joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bd7a
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov ebx, 0x80
push ebx
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x42bec3
push edi
push dword [ebp + 8]
mov eax, 0x800
push str._s.TMP
lea edi, [ebp - 0x80c]
call fcn.0040258b
pop ecx
pop ecx
xor edi, edi
push edi
push ebx
push 4
push edi
push 1
push 0x40000000
lea eax, [ebp - 0x80c]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x42bdf7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42bec2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, str.Winamp_EQ_library_file_v1.1
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
call edi
push 0
lea eax, [ebp - 4]
push eax
push ebx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 0xc]
call ebx
mov esi, 0x10c
jmp 0x42be6b
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.NSCRT.dll__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x42be6b
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 0xc]
call ebx
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x42be40
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov eax, 0x800
push str._s.TMP
lea edi, [ebp - 0x80c]
call fcn.0040258b
pop ecx
pop ecx
push dword [ebp + 8]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42bec7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x42bf79
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push esi
lea eax, [ebp - 0xc]
push eax
mov esi, str.Winamp_EQ_library_file_v1.1
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 4]
call edi
push esi
call ebx
push eax
lea eax, [ebp - 0x80c]
push esi
push eax
call sub.NSCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x42bf6e
xor ebx, ebx
mov esi, 0x10c
jmp 0x42bf57
lea eax, [ebp - 0x80c]
push eax
push ebx
push 0x180
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], esi
je 0x42bf41
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42d428
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0x478290
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor esi, esi
push esi
push esi
push 1
push esi
call edi
push esi
push esi
push esi
push esi
mov dword [0x47826c], eax
call edi
push esi
push esi
push 1
push esi
mov dword [0x478270], eax
call edi
mov dword [0x478274], eax
lea eax, [esp + 8]
push eax
push esi
push esi
push 0x42d27d
push 0x40000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [0x47828c], esi
mov dword [0x478288], esi
mov dword [0x4782ac], esi
mov dword [0x4782b0], esi
mov dword [0x47b648], eax
pop esi
pop ecx
ret

Function at 0x4300b7
Capabilities:
Read .ini file

Disassembly:
push ebp
push esi
mov ebp, 0x47c560
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x47b158
xor esi, esi
push esi
push str.rmudhack
push str.winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0x29a
je 0x430126
cmp dword [0x47b658], esi
je 0x430115
push ebx
xor ebx, ebx
cmp dword [0x47b65c], esi
jle 0x430114
push edi
mov eax, dword [0x47b658]
lea edi, [esi + eax]
call fcn.0042f196
inc ebx
add esi, 0x3c
cmp ebx, dword [0x47b65c]
jl 0x4300f8
xor esi, esi
pop edi
pop ebx
mov dword [0x47b65c], esi
mov dword [0x47b660], esi
call fcn.0043185f
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
ret
Function at 0x4308c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
push 0x47c560
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x46bbe4
call fcn.00413b5c
mov edi, dword [sym.imp.NSCRT.dll__wcsicmp]
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x43090f
push esi
push dword [0x47b6c8]
lea ebx, [ebp - 0x218]
call fcn.0040fb18
test eax, eax
pop ecx
pop ecx
je 0x43095b
mov esi, ebx
push 6
push 0x46a94c
push esi
call dword [sym.imp.NSCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
push esi
jne 0x430939
call dword [0x473f40]
cmp eax, 7
jne 0x430956
push esi
call fcn.0043083a
pop ecx
jmp 0x43095b
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x43096b
push dword [ebp + 8]
push 1
push esi
call fcn.00431a2b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43095b
call fcn.00430bca
push 0x47c560
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
push 0x46bbdc
lea eax, [esi + 2]
push eax
call dword [0x473f30]
test eax, eax
jne 0x430989
push 1
push esi
call fcn.004317a8
pop ecx
jmp 0x430936
lea eax, [ebp - 0x468]
push eax
push esi
call dword [0x473ee4]
cmp eax, 0xffffffff
je 0x430956
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x468], 0x10
jne 0x43097e
xor ebx, ebx
push ebx
push 1
push esi
call fcn.00431a2b
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43095b
push 0x467cdc
call fcn.00413b5c
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x430956
push 0x46bbd8
push esi
call dword [sym.imp.NSCRT.dll__wfopen]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
pop ecx
stosb byte es:[edi], al
je 0x430a15
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push 0xc
push 1
push eax
call dword [sym.imp.NSCRT.dll_fread]
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_fclose]
add esp, 0x14
mov byte [ebp - 5], bl
mov edi, dword [sym.imp.NSCRT.dll__strnicmp]
push 0xb
lea eax, [ebp - 0x10]
push str._Reference_
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x430a3c
push 1
push esi
call fcn.00455391
jmp 0x430986
push 0xa
lea eax, [ebp - 0x10]
push str._playlist_
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x430a5a
push ebx
push 1
push 0x46bbb4
jmp 0x430ab6
push 7
lea eax, [ebp - 0x10]
push str.EXTM3U
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x430a78
push ebx
push 1
push 0x4683d8
jmp 0x430ab6
push 4
lea eax, [ebp - 0x10]
push str._ASX
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x430a96
push ebx
push 1
push str..asx
jmp 0x430ab6
push 5
lea eax, [ebp - 0x10]
push str.__wpl
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x430956
push ebx
push 1
push str..wpl
push esi
call fcn.004318e9
add esp, 0x10
jmp 0x43095b
Function at 0x4318e9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x47b720]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
je 0x431a23
push dword [ebp + 0xc]
xor esi, esi
inc esi
push esi
push 0x78
call fcn.00451c32
test al, al
je 0x431a23
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x43199d
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0040263a
mov edi, eax
push 0x18
xor eax, eax
xor ecx, ecx
call fcn.0040a416
push eax
mov esi, 0x4763a8
push esi
push edi
push dword [0x47b6c8]
call fcn.0040964c
mov ebx, eax
neg ebx
sbb bl, bl
push edi
mov edi, dword [sym.imp.NSCRT.dll_free]
inc bl
call edi
add esp, 0x24
test bl, bl
je 0x43198e
push 0
push esi
call fcn.004026c1
push dword [ebp + 0x14]
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004318e9
push ebx
mov dword [ebp - 4], eax
call edi
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
jmp 0x431a26
call fcn.0042ffcf
test eax, eax
je 0x4319b2
cmp dword [ebp + 0x10], esi
jge 0x4319b2
call fcn.004300b7
mov edi, esi
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
sete al
neg ecx
sbb ecx, ecx
and ecx, 0x47ae48
push eax
lea eax, [ebp - 0x10]
call fcn.004348c5
mov ecx, dword [0x47b720]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push 0xd
call fcn.00450ed3
cmp edi, ebx
je 0x431a1f
push ebx
call fcn.00415714
cmp byte [0x475838], 0
pop ecx
je 0x431a04
push 0xc4653600
call fcn.004313bf
pop ecx
push 0x480520
mov ebx, 0x480d60
call fcn.00430d20
cmp dword [ebp + 0x10], 0
pop ecx
jne 0x431a1f
call fcn.00415552
xor eax, eax
jmp 0x431a26
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43a373
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8648
call fcn.00461410
cmp byte [0x476ad0], 0
push ebx
push esi
push edi
je 0x43a58c
push 0x279
push 0
push 0x400
push dword [0x47b6c8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x10000
jg 0x43a5aa
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push str.readme.txt
mov edi, 0x475b58
push edi
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push 0x469c3c
push eax
call dword [sym.imp.NSCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x43a506
push str.read_me.txt
push edi
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push 0x469c3c
push eax
call dword [sym.imp.NSCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x43a506
push str.file_id.diz
push edi
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push 0x469c3c
push eax
call dword [sym.imp.NSCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x43a506
push str..txt
push edi
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], bl
je 0x43a585
mov ebx, dword [sym.imp.NSCRT.dll__stricmp]
lea eax, [ebp - 0x21c]
push str.pledit.txt
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x43a4bc
lea eax, [ebp - 0x21c]
push str.viscolor.txt
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x43a4bc
lea eax, [ebp - 0x21c]
push str.region.txt
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x43a4d2
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43a480
jmp 0x43a4e3
lea eax, [ebp - 0x21c]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x108]
push 0x469c3c
push eax
call dword [sym.imp.NSCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x43a585
mov edi, dword [sym.imp.NSCRT.dll_fgets]
push ebx
lea esi, [ebp - 0x8648]
push 0x400
mov eax, esi
push eax
jmp 0x43a564
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0xa
jne 0x43a537
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi - 1], 0
push 0x469918
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
mov eax, esi
lea ecx, [ebp - 0x8648]
sub eax, ecx
cmp eax, 0x8000
jg 0x43a56f
push ebx
push 0x400
push esi
call edi
add esp, 0xc
test byte [ebx + 0xc], 0x10
je 0x43a51d
push ebx
call dword [sym.imp.NSCRT.dll_fclose]
mov byte [ebp - 0x649], 0
lea eax, [ebp - 0x8648]
jmp 0x43a5a9
push str._no_info_found_
jmp 0x43a5ab
push 0x473ac8
push str.Winamp_base_skin_v_s
mov eax, 0x100
lea edi, [ebp - 0x104]
call fcn.0040258b
pop ecx
mov eax, edi
pop ecx
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ee50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x20
push 0x40
call edi
mov esi, eax
test esi, esi
je 0x43ef35
push 0x100
push 0x40
call edi
push 0x30
push 0x40
mov dword [esi], eax
call edi
mov ecx, dword [esi]
test ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
je 0x43ef3d
test eax, eax
je 0x43ef3a
mov al, 4
mov edi, 0x10
mov byte [esi + 8], al
mov byte [esi + 9], al
mov eax, 0x42400000
push ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
xor edx, edx
push ebp
lea esp, [esp]
mov ecx, edx
xor eax, eax
shl ecx, 4
mov ebp, dword [esi]
mov bl, dl
xor bl, al
add ebp, ecx
mov byte [eax + ebp], bl
inc eax
cmp eax, edi
jl 0x43eec7
inc edx
cmp edx, edi
jl 0x43eec0
xor ecx, ecx
xor ebp, ebp
xor ebx, ebx
xor edi, edi
mov eax, edi
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x2b
mov byte [ecx + edx], al
mov eax, ebx
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 0x19
mov byte [edx + ecx + 1], al
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
mov edx, dword [esi + 4]
sar eax, 4
add al, 9
mov byte [edx + ecx + 2], al
add edi, 0x32
add ebx, 0x1b
add ebp, 0xe
add ecx, 3
cmp edi, 0x320
jl 0x43eee4
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
push ecx
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x43ef47
push eax
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
ret
Function at 0x444117
Capabilities:
Parse credit card information

Disassembly:
movzx eax, cx
push edi
mov edx, 0xe7
xor edi, edi
cmp eax, edx
jg 0x44419e
je 0x44419a
add edx, 0xffffffea
cmp eax, edx
jg 0x444171
je 0x4441d7
sub eax, 0xb0
je 0x444158
sub eax, 0x16
je 0x444154
dec eax
je 0x444150
dec eax
dec eax
jne 0x444206
push 0x45
jmp 0x444197
push 0x43
jmp 0x444197
push 0x41
jmp 0x444197
push 0x30
pop ecx
xor eax, eax
inc eax
cmp cx, ax
push 6
pop edi
jne 0x44423c
push 0xa
jmp 0x4443ef
cmp eax, 0xdc
je 0x444195
cmp eax, 0xdf
jle 0x444206
cmp eax, 0xe2
jle 0x444191
cmp eax, 0xe6
jne 0x444206
push 0x61
jmp 0x444200
push 0x55
pop ecx
jmp 0x444212
push 0x63
jmp 0x444200
cmp eax, 0xfb
jg 0x4441e7
cmp eax, 0xf9
jge 0x4441e3
cmp eax, 0xe8
jl 0x444206
cmp eax, 0xeb
jle 0x4441df
cmp eax, 0xef
jle 0x4441db
mov edx, 0xf1
cmp eax, edx
je 0x4441d7
jle 0x444206
cmp eax, 0xf4
jg 0x444206
push 0x6f
jmp 0x444200
push 0x6e
jmp 0x444200
push 0x69
jmp 0x444200
push 0x65
jmp 0x444200
push 0x75
jmp 0x444200
sub eax, 0xfc
je 0x444203
sub eax, 3
je 0x4441fe
sub eax, 0x93
jne 0x444206
push 0x66
jmp 0x444200
push 0x79
pop ecx
jmp 0x444231
push 0x75
pop ecx
cmp cx, 0x5a
ja 0x44421d
cmp cx, 0x41
jb 0x44421d
movzx eax, cx
sub eax, 0x41
jmp 0x4443f0
cmp cx, 0x7a
ja 0x44415b
cmp cx, 0x61
jb 0x44415b
movzx eax, cx
sub eax, 0x61
jmp 0x4443f0
cmp cx, 0x2e
jne 0x444249
push 0xb
jmp 0x4443ef
cmp cx, 0x39
ja 0x444260
cmp cx, 0x30
jb 0x444260
movzx eax, cx
sub eax, 0x30
jmp 0x4443f0
cmp cx, 0x3a
jne 0x44426d
push 0xc
jmp 0x4443ef
cmp cx, 0x28
jne 0x44427a
push 0xd
jmp 0x4443ef
cmp cx, 0x29
jne 0x444287
push 0xe
jmp 0x4443ef
cmp cx, 0x2d
jne 0x444294
push 0xf
jmp 0x4443ef
cmp cx, 0x27
je 0x4443ed
cmp cx, 0x60
je 0x4443ed
cmp cx, 0x21
jne 0x4442b5
push 0x11
jmp 0x4443ef
cmp cx, 0x5f
jne 0x4442c2
push 0x12
jmp 0x4443ef
cmp cx, 0x2b
jne 0x4442cf
push 0x13
jmp 0x4443ef
cmp cx, 0x5c
jne 0x4442dc
push 0x14
jmp 0x4443ef
cmp cx, 0x2f
jne 0x4442e9
push 0x15
jmp 0x4443ef
cmp cx, 0x5b
je 0x4443e9
cmp cx, 0x7b
je 0x4443e9
cmp cx, 0x3c
je 0x4443e9
cmp cx, 0x5d
je 0x4443e5
cmp cx, 0x7d
je 0x4443e5
cmp cx, 0x3e
je 0x4443e5
cmp cx, 0x7e
je 0x4443e1
cmp cx, 0x5e
je 0x4443e1
cmp cx, 0x26
jne 0x444346
push 0x19
jmp 0x4443ef
cmp cx, 0x25
je 0x4443c3
cmp cx, 0x2c
jne 0x444359
push 0x1b
jmp 0x4443ef
cmp cx, 0x3d
jne 0x444366
push 0x1c
jmp 0x4443ef
cmp cx, 0x24
jne 0x444370
push 0x1d
jmp 0x4443ef
cmp cx, 0x23
jne 0x44437a
push 0x1e
jmp 0x4443ef
cmp cx, 0xc5
push 0xc
pop edi
je 0x4443dd
cmp cx, 0xe5
je 0x4443dd
cmp cx, 0xd6
je 0x4443f0
cmp cx, 0xf6
je 0x4443f0
cmp cx, 0xc4
je 0x4443d9
cmp cx, 0xe4
je 0x4443d9
cmp cx, 0x3f
jne 0x4443b1
push 3
jmp 0x4443ef
cmp cx, 0x2a
jne 0x4443bb
push 4
jmp 0x4443ef
xor edi, edi
cmp cx, 0x22
jne 0x4443c7
push 0x1a
jmp 0x4443ef
xor eax, eax
cmp cx, 0x40
setne al
dec eax
and eax, 0xfffffffd
add eax, 0x1e
jmp 0x4443f0
push 2
jmp 0x4443ef
xor eax, eax
jmp 0x4443f0
push 0x18
jmp 0x4443ef
push 0x17
jmp 0x4443ef
push 0x16
jmp 0x4443ef
push 0x10
pop eax
mov ecx, dword [esp + 8]
lea eax, [eax + eax*4]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
mov dword [eax], edi
pop edi
ret
Function at 0x446d5e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, 0x479a08
push 0x12
mov edx, esi
mov edi, eax
call fcn.00403759
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040263a
add esp, 0xc
push 0x26e
push eax
push 0x400
push dword [0x47b6c8]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x13
push esi
mov esi, dword [0x47b72c]
push str.PE_Info
call fcn.004511d2
cmp dword [0x47b6a4], ebx
je 0x446dd9
mov eax, dword [0x472d10]
add eax, 0xffffff71
mov dword [ebp - 4], eax
mov eax, dword [0x472d14]
add eax, 0xffffffe4
cmp dword [0x47b6b4], ebx
mov dword [ebp - 0x14], eax
je 0x446de8
push dword [ebp - 8]
call dword [sym.imp.NSCRT.dll_free]
pop ecx
jmp 0x446eb8
mov esi, dword [0x473f40]
push edi
call esi
cmp eax, 0x12
jge 0x446e22
push 0x13
mov eax, edi
lea edx, [ebp - 0x3c]
call fcn.00403759
push edi
call esi
push 0x12
pop ecx
cmp eax, ecx
jge 0x446e31
sub ecx, eax
lea edi, [ebp + eax*2 - 0x3c]
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x446e31
push 0x24
lea eax, [ebp - 0x3c]
push edi
push eax
call sub.NSCRT.dll_memcpy
add esp, 0xc
push dword [0x480840]
call fcn.00443288
mov edi, eax
push edi
call fcn.00443346
push dword [0x4798b4]
call fcn.0044336c
add esp, 0xc
xor esi, esi
mov cx, word [ebp + esi*2 - 0x3c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00444117
pop ecx
pop ecx
push 0xcc0020
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [0x4798cc]
push 6
push 5
push dword [ebp - 0x14]
push dword [ebp - 4]
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp - 4], 5
inc esi
cmp esi, 0x12
jl 0x446e54
push ebx
call fcn.0044336c
push edi
push dword [0x480840]
call fcn.0044329e
push dword [ebp - 8]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447305
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
cmp dword [0x47b6a4], 0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, eax
je 0x4474eb
push esi
mov esi, dword [0x472d14]
push edi
push dword [0x480840]
add esi, 0xffffffc6
mov dword [esp + 0x1c], esi
call fcn.00443288
push eax
mov dword [esp + 0x1c], eax
call fcn.00443346
push dword [0x47b6a0]
call fcn.0044336c
mov eax, dword [0x472d14]
add eax, 0xffffffc4
cdq
idiv dword [0x473ab4]
add esp, 0xc
mov edi, eax
call fcn.0042ffcf
mov ecx, eax
sub ecx, edi
cmp ecx, 1
jl 0x447385
cmp ebx, ecx
jle 0x447374
mov ebx, ecx
lea eax, [esi - 0x12]
imul eax, ebx
cdq
idiv ecx
test eax, eax
mov dword [esp + 0x10], eax
jge 0x44738a
and dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
add eax, 0xffffffe4
xor esi, esi
test eax, eax
mov ebx, 0xcc0020
jle 0x4473d2
push ebx
push 0x2a
push 0x24
push dword [0x4798cc]
lea eax, [esi + 0x14]
push 0x1d
push 8
push eax
mov eax, dword [0x472d10]
add eax, 0xfffffff1
push eax
push dword [esp + 0x34]
call edi
mov eax, dword [esp + 0x10]
add esi, 0x1d
add eax, 0xffffffe4
cmp esi, eax
jl 0x4473a2
mov ecx, dword [esp + 0x10]
lea edx, [esi + 0x1d]
lea eax, [ecx + 0x12]
cmp eax, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
jle 0x4473ed
add dword [esp + 0x1c], 0x1d
cmp esi, ecx
jge 0x447414
mov eax, dword [0x472d10]
push ebx
push 0x2a
push 0x24
push dword [0x4798cc]
sub ecx, esi
push ecx
push 8
add esi, 0x14
push esi
add eax, 0xfffffff1
push eax
push dword [esp + 0x34]
call edi
mov eax, dword [esp + 0x10]
push ebx
neg ebp
sbb ebp, ebp
push 0x35
and ebp, 9
add ebp, 0x34
push ebp
push dword [0x4798cc]
add eax, 0x14
push 0x12
push 8
push eax
mov eax, dword [0x472d10]
add eax, 0xfffffff1
push eax
push dword [esp + 0x34]
call edi
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
mov esi, dword [esp + 0x18]
jge 0x44748b
cmp eax, esi
jge 0x44748b
lea ecx, [esi - 0x1d]
cmp eax, ecx
mov ecx, ebp
jl 0x447462
mov ecx, esi
push ebx
mov edx, eax
sub edx, ebp
add edx, 0x47
push edx
push 0x24
push dword [0x4798cc]
sub ecx, eax
push ecx
push 8
add eax, 0x14
push eax
mov eax, dword [0x472d10]
add eax, 0xfffffff1
push eax
push dword [esp + 0x34]
call edi
cmp ebp, esi
jge 0x4474d0
sub esi, ebp
mov eax, dword [esp + 0x18]
add eax, 0xffffffe3
cmp ebp, eax
jge 0x4474a1
push 0x1d
pop eax
jmp 0x4474a3
mov eax, esi
push ebx
push 0x2a
push 0x24
push dword [0x4798cc]
push eax
push 8
lea eax, [ebp + 0x14]
push eax
mov eax, dword [0x472d10]
add eax, 0xfffffff1
push eax
push dword [esp + 0x34]
call edi
add ebp, 0x1d
sub esi, 0x1d
cmp ebp, dword [esp + 0x18]
jl 0x447491
push 0
call fcn.0044336c
push dword [esp + 0x18]
push dword [0x480840]
call fcn.0044329e
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret