joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b050
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x814
cmp dword [0x4e7ebc], 0
push ebp
mov ebp, dword [esp + 0x81c]
push esi
push edi
jne 0x42b0d8
push 0x104
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xc], 1
jne 0x42b0f0
mov edx, dword [eax]
lea ecx, [esp + 0x10]
mov si, word [ecx]
cmp si, word [edx]
jne 0x42b0c8
test si, si
je 0x42b0c4
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x42b0c8
add ecx, 4
add edx, 4
test si, si
jne 0x42b0a2
xor ecx, ecx
jmp 0x42b0cd
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x42b0f0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4e86f4]
push 0
push 0
push 0
push 0
push 0
push ebp
push eax
push str._restart
jmp 0x42b125
mov ecx, dword [ebx + 0xadc]
push ecx
push str._restart___s_
mov esi, 0x304
lea edi, [esp + 0x220]
call fcn.0049e5c0
mov edx, dword [0x4e86f4]
add esp, 8
push 0
push 0
push 0
push 0
push 0
push ebp
push edx
mov eax, edi
push eax
mov edx, dword [ebx + 0xae8]
push 0x4ea1d0
call fcn.0044ab30
pop edi
pop esi
pop ebp
add esp, 0x814
ret 4
Function at 0x42b150
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ecx
mov dword [ecx + 0xab0], eax
cmp byte [0x4eaefb], bl
jne 0x42b2f2
cmp byte [ecx + 0xaf4], bl
je 0x42b2f2
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4e86f0]
push ebx
push 1
mov dword [0x4eb304], eax
call fcn.00401220
push 0x7f
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
mov eax, dword [0x4e4b24]
inc dword [0x4e8060]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x142], dx
mov ecx, 0x42
mov esi, 0x4e6aa8
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x4e4b24], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x4ea1d0
call fcn.0042ab70
mov dword [0x4eacd0], ebx
mov dword [0x4eacd4], ebx
cmp dword [0x4e808c], ebx
je 0x42b207
push 0x4e86f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [0x4e4a2c]
push str.OnExit
mov dword [0x4e4a2c], ebx
mov byte [0x4eaefb], 1
call fcn.0040b7b0
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0xaa4]
mov byte [esp + 0x13], 1
mov byte [0x4e6207], bl
cmp ecx, ebx
je 0x42b252
call fcn.004012a0
test eax, eax
je 0x42b252
cmp byte [0x4e6207], bl
jne 0x42b252
mov byte [esp + 0x13], bl
mov byte [0x4e6207], 1
cmp byte [esp + 0x13], bl
je 0x42b2aa
mov dword [esp + 0x20], ebx
call fcn.0045ea30
mov dword [esp + 0x18], eax
mov eax, dword [0x4eb304]
cdq
mov dword [esp + 0x28], eax
xor eax, eax
cmp dword [esi + 0xaa4], ebx
lea ecx, [esp + 0x18]
sete al
mov dword [esp + 0x2c], edx
lea edx, [esi + 0xa70]
mov dword [esp + 0x30], 1
push eax
push 2
push ecx
push edx
call fcn.00491200
cmp eax, 3
jne 0x42b2aa
mov byte [esp + 0x13], bl
sub dword [0x4e9884], 0xc
mov byte [0x4eaefb], bl
cmp byte [esp + 0x13], bl
jne 0x42b2e4
cmp dword [ebp + 8], 3
je 0x42b2e4
lea eax, [esp + 0x38]
push eax
call fcn.00403a20
add esp, 4
mov dword [0x4e4a2c], edi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
push esi
call fcn.0042b340
cmp byte [0x4e6207], bl
jne 0x42b327
cmp eax, 9
jne 0x42b327
mov eax, dword [0x4e7e30]
cmp word [eax], bx
je 0x42b312
mov ecx, dword [ebp + 0xc]
mov dword [0x4eb304], ecx
pop edi
pop esi
mov byte [0x4e6207], 1
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push edx
push eax
push ecx
mov byte [0x4e6207], bl
call fcn.0042b340
int3
Function at 0x434a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov cx, word [0x4e4a48]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
push esi
mov word [esp + 0xc], ax
push edi
lea ebx, [esp + 0x10]
mov eax, ebp
mov word [esp + 0x12], cx
mov dword [esp + 0x14], 0x90028
mov dword [esp + 0x18], 0x3e003c
mov dword [esp + 0x1c], 0x3d003a
mov dword [esp + 0x20], 0x2d002b
mov dword [esp + 0x24], 0x2f002a
mov dword [esp + 0x28], 0x7e0021
mov dword [esp + 0x2c], 0x7c0026
mov dword [esp + 0x30], 0x5b005e
mov dword [esp + 0x34], 0x3f002e
mov dword [esp + 0x38], 0x7b
call fcn.00405590
test eax, eax
je 0x434a89
cmp eax, ebp
jbe 0x434aa3
sub eax, 2
jmp 0x434aa3
mov eax, ebp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434a90
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 2]
mov edi, eax
cmp eax, ebp
jbe 0x434ac4
lea esp, [esp]
movzx eax, word [edi]
cmp eax, 0x20
je 0x434abd
cmp eax, 9
jne 0x434ac4
sub edi, 2
cmp edi, ebp
ja 0x434ab0
mov esi, edi
sub esi, ebp
sar esi, 1
inc esi
cmp esi, 0xfd
jbe 0x434af5
cmp byte [esp + 0x4c], 0
je 0x434ae9
mov ecx, dword [esp + 0x40]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.00449df0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ebx, dword [esp + 0x44]
push esi
push ebp
push ebx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
mov eax, edi
pop edi
mov word [ebx + esi*2], cx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x446d30
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4e8060]
sub esp, 0x124
push ebx
push esi
push edi
cmp eax, dword [0x4e4a38]
jl 0x446d5a
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [0x4e86f0]
cmp byte [esi + 0x17], 0
jne 0x446d69
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x446d76
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x446d93
test byte [esi + 0x15], 4
je 0x446d8e
push esi
mov ecx, 0x4ea1d0
call fcn.0044a460
mov eax, dword [esi + 8]
jmp 0x446da3
cmp al, 2
jne 0x446d9e
call fcn.00401000
jmp 0x446da3
mov eax, 0x4e9868
push 0x7f
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
mov eax, dword [0x4e4b24]
inc dword [0x4e8060]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x13a], dx
mov ecx, 0x42
mov esi, 0x4e6aa8
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x4e4b24], eax
push edi
mov eax, 0x4ea1d0
mov dword [esi + 0x2c], edi
call fcn.0042ab70
mov dword [0x4eacd0], edi
mov dword [0x4eacd4], edi
cmp dword [0x4e808c], edi
je 0x446e12
push 0x4e86f8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or eax, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x446e2d
mov byte [esi + 0xee], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
cmp dword [0x4eacdc], edi
je 0x446e3d
cmp dword [0x4eacd8], edi
jne 0x446e46
cmp byte [esi + 0xee], 0
je 0x446e75
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x446e75
cmp dword [0x4eacdc], edi
jl 0x446e6f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov eax, dword [0x4eacdc]
mov dword [esi + 0xe0], eax
mov eax, dword [0x4eac38]
mov ebx, dword [0x4eac3c]
mov ecx, dword [0x4eaca0]
mov edx, dword [0x4eaca4]
mov edi, eax
mov dword [0x4eac3c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [0x4eaca4], ecx
mov dword [0x4eac38], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 8]
mov dword [0x4eace4], eax
mov dword [0x4eace0], eax
mov dword [0x4eaca0], eax
cmp byte [esi], 5
jne 0x446ee3
push 0x4bdb8c
call fcn.0040b7b0
mov esi, dword [esi + 0xc]
call fcn.00446cc0
sub dword [0x4e9884], 0xc
mov esi, eax
jmp 0x446f25
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0xc]
lea eax, [esp + 0x1c]
push eax
push 1
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x24], edx
push 0x4bdb8c
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x3c], 0
call fcn.00491070
mov esi, eax
test esi, esi
je 0x446f25
mov esi, dword [esp + 0x1c]
neg esi
sbb esi, esi
add esi, 4
mov eax, dword [0x4e4b24]
mov ecx, dword [eax + 0xc4]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [0x4e8074], ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [0x4eac38], edi
mov dword [0x4eaca0], edx
mov dword [0x4eac3c], ebx
mov dword [0x4eaca4], eax
call fcn.00403a20
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x4034
call fcn.004b9d80
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x449b01
mov ecx, 0x4bd2c4
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x449b0d
mov esi, 0x4bd2c4
mov eax, dword [0x4e4b24]
cmp dword [eax + 0x100], 0
jne 0x449b24
cmp dword [0x4eac68], 0
je 0x449b42
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x449b30
cmp ebx, 8
jne 0x449b45
push esi
push 0
push ecx
call fcn.00449890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp + 0xc]
cmp byte [0x4eacc7], 0
mov al, byte [0x4eacc4]
je 0x449bb3
test al, al
jne 0x449bb3
cmp ebx, 1
je 0x449bb3
movzx edx, word [edi + 2]
mov eax, dword [0x4e9038]
push ecx
mov ecx, dword [edi + 4]
mov edi, dword [sym.imp.MSVCR100.dll___iob_func]
push ecx
mov ecx, dword [eax + edx*4]
push ecx
push str._s___d__:____s_n
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_fwprintf]
add eax, 0x40
push eax
call ebx
add esp, 0x14
cmp word [esi], 0
je 0x449c86
push esi
push str._____Specifically:__s_n
call edi
add eax, 0x40
push eax
call ebx
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ebx, ebx
jne 0x449bc2
test al, al
je 0x449bd5
mov eax, str.The_current_thread_will_exit.
