joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c3db
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [ecx + 0x74]
mov dword [ebp - 4], ebx
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
call fcn.00440a90
cmp al, bl
je 0x42d26e
xor eax, eax
cmp dword [esi + 0x68], ebx
jle 0x42d10c
mov esi, dword [esi + 0x64]
cmp esi, ebx
jne 0x42d0f9
mov esi, 0x54ee24
push esi
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jl 0x42d26e
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x54], ebx
mov ecx, eax
lea esi, [ebp - 0x20]
lea ebx, [ebp - 0x54]
mov dword [ebp - 4], 1
call fcn.00508530
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00508010
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42d165
push eax
call fcn.0051ebab
add esp, 4
cmp dword [edi + 4], 0
jle 0x42d261
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.004407d0
mov bl, 3
mov byte [ebp - 4], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
call esi
push 0x54ede0
call fcn.00507dd0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.00507dd0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42d24d
cmp word [eax], 0
je 0x42d24d
push eax
lea eax, [ebp - 0x20]
call fcn.005080c0
mov ecx, 0x552fac
lea eax, [ebp - 0x20]
call fcn.00507ba0
test al, al
je 0x42d1d9
mov ecx, str.ScanOcrFolderName
jmp 0x42d20c
mov ecx, str.Email
lea eax, [ebp - 0x20]
call fcn.00507ba0
test al, al
je 0x42d1f1
mov ecx, str.ScanMailFolderName
jmp 0x42d20c
mov ecx, str.SharePoint
lea eax, [ebp - 0x20]
call fcn.00507ba0
mov ecx, str.ScanMossFolderName
test al, al
jne 0x42d20c
mov ecx, str.ScanImgFolderName
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
push edx
push eax
call fcn.00440870
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00508010
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00507320
push 0x54ede0
call esi
push 0x54ede0
call fcn.00507dd0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.00507dd0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42d261
push eax
call fcn.0051ebab
add esp, 4
lea edx, [ebp - 0x54]
push edx
mov byte [ebp - 4], 0
call fcn.00508490
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4371e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
xor al, al
mov edi, ecx
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
mov byte [ebp - 0x481], al
test esi, esi
je 0x43733d
cmp word [esi], 0
je 0x43733d
test ebx, ebx
je 0x43733d
mov eax, esi
call fcn.004376f0
cmp eax, 0x474
jne 0x437357
mov eax, esi
mov esi, edi
call fcn.00449600
test al, al
je 0x437357
mov ecx, 0x474
lea eax, [ebp - 0x480]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x437260
mov esi, 0x474
lea edx, [ebp - 0x480]
call fcn.00449680
cmp eax, esi
jne 0x437306
mov ax, word [ebp - 0x42c]
mov edx, dword [ebp - 0x424]
lea edi, [ebx + 0x38]
mov ecx, 7
lea esi, [ebp - 0x448]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x428]
mov dword [ebx + 0x68], ecx
lea edi, [ebx + 0x70]
mov ecx, 0x104
lea esi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebx + 0x54], ax
lea eax, [ebx + 4]
lea esi, [ebp - 0x47c]
mov dword [ebx + 0x6c], edx
mov edx, 0x19
sub esi, eax
mov edi, edi
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x4372f6
movzx ecx, word [esi + eax]
test cx, cx
je 0x4372f6
mov word [eax], cx
add eax, 2
dec edx
jne 0x4372d0
sub eax, 2
mov word [eax], dx
mov bl, 1
jmp 0x43730c
test edx, edx
jne 0x4372fd
sub eax, 2
xor edx, edx
mov word [eax], dx
mov bl, 1
jmp 0x43730c
mov bl, byte [ebp - 0x481]
mov esi, dword [ebp - 0x488]
call fcn.00449660
test bl, bl
je 0x437328
mov eax, dword [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x481]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
Function at 0x437370
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor al, al
mov edi, edx
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x440], ecx
mov byte [ebp - 0x439], al
test ebx, ebx
je 0x437468
cmp word [ebx], 0
je 0x437468
test ecx, ecx
je 0x437468
mov eax, ebx
mov ecx, edi
call fcn.004376f0
cmp eax, 0x434
jne 0x43747e
push esi
mov eax, ebx
mov esi, edi
call fcn.00449600
test al, al
je 0x437452
mov ecx, 0x434
lea eax, [ebp - 0x438]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4373e1
mov esi, 0x434
lea edx, [ebp - 0x438]
call fcn.00449680
cmp eax, esi
jne 0x437436
mov eax, dword [ebp - 0x440]
lea edi, [eax + 4]
mov ecx, 7
lea esi, [ebp - 0x434]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x418]
mov word [eax + 0x20], cx
lea edi, [eax + 0x34]
mov ecx, 0x104
lea esi, [ebp - 0x416]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x439], 1
mov esi, dword [ebp - 0x444]
call fcn.00449660
mov al, byte [ebp - 0x439]
test al, al
je 0x437458
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x439]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xc], 0x57
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x439]
xor ecx, ebp
pop edi
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret
Function at 0x4374a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e8
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor al, al
push edi
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8e8], esi
mov byte [ebp - 0x8dd], al
test esi, esi
je 0x4376b8
cmp word [esi], 0
je 0x4376b8
test ebx, ebx
je 0x4376b8
mov eax, esi
call fcn.004376f0
mov edi, eax
cmp edi, 0x460
je 0x437506
cmp edi, 0x46c
jne 0x4376d2
mov eax, esi
mov esi, dword [ebp - 0x8e4]
call fcn.00449600
test al, al
je 0x4376d2
cmp edi, 0x460
jne 0x4375bf
mov ecx, edi
lea eax, [ebp - 0x8dc]
nop
mov byte [eax], 0
inc eax
dec ecx
jne 0x437530
mov edi, dword [ebp - 0x8e4]
mov esi, 0x460
lea edx, [ebp - 0x8dc]
call fcn.00449680
cmp eax, esi
jne 0x437670
mov ax, word [ebp - 0x8bc]
mov edx, dword [ebp - 0x8b4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x8d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x8b8]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x8ac]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x8b0]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], ecx
lea ecx, [ebx + 0x34]
lea eax, [ebp - 0x8a8]
call fcn.00437a30
mov edx, dword [ebp - 0x898]
mov eax, dword [ebp - 0x894]
mov dword [ebx + 0x54], edx
mov dword [ebx + 0x58], eax
lea esi, [ebp - 0x890]
jmp 0x43765d
cmp edi, 0x46c
jne 0x437670
mov ecx, edi
lea eax, [ebp - 0x47c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4375d3
mov edi, dword [ebp - 0x8e4]
mov esi, 0x46c
lea edx, [ebp - 0x47c]
call fcn.00449680
cmp eax, esi
jne 0x437670
mov edx, dword [ebp - 0x458]
mov eax, dword [ebp - 0x454]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x478]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x45c]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x44c]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x450]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x30], edx
test ecx, ecx
je 0x437645
lea eax, [ebp - 0x448]
call fcn.00437a70
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], ecx
lea esi, [ebp - 0x424]
mov ecx, 0x104
lea edi, [ebx + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x8dd], 1
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x8e4]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x43768c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov bl, byte [ebp - 0x8dd]
test bl, bl
je 0x4376a3
mov edx, dword [ebp - 0x8e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x8dd]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
Function at 0x43b330
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebx
xor bl, bl
cmp dword [ebp + 8], 0x101
push edi
sete al
lea edi, [eax + 0x8369]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6a
ja case.default.0x43b35c
movzx ecx, byte [eax + 0x43b3ec]
push esi
jmp dword [ecx*4 + 0x43b3cc]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0
test al, 0x80
setne dl
lea esi, [edx + 1]
jmp 0x43b3a7
mov esi, 4
jmp 0x43b3a7
mov esi, 3
jmp 0x43b3a7
mov esi, 2
jmp 0x43b3a7
mov esi, 1
jmp 0x43b3a7
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x43b35c.16
mov esi, 5
xor bl, bl
call fcn.00513440
test eax, eax
je case.0x43b35c.16
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
pop esi
pop edi
mov al, bl
pop ebx
pop ebp
ret 0xc
Function at 0x43efa0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5396b6
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, edx
xor al, al
mov dword [ebp - 0x264], esi
test ebx, ebx
je 0x43f118
cmp word [ebx], 0
je 0x43f118
push ecx
lea eax, [ebp - 0x270]
push eax
push esi
call fcn.0043f640
add esi, 0x58
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00508010
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x43f026
push eax
call fcn.0051ebab
add esp, 4
push 0x54ede0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
mov edi, esi
call fcn.00507dd0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call fcn.00507dd0
mov ebx, dword [ebp - 0x264]
cmp dword [ebx + 0x68], 0
lea edi, [ebx + 0x64]
jle 0x43f071
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push ecx
push 0
push edx
call fcn.005226e0
add esp, 0xc
mov dword [edi + 4], 0
mov eax, dword [esi]
test eax, eax
jne 0x43f07c
mov eax, 0x54ee24
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x43f114
mov edx, dword [ebp + 0xc]
push edx
mov ecx, ebx
call fcn.0043f8b0
test al, al
jne 0x43f121
mov ecx, 0x2e
call fcn.00507b70
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [eax + 1]
mov ecx, esi
call fcn.00507640
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00508010
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], 0xffffffff
call fcn.00507320
push 0x553904
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x553904
call fcn.00507dd0
mov edi, dword [edi]
test edi, edi
jne 0x43f0fd
mov edi, 0x54ee24
mov esi, dword [esi]
mov eax, esi
test esi, esi
jne 0x43f10a
mov eax, 0x54ee24
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, 1
jmp 0x43f123
mov dword [esi + 0x70], 0x57
jmp 0x43f123
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 8
Function at 0x43f760
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ece8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x40]
add edi, 0x40
test esi, esi
je 0x43f7f2
cmp word [esi], 0
je 0x43f7f2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f7e7
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x43f7fb
mov dword [ebp - 0x10], 2
mov eax, dword [edi]
test eax, eax
jne 0x43f7ca
mov eax, 0x54ee24
xor bl, bl
test eax, eax
je 0x43f80a
cmp word [eax], 0
je 0x43f80a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43f7ff
mov bl, 1
jmp 0x43f811
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x43f7bf
mov dword [ebp - 0x10], 0x57
jmp 0x43f7bf
mov bl, 1
jmp 0x43f815
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x43f811
mov dword [ebp - 0x10], 0x57
test bl, bl
je 0x43f887
mov eax, dword [ebp + 8]
cmp dword [eax + 0x50], 0
jle 0x43f883
push edi
lea ecx, [ebp - 0x1c]
call fcn.005072b0
push 0x54ede0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
lea edi, [ebp - 0x1c]
call fcn.00507dd0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4c]
mov eax, dword [eax + 0x50]
push ecx
call fcn.00507dd0
mov esi, dword [ebp - 0x1c]
mov eax, esi
test esi, esi
jne 0x43f863
mov eax, 0x54ee24
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.00449e10
mov bl, al
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x43f883
push esi
call fcn.0051ebab
add esp, 4
test bl, bl
jne 0x43f890
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43f8b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x58]
sub esp, 8
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
jne 0x43f8c6
mov eax, 0x54ee24
lea esi, [ecx + 0x34]
call fcn.00449600
test al, al
je 0x43f925
mov eax, dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, 0xffffffff
je 0x43f92f
push ebx
lea ecx, [ebp - 4]
push ecx
push 4
lea edx, [ebp - 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43f8ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
cmp dword [ebp - 4], 4
jne 0x43f90f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x43f90f
mov bl, 1
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x43f925
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], 0xc
jmp 0x43f90f
Function at 0x440a00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor al, al
test ecx, ecx
je 0x440a7f
cmp word [ecx], 0
je 0x440a7f
mov eax, dword [ebx + 0x80]
test eax, eax
jne 0x440a25
mov eax, 0x54ee24
test eax, eax
je 0x440a4d
cmp word [eax], 0
je 0x440a4d
push esi
push edi
push eax
lea eax, [ebx + 0x44]
call fcn.005080c0
push 0x5c
lea esi, [ebx + 0x44]
call fcn.00507e80
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x44]
call fcn.00508170
pop edi
pop esi
cmp dword [ebx + 0x48], 0
jle 0x440a7d
mov eax, dword [ebx + 0x44]
test eax, eax
jne 0x440a5f
mov eax, 0x54ee24
push eax
push 0
push str.ModifyDefault
push str.CustomDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x440a7d
mov al, al
pop ebp
ret 0x8b55
push ebp
invalid
in al, dx
Function at 0x441230
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4411e1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4411ff
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x44125d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
add byte [eax], ah
add byte [eax], ah
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x441244
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44124d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x441257
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x441239
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4411c3
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4412aa
dec eax
je 0x4412a1
sub eax, 3
je 0x441298
mov dword [ebp - 4], 0x40
jmp 0x4412c7
mov dword [ebp - 4], 4
jmp 0x4412ad
mov dword [ebp - 4], 0x20
jmp 0x4412ad
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4412f9
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x441279
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00440b0a
stosd dword es:[edi], eax
wait
push ds
outsb dx, byte [esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x441305
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x441400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
Function at 0x441a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x11fffffc]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00440b1a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00440acf
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00440b0a
jb 0x441b74
rcl dword [edx + 0x10468], cl
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
jne 0x441b8e
push dword [ebp + 0x14]
call fcn.00440acf
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x441bb6
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x441bd6
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x441bf3
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x441c5a
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x441c25
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x441c58
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x441c44
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x441c58
jmp 0x441c5a
jmp 0x441be6
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00440a7b
add esp, 0xc
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
and dword [ebp - 4], 0
and dword [ebp - 0x3a0], 0
and dword [ebp - 0x37c], 0
and dword [ebp - 0x388], 0
and dword [ebp - 0x374], 0
mov al, byte [ebp - 8]
add al, byte [ebp - 0x670]
mov byte [ebp - 8], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x548]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
mov eax, dword [ebp - 0x53c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x3a8], ecx
mov al, byte [ebp - 0x24]
sub al, byte [ebp - 0x670]
mov byte [ebp - 0x24], al
call fcn.00440ae8
mov edx, 0x4a580a9
cld
invalid
Function at 0x442690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00440b1a
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00440a7b
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x442a82

Function at 0x445170
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
xor al, al
push esi
mov esi, edx
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x445201
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esi, 0x10
mov word [ebp - 0x24], ax
mov eax, dword [esi + 4]
xor edi, edi
test eax, eax
je 0x4451ca
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
test edi, edi
jg 0x4451ca
mov edx, dword [esi]
mov ebx, dword [edx + 4]
add ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov bl, 1
test edi, edi
jg 0x4451dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4451dc
xor bl, bl
test bl, bl
je 0x4451fd
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
call fcn.00445210
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret