joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443502
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, 0x4681d8
mov ecx, esi
call fcn.00443ae3
test eax, eax
jne 0x443533
push 0x45a5d8
push eax
push 0x45a7bc
mov ecx, edi
call fcn.0044c1bc
jmp 0x4436f2
mov ecx, dword [0x467b78]
push ebx
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45bf4c
call fcn.0040184e
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push ebx
jne 0x443574
mov ecx, esi
call fcn.0044374a
jmp 0x4436f1
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
jmp 0x44368c
cmp eax, 1
je 0x443597
cmp eax, 7
je 0x443597
cmp eax, 0xd
mov byte [ebp + 0xb], bl
jne 0x44359b
mov byte [ebp + 0xb], 1
cmp eax, 8
je 0x4435a8
cmp eax, 0x11
mov byte [ebp - 1], bl
jne 0x4435ac
mov byte [ebp - 1], 1
cmp eax, 0xe
je 0x4435ba
cmp eax, 3
je 0x4435ba
xor cl, cl
jmp 0x4435bc
mov cl, 1
cmp byte [ebp + 0xb], bl
je 0x4435ca
cmp byte [ebp - 2], bl
jne 0x44368b
cmp byte [ebp - 1], bl
je 0x4435d8
cmp byte [ebp - 3], bl
jne 0x44368b
cmp cl, bl
je 0x4435e5
cmp byte [ebp - 4], bl
jne 0x44368b
cmp byte [ebp + 0xb], bl
je 0x4435f0
mov byte [ebp - 2], 1
jmp 0x443603
cmp byte [ebp - 1], bl
je 0x4435fb
mov byte [ebp - 3], 1
jmp 0x443603
cmp cl, bl
je 0x443603
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004439a1
mov edi, eax
cmp edi, ebx
je 0x443688
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalSize]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x44362d
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x443688
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44369f
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44369f
cmp dword [ebp - 0x10], ebx
je 0x443688
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp esi, ebx
mov esi, 0x4681d8
je 0x4436ab
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x443585
jmp 0x4436ab
cmp dword [ebp - 0x10], ebx
je 0x4436ab
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
mov ecx, esi
call fcn.0044374a
cmp dword [ebp - 8], ebx
jne 0x4436e5
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4436e5
mov ecx, dword [0x467b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443796
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x4437b8
call fcn.00443ae3
test eax, eax
jne 0x4437b8
push 0x45a804
jmp 0x443845
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4437d1
push ebx
mov ecx, esi
call fcn.0044374a
push 0x45a7f4
jmp 0x443845
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x443815
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x443823
cmp byte [eax], bl
jne 0x4437f4
cmp dword [ebp + 8], 0xd
jne 0x4437ee
cmp byte [eax + 1], bl
jne 0x4437f4
mov byte [ebp - 1], 1
jmp 0x4437f7
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x443823
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.0044374a
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x443838
mov dword [esi + 4], ebx
jmp 0x443815
push ebx
mov ecx, esi
call fcn.0044374a
push 0x45a7e0
mov ecx, esi
call fcn.004436f8
jmp 0x44381d

Function at 0x4439a1
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xc000
jb 0x443a56
cmp esi, 0xffff
ja 0x443a56
push 0x104
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x10c]
push 0x45a7b0
push eax
call fcn.00442545
add esp, 0xc
test eax, eax
je 0x443a4f
lea eax, [ebp - 0x10c]
push 0x45a7a4
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push 0x45a798
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push 0x45a790
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push 0x45a780
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x443a5d
xor eax, eax
jmp 0x443ade
mov byte [ebp - 0x10c], 0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
jmp 0x443ad3
cmp dword [ebp + 8], 0xf
je 0x443adb
lea eax, [ebp - 0x10c]
push 0x45a798