jmp 0x449be8
cmp ebx, 8
jne 0x449bce
mov eax, str.Continue_running_the_script_
jmp 0x449be8
mov eax, str.For_more_details__read_the_documentation_for_Warn.
jmp 0x449be8
cmp byte [0x4eacc6], 0
mov eax, str.The_script_was_not_reloaded__the_old_version_will_remain_in_effect.
jne 0x449be8
mov eax, str.The_program_will_exit.
push eax
push edi
push esi
push ecx
push ebx
lea eax, [esp + 0x54]
call fcn.00449ca0
add esp, 0x14
cmp dword [0x4e98bc], 0
mov dword [0x4ea818], edi
lea edx, [esp + 0x40]
je 0x449c3b
push str.stderr
push edx
mov ecx, 0x4e9880
call fcn.0040a640
cmp dword [0x4e98bc], 2
je 0x449c89
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
fldz
push 0
sub esp, 8
fstp qword [esp]
xor ecx, ecx
cmp ebx, 8
setne cl
push 0
dec ecx
and ecx, 4
or ecx, 0x40000
push ecx
push edx
call fcn.004a4470
add esp, 0x18
cmp eax, 7
jne 0x449c89
cmp byte [0x4eacc4], 0
mov dword [ebp + 0xc], 2
je 0x449c86
push 0
push 2
mov ecx, 0x4ea1d0
call fcn.0042b150
mov ebx, dword [ebp + 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449df0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x4034
call fcn.004b9d80
mov eax, ecx
mov ecx, dword [eax + 0x648]
push ebx
push esi
push edi
mov dword [esp + 0x3c], eax
test ecx, ecx
je 0x449e2b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push 0
push edx
call fcn.00449ae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 8], 0
jne 0x449e38
mov dword [ebp + 8], 0x4d8998
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x449e44
mov ebx, 0x4bd2c4
cmp byte [0x4eacc7], 0
je 0x449eb3
cmp byte [0x4eacc4], 0
jne 0x449eb3
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x24c]
mov eax, dword [eax + 0x248]
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push ecx
mov ecx, dword [0x4e9038]
push edx
mov edx, dword [ecx + eax*4]
push edx
push str._s___d__:____s_n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fwprintf]
add eax, 0x40
push eax
call edi
add esp, 0x14
cmp word [ebx], 0
je 0x44a009
push ebx
push str._____Specifically:__s_n
call esi
add eax, 0x40
push eax
call edi
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax + 0x24c]
push eax
push str.Error_at_line__u
mov esi, 0x2000
lea edi, [esp + 0x48]
call fcn.0049e5c0
lea edi, [esp + eax*2 + 0x48]
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 0x248]
mov ecx, edi
lea edx, [esp + 0x48]
sub ecx, edx
sar ecx, 1
add esp, 8
sub esi, ecx
test eax, eax
je 0x449f19
mov ecx, dword [0x4e9038]
mov edx, dword [ecx + eax*4]
push edx
push str._in_include_file___s_
call fcn.0049e5c0
lea edi, [edi + eax*2]
mov eax, edi
lea ecx, [esp + 0x48]
sub eax, ecx
sar eax, 1
mov esi, 0x2000
add esp, 8
sub esi, eax
push 0x4d89c4
call fcn.0049e5c0
lea edi, [edi + eax*2]
mov edx, edi
lea eax, [esp + 0x44]
sub edx, eax
sar edx, 1
mov esi, 0x2000
add esp, 4
sub esi, edx
cmp word [ebx], 0
je 0x449f86
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449f45
sub eax, edx
sar eax, 1
cmp eax, 0x64
mov eax, 0x4d38d4
ja 0x449f63
mov eax, 0x4bd2c4
push eax
push ebx
push str.Line_Text:___1.100s_s_nError:
call fcn.0049e5c0
lea edi, [edi + eax*2]
mov ecx, edi
lea edx, [esp + 0x4c]
sub ecx, edx
sar ecx, 1
mov esi, 0x2000
add esp, 0xc
sub esi, ecx
mov eax, dword [esp + 0x3c]
cmp byte [eax + 0xaf6], 0
mov eax, str.The_script_was_not_reloaded__the_old_version_will_remain_in_effect.
jne 0x449f9d
mov eax, str.The_program_will_exit.
mov ecx, dword [ebp + 8]
push eax
push ecx
push str._s_n_n_s
call fcn.0049e5c0
add esp, 0xc
cmp dword [0x4e98bc], 0
je 0x449feb
push str.stderr
lea edx, [esp + 0x44]
push edx
mov ecx, 0x4e9880
call fcn.0040a640
cmp dword [0x4e98bc], 2
je 0x44a009
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
lea ecx, [esp + 0x50]
push 0x10000
push ecx
call fcn.004a4470
add esp, 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44a2f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4004
call fcn.004b9d80
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x44a44c
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x44a322
mov ebx, dword [ecx + 0x648]
test ebx, ebx
je 0x44a32c
movzx edx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x44a339
mov edx, dword [ecx + 0x248]
movzx eax, word [ecx + 0x24c]
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [0x4e9038]
mov edx, dword [ecx + edx*4]
movzx eax, ax
push eax
push edx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.0049e5c0
mov esi, dword [ebp + 0x10]
add esp, 0x10
cmp word [esi], 0
lea edi, [esp + eax*2 + 0x10]
je 0x44a390
lea ecx, [esp + 0x10]
mov eax, edi
push esi
sub eax, ecx
sar eax, 1
mov esi, 0x2000
push str._____Specifically:__s_n
sub esi, eax
call fcn.0049e5c0
mov esi, dword [ebp + 0x10]
add esp, 8
mov edi, dword [ebp + 8]
cmp edi, 3
jne 0x44a3e3
cmp dword [0x4e98c0], 0
je 0x44a3b5
push str.stdout
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4e9880
call fcn.0040a640
cmp dword [0x4e98c0], 2
je 0x44a44c
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.MSVCR100.dll_fputws]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4e98bc], 0
je 0x44a400
push str.stderr
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4e9880
call fcn.0040a640
cmp dword [0x4e98bc], 2
je 0x44a414
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp edi, 2
jne 0x44a44c
test ebx, ebx
jne 0x44a42b
mov ecx, dword [esp + 0xc]
mov ebx, dword [ecx + 0x648]
test ebx, ebx
je 0x44a442
mov eax, dword [ebp + 0xc]
push esi
push 1
push eax
mov ecx, ebx
call fcn.00449ae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0xc]
push esi
push edx
call fcn.00449df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44a8f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44a917
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x44a921
xor edx, edx
mov word [esp + 0x120], dx
mov esi, dword [0x4eac84]
xor eax, eax
mov word [esp + 0x20], ax
test esi, esi
je 0x44a9d9
cmp byte [esi + 0x11], 0
je 0x44a979
mov ecx, dword [esi]
push ecx
call fcn.004910f0
add esp, 4
sub eax, 0
je 0x44a95d
dec eax
je 0x44a956
mov eax, 0x4d7f1c
jmp 0x44a962
mov edx, dword [esi]
mov eax, dword [edx + 4]
jmp 0x44a962
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4d8db8
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.0049e600
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x44a936
cmp word [esp + 0x20], si
je 0x44a9d9
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44a990
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x44a9c7
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x4d38d4
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x44a9d9
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x44a9d9
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x4e6998]
cmp byte [eax + 0xf8], 0
je 0x44a9f8
cmp byte [0x4eacc5], 0
mov dword [esp + 0x14], 1
je 0x44aa00
mov dword [esp + 0x14], 0
mov eax, dword [0x4e8060]
mov dword [esp + 0x18], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x44ab1e
mov dword [esp + 0x18], 0x4bd2c4
xor ebp, ebp
cmp dword [0x4e8024], 0
mov edi, 0x4bf050
je 0x44aa33
mov edi, 0x4bf048
cmp dword [0x4e8020], 0
mov esi, 0x4bf050
je 0x44aa46
mov esi, 0x4bf048
push 1
call fcn.0041b9f0
mov bl, al
add esp, 4
lea eax, [esp + 0x1e8]
call fcn.0041bdb0
mov ecx, dword [0x4e805c]
mov edx, dword [0x4e8060]
push eax
mov eax, dword [0x4e8064]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [0x4eac8c]
push ecx
mov ecx, dword [0x4eac90]
push ebp
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push edi
mov edi, dword [esp + 0x414]
push esi
lea edx, [esp + 0x14c]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.0049e5c0
lea esi, [edi + eax*2]
mov eax, esi
mov ebx, edi
sub eax, ebx
sar eax, 1
mov ecx, 0xfffe
add esp, 0x34
sub ecx, eax
push ecx
push esi
call fcn.00412d40
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44aad3
sub eax, edx
sar eax, 1
cmp dword [0x4e8934], 0
lea edi, [esi + eax*2]
mov eax, str._r_nPress__F5__to_refresh.
jne 0x44aaf8
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
mov edx, edi
sub edx, ebx
sar edx, 1
mov esi, 0xfffe
push eax
sub esi, edx
call fcn.0049e5c0
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
lea ebp, [eax - 1]
jmp 0x44aa20
Function at 0x4505b0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x20]
call fcn.0045d790
mov edi, eax
test edi, edi
je 0x4505d9
mov esi, dword [esp + 0x18]
push edi
call fcn.004a4270
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x450622
mov ecx, dword [0x4e4b24]
test byte [ecx + 0x100], 1
jne 0x450606
mov edx, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push 0x4bf81c
push edx
call fcn.004a2810
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov edi, dword [esp + 0x14]
push 0x4bd2c4
push 0
push 0x4bf81c
call fcn.00449890
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x45065a
cmp ebp, dword [0x4ea158]
je 0x45065a
mov esi, edi
call fcn.004a4790
test al, al
jne 0x45065a
mov eax, dword [0x4ea158]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x4506be
mov edx, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push 0x4bbb9c
push edx
call fcn.004a2810
mov eax, dword [0x4e4b24]
cmp dword [eax + 0x58], 0xffffffff
jle 0x4506be
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4ea158], eax
jne 0x4506af
mov ecx, dword [0x4e4b24]
mov edx, dword [ecx + 0x58]
push 1
push edx
call fcn.00401510
add esp, 8
jmp 0x4506be
mov eax, dword [0x4e4b24]
mov ecx, dword [eax + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x4506d2
mov edx, dword [0x4ea158]
push 0
push ebp
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x451ec0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [0x4e7de0]
push edi
push eax
mov eax, dword [esp + 0x18]
call fcn.0045d790
mov edi, eax
test edi, edi
je 0x451ee6
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [eax + 1]
jmp 0x451eeb
mov ebp, 1
push 1
push 0
lea ecx, [ebp - 1]
push ecx
push 0
push esi
call fcn.004a2810
cmp eax, 1
je 0x451f09
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov ecx, esi
test edi, edi
je 0x451f9b
push ebp
push 0
push 1
call fcn.00401220
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [esi + 0x17], 0
mov ebp, eax
jne 0x451f32
mov edi, dword [esi + 0xc]
jmp 0x451f34
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x451f4c
test byte [edi + 0x15], 8
je 0x451f47
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x451f51
mov eax, 0x4eaef4
lea edx, [ebp + ebp]
mov dword [eax], edx
cmp byte [esi + 0x17], 0
jne 0x451f62
mov edi, dword [esi + 0xc]
jmp 0x451f64
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x451f7c
test byte [edi + 0x15], 8
je 0x451f77
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x451f81
mov eax, 0x4eaef4
test dword [eax], 0xfffffffe
jne 0x451fd8
push 0
push 1
mov ecx, esi
call fcn.00401220
xor ecx, ecx
mov word [eax], cx
jmp 0x451fd8
push 0
push 1
call fcn.00401220
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], dl
jne 0x451fb3
mov edi, dword [esi + 0xc]
jmp 0x451fb5
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x451fcd
test byte [edi + 0x15], 8
je 0x451fc8
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x451fd2
mov eax, 0x4eaef4
mov dword [eax], 0
cmp byte [esi + 0x17], 0
jne 0x451fe1
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x452001
cmp dword [0x4ea180], 0
je 0x452001
mov ecx, 0x4ea174
call fcn.00405160
pop edi
pop esi
pop ebp
pop ecx
ret 4
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4

Function at 0x452da0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004b9d80
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
mov esi, dword [0x4e7de0]
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0x7fff
jb 0x452e54
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push esi
call fcn.004a2810
test eax, eax
jne 0x452df2
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
push edi
push 0
push 1
mov ecx, esi
call fcn.00401220
push eax
push ebx
call ebp
test eax, eax
jne 0x452e15
push eax
push 1
mov ecx, esi
call fcn.00401220
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], 0
jne 0x452e1e
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x452e41
cmp dword [0x4ea180], 0
je 0x452e41
mov ecx, 0x4ea174
call fcn.00405160
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x452e61
mov eax, 0x4bd2c4
push 1
push 0
push edi
push eax
push esi
call fcn.004a2810
pop edi
pop esi
pop ebp
add esp, 0x10000
ret