joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d90
Capabilities:
Check for unmoving mouse cursor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
cmp eax, 0x80000000
je 0x410f71
mov edi, dword [ebp]
cmp edi, 0x80000000
je 0x410f71
mov edx, dword [0x4caf70]
cmp edx, 2
jne 0x410e05
movzx ebx, byte [esp + 0x24]
neg ebx
sbb ebx, ebx
and ebx, 0x80000000
push 0
or ebx, 1
call fcn.00411150
add esp, 4
call fcn.004115e0
cmp byte [esp + 0x24], 0
je 0x410f71
mov dword [esi], SysReAllocString
mov dword [ebp], SysReAllocString
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or dword [ecx], 0x8001
cmp byte [esp + 0x24], 0
je 0x410e5a
cmp edx, 1
jne 0x410e40
cmp dword [0x4c8428], 0x80000000
jne 0x410e2e
push 0x4c8428
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c8428]
add dword [esi], eax
mov ecx, dword [0x4c842c]
add dword [ebp], ecx
jmp 0x410e7f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add dword [esi], eax
add dword [ebp], ecx
jmp 0x410e7f
mov edx, dword [0x4c590c]
movzx eax, word [edx + 0xf0]
shr eax, 2
and eax, 3
cmp eax, 2
je 0x410e7f
push eax
mov edi, ebp
mov ebx, esi
call fcn.00476360
add esp, 4
cmp dword [0x4caf70], 1
jne 0x410e98
mov eax, dword [esi]
mov dword [0x4c8428], eax
mov ecx, dword [ebp]
mov dword [0x4c842c], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esi]
mov ebx, eax
mov eax, ecx
shl eax, 0x10
cdq
idiv edi
xor edx, edx
test ecx, ecx
setns dl
lea eax, [eax + edx*2 - 1]
mov dword [esi], eax
mov ecx, dword [ebp]
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
xor edx, edx
test ecx, ecx
setns dl
lea edx, [edx + edx - 1]
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [ebp], edx
test eax, eax
js 0x410f5b
cmp eax, 0x64
jle 0x410ef3
mov dword [esp + 0x20], 0x64
jmp 0x410ef7
test eax, eax
je 0x410f5b
cmp dword [0x4caf70], 1
je 0x410f5b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
mov eax, ecx
shl eax, 0x10
cdq
idiv ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov ebx, eax
lea ebx, [ebx + edx*2 - 1]
mov eax, esi
shl eax, 0x10
cdq
idiv edi
mov ecx, eax
xor eax, eax
test esi, esi
setns al
lea ecx, [ecx + eax*2 - 1]
mov eax, ebx
call fcn.00454ec0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
push 0x8001
xor ecx, ecx
call fcn.00410f80
add esp, 4
call fcn.004115e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4113b0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 8
cmp dword [0x4caf70], 1
push ebx
jne 0x411477
xor bl, bl
cmp dword [0x4c9638], 0
mov byte [esp + 8], bl
je 0x4113d6
mov bl, 1
mov byte [esp + 8], bl
cmp dword [0x4c963c], 0
je 0x4113e6
or bl, 2
mov byte [esp + 8], bl
test bl, bl
je 0x411401
mov al, byte [0x4c8425]
not al
and al, bl
movzx ecx, al
push 1
push ecx
call fcn.00408b70
add esp, 8
mov edx, dword [0x4c843c]
mov eax, dword [0x4c8438]
push 0x1c
push edx
push eax
call dword [0x4cc340]
test bl, bl
je 0x4114f5
mov cl, byte [0x4c8425]
and cl, bl
test cl, 1
je 0x41145e
push 1
call fcn.00411f60
mov dl, byte [esp + 0x18]
mov cl, al
xor cl, dl
mov bl, cl
and bl, dl
not bl
and bl, byte [0x4c9507]
and cl, al
or bl, cl
add esp, 4
mov byte [0x4c9507], bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [0x4c8250], eax
mov edx, dword [esp + 8]
pop ebx
add esp, 8
mov dword [esp + 8], 1
mov dword [esp + 4], edx
jmp fcn.00408b70
mov eax, dword [0x4c9500]
push 0
push eax
push 0x40f7e0
push 1
mov dword [0x4c8430], 0
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4c9640], eax
test eax, eax
je 0x4114f5
mov byte [0x4c9628], 1
push 1
push 0x8000012f
mov dword [0x4c58e0], 0
call fcn.00401360
add esp, 8
cmp dword [0x4c9640], 0
mov dword [0x4c58e0], 1
jne 0x4114a6
mov eax, dword [0x4c843c]
mov ecx, dword [0x4c8438]
cmp dword [eax + ecx*8 - 8], 0
mov byte [0x4c9628], 0
jne 0x4114f5
mov ecx, dword [eax + ecx*8 - 4]
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
pop ebx
add esp, 8
ret

Function at 0x4116d0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov eax, dword [0x4c9f1c]
test eax, eax
je 0x4117e8
mov ecx, dword [0x4c9f20]
imul ecx, ecx, 0xd4
add eax, ecx
mov cl, byte [esp + 8]
mov byte [eax + 6], dl
mov dx, word [esp + 0xc]
mov byte [eax], cl
mov ecx, 0x69
mov word [eax + 2], dx
push esi
mov word [eax + 4], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4cc1c4]
mov dword [0x4c9f24], eax
mov dword [esp + 4], edx
fild dword [esp + 4]
jns 0x41172b
fadd dword [0x4bfac8]
fdiv qword [0x4bfac0]
mov ecx, dword [0x4c9f20]
mov edx, dword [0x4c9f1c]
mov dword [0x4cc1c4], eax
imul ecx, ecx, 0xd4
fstp dword [esp + 4]
fld dword [esp + 4]
fstp dword [ecx + edx + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x411798
mov eax, dword [0x4c9f20]
imul eax, eax, 0xd4
cmp esi, dword [0x4c9f28]
je 0x411789
mov ecx, dword [0x4c9f1c]
push 0x64
lea edx, [eax + ecx + 0xc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4117c4
mov edx, dword [0x4c9f1c]
xor ecx, ecx
mov word [eax + edx + 0xc], cx
jmp 0x4117c4
mov ecx, dword [0x4c9f20]
mov edx, dword [0x4c9f1c]
imul ecx, ecx, 0xd4
mov eax, 0x4a4910
lea edx, [ecx + edx + 0xc]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4117b5
mov eax, dword [0x4c9f20]
inc eax
mov dword [0x4c9f28], esi
mov dword [0x4c9f20], eax
pop esi
cmp eax, dword [0x4c58e4]
jl 0x4117e8
mov dword [0x4c9f20], 0
pop ecx
ret
Function at 0x412540
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x284
push ebx
push ebp
xor ebp, ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ebx, eax
test ebx, ebx
je 0x4125ef
xor eax, eax
jmp 0x412570
movzx ecx, word [eax + str.SYSTEMCurrentControlSetControlKeyboard_Layouts_]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x412570
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x4125dd
lea edx, [esp + 8]
push edx
push 1
push 0
lea eax, [esp + 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4125dd
push esi
push edi
lea edi, [esp + 0x10]
lea esi, [esp + 0x8c]
mov ecx, str.Layout_File
call fcn.004764d0
pop edi
pop esi
test eax, eax
je 0x4125dd
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp dword [esp + 0x290], ebx
je 0x4125ef
push 0
push ebx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov eax, ebp
pop ebp
pop ebx
add esp, 0x284
ret

Function at 0x4127c0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x114
push ebx
push edi
push 0
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
lea eax, [ebx - 0x41]
cmp al, 0x19
ja 0x4128af
push ebp
push esi
push 0x100
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00497430
mov ebp, dword [sym.imp.USER32.dll_ToUnicodeEx]
add esp, 0xc
push edi
xor esi, esi
push esi
push 2
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push 0x6e
call ebp
cmp eax, 2
jne 0x41281a
movzx esi, word [esp + 0x14]
push edi
push 0
push 2
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
movzx eax, bl
push 0
push eax
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
jns 0x41284e
push edi
push 0
push 2
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push 0x6e
call ebp
test si, si
je 0x41288d
push 1
lea eax, [esp + 0x17]
push edi
push eax
call fcn.00412a70
mov bl, al
add esp, 0xc
test bl, bl
je 0x41288d
mov al, byte [esp + 0x13]
lea ecx, [esp + 0x24]
call fcn.00412060
push edi
push 0
push 2
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
movzx eax, bl
push 0
push eax
call ebp
cmp dword [esp + 0x1c], 0
pop esi
pop ebp
je 0x4128a4
movzx eax, word [esp + 0xc]
pop edi
pop ebx
add esp, 0x114
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x114
ret
push edi
movzx ecx, bl
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
pop edi
pop ebx
add esp, 0x114
ret
Function at 0x413420
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4caf74], 0
push esi
mov esi, 0x4c8450
jne 0x41343a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.004133d0
mov dword [0x4c53f4], 0x270
mov dword [0x4c844c], esi
mov ecx, 0xe3
nop
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi + 0x634]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x413450
mov ecx, 0x18c
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor edx, eax
and edx, 0x7ffffffe
xor edx, dword [esi]
and al, 1
movzx eax, al
shr edx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor edx, eax
xor edx, dword [esi - 0x38c]
add esi, 4
dec ecx
mov dword [esi - 4], edx
jne 0x413485
mov ecx, dword [esi]
mov eax, dword [0x4c8450]
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, dword [esi]
and al, 1
movzx edx, al
shr ecx, 1
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor ecx, edx
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
ret

Function at 0x4134f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c53f4]
jne 0x4134fd
call fcn.00413420
mov eax, dword [0x4c844c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c844c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x413540
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4c53f4]
jne 0x41354e
call fcn.00413420
mov ecx, dword [0x4c844c]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4c844c], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x413595
fadd qword [0x4bfa98]
fmul qword [0x4bfad8]
pop ecx
ret
Function at 0x4166f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4c58ec]
add eax, 4
imul eax, eax, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push eax
call fcn.0048e5e4
xor ebx, ebx
add esp, 4
mov dword [0x4c8020], eax
cmp eax, ebx
jne 0x416723
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [0x4c590c]
push 0x4038e0
mov edi, eax
push 0x4ef6d80
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4c9508]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0xe
push ecx
mov dword [0x4c590c], eax
call edi
cmp dword [ebp], ebx
jne 0x416764
mov dword [esp + 0x14], 1
jmp 0x41680e
mov edx, dword [0x4c590c]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xec], bl
call esi
mov ecx, dword [0x4c590c]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], 0x64
cmp byte [0x4c9660], bl
jne 0x4167b2
mov eax, dword [0x4c9508]
push 0x4037e0
push 0x64
push 0xb
push eax
call edi
test eax, eax
setne cl
mov byte [0x4c9660], cl
mov byte [ebp + 0xacd], 1
call esi
mov ecx, dword [ebp]
push ebx
mov esi, 1
add dword [0x4c9678], esi
push ebx
push esi
mov dword [ebp + 0xae4], eax
mov dword [ebp + 0xae0], eax
call fcn.00425420
sub dword [0x4c9678], esi
mov dword [esp + 0x14], eax
cmp byte [0x4c9660], bl
je 0x416808
mov edx, dword [0x4c9508]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x416808
mov byte [0x4c9660], bl
mov byte [ebp + 0xacd], bl
mov eax, dword [0x4c590c]
cmp dword [eax + 0x100], ebx
lea ecx, [eax + 0x100]
je 0x41683f
mov eax, dword [eax + 0x104]
push str.The_thread_has_exited.
push eax
push ecx
call fcn.0042eed0
mov dword [esp + 0x20], eax
mov eax, dword [0x4c590c]
add esp, 0xc
push 1
push ebx
mov byte [eax + 0xec], 1
mov esi, eax
push 0xffffffffffffffff
mov dword [eax + 0xb4], ebx
mov dword [eax + 0xb8], ebx
mov dword [eax + 0xbc], ebx
mov dword [eax + 0xc4], ebx
mov dword [eax + 0xc8], ebx
mov byte [eax + 0xf8], bl
mov dword [eax + 0x28], ebx
mov dword [eax + 0x4c], ebx
mov byte [eax + 0xe8], bl
mov dword [eax + 0x48], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x100], ebx
mov byte [eax + 0x108], bl
mov ecx, 0x44
mov edi, 0x4c8138
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4c9d08]
push 0x4a296c
push ecx
mov byte [eax + 0xec], 1
mov dword [eax + 0xe0], ebx
mov word [eax + 0xed], 1
mov dword [eax + 0x2c], SysReAllocString
call fcn.00477e60
mov edx, dword [0x4c6aec]
cmp word [edx], bx
jne 0x41691e
cmp dword [0x4caf10], ebx
jne 0x41691e
cmp dword [0x4c9638], ebx
jne 0x41691e
cmp dword [0x4c963c], ebx
jne 0x41691e
cmp byte [0x4c965c], bl
jne 0x41691e
mov edx, dword [esp + 0x14]
neg edx
sbb edx, edx
push ebx
and edx, 7
add edx, 2
push 0x4cb680
xor eax, eax
call fcn.00416960
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x41ced0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov cx, word [0x4c58fc]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
push esi
mov word [esp + 0xc], ax
push edi
lea ebx, [esp + 0x10]
mov eax, ebp
mov word [esp + 0x12], cx
mov dword [esp + 0x14], 0x90028
mov dword [esp + 0x18], 0x3e003c
mov dword [esp + 0x1c], 0x3d003a
mov dword [esp + 0x20], 0x2d002b
mov dword [esp + 0x24], 0x2f002a
mov dword [esp + 0x28], 0x7e0021
mov dword [esp + 0x2c], 0x7c0026
mov dword [esp + 0x30], 0x5b005e
mov dword [esp + 0x34], 0x3f002e
mov dword [esp + 0x38], 0x7b
call fcn.004095d0
test eax, eax
je 0x41cf59
cmp eax, ebp
jbe 0x41cf73
sub eax, 2
jmp 0x41cf73
mov eax, ebp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cf60
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 2]
mov edi, eax
cmp eax, ebp
jbe 0x41cf94
lea esp, [esp]
movzx eax, word [edi]
cmp eax, 0x20
je 0x41cf8d
cmp eax, 9
jne 0x41cf94
sub edi, 2
cmp edi, ebp
ja 0x41cf80
mov esi, edi
sub esi, ebp
sar esi, 1
inc esi
cmp esi, 0xfd
jbe 0x41cfc5
cmp byte [esp + 0x4c], 0
je 0x41cfb9
mov ecx, dword [esp + 0x40]
push ebp
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0042ece0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
mov ebx, dword [esp + 0x44]
push esi
push ebp
push ebx
call fcn.00491254
add esp, 0xc
xor ecx, ecx
mov eax, edi
pop edi
mov word [ebx + esi*2], cx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x42bba0
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4c9678]
sub esp, 0x124
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x4c58ec]
jl 0x42bbc9
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
mov esi, dword [0x4c9d08]
cmp byte [esi + 0x17], 0
jne 0x42bbd8
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42bbe5
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42bbfe
test byte [esi + 0x15], 4
je 0x42bbf9
mov eax, esi
call fcn.0042f290
mov eax, dword [esi + 8]
jmp 0x42bc0e
cmp al, 2
jne 0x42bc09
call fcn.00401000
jmp 0x42bc0e
mov eax, 0x4cb614
push 0x7f
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00491254
mov eax, dword [0x4c590c]
inc dword [0x4c9678]
add eax, 0x110
xor edx, edx
mov edi, eax
mov word [esp + 0x13a], dx
mov ecx, 0x44
mov esi, 0x4c8138
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor edi, edi
mov dword [0x4c590c], eax
push edi
mov eax, 0x4cb680
mov dword [esi + 0x2c], edi
call fcn.004165f0
mov dword [0x4cc150], edi
mov dword [0x4cc154], edi
cmp dword [0x4c96a4], edi
je 0x42bc7c
push 0x4c9d10
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or eax, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x42bc97
mov byte [esi + 0xee], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
cmp dword [0x4cc15c], edi
je 0x42bca7
cmp dword [0x4cc158], edi
jne 0x42bcb0
cmp byte [esi + 0xee], 0
je 0x42bcdf
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x42bcdf
cmp dword [0x4cc15c], edi
jl 0x42bcd9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov eax, dword [0x4cc15c]
mov dword [esi + 0xe0], eax
mov eax, dword [0x4cc0d0]
mov ecx, dword [0x4cc128]
mov edx, dword [0x4cc12c]
mov ebp, dword [0x4cc0d4]
mov esi, dword [esp + 0x13c]
mov edi, eax
mov ebx, ecx
mov dword [esp + 0x1c], edx
mov dword [0x4cc0d4], eax
mov dword [0x4cc12c], ecx
mov dword [0x4cc0d0], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4cc164], eax
mov dword [0x4cc160], eax
mov dword [0x4cc128], eax
mov eax, dword [esp + 0x138]
cmp byte [eax], 5
jne 0x42bd43
mov esi, dword [eax + 0xc]
call fcn.0042bb30
mov esi, eax
jmp 0x42bd80
mov ecx, dword [eax + 0xc]
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x24]
push edx
xor eax, eax
push 0x4a28cc
push ecx
lea edx, [eax + 1]
mov dword [esp + 0x38], 0
mov dword [esp + 0x30], esi
call fcn.0046d480
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42bd80
mov esi, dword [esp + 0x14]
neg esi
sbb esi, esi
add esi, 4
mov eax, dword [0x4c590c]
mov ecx, dword [eax + 0xc4]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov dword [0x4c968c], ecx
mov dword [0x4cc0d0], edi
mov dword [0x4cc128], ebx
mov dword [0x4cc0d4], ebp
mov dword [0x4cc12c], edx
call fcn.00403690
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8
Function at 0x42f160
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.00499d50
cmp dword [esp + 0x4008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4018]
mov ebx, ecx
je 0x42f283
test ebx, ebx
jne 0x42f198
mov eax, dword [esp + 0x400c]
mov ebx, dword [eax + 0x630]
test ebx, ebx
je 0x42f1a2
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42f1af
mov ecx, dword [eax + 0x26c]
movzx eax, word [eax + 0x270]
mov edx, dword [esp + 0x4014]
mov ecx, dword [ecx*4 + 0x4c94a0]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str._s___d__:___Warning:__s_n
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.00474fc0
add esp, 0x10
cmp word [ebp], 0
lea edi, [esp + eax*2 + 0x10]
je 0x42f200
lea eax, [esp + 0x10]
mov edx, edi
sub edx, eax
sar edx, 1
push ebp
push str._____Specifically:__s_n
sub esi, edx
call fcn.00474fc0
add esp, 8
mov esi, dword [esp + 0x4018]
cmp esi, 3
jne 0x42f22f
call fcn.0048eb0d
add eax, 0x20
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0049058e
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x42f281
test ebx, ebx
jne 0x42f254
mov ecx, dword [esp + 0x4014]
mov ebx, dword [ecx + 0x630]
test ebx, ebx
je 0x42f273
mov eax, dword [esp + 0x401c]
push ebp
push 1
push eax
mov ecx, ebx
call fcn.0042ea20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
mov edx, dword [esp + 0x401c]
push ebp
push edx
call fcn.0042ece0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
Function at 0x42f690
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42f6b7
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42f6c1
xor edx, edx
mov word [esp + 0x120], dx
mov esi, dword [0x4cc10c]
xor eax, eax
mov word [esp + 0x20], ax
test esi, esi
je 0x42f778
cmp byte [esi + 0x11], 0
je 0x42f719
mov ecx, dword [esi]
push ecx
call fcn.004703d0
add esp, 4
sub eax, 0
je 0x42f6fd
dec eax
je 0x42f6f6
mov eax, str.Object
jmp 0x42f702
mov edx, dword [esi]
mov eax, dword [edx + 4]
jmp 0x42f702
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4aa788
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.00475000
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42f6d6
cmp word [esp + 0x20], si
je 0x42f778
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42f730
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x42f766
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x4a6c04
push edi
call fcn.00491254
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x42f778
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x42f778
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x4c8020]
cmp byte [eax + 0xf8], 0
je 0x42f797
cmp byte [0x4cc14d], 0
mov dword [esp + 0x14], 1
je 0x42f79f
mov dword [esp + 0x14], 0
mov eax, dword [0x4c9678]
mov dword [esp + 0x18], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
cmp eax, 1
jg 0x42f8bd
mov dword [esp + 0x18], 0x4a2868
xor ebp, ebp
cmp dword [0x4c963c], 0
mov edi, 0x4a4a70
je 0x42f7d2
mov edi, 0x4a4a68
cmp dword [0x4c9638], 0
mov esi, 0x4a4a70
je 0x42f7e5
mov esi, 0x4a4a68
push 1
call fcn.00411f60
mov bl, al
add esp, 4
lea eax, [esp + 0x1e8]
call fcn.00412320
mov ecx, dword [0x4c9674]
mov edx, dword [0x4c9678]
push eax
mov eax, dword [0x4c967c]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [0x4cc114]
push ecx
mov ecx, dword [0x4cc118]
push ebp
lea edx, [esp + 0x38]
push edx
push eax
push ecx
push edi
mov edi, dword [esp + 0x414]
push esi
lea edx, [esp + 0x14c]
push edx
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
mov esi, 0xfffe
call fcn.00474fc0
lea esi, [edi + eax*2]
mov eax, esi
mov ebx, edi
sub eax, ebx
sar eax, 1
mov ecx, 0xfffe
add esp, 0x34
sub ecx, eax
push ecx
push esi
call fcn.004092c0
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42f872
sub eax, edx
sar eax, 1
cmp dword [0x4c9f1c], 0
lea edi, [esi + eax*2]
mov eax, str._r_nPress__F5__to_refresh.
jne 0x42f897
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
mov edx, edi
sub edx, ebx
sar edx, 1
mov esi, 0xfffe
push eax
sub esi, edx
call fcn.00474fc0
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
lea ebp, [eax - 1]
jmp 0x42f7bf