function at 0x459af6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x4b2068]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x459b59
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
cmp eax, edi
je 0x459c07
mov eax, dword [ebp - 0x98]
dec eax
je 0x459bf3
dec eax
jne 0x459c07
cmp dword [ebp - 0xa4], 6
jne 0x459ba4
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x459b8c
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
add ecx, 8
jmp 0x459ba0
cmp dword [ebp - 0xa0], edi
jne 0x459be0
xor ecx, ecx
cmp byte [ebp + 0x72], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x459c07
cmp dword [ebp - 0xa4], 5
jne 0x459bd3
cmp dword [ebp - 0xa0], 2
jne 0x459bba
push 5
jmp 0x459bf0
cmp dword [ebp - 0xa0], 1
jne 0x459bc7
push 6
jmp 0x459bf0
cmp dword [ebp - 0xa0], edi
jne 0x459c07
push 3
jmp 0x459bf0
cmp dword [ebp - 0xa4], 4
ja 0x459c07
push 4
jmp 0x459bf0
cmp dword [ebp - 0xa0], 2
jne 0x459c07
cmp byte [ebp + 0x72], al
jne 0x459c07
push 0xa
pop edi
jmp 0x459c07
mov eax, dword [ebp - 0x9c]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov ecx, dword [ebp + 0x74]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047f7b2
add ebp, 0x78
leave
ret

Function at 0x459d0c
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [eax + 8]
cmp ecx, 1
jne 0x459d5f
mov eax, dword [eax + 0xc]
cmp eax, 0x12e
jne 0x459d2d
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
ret
cmp eax, 0x131
jne 0x459d5f
cmp dword [esi + 0x3d0], 0
je 0x459d29
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x465
push dword [esi + 0x3d4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x459d29
and dword [esi + 0x3cc], 0
xor eax, eax
ret
Function at 0x459d9f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x4e
push ebx
push esi
push edi
mov esi, eax
jne 0x459ddb
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0xffffffff
jne 0x459e3f
xor ebx, ebx
inc ebx
lea edi, [esi + 0x3cc]
mov dword [edi], ebx
call fcn.00459d0c
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi], 0
je 0x459e3f
mov eax, ebx
jmp 0x459e5d
cmp dword [ebp + 0xc], 0x110
jne 0x459dff
push ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
inc ebx
mov eax, esp
lea edi, [esi + 0x3cc]
mov dword [edi], ebx
push esi
mov dword [eax], ecx
call fcn.00459e94
jmp 0x459dca
cmp dword [ebp + 0xc], 0x113
jne 0x459e3f
xor ebx, ebx
inc ebx
mov eax, 0x2711
cmp dword [ebp + 0x10], eax
mov dword [esi + 0x3cc], ebx
jne 0x459e30
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0x3cc], 0
jmp 0x459dd2
push 0
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045a4fc
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x45c45c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x45c4a8
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x10c]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x45c4a8
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1f0]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x2f0], 0
je 0x45c520
lea ebx, [esi + 0x300]
cmp dword [ebx], 0
je 0x45c4c5
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x2f0], edi
jne 0x45c519
push edi
call fcn.004384b4
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.004388d3
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x10]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x2f0], 0
pop edi
pop ebx
leave
ret 0xc
Function at 0x45c7e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x300]
cmp dword [edi], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
je 0x45c814
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x45c858
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x10c]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x45c858
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1f0]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ebx, eax
mov eax, dword [esi + 0x2ec]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x45c9af
push eax
call fcn.004384b4
mov edi, eax
test edi, edi
pop ecx
je 0x45c92e
mov eax, dword [edi + 0x10]
push 2
mov dword [ebp - 4], eax
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x45c89c
push edi
call fcn.0045a90b
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.004388d3
cmp dword [esi + 0x2ec], ebx
jne 0x45c8f0
mov ecx, dword [edi + 0x40]
xor eax, eax
cmp ecx, eax
je 0x45c8e2
cmp word [ecx], ax
je 0x45c8e2
push 1
push eax
push eax
push ecx
push 0x496ef8
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45c92e
cmp dword [edi + 0x10], eax
je 0x45c92e
mov dword [ebp - 8], 1
jmp 0x45c92e
mov eax, dword [edi]
xor ebx, ebx
inc ebx
push ebx
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x45c90e
push edi
call fcn.0045a90b
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x2a3
call fcn.004388d3
mov dword [ebp - 0xc], ebx
xor eax, eax
cmp dword [ebp - 8], eax
mov dword [esi + 0x2ec], eax
je 0x45c970
mov eax, dword [esi + 4]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x1c], 1
call dword [eax + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45c9af
cmp dword [ebp - 0xc], eax
je 0x45c9af
mov ecx, dword [ebp - 4]
cmp ecx, eax
je 0x45c9af
mov eax, dword [esi + 4]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x24]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x2e8]
cmp ecx, dword [eax]
jne 0x45c9af
and dword [eax], 0
pop edi
pop esi
pop ebx
leave
ret 0xc