joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e9d7
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
xor eax, eax
cmp dword [ebp + 8], eax
jne 0x43e9e9
leave
ret
cmp word [0x4868d8], ax
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ebx, 0x104
mov edi, 0x484e20
je 0x43ea95
mov esi, 0x4868d8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x43ea98
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
push edi
call fcn.004182a3
add esp, 0x10
test eax, eax
je 0x43ea98
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x220]
push eax
call fcn.00418328
add esp, 0xc
test eax, eax
je 0x43ea98
cmp eax, 2
je 0x43ea98
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ea98
push 0
push ebx
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0043e8bc
add esp, 0x18
test eax, eax
je 0x43ea98
push dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x43ea98
jmp 0x43eb78
mov dword [ebp - 8], eax
push 0x473e14
push edi
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43eb30
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x470]
and eax, 0x10
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043e8bc
add esp, 0x18
test eax, eax
je 0x43eb17
cmp dword [ebp - 0xc], 0
je 0x43eb09
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
test eax, eax
je 0x43eb29
lea eax, [ebp - 0x470]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43eac6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
cmp word [0x4905b8], di
mov esi, 0x4905b8
jne 0x43eb50
push 0x40
push esi
push 0x174
call fcn.0045ede1
add esp, 0xc
push dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
sete al
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x442ac0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x20
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x442ba5
push 0x100
push 0x40
call edi
push 0x30
push 0x40
mov dword [esi], eax
call edi
mov ecx, dword [esi]
test ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
je 0x442bad
test eax, eax
je 0x442baa
mov al, 4
mov edi, 0x10
mov byte [esi + 8], al
mov byte [esi + 9], al
mov eax, 0x42400000
push ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
xor edx, edx
push ebp
lea esp, [esp]
mov ecx, edx
xor eax, eax
shl ecx, 4
mov ebp, dword [esi]
mov bl, dl
xor bl, al
add ebp, ecx
mov byte [eax + ebp], bl
inc eax
cmp eax, edi
jl 0x442b37
inc edx
cmp edx, edi
jl 0x442b30
xor ecx, ecx
xor ebp, ebp
xor ebx, ebx
xor edi, edi
mov eax, edi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x2b
mov byte [ecx + edx], al
mov eax, ebx
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x19
mov byte [edx + ecx + 1], al
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 9
mov byte [edx + ecx + 2], al
add edi, 0x32
add ebx, 0x1b
add ebp, 0xe
add ecx, 3
cmp edi, 0x320
jl 0x442b54
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
push ecx
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x442bb7
push eax
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
ret
Function at 0x447dd2
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 4]
movzx eax, cx
push edi
mov edx, 0xe7
xor edi, edi
cmp eax, edx
jg 0x447e5d
je 0x447e59
add edx, 0xffffffea
cmp eax, edx
jg 0x447e30
je 0x447e96
sub eax, 0xb0
je 0x447e17
sub eax, 0x16
je 0x447e13
dec eax
je 0x447e0f
dec eax
dec eax
jne 0x447ec5
push 0x45
jmp 0x447e56
push 0x43
jmp 0x447e56
push 0x41
jmp 0x447e56
push 0x30
pop ecx
xor eax, eax
inc eax
cmp cx, ax
push 6
pop edi
jne 0x447efb
push 0xa
jmp 0x4480ae
cmp eax, 0xdc
je 0x447e54
cmp eax, 0xdf
jle 0x447ec5
cmp eax, 0xe2
jle 0x447e50
cmp eax, 0xe6
jne 0x447ec5
push 0x61
jmp 0x447ebf
push 0x55
pop ecx
jmp 0x447ed1
push 0x63
jmp 0x447ebf
cmp eax, 0xfb
jg 0x447ea6
cmp eax, 0xf9
jge 0x447ea2
cmp eax, 0xe8
jl 0x447ec5
cmp eax, 0xeb
jle 0x447e9e
cmp eax, 0xef
jle 0x447e9a
mov edx, 0xf1
cmp eax, edx
je 0x447e96
jle 0x447ec5
cmp eax, 0xf4
jg 0x447ec5
push 0x6f
jmp 0x447ebf
push 0x6e
jmp 0x447ebf
push 0x69
jmp 0x447ebf
push 0x65
jmp 0x447ebf
push 0x75
jmp 0x447ebf
sub eax, 0xfc
je 0x447ec2
sub eax, 3
je 0x447ebd
sub eax, 0x93
jne 0x447ec5
push 0x66
jmp 0x447ebf
push 0x79
pop ecx
jmp 0x447ef0
push 0x75
pop ecx
cmp cx, 0x5a
ja 0x447edc
cmp cx, 0x41
jb 0x447edc
movzx eax, cx
sub eax, 0x41
jmp 0x4480af
cmp cx, 0x7a
ja 0x447e1a
cmp cx, 0x61
jb 0x447e1a
movzx eax, cx
sub eax, 0x61
jmp 0x4480af
cmp cx, 0x2e
jne 0x447f08
push 0xb
jmp 0x4480ae
cmp cx, 0x39
ja 0x447f1f
cmp cx, 0x30
jb 0x447f1f
movzx eax, cx
sub eax, 0x30
jmp 0x4480af
cmp cx, 0x3a
jne 0x447f2c
push 0xc
jmp 0x4480ae
cmp cx, 0x28
jne 0x447f39
push 0xd
jmp 0x4480ae
cmp cx, 0x29
jne 0x447f46
push 0xe
jmp 0x4480ae
cmp cx, 0x2d
jne 0x447f53
push 0xf
jmp 0x4480ae
cmp cx, 0x27
je 0x4480ac
cmp cx, 0x60
je 0x4480ac
cmp cx, 0x21
jne 0x447f74
push 0x11
jmp 0x4480ae
cmp cx, 0x5f
jne 0x447f81
push 0x12
jmp 0x4480ae
cmp cx, 0x2b
jne 0x447f8e
push 0x13
jmp 0x4480ae
cmp cx, 0x5c
jne 0x447f9b
push 0x14
jmp 0x4480ae
cmp cx, 0x2f
jne 0x447fa8
push 0x15
jmp 0x4480ae
cmp cx, 0x5b
je 0x4480a8
cmp cx, 0x7b
je 0x4480a8
cmp cx, 0x3c
je 0x4480a8
cmp cx, 0x5d
je 0x4480a4
cmp cx, 0x7d
je 0x4480a4
cmp cx, 0x3e
je 0x4480a4
cmp cx, 0x7e
je 0x4480a0
cmp cx, 0x5e
je 0x4480a0
cmp cx, 0x26
jne 0x448005
push 0x19
jmp 0x4480ae
cmp cx, 0x25
je 0x448082
cmp cx, 0x2c
jne 0x448018
push 0x1b
jmp 0x4480ae
cmp cx, 0x3d
jne 0x448025
push 0x1c
jmp 0x4480ae
cmp cx, 0x24
jne 0x44802f
push 0x1d
jmp 0x4480ae
cmp cx, 0x23
jne 0x448039
push 0x1e
jmp 0x4480ae
cmp cx, 0xc5
push 0xc
pop edi
je 0x44809c
cmp cx, 0xe5
je 0x44809c
cmp cx, 0xd6
je 0x4480af
cmp cx, 0xf6
je 0x4480af
cmp cx, 0xc4
je 0x448098
cmp cx, 0xe4
je 0x448098
cmp cx, 0x3f
jne 0x448070
push 3
jmp 0x4480ae
cmp cx, 0x2a
jne 0x44807a
push 4
jmp 0x4480ae
xor edi, edi
cmp cx, 0x22
jne 0x448086
push 0x1a
jmp 0x4480ae
xor eax, eax
cmp cx, 0x40
setne al
dec eax
and eax, 0xfffffffd
add eax, 0x1e
jmp 0x4480af
push 2
jmp 0x4480ae
xor eax, eax
jmp 0x4480af
push 0x18
jmp 0x4480ae
push 0x17
jmp 0x4480ae
push 0x16
jmp 0x4480ae
push 0x10
pop eax
mov ecx, dword [esp + 0xc]
lea eax, [eax + eax*4]
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
mov dword [eax], edi
pop edi
ret
Function at 0x44b9f2
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp dword [0x491d04], ebx
je 0x44bbe5
push esi
mov esi, dword [0x482cbc]
push edi
push dword [ebp + 8]
add esi, 0xffffffc6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], esi
call fcn.0044e888
lea ecx, [ebp - 0x18]
call fcn.0044e8c3
push eax
call fcn.004479b5
push dword [0x491d00]
call fcn.004479db
mov eax, dword [0x482cbc]
add eax, 0xffffffc4
cdq
idiv dword [0x483854]
pop ecx
pop ecx
mov edi, eax
call fcn.00431c56
mov ecx, eax
sub ecx, edi
cmp ecx, 1
jl 0x44ba76
cmp dword [ebp + 0x14], ecx
jle 0x44ba65
mov dword [ebp + 0x14], ecx
lea eax, [esi - 0x12]
imul eax, dword [ebp + 0x14]
cdq
idiv ecx
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x44ba79
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
add eax, 0xffffffe4
cmp eax, ebx
mov edi, 0xcc0020
jle 0x44bac2
push edi
push 0x2a
push 0x24
push dword [0x491b7c]
lea eax, [ebx + 0x14]
push 0x1d
push 8
push eax
mov eax, dword [0x482cb8]
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0044e8c3
push eax
call esi
mov eax, dword [ebp - 4]
add ebx, 0x1d
add eax, 0xffffffe4
cmp ebx, eax
jl 0x44ba8e
mov ecx, dword [ebp - 4]
lea edx, [ebx + 0x1d]
lea eax, [ecx + 0x12]
cmp eax, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
jle 0x44bad9
add dword [ebp - 0xc], 0x1d
cmp ebx, ecx
jge 0x44bb05
mov eax, dword [0x482cb8]
push edi
push 0x2a
push 0x24
push dword [0x491b7c]
sub ecx, ebx
push ecx
push 8
add ebx, 0x14
push ebx
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0044e8c3
push eax
call esi
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
push edi
and eax, 9
push 0x35
add eax, 0x34
push eax
push dword [0x491b7c]
mov eax, dword [ebp - 4]
push 0x12
add eax, 0x14
push 8
push eax
mov eax, dword [0x482cb8]
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0044e8c3
push eax
call esi
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
cmp ecx, ebx
jge 0x44bb83
mov eax, dword [ebp - 8]
cmp ecx, eax
jge 0x44bb83
lea edx, [eax - 0x1d]
cmp ecx, edx
jge 0x44bb55
mov eax, ebx
push edi
mov edx, ecx
sub edx, ebx
add edx, 0x47
push edx
push 0x24
push dword [0x491b7c]
sub eax, ecx
push eax
mov eax, dword [0x482cb8]
push 8
add ecx, 0x14
push ecx
add eax, 0xfffffff1
push eax
lea ecx, [ebp - 0x18]
call fcn.0044e8c3
push eax
call esi
mov eax, dword [ebp - 8]
cmp ebx, eax
jge 0x44bbd3
sub eax, ebx
mov dword [ebp - 0xc], eax
jmp 0x44bb94
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, 0xffffffe3
cmp ebx, ecx
jge 0x44bba1
push 0x1d
pop eax
push edi
push 0x2a
push 0x24
push dword [0x491b7c]
lea ecx, [ebp - 0x18]
push eax
push 8
lea eax, [ebx + 0x14]
push eax
mov eax, dword [0x482cb8]
add eax, 0xfffffff1
push eax
call fcn.0044e8c3
push eax
call esi
sub dword [ebp - 0xc], 0x1d
add ebx, 0x1d
cmp ebx, dword [ebp - 8]
jl 0x44bb91
push 0
call fcn.004479db
pop ecx
lea ecx, [ebp - 0x18]
call fcn.0044e8b1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44c067
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x470d19
call fcn.00470310
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
push edi
push 0x12
mov esi, 0x491cd8
push esi
call fcn.00467521
xor ebx, ebx
push ebx
push ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.00402b8d
push 0x26e
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
push 0x400
push dword [0x4924ec]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x492568]
push 0x13
push esi
call fcn.00455e1a
cmp dword [0x491d04], ebx
je 0x44c0e6
mov eax, dword [0x482cb8]
add eax, 0xffffff71
mov dword [ebp - 0x14], eax
mov eax, dword [0x482cbc]
add eax, 0xffffffe4
cmp dword [0x4924d8], ebx
mov dword [ebp - 0x20], eax
je 0x44c0f4
push dword [ebp - 0x10]
call dword [sym.imp.NSCRT.dll_free]
jmp 0x44c1ad
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
cmp eax, 0x12
lea eax, [ebp - 0x48]
jge 0x44c12e
push edi
push 0x13
push eax
call fcn.00467521
push edi
call esi
push 0x12
pop ecx
cmp eax, ecx
jge 0x44c13a
sub ecx, eax
lea edi, [ebp + eax*2 - 0x48]
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x44c13a
push 0x24
push edi
push eax
call sub.NSCRT.dll_memcpy
add esp, 0xc
push dword [ebp + 8]
call fcn.004479b5
push dword [0x491b64]
call fcn.004479db
pop ecx
pop ecx
xor esi, esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
mov ax, word [ebp + esi*2 - 0x48]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push eax
call fcn.00447dd2
add esp, 0xc
push 0xcc0020
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [0x491b7c]
push 6
push 5
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp - 0x14], 5
inc esi
cmp esi, 0x12
jl 0x44c151
push ebx
call fcn.004479db
push dword [ebp - 0x10]
call dword [sym.imp.NSCRT.dll_free]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44cb13
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0xc
cmp dword [0x491d04], 0
je 0x44cd6f
push ebx
call fcn.004479b5
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esp + 0x10]
jne 0x44cb3b
xor eax, eax
inc eax
jmp 0x44cb46
xor eax, eax
cmp byte [0x482c82], al
sete al
push eax
push ebx
push dword [esp + 0x18]
call fcn.0044c77b
push dword [0x491d00]
call fcn.004479db
mov ecx, dword [0x482cbc]
add esp, 0x10
cmp ecx, 0xe
je 0x44cd67
push ebp
push esi
push edi
push 0x14
pop edi
lea eax, [ecx - 0x3a]
push 0x1d
cdq
pop esi
idiv esi
and dword [esp + 0x14], 0
mov ebp, dword [sym.imp.GDI32.dll_BitBlt]
mov esi, 0xcc0020
test eax, eax
jle 0x44cbf1
mov dword [esp + 0xc], eax
push esi
push 0x2a
push 0
push dword [0x491b7c]
push 0x1d
push 0xc
push edi
push 0
push ebx
call ebp
mov eax, dword [0x482cb8]
push esi
push 0x2a
push 0x1f
push dword [0x491b7c]
add eax, 0xffffffec
push 0x1d
push 5
push edi
push eax
push ebx
call ebp
mov eax, dword [0x482cb8]
push esi
push 0x2a
push 0x2c
push dword [0x491b7c]
add eax, 0xfffffff9
push 0x1d
push 7
push edi
push eax
push ebx
call ebp
add edi, 0x1d
dec dword [esp + 0xc]
jne 0x44cb95
mov ecx, dword [0x482cbc]
lea eax, [ecx - 0x3a]
push 0x1d
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [esp + 0xc], edx
je 0x44cc6d
push esi
push ecx
push 0xc
push 0x2a
push 0
push dword [0x491b7c]
push edx
push 0xc
push edi
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [0x482cb8]
push esi
push 0x1d
push 5
push 0x2a
push 0x1f
push dword [0x491b7c]
add eax, 0xffffffec
push dword [esp + 0x24]
push 5
push edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [0x482cb8]
push esi
push 0x1d
push 7
push 0x2a
push 0x2c
push dword [0x491b7c]
add eax, 0xfffffff9
push dword [esp + 0x24]
push 7
push edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
add edi, dword [esp + 0xc]
cmp dword [0x4924d8], 0
jne 0x44cd64
push esi
push 0x48
push 0
push dword [0x491b7c]
push 0x26
push 0x7d
push edi
push 0
push ebx
call ebp
mov eax, dword [0x482cb8]
add eax, 0xfffffeed
push 0x19
cdq
pop ecx
idiv ecx
mov dword [esp + 0xc], 0x7d
cmp eax, 3
jl 0x44ccb7
sub eax, 3
mov dword [esp + 0x14], 1
test eax, eax
jle 0x44cce4
mov dword [esp + 0x10], eax
push esi
push 0
push 0xb3
push dword [0x491b7c]
push 0x26
push 0x19
push edi
push dword [esp + 0x28]
push ebx
call ebp
add dword [esp + 0xc], 0x19
dec dword [esp + 0x10]
jne 0x44ccbf
mov eax, dword [0x482cb8]
add eax, 0xfffffeed
push 0x19
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [esp + 0x10], edx
je 0x44cd24
push esi
push 0x26
push ecx
push 0
push 0xb3
push dword [0x491b7c]
push 0x26
push edx
push edi
push dword [esp + 0x30]
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x10]
add dword [esp + 0xc], eax
cmp dword [esp + 0x14], 0
je 0x44cd4a
push esi
push 0
push 0xcd
push dword [0x491b7c]
push 0x26
push 0x4b
push edi
push dword [esp + 0x28]
push ebx
call ebp
add dword [esp + 0xc], 0x4b
push esi
push 0x48
push 0x7e
push dword [0x491b7c]
push 0x26
push 0x96
push edi
push dword [esp + 0x28]
push ebx
call ebp
pop edi
pop esi
pop ebp
push 0
call fcn.004479db
pop ecx
add esp, 0xc
ret
Function at 0x44e15e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4924d8], ebx
jne 0x44e36b
mov eax, dword [0x497280]
cmp eax, ebx
je 0x44e36b
cmp dword [0x4922b4], ebx
je 0x44e36b
push esi
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.0044e86d
mov edi, dword [ebp + 8]
neg edi
sbb edi, edi
and edi, 0xffffffeb
lea ecx, [ebp - 0x10]
add edi, 0x15
call fcn.0044e8c3
push eax
call fcn.004479b5
push dword [0x4922b0]
call fcn.004479db
pop ecx
pop ecx
mov esi, 0xcc0020
push esi
push edi
push ebx
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0x19
push ebx
push ebx
call fcn.0044e8c3
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
push eax
call ebx
mov eax, dword [0x482ce8]
add eax, 0xffffff6a
push 0x19
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], 0x19
test eax, eax
mov dword [ebp - 8], eax
je 0x44e25f
test al, 1
je 0x44e229
push esi
push edi
push 0x7f
push dword [0x491b7c]
push 0x14
push 0xc
push 0
push ecx
lea ecx, [ebp - 0x10]
call fcn.0044e8c3
push eax
call ebx
mov dword [ebp - 4], 0x25
mov eax, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x44e25f
mov dword [ebp - 8], eax
push esi
push edi
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0x19
push 0
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call ebx
add dword [ebp - 4], 0x19
dec dword [ebp - 8]
jne 0x44e238
push esi
push edi
push 0x1a
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0x64
push 0
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call ebx
mov eax, dword [0x482ce8]
add eax, 0xffffff6a
push 0x19
cdq
pop ecx
idiv ecx
add dword [ebp - 4], 0x64
test eax, eax
mov dword [ebp - 8], eax
je 0x44e2f4
test al, 1
je 0x44e2be
push esi
push edi
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0xd
push 0
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call ebx
add dword [ebp - 4], 0xd
mov eax, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x44e2f4
mov dword [ebp - 8], eax
push esi
push edi
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0x19
push 0
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call ebx
add dword [ebp - 4], 0x19
dec dword [ebp - 8]
jne 0x44e2cd
mov eax, dword [0x482ce8]
add eax, 0xffffff6a
push 0x19
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [ebp - 8], edx
je 0x44e337
push esi
push 0x14
push ecx
push edi
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push edx
push 0
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
jmp 0x44e33a
mov eax, dword [ebp - 4]
push esi
push edi
push 0x99
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x14
push 0x19
push 0
push eax
call fcn.0044e8c3
push eax
call ebx
push 0
call fcn.004479db
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0044e8b1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44e36e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [0x4924d8], edi
jne 0x44e564
mov eax, dword [0x497280]
cmp eax, edi
je 0x44e564
cmp dword [0x4922b4], edi
je 0x44e564
push eax
lea ecx, [ebp - 0x10]
call fcn.0044e86d
cmp dword [ebp + 8], edi
jne 0x44e3b3
mov dword [ebp + 8], 0x4920b0
jmp 0x44e3c6
push 0x200
push dword [ebp + 8]
push 0x4920b0
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp + 0xc], edi
push esi
je 0x44e4cb
push ebx
mov ebx, dword [0x482cec]
lea ecx, [ebp - 0x10]
add ebx, 0xffffffda
call fcn.0044e8c3
push eax
call fcn.004479b5
push dword [0x4922b0]
call fcn.004479db
pop ecx
pop ecx
mov esi, 0xcc0020
push esi
push 0x2a
push edi
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x26
push 0x7d
push ebx
push edi
call fcn.0044e8c3
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push eax
call edi
mov eax, dword [0x482ce8]
add eax, 0xffffff06
push 0x19
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], 0x7d
test eax, eax
jle 0x44e460
mov dword [ebp - 8], eax
push esi
push 0x51
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x26
push 0x19
push ebx
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call edi
add dword [ebp - 4], 0x19
dec dword [ebp - 8]
jne 0x44e439
mov eax, dword [0x482ce8]
add eax, 0xffffff06
push 0x19
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [ebp - 8], edx
je 0x44e4a3
push esi
push 0x26
push ecx
push 0x51
push 0x7f
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x26
push edx
push ebx
push dword [ebp - 4]
call fcn.0044e8c3
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
jmp 0x44e4a6
mov eax, dword [ebp - 4]
push esi
push 0x51
push 0
push dword [0x491b7c]
lea ecx, [ebp - 0x10]
push 0x26
push 0x7d
push ebx
push eax
call fcn.0044e8c3
push eax
call edi
push 0
call fcn.004479db
pop ecx
pop ebx
mov eax, dword [0x482cec]
push dword [0x491b9c]
lea ecx, [eax - 0x1b]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [0x482ce8]
add ecx, 0xffffffe7
mov dword [ebp - 0x18], ecx
add eax, 0xfffffff3
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], 0x5c
mov dword [ebp - 0x14], eax
call fcn.0044e8c3
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
call esi
push dword [0x482d70]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0044e8c3
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x482d74]
lea ecx, [ebp - 0x10]
call fcn.0044e8c3
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x820
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0044e8c3
push eax
call dword [sym.imp.USER32.dll_DrawTextA]
push edi
lea ecx, [ebp - 0x10]
call fcn.0044e8c3
push eax
call esi
lea ecx, [ebp - 0x10]
call fcn.0044e8b1
pop esi
pop edi
leave
ret
Function at 0x44e62f
Capabilities:
Capture screenshot

Disassembly:
push ecx
push ecx
push ebp
xor ebp, ebp
cmp dword [0x497280], ebp
je 0x44e819
cmp dword [0x4922b4], ebp
je 0x44e819
push ebx
mov ebx, dword [esp + 0x14]
push ebx
call fcn.004479b5
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x497280]
jne 0x44e66b
xor eax, eax
inc eax
jmp 0x44e676
xor eax, eax
cmp byte [0x482c82], al
sete al
push eax
call fcn.0044e15e
cmp dword [0x4924d8], ebp
pop ecx
jne 0x44e818
push esi
push edi
push dword [0x4922b0]
call fcn.004479db
mov eax, dword [0x482cec]
pop ecx
add eax, 0xffffffc6
push 0x1d
pop ecx
cdq
idiv ecx
push 0x14
pop edi
mov esi, 0xcc0020
cmp eax, ebp
mov ebp, dword [sym.imp.GDI32.dll_BitBlt]
jle 0x44e6f8
mov dword [esp + 0x10], eax
push esi
push 0x2a
push 0x7f
push dword [0x491b7c]
push 0x1d
push 0xb
push edi
push 0
push ebx
call ebp
mov eax, dword [0x482ce8]
push esi
push 0x2a
push 0x8b
push dword [0x491b7c]
add eax, 0xfffffff8
push 0x1d
push 8
push edi
push eax
push ebx
call ebp
add edi, 0x1d
dec dword [esp + 0x10]
jne 0x44e6bb
mov eax, dword [0x482cec]
add eax, 0xffffffc6
push 0x1d
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [esp + 0x10], edx
je 0x44e756
push esi
push ecx
push 0xb
push 0x2a
push 0x7f
push dword [0x491b7c]
push edx
push 0xb
push edi
push 0
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [0x482ce8]
push esi
push 0x1d
push 8
push 0x2a
push 0x8b
push dword [0x491b7c]
add eax, 0xfffffff8
push dword [esp + 0x28]
push 8
push edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
add edi, dword [esp + 0x10]
push esi
push 0x2a
push 0
push dword [0x491b7c]
push 0x26
push 0x7d
push edi
push 0
push ebx
call ebp
mov eax, dword [0x482ce8]
add eax, 0xffffff06
push 0x19
cdq
pop ecx
idiv ecx
mov dword [esp + 0x10], 0x7d
test eax, eax
jle 0x44e7ad
mov dword [esp + 0x14], eax
push esi
push 0x51
push 0x7f
push dword [0x491b7c]
push 0x26
push 0x19
push edi
push dword [esp + 0x2c]
push ebx
call ebp
add dword [esp + 0x10], 0x19
dec dword [esp + 0x14]
jne 0x44e78b
mov eax, dword [0x482ce8]
add eax, 0xffffff06
push 0x19
cdq
pop ecx
idiv ecx
test edx, edx
mov dword [esp + 0x14], edx
je 0x44e7ec
push esi
push 0x26
push ecx
push 0x51
push 0x7f
push dword [0x491b7c]
push 0x26
push edx
push edi
push dword [esp + 0x34]
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x14]
jmp 0x44e7f0
mov eax, dword [esp + 0x10]
push esi
push 0x51
push 0
push dword [0x491b7c]
push 0x26
push 0x7d
push edi
push eax
push ebx
call ebp
xor esi, esi
push esi
push esi
call fcn.0044e36e
push esi
call fcn.004479db
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
pop ecx
pop ecx
ret