joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b688
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, 0x493fc0
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x48393c]
cmp eax, 0x270
jl 0x45b753
xor edx, edx
mov esi, SysReAllocString
push ebx
mov ecx, edx
shl ecx, 2
mov eax, dword [ecx + 0x493fdc]
xor eax, dword [ecx + 0x493fd8]
and eax, esi
xor eax, dword [ecx + 0x493fd8]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x47b900]
xor eax, dword [ecx + 0x49460c]
inc edx
cmp edx, 0xe3
mov dword [ecx + 0x493fd8], eax
jl 0x45b6ae
cmp edx, 0x26f
jge 0x45b726
lea ecx, [edx*4 + 0x493fd8]
mov eax, dword [ecx]
lea edx, [ecx + 4]
xor eax, dword [edx]
and eax, esi
xor eax, dword [ecx]
mov ebx, eax
and ebx, 1
mov ebx, dword [ebx*4 + 0x47b900]
xor ebx, dword [edx - 0x390]
shr eax, 1
xor ebx, eax
mov dword [ecx], ebx
mov ecx, edx
cmp ecx, 0x494994
jl 0x45b6f9
mov ecx, dword [0x494994]
mov eax, dword [0x493fd8]
xor eax, ecx
and eax, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x47b900]
pop ebx
xor eax, dword [0x494608]
mov dword [0x494994], eax
xor eax, eax
mov esi, dword [eax*4 + 0x493fd8]
inc eax
push edi
mov dword [0x48393c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
shr eax, 0xb
xor esi, eax
mov eax, esi
and eax, 0xff3a58ad
shl eax, 7
xor esi, eax
mov eax, esi
and eax, 0xffffdf8c
shl eax, 0xf
xor esi, eax
mov eax, esi
shr eax, 0x12
pop edi
xor eax, esi
pop esi
ret
Function at 0x45b966
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x470f57
call fcn.00470310
sub esp, 0x20
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00427c56
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x45ba7a
cmp dword [ebp - 0x14], 0
jl 0x45b9a5
inc dword [ebp - 0x14]
push str.winampGetExtendedRead_open
push dword [edi + 0xc]
mov byte [ebp - 0xd], 1
call esi
push str.winampGetExtendedRead_open_float
push dword [edi + 0xc]
mov ebx, eax
call esi
push str.winampGetExtendedRead_openW
push dword [edi + 0xc]
mov dword [ebp - 0x28], eax
call esi
push str.winampGetExtendedRead_openW_float
push dword [edi + 0xc]
mov dword [ebp - 0x20], eax
call esi
push str.winampGetExtendedRead_getData
push dword [edi + 0xc]
mov dword [ebp - 0x24], eax
call esi
push str.winampGetExtendedRead_close
push dword [edi + 0xc]
mov dword [ebp - 0x1c], eax
call esi
push 0x47b934
push dword [edi + 0xc]
mov dword [ebp - 0x18], eax
call esi
mov edi, eax
xor eax, eax
cmp ebx, eax
jne 0x45ba0d
cmp dword [ebp - 0x20], eax
je 0x45ba6a
cmp dword [ebp - 0x1c], eax
je 0x45ba6a
cmp dword [ebp - 0x18], eax
je 0x45ba6a
push 0x24
call sub.NSCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x45ba46
push edi
push dword [ebp - 0x18]
mov ecx, eax
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push ebx
call fcn.0045c2a3
mov edi, eax
jmp 0x45ba48
xor edi, edi
push dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
mov ecx, edi
call fcn.0045c0c5
test al, al
jne 0x45ba76
test edi, edi
je 0x45ba6a
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
cmp dword [ebp - 0x14], 0
jge 0x45b984
jmp 0x45ba80
mov eax, edi
jmp 0x45bae8
cmp byte [ebp - 0xd], 0
je 0x45badc
cmp byte [ebp + 0x10], 0
je 0x45badc
push 0xc
call sub.NSCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 0x10], eax
xor edi, edi
inc edi
test eax, eax
mov dword [ebp - 4], edi
je 0x45baa6
mov ecx, eax
call fcn.0045c4ac
mov esi, eax
jmp 0x45baa8
xor esi, esi
or dword [ebp - 4], 0xffffffff
push 0
push dword [ebp + 8]
call fcn.00427c56
pop ecx
pop ecx
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push eax
call fcn.0045c5de
test al, al
je 0x45bace
mov eax, esi
jmp 0x45bae8
test esi, esi
je 0x45bae6
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 4]
jmp 0x45bae6
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x18], 2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x45d05d
Capabilities:
Read file on windows

Disassembly:
and dword [esi], 0
push ebx
push 0x472ae4
push dword [esp + 0xc]
call dword [sym.imp.NSCRT.dll__wfopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x45d07a
pop ebx
ret
push edi
mov edi, dword [sym.imp.NSCRT.dll_fseek]
push 2
push 0
push ebx
call edi
push ebx
call dword [sym.imp.NSCRT.dll_ftell]
add esp, 0x10
test eax, eax
mov dword [esi], eax
jne 0x45d09c
xor edi, edi
jmp 0x45d0bc
push 0
push 0
push ebx
call edi
push dword [esi]
call dword [sym.imp.NSCRT.dll_malloc]
push ebx
push 1
push dword [esi]
mov edi, eax
push edi
call dword [sym.imp.NSCRT.dll_fread]
add esp, 0x20
push ebx
call dword [sym.imp.NSCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop ebx
ret

Function at 0x45d12b
Capabilities:
Write file on windows

Disassembly:
push esi
push 0x47b5dc
push dword [esp + 0xc]
call dword [sym.imp.NSCRT.dll__wfopen]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x45d146
inc eax
pop esi
ret
push edi
push esi
xor edi, edi
inc edi
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.NSCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x45d163
xor edi, edi
push esi
call dword [sym.imp.NSCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x45d170
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push 0x47be8c
push dword [ebp + 8]
lea eax, [ebp - 0x868]
push eax
call esi
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45d1f4
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x660]
push eax
call esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x458]
push eax
call esi
push 1
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x45d1f6
xor al, al
pop edi
pop esi
leave
ret

Function at 0x45d57c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x458]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45d5ef
push dword [ebp + 0x18]
lea eax, [ebp - 0x224]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.0045d4c5
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x45d5f5
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45d5b5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x45d5f1
Function at 0x45d600
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x460]
push dword [ebp + 8]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45d677
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
call fcn.0045d4c5
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x45d67e
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45d63c
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x492574]
push edi
push 0xa
call fcn.00402f06
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x668]
push eax
call esi
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
jmp 0x45d679

Function at 0x45dd57
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp + 8]
lea eax, [ebp - 0x86c]
push eax
call esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x86c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45de19
push edi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0045d270
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x45ddff
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x45c]
push eax
call esi
push 1
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
push edi
push 0
push 0x136
call fcn.00424a5f
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45dd97
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x460046
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [esi], edi
je 0x4600ce
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4600c5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x4600c5
push edi
lea eax, [ebp - 8]
push eax
push dword [esi]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4600b4
mov eax, dword [esi]
cmp eax, dword [ebp - 8]
je 0x4600c5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
pop edi
mov eax, ebx
pop ebx
leave
ret

Function at 0x460465
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0x28
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x30]
push ebx
push eax
call sub.NSCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
cmp edi, ebx
mov word [ebp - 0x22], 0x20
mov word [ebp - 0x24], 1
mov dword [ebp - 0x30], esi
jne 0x4604aa
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
lea esi, [ebp - 4]
call fcn.00460046
pop ecx
pop ecx
jmp 0x4604e3
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4604e1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4604e3
xor eax, eax
mov esi, eax
cmp esi, ebx
je 0x460502
push dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
push esi
call fcn.004603a7
add esp, 0x14
mov esi, eax
cmp dword [ebp + 8], ebx
je 0x460524
cmp edi, ebx
push dword [ebp + 8]
je 0x460516
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x460524
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, ebx
je 0x460570
neg dword [ebp - 0x28]
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, eax
cmp edi, ebx
je 0x460560
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jg 0x46054c
neg eax
imul eax, dword [ebp - 0x2c]
shl eax, 2
push eax
push esi
push dword [ebp - 8]
call sub.NSCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [0x492574]
push esi
push 0xa
call fcn.00402f06
jmp 0x460572
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x460579
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
lea eax, [ebp - 8]
push eax
push str.SoftwareOrb_NetworksOrb
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x46059e
xor eax, eax
leave
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push esi
push esi
push str.FirstTime
push dword [ebp - 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x4605ca
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x860]
push eax
push esi
push esi
push str.InstallName
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call edi
test eax, eax
je 0x4605f3
mov word [ebp - 0x860], si
cmp word [ebp - 0x860], si
je 0x460647
push 0xffffffffffffffff
push str.us_winamp
push 0xffffffffffffffff
lea eax, [ebp - 0x860]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x460647
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x860]
push eax
push esi
push esi
push str.InstallDir
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call edi
test eax, eax
je 0x460647
mov word [ebp - 0x860], si
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], esi
je 0x4606a6
cmp word [ebp - 0x860], si
je 0x4606a6
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x60], 0x44
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
push 0x47c18c
lea eax, [ebp - 0x860]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x860]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
jmp 0x4606a8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4606ac
Capabilities:
Check for time delay via gettickcount
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x264]
mov dword [ebp - 0x268], 0x22
rep stosd dword es:[edi], eax
push 0x10
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4606eb
mov dword [eax], ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x266]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___NEW
push 0x104
lea eax, [ebp - 0x268]
push eax
call fcn.0040bd1d
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x46076a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x46076a
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x268]
push eax
call edi
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x10]
sub esi, eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jge 0x46076a
push esi
lea eax, [ebp - 0x268]
push eax
call edi
lea eax, [ebp + eax*2 - 0x268]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
push ebx
mov dword [ebp - 0x34], 0x41
mov word [ebp - 0x30], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x460854
cmp dword [ebp + 8], ebx
mov dword [ebp + 0x10], ebx
je 0x460845
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], ebx
mov edi, 0xfa
cmp dword [ebp + 0x10], ebx
jne 0x4607ef
push ebx
push 0x4965c0
push ebx
jmp 0x4607e1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x4607ef
push ebx
push 0x4965c0
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x4607c3
call esi
mov dword [ebp - 8], eax
jmp 0x46081d
push 5
push 0xff
mov ecx, edi
sub ecx, eax
push ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
test eax, eax
jne 0x46081d
mov ecx, dword [0x49257c]
call fcn.00456383
test eax, eax
jne 0x46080e
call esi
sub eax, dword [ebp - 8]
cmp eax, edi
jb 0x4607f6
cmp dword [ebp + 0x10], ebx
je 0x460838
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x460845
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jl 0x4607b5
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x460851
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x460ece
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x470ffa
call fcn.00470310
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
and dword [esi + 8], 0
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esi], 0x47c30c
mov dword [esi + 4], 1
call fcn.00410af4
mov dword [edi], 0x47c2bc
lea edi, [esi + 0x1c]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00410af4
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x47c2c0
and dword [esi + 0x2c], 0
or dword [esi + 0x30], 0xffffffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x461536
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x14], ebx
jbe 0x461572
test edi, edi
jne 0x461572
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + ebx*4]
push 0x80004001
push 0x28
call fcn.00424a88
mov edi, eax
dec edi
neg edi
sbb edi, edi
neg edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x46154d
push 0x80
lea eax, [ebp - 0x100]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ebx, ebx
cmp edi, ebx
lea eax, [ebp - 0x100]
je 0x4615ce
push 0x33
push eax
push ebx
push ebx
push 0x7d6
call fcn.0045ede1
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
dec eax
dec eax
je 0x461600
sub eax, 4
jne 0x4615ef
push ebx
push 0x9c4d
push 0x111
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4615ef
push 0x34
push eax
push ebx
push ebx
push 0x7db
call fcn.0045ede1
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x461600
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4618f9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, 0x9c48
cmp ecx, eax
jg 0x4619e7
je 0x4619ce
mov eax, ecx
dec eax
je 0x461985
dec eax
je 0x46197f
sub eax, 0x3e7
je 0x461966
dec eax
je 0x46194d
dec eax
jne 0x461a86
mov eax, dword [ebp + 0xc]
dec eax
jne 0x461a86
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00461605
jmp 0x461a86
cmp dword [ebp + 0xc], 0
jne 0x461a86
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00460911
jmp 0x461a86
cmp dword [ebp + 0xc], 0
jne 0x461a86
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004608bf
jmp 0x461a86
cmp dword [ebp + 0xc], 0
jmp 0x4619f9
cmp dword [ebp + 0xc], 0
jne 0x461a86
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x461a86
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + eax*4]
push 0x80004001
push 0x3c
mov ecx, eax
call fcn.00424a88
cmp eax, 1
je 0x461a86
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x461a86
push 0
push 0x4609cf
push dword [esi + 8]
push 0x69
call fcn.0045ff7b
add esp, 0x10
jmp 0x461a86
mov eax, ecx
sub eax, 0x9c4b
je 0x461a68
dec eax
je 0x461a58
dec eax
je 0x461a08
sub eax, 3
jne 0x461a86
mov ecx, esi
call fcn.00461536
jmp 0x461a86
push 0
mov ecx, esi
call fcn.00461050
test eax, eax
je 0x461a86
push 0x80
lea eax, [ebp - 0x100]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10
lea eax, [ebp - 0x100]
push eax
push 0x100
lea eax, [ebp - 0x300]
push eax
push 0x7d8
call fcn.0045ede1
add esp, 0xc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x461a86
push 0
push 0
push 0xf5
push 0x3e9
jmp 0x461a76
push 0
push 0
push 0xf5
push 0x3ea
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
leave
ret 0xc
Function at 0x4620e9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa8
mov eax, dword [ebp + 0x7c]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x462158
cmp dword [0x483990], 0xffffffff
mov dword [eax], edi
jne 0x462140
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x46213a
cmp dword [ebp - 0x30], 5
ja 0x46212e
jne 0x46213a
cmp dword [ebp - 0x2c], edi
jbe 0x46213a
mov dword [0x483990], 1
jmp 0x462140
mov dword [0x483990], edi
push edi
push 0x461fc2
push edi
push 0x6d
call fcn.0045ffc0
add esp, 0x10
cmp eax, edi
mov dword [ebp + 0x70], eax
jne 0x462160
xor eax, eax
inc eax
jmp 0x462246
mov ecx, dword [esi + 0xc0]
push ebx
lea ebx, [esi + 0xb8]
cmp ecx, dword [ebx]
je 0x4621be
lea ecx, [ebp + 0x60]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0xbc]
mov eax, dword [esi + 0xc4]
mov ebx, dword [ebx]
sub eax, ecx
sub eax, dword [ebp + 0x6c]
push 0x15
add eax, dword [ebp + 0x64]
push edi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
push edi
push eax
mov eax, dword [ebp + 0x60]
sub eax, ebx
sub eax, dword [ebp + 0x68]
add eax, dword [esi + 0xc0]
cdq
sub eax, edx
sar eax, 1
add eax, ebx
push eax
push edi
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x3fa
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
cmp ebx, edi
je 0x46223b
cmp dword [0x483990], edi
je 0x462205
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xc8
push 1
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46223b
xor eax, eax
mov ax, word [esi + 0x24]
add ax, word [esi + 0x14]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
inc eax
movzx eax, ax
shl eax, 0x10
push eax
push edi
push 0x401
push ebx
call esi
push edi
push edi
push 0x402
push ebx
call esi
push edi
push 1
push 0x404
push ebx
call esi
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x7c]
mov dword [ecx], eax
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x74
leave
ret 4