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443adb
mov eax, dword [0x465064]
cmp eax, 0xffffffff
je 0x443ab1
test eax, eax
je 0x443adb
call edi
mov ecx, dword [0x465064]
mov edx, dword [ebp - 4]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x443adb
and dword [0x46506c], 0
push 1
push 0x8000012f
call fcn.0040de6e
pop ecx
pop ecx
push dword [ebp + 8]
mov dword [0x46506c], 1
call esi
test eax, eax
je 0x443a72
jmp 0x443add
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x443ae3
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ecx
cmp dword [ecx + 0x18], 0
mov dword [esp], ecx
je 0x443af2
xor eax, eax
inc eax
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
push dword [0x467254]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
xor ebp, ebp
inc ebp
jmp 0x443b54
mov eax, dword [0x465064]
cmp eax, 0xffffffff
je 0x443b32
test eax, eax
je 0x443b63
call esi
mov ecx, dword [0x465064]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x443b63
and dword [0x46506c], 0
push ebp
push 0x8000012f
call fcn.0040de6e
pop ecx
pop ecx
push dword [0x467254]
mov dword [0x46506c], ebp
call edi
test eax, eax
je 0x443b13
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], ebp
mov eax, ebp
jmp 0x443b65
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x443ea6
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
jmp 0x443eb1
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x443eae
mov edi, dword [esp + 0x14]
cmp byte [edi + 0x17], 0
jne 0x443ec4
mov edi, dword [edi + 0xc]
mov ecx, edi
call fcn.00401dcc
xor ebx, ebx
inc ebx
cmp byte [esi + 0x17], bl
jne 0x443f13
push ebx
mov ecx, esi
call fcn.00401e61
cmp dword [edi + 8], eax
je 0x443f0f
push ebx
push 0
push dword [edi + 0xc]
mov ecx, esi
push 0
call fcn.0040184e
test eax, eax
je 0x443f60
mov eax, dword [edi + 0xc]
inc eax
push eax
push dword [edi + 8]
mov ecx, esi
push ebx
call fcn.00401e61
push eax
call fcn.004576b0
add esp, 0xc
or byte [esi + 0x15], bl
mov eax, ebx
jmp 0x443f60
mov ecx, 0x4681d8
call fcn.00443ae3
test eax, eax
jne 0x443f37
push 0x45a5d8
push 0x45a804
mov ecx, 0x467ce0
call fcn.0044c37d
jmp 0x443f60
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi + 8]
mov eax, dword [edi + 0xc]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x443f6b
push 0
mov ecx, 0x4681d8
call fcn.0044374a
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x443f53
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x443f53
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x443f53
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x443fd0
test ebx, ebx
je 0x443fba
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x443ff5
push ebx
push esi
push eax
call fcn.004576b0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x443f67
jmp 0x443f53
push 0
mov ecx, 0x4681d8
call fcn.0044374a
push 0x45a5d8
push 0x45bd50
mov ecx, 0x467ce0
call fcn.0044c37d
jmp 0x443f5f
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
mov ecx, 0x4681d8
call fcn.0044374a
push 0x45a5d8
push 0x45a768
jmp 0x443fe6
Function at 0x444014
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.00444e8e
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x444211
test al, al
push esi
jne 0x444065
cmp byte [esp + 0x34], al
jne 0x444065
push 0x467248
xor esi, esi
push esi
push esi
push 0x44501c
push 0x2000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x468414], eax
je 0x4440fc
push 0xf
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x467248]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4440a0
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x44407f
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x444106
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x444137
cmp dword [esp + 0x24], esi
je 0x444166
mov byte [esp + 0x13], 1
call fcn.00444e8e
test al, al
jne 0x444166
cmp byte [esp + 0x40], al
jne 0x4441e2
mov byte [esp + 0x3c], al
jmp 0x4440b1
call fcn.00444e1b
jmp 0x444210
cmp byte [esp + 0x40], 0
je 0x44411a
call fcn.00444e8e
xor esi, esi
test al, al
je 0x444166
jmp 0x444137
lea eax, [esp + 0x14]
push eax
push dword [0x468414]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x444150
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x444166
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4440b1
push dword [0x468414]
call ebx
and dword [0x468414], 0
call fcn.00444e1b
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x4441db
cmp dword [0x467388], esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
je 0x444192
test byte [esp + 0x12], 1
jne 0x4441a7
push 0x45b708
push esi
push esi
call edi
mov dword [0x4683f0], eax
jmp 0x4441a7
test byte [esp + 0x12], 1
je 0x4441a7
push dword [0x4683f0]
call ebx
mov dword [0x4683f0], esi
cmp dword [0x46738c], esi
je 0x4441c6
test byte [esp + 0x12], 2
jne 0x4441db
push 0x45b714
push esi
push esi
call edi
mov dword [0x4683f4], eax
jmp 0x4441db
test byte [esp + 0x12], 2
je 0x4441db
push dword [0x4683f4]
call ebx
mov dword [0x4683f4], esi
cmp byte [esp + 0x13], 0
je 0x44420d
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x45bac0
mov dword [0x46506c], esi
call fcn.0043c205
add esp, 0x18
mov dword [0x46506c], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4451af
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x4451b9
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
je 0x4451ce
cmp byte [esp + 0xc], 0x10
jne 0x445223
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x445223
cmp byte [0x4683e3], cl
je 0x4451f1
call fcn.00444e04
test al, al
jne 0x4451f1
mov byte [0x4683e3], cl
xor al, al
pop esi
ret
cmp byte [0x4683dd], cl
je 0x445223
xor eax, eax
mov ax, word [0x4683e0]
push eax
xor eax, eax
mov al, byte [0x4683e2]
push eax
call fcn.0044514b
add esp, 8
test al, al
je 0x445223
call esi
sub eax, dword [0x4683d8]
cmp eax, 0x16
jb 0x4451ed
call esi
mov dword [0x4683b8], eax
mov al, 1
pop esi
ret
Function at 0x447148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4683dc], 0
je 0x4471c3
mov al, byte [0x4683e2]
cmp al, 0xa0
je 0x447161
cmp al, 0x10
jne 0x4471c3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4683d8]
cmp eax, 0x16
jae 0x4471c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044514b
add esp, 8
cmp byte [0x4683dd], 0
jne 0x44719b
call fcn.00444e04
test al, al
je 0x4471c3
mov byte [0x4683e3], 1
jmp 0x4471a5
cmp byte [ebp + 0x14], 0
jne 0x44718e
test al, al
je 0x4471c3
mov al, byte [0x4683d4]
mov byte [0x467272], al
mov al, byte [0x4683d3]
mov byte [0x467288], al
mov al, byte [0x4683d2]
mov byte [0x467318], al
mov al, byte [0x467272]
mov ecx, dword [0x468404]
mov byte [0x4683d4], al
mov al, byte [0x467288]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x4683d3], al
mov al, byte [0x467318]
mov byte [0x4683d2], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x44730d
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004451af
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x4472b3
cmp byte [ebp + 0x18], 0
jne 0x447245
mov cl, bl
not cl
and byte [0x467270], cl
cmp byte [ebp + 0xb], 0
je 0x447245
and byte [0x467271], cl
test al, al
je 0x44730d
not bl
and byte [0x467272], bl
sub esi, 0xa0
mov byte [esi + 0x467318], 0
je 0x4472ac
dec esi
je 0x4472a0
dec esi
je 0x447294
dec esi
je 0x44728d
dec esi
je 0x44727e
dec esi
jne 0x44730d
mov al, byte [0x46731c]
jmp 0x447283
mov al, byte [0x46731d]
mov byte [0x46728a], al
jmp 0x44730d
mov al, byte [0x46731a]
jmp 0x447299
mov al, byte [0x46731b]
mov byte [0x467289], al
jmp 0x44730d
mov al, byte [0x467318]
mov byte [0x467288], al
jmp 0x44730d
mov al, byte [0x467319]
jmp 0x4472a5
cmp byte [ebp + 0x18], 0
jne 0x4472cb
or byte [0x467270], bl
cmp byte [ebp + 0xb], 0
je 0x4472cb
or byte [0x467271], bl
test al, al
je 0x44730d
or byte [0x467272], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x467278], 0x80
jb 0x44730d
cmp byte [ebp + 0xc], 0xa1
jbe 0x447306
cmp byte [ebp + 0xc], 0xa3
jbe 0x4472fd
cmp byte [ebp + 0xc], 0xa5
ja 0x44730d
mov byte [0x46728a], 0x80
jmp 0x44730d
mov byte [0x467289], 0x80
jmp 0x44730d
mov byte [0x467288], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x4683e0], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x4683e2], al
mov byte [0x4683dd], cl
call fcn.004451af
add esp, 0xc
mov byte [0x4683dc], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop edi
pop esi
mov dword [0x4683d8], eax
pop ebx
pop ebp
ret
Function at 0x448107
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x44813b
cmp byte [0x46818c], al
je 0x4481d8
push 1
push eax
push 0xffffffffffffffff
push 0x45bf4c
jmp 0x4481cd
cmp byte [0x46818c], 0
push ebx
push ebp
push esi
mov ebp, 0x467b80
jne 0x448150
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x4481ab
cmp byte [edi], 0
je 0x4481b6
cmp byte [edi + 1], 0x3a
jne 0x4481b6
cmp byte [edi + 2], 0
jne 0x4481b6
push ebp
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x4481b6
push edi
lea eax, [esp + 0x14]
push 0x45e784
push eax
call fcn.0040a7af
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x4481b6
push ebp
push esi
call ebx
test eax, eax
jne 0x4481b6
push esi
push edi
push ebp
call fcn.00439851
add esp, 0xc
cmp byte [0x46818c], 0
pop esi
pop ebp
pop ebx
je 0x4481d8
push 1
push 0
push 0xffffffffffffffff
push 0x45a734
mov ecx, dword [0x467b78]
call fcn.0040184e
pop edi
add esp, 0x10c
ret
Function at 0x44cced
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f4
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x60], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44cd1e
push 0x64
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44cd25
mov byte [ebp - 0x84], 0
push edi
push 0x1f
mov byte [ebp - 0x20], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x44cd5f
cmp byte [edi + 0x11], 0
je 0x44cd5c
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x20]
push 0x45cd30
push 0x7d
push eax
call fcn.0040a76e
add esp, 0x10
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x44cd3f
cmp byte [ebp - 0x20], 0
je 0x44cda0
lea eax, [ebp - 0x20]
push eax
call fcn.00457cb0
cmp eax, 0x7b
pop ecx
jbe 0x44cd94
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x20]
push 0x45c0e0
push eax
call fcn.00439851
add esp, 0xc
jmp 0x44cda0
lea eax, [ebp + eax - 0x21]
cmp byte [eax], 0x20
jne 0x44cda0
mov byte [eax], 0
mov eax, dword [0x466f60]
xor ecx, ecx
inc ecx
cmp byte [eax + 0xce], 0
je 0x44cdbf
cmp byte [esi + 0x4ad], 0
jne 0x44cdbf
mov dword [ebp + 0x78], ecx
jmp 0x44cdc3
and dword [ebp + 0x78], 0
mov eax, dword [0x4673b8]
cmp eax, ecx
mov dword [ebp + 0x68], 0x45ccf0
jg 0x44ceaf
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x68], 0x45a5d8
cmp dword [0x46738c], 0
mov edi, 0x45ba9c
mov eax, 0x45baa0
mov dword [ebp + 0x64], edi
je 0x44cdfb
mov dword [ebp + 0x64], eax
cmp dword [0x467388], 0
je 0x44ce06
mov edi, eax
lea eax, [ebp - 0x184]
push eax
push ecx
call fcn.00412558
pop ecx
push eax
call fcn.0041336d
push eax
push dword [0x4673b4]
mov eax, dword [0x4673bc]
push dword [0x4673b8]
sub eax, dword [ebp + 0x78]
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x20]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x84]
push dword [esi + 0x478]
push dword [ebp + 0x64]
push edi
push eax
push 0x45cc38
push dword [ebp + 0x7c]
push ebx
call fcn.0040a6d3
mov esi, dword [ebp + 0x60]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.00444ea7
push ebx
call fcn.00457cb0
add esp, 0xc
add ebx, eax
cmp dword [0x467c8c], 0
pop edi
mov eax, 0x45cc1c
jne 0x44ce94
mov eax, 0x45cbe8
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.0040a6d3
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x44cde2
Function at 0x44cf96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x465090]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00439b0d
test eax, eax
pop ecx
pop ecx
je 0x44d01a
cmp byte [eax], 0x3d
jne 0x44d013
cmp eax, esi
jbe 0x44d025
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44d013
mov eax, ecx
cmp eax, esi
jbe 0x44d025
dec eax
jmp 0x44d025
push esi
call fcn.00457cb0
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00439a59
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44d051
cmp byte [ebp + 0x10], 0
je 0x44d04d
push esi
push 0x45d698
mov ecx, ebx
call fcn.0044c37d
xor eax, eax
jmp 0x44d061
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.00439851
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44fbdd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.00458250
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44fc5e
lea ecx, [ebp - 0x8958]
call fcn.0043bb0e
mov al, byte [ebp + 8]
mov byte [ebp - 0x8114], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8110], eax
lea eax, [ebp - 0x8958]
push eax
push 0x45022c
mov dword [ebp - 0x8118], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8128], 0
je 0x44fc5e
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x44fc5e
cmp eax, 0x19
jge 0x44fc54
cmp byte [0x468399], 0
je 0x44fc54
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44fc5e
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x4500e2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x895c
call fcn.00458250
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x450223
push ebx
call fcn.00450437
test eax, eax
je 0x450226
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x465108]
mov ecx, edi
push eax
mov dword [ebp - 4], eax
call fcn.0044fe60
test eax, eax
je 0x450132
xor esi, esi
mov dword [0x46b480], esi
jmp 0x450138
mov esi, dword [0x46b480]
lea ecx, [ebp - 0x895c]
call fcn.0043bb0e
cmp byte [ebp + 8], bl
je 0x450152
cmp esi, ebx
mov byte [ebp - 0x8134], bl
je 0x450159
mov byte [ebp - 0x8134], 1
mov eax, dword [0x46b47c]
mov dword [ebp - 0x8124], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x811c], eax
lea eax, [ebp - 0x895c]
push eax
push 0x450338
mov dword [ebp - 0x8120], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x812c], ebx
je 0x4501f8
push dword [ebp - 0x812c]
call fcn.0043ca8c
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4501b1
push dword [ebp - 0x812c]
call fcn.00450405
pop ecx
mov dword [ebp - 0x812c], esi
push dword [ebp - 0x812c]
call fcn.0043c3f2
push dword [ebp - 0x812c]
call fcn.00450405
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x450222
cmp eax, 0x19
jge 0x4501ec
cmp byte [0x468399], bl
je 0x4501ec
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x450222
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
jmp 0x450222
mov eax, dword [0x46b480]
cmp eax, ebx
je 0x450222
cmp eax, 1
setg al
cmp al, bl
mov dword [0x46b480], ebx
je 0x450222
push dword [ebp - 4]
call fcn.00450405
pop ecx
push ebx
mov ecx, edi
call fcn.004500e2
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4

Function at 0x450529
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x469e60], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4694a0
jne 0x450549
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00415fbd
pop ecx
mov dword [0x466208], 0x270
mov dword [0x469498], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x450568
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x45059e
mov edx, dword [0x4694a0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret