joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
push edi
jne 0x44171c
cmp dword [esi + 4], 0xffffffff
jne 0x44171c
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4416b0
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x4416e7
cmp eax, 0x2f
je 0x4416e7
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4416d4
mov eax, dword [0x4d5cf0]
mov dword [edi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
call fcn.00440720
add esp, 4
test eax, eax
jne 0x441702
mov eax, dword [ebp + 8]
pop edi
pop ebp
ret 4
call fcn.00440b90
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebp
ret 4
mov eax, 0x1000000
pop edi
pop ebp
ret 4

Function at 0x441d40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f4214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x441d74
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x441d74
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x441e5e
mov ecx, ebx
mov edx, ebx
cmp ax, 0x2f
je 0x441d90
cmp ax, 0x5c
jne 0x441d92
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x441d84
push edi
cmp ecx, ebx
je 0x441dd2
sub ecx, ebx
sar ecx, 1
lea edi, [ecx + ecx]
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0049fa60
lea edx, [ebp - 0x414]
push edx
xor ecx, ecx
push esi
mov word [ebp + edi - 0x414], cx
call fcn.00441d40
add esp, 0x14
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x441dff
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x441df0
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441e03
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x441e20
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x441e5e
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049c72a
mov esp, ebp
pop ebp
ret
Function at 0x442380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f4214]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x11], 1
test eax, eax
je 0x4424d9
push 0x4d45d8
push eax
call fcn.0049d1a1
mov esi, eax
add esp, 8
test esi, esi
je 0x4424d9
push esi
push 8
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0049d402
add esp, 0x10
mov eax, 8
xor ecx, ecx
jmp 0x4423e0
mov edx, dword [ebp + ecx - 0x10]
cmp edx, dword [ecx + 0x4f59c8]
jne 0x4424d0
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x4423e0
push 0
push 0xc
push esi
call fcn.0049d89d
add esp, 0xc
push esi
push 4
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.0049d402
mov ecx, dword [ebp - 0x18]
add esp, 0x10
cmp ecx, dword [0x4f59d8]
jne 0x4424d0
push 2
push 0
push esi
call fcn.0049d89d
add esp, 0xc
push esi
call fcn.0049d7ae
mov ebx, eax
add esp, 4
push ebx
call fcn.0049c7c6
add esp, 4
push 0
push 0
push esi
mov edi, eax
call fcn.0049d89d
add esp, 0xc
push esi
push ebx
push 1
push edi
call fcn.0049d402
push esi
call fcn.0049d986
add esp, 0x14
push 0x50
call fcn.0049c7c6
mov esi, eax
add esp, 4
push esi
mov eax, edi
call fcn.004424f0
add esp, 4
push esi
call fcn.00442590
add esp, 4
test al, al
je 0x44249f
mov eax, dword [ebp - 0x1c]
push esi
call fcn.00442890
add esp, 4
test al, al
jne 0x4424a3
mov byte [ebp - 0x11], 0
mov ebx, esi
call fcn.00442840
push esi
call fcn.0049c78c
add esp, 4
push edi
call fcn.0049c78c
mov al, byte [ebp - 0x11]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049c72a
mov esp, ebp
pop ebp
ret
push esi
call fcn.0049d986
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0049c72a
mov esp, ebp
pop ebp
ret
Function at 0x442890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x4d46bc
push eax
call fcn.0049d1a1
mov edi, eax
add esp, 8
test edi, edi
jne 0x4428b2
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push edi
push 8
push 1
push 0x4f59c8
call fcn.0049d5a0
add esp, 0x10
push ebx
mov dword [ebp - 4], 0
push esi
lea ecx, [ecx]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov esi, dword [ecx + edx*4]
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0xc]
lea ebx, [esi + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esi + 4]
mov dword [ebx], eax
mov eax, dword [edx]
cmp eax, dword [0x4f59d8]
je 0x442955
cmp eax, dword [0x4f59d0]
jne 0x44290e
cmp dword [esi], 0
je 0x442962
push edi
push 1
lea eax, [ebp - 8]
push 4
push eax
call fcn.0049d5a0
mov ecx, dword [esi + 4]
push edi
push 4
push 1
push ecx
call fcn.0049d5a0
mov eax, dword [esi]
add esp, 0x20
test eax, eax
je 0x442947
mov edx, dword [esi + 8]
push edi
push eax
push 1
push edx
call fcn.0049d5a0
add esp, 0x10
test eax, eax
je 0x442984
push edi
push 1
push 4
push ebx
call fcn.0049d5a0
add esp, 0x10
mov eax, dword [esi + 4]
mov ecx, dword [eax]
cmp ecx, dword [0x4f59d4]
je 0x442972
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x14
jl 0x4428d0
push edi
call fcn.0049d986
add esp, 4
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
push edi
call fcn.0049d986
add esp, 4
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x444230
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
push esi
je 0x44436f
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44436f
mov esi, dword [eax]
mov dword [ebp - 0xc], esi
test esi, esi
je 0x44436f
mov eax, 0xaaaaaaab
mul esi
push ebx
shr edx, 1
lea eax, [edx*4 + 5]
push edi
push eax
call fcn.0049c7c6
add esp, 4
xor edi, edi
mov ebx, eax
test esi, esi
je 0x44435d
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
dec edx
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
mov esi, 1
inc edx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], edx
jmp 0x4442a3
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov cl, byte [eax + esi - 1]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x4442b9
mov cl, byte [esi + eax]
jmp 0x4442bb
xor cl, cl
lea eax, [esi + 1]
cmp eax, edx
jae 0x4442ce
mov edx, dword [ebp + 8]
mov al, byte [esi + edx + 1]
mov byte [ebp - 2], al
jmp 0x4442d2
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 4]
mov edx, eax
movzx ecx, cl
and eax, 3
shl eax, 4
mov esi, ecx
shr esi, 4
add eax, esi
movzx esi, byte [ebp - 2]
mov dword [ebp - 0x1c], eax
shr edx, 2
movzx edx, byte [edx + 0x4d0180]
mov eax, esi
shr eax, 6
and ecx, 0xf
lea ecx, [eax + ecx*4]
mov eax, dword [ebp - 0x1c]
and esi, 0x3f
mov byte [edi + ebx], dl
movzx edx, byte [eax + 0x4d0180]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0xc]
mov byte [edi + ebx + 1], dl
cmp eax, esi
jae 0x44432d
mov cl, byte [ecx + 0x4d0180]
jmp 0x44432f
mov cl, 0x3d
mov byte [edi + ebx + 2], cl
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x444345
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + 0x4d0180]
jmp 0x444347
mov cl, 0x3d
mov byte [edi + ebx + 3], cl
add eax, 3
add edi, 4
dec dword [ebp - 0x10]
mov dword [ebp - 8], eax
jne 0x4442a0
mov edx, dword [ebp + 0xc]
mov byte [edi + ebx], 0
mov dword [edx], edi
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44ce80
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jns 0x44ce98
mov esi, 8
push 2
call edi
test ax, ax
jns 0x44cea4
or esi, 1
push 1
call edi
test ax, ax
jns 0x44ceb0
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x44cebc
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x44cec8
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret

Function at 0x44db90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, eax
cmp dword [edi + 0xd4], esi
jle 0x44dbe3
jmp 0x44dbb0
mov eax, dword [edi + 0xd0]
mov byte [ebp - 1], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
call edx
cmp byte [ebp - 1], 0
jne 0x44dd1c
inc esi
cmp esi, dword [edi + 0xd4]
jl 0x44dbb0
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x44dcb4
sub eax, 4
je 0x44dc50
sub eax, 2
jne 0x44dca9
push ebx
mov dword [ebp + 8], eax
call fcn.004a47c6
mov ecx, dword [edi + 0x50]
add esp, 4
mov word [ebp + 8], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0xfc]
push reloc.WS2_32.dll_ioctlsocket
lea eax, [ebp + 8]
push eax
push 0x451640
call edx
mov esi, eax
test esi, esi
je 0x44dca9
mov eax, dword [esi]
mov edx, dword [eax + 0xf0]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0x54], 0
je 0x44dca9
mov ecx, dword [edi + 0x68]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x24], 6
mov word [ebp - 0x10], bx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
call fcn.0044ce80
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [edi + 0x54]
mov dword [ebp - 0x1c], eax
mov edx, dword [edi]
mov edx, dword [edx + 0x108]
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call edx
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp ebx, 9
jne 0x44dca9
cmp dword [edi + 0x54], 0
je 0x44dd09
mov ecx, dword [edi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc8]
call edx
test al, al
je 0x44dd09
mov ecx, dword [edi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xd4]
call edx
test al, al
je 0x44dd09
mov ecx, dword [edi + 0x54]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push str.RichEditUI
call edx
push eax
call fcn.0049e0ac
add esp, 8
test eax, eax
je 0x44dd09
mov eax, dword [edi + 0x54]
cmp byte [eax + 0x4d9], 0
jne 0x44dca9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns bl
call fcn.004502b0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44fdc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi]
cmp eax, ecx
je 0x44fde5
cmp esi, dword [edi + 0x54]
je 0x44fde5
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x54]
cmp esi, eax
je 0x44fedf
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x44fe54
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [edi + 0x54]
push 0
push 0
push str.killfocus
call fcn.00450780
mov dword [edi + 0x54], 0
test esi, esi
je 0x44fedf
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
cmp eax, edi
jne 0x44fedf
mov edx, dword [esi]
mov eax, dword [edx + 0xc8]
mov ecx, esi
call eax
test al, al
je 0x44fedf
mov edx, dword [esi]
mov eax, dword [edx + 0xd4]
mov ecx, esi
call eax
test al, al
je 0x44fedf
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0x54], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [edi + 0x54]
push 0
push 0
push str.setfocus
call fcn.00450780
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45aa70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbc14
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4f4214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], vtable.DuiLib::CControlUI.0
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
xor esi, esi
mov word [eax + 0x4c], si
lea edx, [eax + 0x4c]
mov dword [eax + 0x48], edx
mov word [eax + 0xd0], si
lea edx, [eax + 0xd0]
mov dword [eax + 0xcc], edx
mov word [eax + 0x150], 1
mov dword [eax + 0x194], 0x1010101
mov dword [eax + 0x198], 1
mov word [eax + 0x1bc], si
lea edx, [eax + 0x1bc]
mov dword [eax + 0x1b8], edx
mov word [eax + 0x240], si
lea edx, [eax + 0x240]
mov dword [eax + 0x23c], edx
xor edx, edx
mov word [eax + 0x2c0], dx
mov word [eax + 0x2c8], si
lea edx, [eax + 0x2c8]
mov dword [eax + 0x2c4], edx
mov dword [eax + 0x348], ecx
mov dword [eax + 0x34c], ecx
mov dword [eax + 0x350], ecx
mov dword [eax + 0x354], ecx
mov word [eax + 0x35c], si
lea edx, [eax + 0x35c]
mov dword [eax + 0x358], edx
mov word [eax + 0x3e0], si
lea edx, [eax + 0x3e0]
mov dword [eax + 0x3dc], edx
mov dword [eax + 0x460], ecx
mov dword [eax + 0x464], ecx
mov byte [eax + 0x468], cl
mov dword [eax + 0x46c], ecx
mov dword [eax + 0x470], ecx
mov dword [eax + 0x474], 0x12c
mov dword [eax + 0x178], ecx
mov dword [eax + 0x174], ecx
mov dword [eax + 0x180], ecx
mov dword [eax + 0x17c], ecx
mov dword [eax + 0x188], ecx
mov dword [eax + 0x184], ecx
mov dword [eax + 0x47c], ecx
mov dword [eax + 0x478], ecx
mov edx, 0x270f
mov dword [eax + 0x190], edx
mov dword [eax + 0x18c], edx
mov dword [eax + 0x164], ecx
mov dword [eax + 0x168], ecx
mov dword [eax + 0x16c], ecx
mov dword [eax + 0x170], ecx
mov dword [eax + 0x154], ecx
mov dword [eax + 0x158], ecx
mov dword [eax + 0x15c], ecx
mov dword [eax + 0x160], ecx
mov dword [eax + 0x480], ecx
mov dword [eax + 0x484], ecx
mov dword [eax + 0x488], ecx
mov dword [eax + 0x48c], ecx
mov dword [eax + 0x490], ecx
mov dword [eax + 0x494], ecx
mov dword [eax + 0x498], ecx
mov dword [eax + 0x49c], ecx
mov dword [eax + 0x19c], ecx
mov dword [eax + 0x1a0], ecx
mov dword [eax + 0x1a4], ecx
mov dword [eax + 0x1a8], ecx
mov dword [eax + 0x1ac], ecx
mov dword [eax + 0x1b0], ecx
mov dword [eax + 0x1b4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x465c80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x4f4214]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 8], eax
mov dword [esi + 0x10], eax
push edi
lea eax, [esp + 0x10]
push eax
mov eax, esi
call fcn.00465e70
mov ecx, dword [esi + 0x10]
cmp byte [ecx + 0x5b1], 0
mov edi, 0x40000080
je 0x465cc8
mov edi, 0x400000a0
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov eax, dword [eax]
push 0
sub edx, ecx
push edx
mov edx, dword [esp + 0x18]
sub ebx, edx
push ebx
push ecx
push edx
push 0
push edi
push 0
push eax
mov eax, esi
call fcn.00445bf0
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx + 0x4a8]
cmp edi, 0xffffffff
je 0x465d31
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
test edi, edi
js 0x465d26
cmp edi, dword [eax + 0x218]
jge 0x465d26
mov ecx, dword [eax + 0x214]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
jmp 0x465d2d
call fcn.00450ab0
mov eax, dword [eax]
test eax, eax
jne 0x465d42
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
call fcn.00450ab0
mov eax, dword [eax]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 1
push ebx
push eax
mov eax, dword [esi + 4]
push 0x30
push eax
call edi
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0x5ac]
mov eax, dword [esi + 4]
push 0
push edx
push 0xc5
push eax
call edi
mov eax, dword [esi + 0x10]
cmp byte [eax + 0x5b1], 0
je 0x465d8f
movzx ecx, word [eax + 0x5b2]
mov edx, dword [esi + 4]
push 0
push ecx
push 0xcc
push edx
call edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x20]
push edx
call eax
mov ecx, dword [eax]
mov edx, dword [esi + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x465dc0
push eax
call fcn.0049c78c
add esp, 4
mov edx, dword [esi + 4]
push 0
push 0
push 0xb9
push edx
call edi
mov eax, dword [esi + 4]
push 0
push 3
push 0xd3
push eax
call edi
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd4]
call eax
mov edx, dword [esi + 4]
xor ecx, ecx
cmp al, bl
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 4]
xor ecx, ecx
cmp byte [eax + 0x5b0], bl
push 0
sete cl
push ecx
push 0xcf
push edx
call edi
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x7cc]
or edx, eax
mov eax, dword [esi + 4]
push edx
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [esi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0xac]
pop edi
mov byte [esi + 0x18], bl
pop ebx
xor ecx, esp
call fcn.0049c72a
mov esp, ebp
pop ebp
ret 4
Function at 0x4661f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4f4214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x466260
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
lea eax, [esi + esi]
call fcn.004aa0c0
mov ebx, esp
test ebx, ebx
je 0x466260
mov ecx, dword [edi + 4]
push esi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [edi + 0x10]
add esi, 0x1b8
push ebx
or eax, 0xffffffff
call fcn.00451c40
mov esi, dword [edi + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0
push str.textchanged
mov ecx, esi
call eax
mov ecx, esi
mov edi, eax
call fcn.00450780
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c72a
mov esp, ebp
pop ebp
ret
Function at 0x46aa60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x46aa67
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x46ab3d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cfd80]
add ecx, 8
sub edx, 8
dec esi
jne 0x46aa80
pop edi
test edx, edx
je 0x46ab5a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4cfd80]
inc ecx
dec edx
jne 0x46ab41
not eax
pop esi
ret

Function at 0x46b120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x46b156
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46b14c
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x46b167
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.0049fa60
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret