joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483d18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x483d88
mov edx, 0x80000002
xor eax, eax
call fcn.0042de1c
test eax, eax
jne 0x483d81
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x483db4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x483d78
cmp dword [ebp - 0xc], 4
jne 0x483d78
cmp dword [ebp - 8], 4
jne 0x483d78
mov ax, word [ebp - 0x10]
mov word [0x49c450], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x483efc
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x483fae
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x49c44c], eax
cmp byte [0x49c439], 0
je 0x483fae
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x483f9f
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x483fae
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x49c450], ax
mov al, byte [esp + 0x12e]
mov byte [0x49c452], al
mov ax, word [esp + 0x12c]
mov word [0x49c454], ax
jmp 0x483fae
cmp eax, 4
jne 0x483fae
call fcn.00483d18
call fcn.00483dc0
add esp, 0x130
ret
Function at 0x48def4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x48e095
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
mov ecx, 0x200
xor edx, edx
call fcn.004034e0
push 0
xor eax, eax
mov al, byte [ebp + 8]
mov eax, dword [eax*4 + 0x49a0e0]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0042de1c
test eax, eax
jne 0x48e07a
xor edx, edx
push ebp
push 0x48e06f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
xor ecx, ecx
mov edx, dword [esi + 4]
call fcn.00436adc
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov dword [ebp - 0x18], eax
cmp byte [ebp + 8], 0
je 0x48dfac
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
jmp 0x48dfcb
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
sub eax, 1
jb 0x48e019
sub eax, 0xe9
je 0x48dfde
sub eax, 0x19
je 0x48e058
jmp 0x48e012
mov eax, dword [ebp - 0x10]
call fcn.00403574
cmp eax, 0x10000
jl 0x48dff7
call fcn.004031bc
jmp 0x48e07a
mov eax, dword [ebp - 0x10]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.004034e0
jmp 0x48df7a
call fcn.004031bc
jmp 0x48e07a
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.00436adc
lea eax, [ebp - 0x10]
call fcn.00403744
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004034e0
lea ecx, [ebp - 0x24]
mov eax, esi
mov edx, ebx
call fcn.004434fc
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
call fcn.00435a2c
inc ebx
jmp 0x48df7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e076
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e09c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403420
ret
Function at 0x4964f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x496597
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4965b0
push ebx
push 0x4965bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403634
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402934
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x496575
mov eax, dword [0x49bdf8]
call fcn.0049644c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49659e
lea eax, [ebp - 4]
call fcn.00403400
ret
Function at 0x496da4
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x496f75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042da18
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004538bc
test al, al
jne 0x496e0b
xor eax, eax
push ebp
push 0x496e01
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00453d30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x496e0b
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49c534]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x496e34
mov eax, dword [0x49bdf4]
call fcn.0049644c
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49b014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x496f84
push 0x496f88
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x4965fc
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49c560], eax
xor eax, eax
push ebp
push 0x496f48
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d44c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x496f98
call fcn.004078f4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d32c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004964f4
mov dword [ebp - 0xc], eax
call fcn.004965c0
test al, al
jne 0x496f28
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x496f08
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496f4f
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x497eb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x498115
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x49812c
mov eax, dword [0x49b628]
call fcn.004242c4
push 5
mov eax, dword [0x49b628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4980e1
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047f460
lea eax, [ebp - 0x10]
call fcn.0042d8c4
mov eax, dword [ebp - 0x10]
call fcn.004072a8
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d44c
mov edx, dword [ebp - 0x10]
mov eax, 0x49c534
call fcn.00403450
call fcn.0049679c
lea ecx, [ebp - 0x10]
mov edx, 0x498140
mov eax, dword [0x49c534]
call fcn.0042c4f8
mov edx, dword [ebp - 0x10]
mov eax, 0x49c538
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x498150
mov eax, dword [0x49c534]
call fcn.0042c4f8
mov edx, dword [ebp - 0x10]
mov eax, 0x49c53c
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49c534]
mov dl, 1
mov eax, 0x4504d0
call fcn.0045072c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x497ff8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004506f0
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004506c8
cmp dword [ebp - 0xc], 0x67734d49
je 0x497fd3
mov cl, 1
xor edx, edx
mov eax, dword [0x49c53c]
call fcn.004515b0
jmp 0x497fe2
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49c534]
call fcn.004515b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497fff
mov eax, dword [ebp - 4]
call fcn.00402b58
ret
Function at 0x4981f8
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x498336
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
mov edx, ebx
lea eax, [ebp - 0x14c]
call fcn.00403494
lea eax, [ebp - 0x14c]
mov edx, 0x49834c
call fcn.0040357c
mov eax, dword [ebp - 0x14c]
call fcn.00403738
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x498315
xor eax, eax
push ebp
push 0x49830e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x49835c
lea eax, [ebp - 0x11c]
mov ecx, 5
call fcn.00407458
test eax, eax
jne 0x4982df
test byte [ebp - 0x148], 0x10
jne 0x4982df
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.0040355c
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004035c0
mov esi, dword [ebp - 0x148]
test esi, 1
je 0x4982d7
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
call fcn.00406f50
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x49826f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498315
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49833d
lea eax, [ebp - 0x14c]
call fcn.00403400
lea eax, [ebp - 8]
call fcn.00403400
ret
Function at 0x498364
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49845a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403400
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c954
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x498470
call fcn.004078f4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004035c0
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
cmp esi, 0xffffffff
je 0x498402
test esi, 0x10
jne 0x498432
test esi, 1
je 0x498402
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x49842c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403494
jmp 0x49843f
inc edi
cmp edi, 0xa
je 0x49843f
inc ebx
cmp ebx, 0x3e8
jne 0x4983a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498461
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403420
ret
Function at 0x403440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40349b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40349b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40348a
cmp esi, edx
jae 0x40349b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403478
cmp esi, edx
jae 0x40349b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40c5f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511b4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x565300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.00404590
mov ecx, eax
test ecx, ecx
je 0x40c6f2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.00404590
mov ecx, eax
test ecx, ecx
je 0x40c6fc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x1c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0050e592
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x579e0c]
cmp eax, dword [ecx + 4]
jg 0x40c706
mov dword [edi + 0x30], 0x5654c0
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x40d070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404110
push 0x80004005
call fcn.00404110
push 0x579e0c
call fcn.0050e9d5
add esp, 4
cmp dword [0x579e0c], 0xffffffff
jne 0x40c6ca
push 0x523550
mov dword [0x5654c0], 0x64
mov byte [0x5654c4], 0
call fcn.0050e944
push 0x579e0c
call fcn.0050e984
add esp, 8
jmp 0x40c6ca
Function at 0x41e330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xcc]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub edx, dword [esi + 0x58]
sub ebx, dword [esi + 0x5c]
mov dword [eax], 0
mov eax, dword [esi + 0x134]
mov ecx, dword [esi + 0x130]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
test eax, eax
je 0x41e42b
xor edi, edi
push ebx
lea eax, [ecx + 8]
push edx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x41e3f5
mov eax, dword [esi + 0x130]
cmp dword [eax + edi + 0x20], 0
je 0x41e3f5
push 1
mov dword [ebx], 1
mov eax, dword [esi + 0x130]
push 0
push 0
push dword [eax + edi + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x134]
add edi, 0x2c
mov ecx, dword [esi + 0x130]
sub eax, ecx
mov edx, dword [esp + 0xc]
sar eax, 2
inc edx
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0xc], edx
cmp edx, eax
jae 0x41e426
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jmp 0x41e3b3
cmp dword [ebx], 0
jne 0x41e438
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x2c]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43e510
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x565300]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 0x138]
test eax, eax
je 0x43e580
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push ecx
movups xmmword [esp + 0x18], xmm0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb ecx, ecx
inc ecx
jmp 0x43e5c7
cmp dword [esi + 0x1d4], 0
je 0x43e5cb
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x1d4]
test ecx, ecx
jne 0x43e5b4
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
mov eax, dword [eax + 8]
call eax
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
je 0x43e5db
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x158]
call dword [eax + 0xa8]
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x643
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [edi], 0
pop edi
pop esi
xor ecx, esp
call fcn.0050ea5d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44a640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x120], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x124], 0
mov dword [esi + 0x140], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], 1
call fcn.0044a7e0
lea ebx, [esi + 0x11c]
mov dword [ebp + 0xc], ebx
call fcn.0048ead0
mov edi, eax
test ebx, ebx
je 0x44a711
lea eax, [edi + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [edi + 0xf8]
lea esi, [edi + 0xf4]
push dword [esi]
call fcn.0050cef0
cmp eax, dword [edi + 0xf8]
jne 0x44a6da
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x44a6ce
mov dword [eax], ebx
add dword [esi + 4], 4
jmp 0x44a6da
lea ecx, [ebp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.0048f370
lea eax, [edi + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
cmp dword [edi + 0x100], 0
jne 0x44a711
push 0
push 0
push edi
push 0x48e770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x100], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x44db40
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x565300]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x5f7
je 0x44dc40
cmp eax, 0x5f8
je 0x44dc40
cmp eax, 0x201
jne 0x44db84
mov ecx, dword [esi + 0x138]
push 2
jmp 0x44dcca
cmp eax, 0x202
jne 0x44dcd2
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
mov dword [esp + 0xc], ecx
mov ecx, esi
call dword [eax + 0xcc]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 4]
add eax, ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
add eax, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x138]
test eax, eax
mov eax, dword [ecx]
je 0x44dc39
push 1
call dword [eax + 0x14c]
push ecx
mov ecx, esi
call fcn.0044c5a0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0050ea5d
mov esp, ebp
pop ebp
ret 0x14
push 0
jmp 0x44dccc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
call dword [eax + 0xcc]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov edx, dword [esp + 0x10]
push dword [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
push dword [esp + 8]
add eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x138]
test eax, eax
je 0x44dcc8
push 1
jmp 0x44dcca
push 0
mov eax, dword [ecx]
call dword [eax + 0x14c]
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0050ea5d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x452010
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516145
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x565300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x15c], 0
je 0x45208d
call fcn.00404590
test eax, eax
je 0x452164
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x52ca68
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004037a0
test al, al
jne 0x452144
push 0
push 0x52ca68
mov ecx, esi
call fcn.00403c10
jmp 0x452144
call fcn.00404590
mov ecx, eax
test ecx, ecx
je 0x452164
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push dword [edi + 0x134]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
test ebx, ebx
js 0x45215a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x4520e2
push ebx
lea ecx, [ebp - 0x10]
call fcn.004039e0
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [edi + 0x134]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x452102
push dword [esi - 8]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
test eax, eax
js 0x45215a
cmp eax, dword [esi - 8]
jg 0x45215a
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edi, [esi - 0x10]
mov word [esi + eax*2], cx
push edi
call fcn.00403fb0
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x452144
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00404110
push 0x80004005
call fcn.00404110
int3