joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425dfb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
push 0x555704
push 0x3e7
push 0xd
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x555704], 0
cmp dword [ebp - 8], 0
jne 0x425e37
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, edx
jmp 0x425f27
push 0
push 0
push 0xb0
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageA
mov ebx, eax
movzx eax, bx
mov dword [ebp - 0x10], eax
push 0x555704
call fcn.005183dc
pop ecx
cmp eax, dword [ebp - 0x10]
jae 0x425e65
xor edx, edx
mov dword [ebp - 0x10], edx
mov esi, ebx
shr esi, 0x10
and si, 0xffff
movzx esi, si
push 0x555704
call fcn.005183dc
pop ecx
cmp esi, eax
jbe 0x425e83
xor esi, esi
push dword [ebp + 0xc]
call sub.USER32.dll_GetDC
mov edi, eax
push dword [0x53742c]
call fcn.004f9c59
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x425eb3
mov eax, dword [ebp - 0xc]
push dword [eax + 0x774]
push edi
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x555704], 0
push 0x555704
call fcn.005183dc
pop ecx
push eax
push 0x555704
push edi
call fcn.004c799b
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x555704], 0x20
cmp esi, dword [ebp - 8]
jae 0x425eee
mov byte [esi + 0x555705], 0
jmp 0x425ef5
mov byte [esi + 0x555704], 0
push 0x555704
call fcn.005183dc
pop ecx
push eax
push 0x555704
push edi
call fcn.004c799b
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x425f1e
push dword [ebp - 0x14]
push edi
call sub.GDI32.dll_SelectObject
push edi
push dword [ebp + 0xc]
call sub.USER32.dll_ReleaseDC
lea edx, [ebp - 0x24]
push edx
push dword [ebp + 0xc]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x24]
add ebx, eax
add dword [ebp - 4], eax
lea edx, [ebp - 0x34]
push edx
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
mov esi, dword [ebp - 0x2c]
sub esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x28]
sub edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
sub eax, edi
add eax, 0xfffffffd
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 4]
sub edx, ebx
mov eax, esi
sub eax, edx
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x425f84
mov ecx, 2
mov eax, dword [ebp - 0x34]
cdq
idiv ecx
mov dword [ebp - 0x34], eax
sub ebx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ebx
jmp 0x425f95
mov ecx, 0xfffffffe
mov eax, dword [ebp - 0x34]
cdq
idiv ecx
mov dword [ebp - 0x34], eax
add dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x34]
jle 0x425fa5
mov edx, eax
add edx, 3
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x34]
add ecx, esi
mov edx, dword [ebp - 0x1c]
sub edx, eax
add edx, eax
cmp ecx, edx
jle 0x425fc6
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
sub eax, esi
add eax, 0xfffffffd
mov dword [ebp - 0x34], eax
push 0
push edi
push esi
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp + 8]
call sub.USER32.dll_MoveWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x425fe1
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x52a40c]
call sub.USER32.dll_ShowWindow
mov eax, dword [0x52a40c]
test eax, eax
je 0x425ffd
push eax
call sub.USER32.dll_DestroyWindow
xor edx, edx
mov dword [0x52a40c], edx
ret
Function at 0x4330f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x433125
mov edi, dword [ebx + 4]
test edi, edi
je 0x4331f9
cmp byte [edi], 0x2d
jne 0x4331f9
push 0x68
push edi
call fcn.0051833c
add esp, 8
test eax, eax
je 0x433193
push 0x5a
push esi
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x433189
xor eax, eax
mov dword [0x533ee8], eax
mov byte [0x533e84], 0
push esi
mov edi, esi
mov esi, 0x533e20
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x533e20
call fcn.004e50a7
call fcn.004fe215
push 0x33
push 0
push 0x533e20
push 0x52acdc
push 0
call fcn.004531f8
mov eax, 1
jmp 0x4332c8
push 0x75
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x4331f9
push 2
call fcn.0043d398
test eax, eax
jne 0x4331c1
push 0xc
push 0
push dword [ebx]
push 0
call fcn.0045abd0
jmp 0x4332c8
mov dword [0x531afc], 1
imul edx, dword [0x533af8], 0x64
add edx, 0x533a30
push edx
push 0x52ace0
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push esi
call fcn.004fe9da
mov eax, 1
jmp 0x4332c8
mov eax, dword [ebx + 4]
test eax, eax
je 0x4332c3
push eax
call fcn.005183dc
pop ecx
cmp eax, 0x5a
jbe 0x433217
mov edx, dword [ebx + 4]
mov byte [edx + 0x5a], 0
mov ecx, dword [ebx + 4]
mov esi, 0x533e20
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x533e20
call fcn.004e50a7
mov eax, dword [ebx + 8]
test eax, eax
je 0x4332be
push eax
call fcn.005183dc
pop ecx
cmp eax, 0x5a
jbe 0x433262
mov edx, dword [ebx + 8]
mov byte [edx + 0x5a], 0
push dword [ebx + 8]
call sub.WSOCK32.dll_inet_addr
mov esi, eax
mov dword [0x533ee8], esi
cmp esi, 0xffffffff
jne 0x433287
xor eax, eax
mov dword [0x533ee8], eax
mov byte [0x533e84], 0
jmp 0x4332be
push dword [0x533ee8]
call sub.WSOCK32.dll_htonl
mov dword [0x533ee8], eax
mov edx, dword [ebx + 8]
mov esi, 0x533e84
mov edi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004fe215
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x436c78
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
je 0x436c93
cmp dword [ebx + 8], 0
jne 0x436ca5
push 0
push 0
push dword [ebx]
push 0
call fcn.0045abd0
jmp 0x436e5e
push dword [ebx + 4]
call fcn.004f9bfc
mov dword [0x548dc0], eax
cmp dword [0x548dc0], 0
je 0x436cce
mov eax, dword [0x548dc0]
mov al, byte [eax + 0x638]
cmp al, 9
je 0x436ce0
cmp al, 0xa
je 0x436ce0
push 7
push 0
push dword [ebx]
push 0
call fcn.0045abd0
jmp 0x436e5e
mov eax, dword [ebx + 8]
cmp byte [eax], 0x40
jne 0x436cf4
push eax
call fcn.005183dc
pop ecx
cmp eax, 1
ja 0x436d06
push 3
push 0
push dword [ebx]
push 0
call fcn.0045abd0
jmp 0x436e5e
push dword [ebx + 8]
call fcn.004f9bfc
test eax, eax
je 0x436d2f
push 6
push 0
push 0
push 0x397
call fcn.00415c87
push eax
push 0
call fcn.0045abd0
jmp 0x436e5e
push dword [ebx + 8]
call fcn.005183dc
pop ecx
cmp eax, 0x5a
jbe 0x436d44
mov edx, dword [ebx + 8]
mov byte [edx + 0x5a], 0
mov ecx, dword [0x548dc0]
add ecx, 4
mov eax, dword [ebx + 8]
push esi
push edi
mov esi, ecx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [0x548dc0]
add eax, 4
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [ebx + 0xc], 0
je 0x436ddb
mov byte [esi], 0
push ebx
push esi
push 3
call fcn.004bf445
cmp byte [esi], 0
je 0x436e13
push 0x52b0fd
push edi
call fcn.00518300
add esp, 8
push esi
push edi
call fcn.00518300
add esp, 8
push 0xf
push edi
call fcn.004e51c7
jmp 0x436e13
push 0x104
push esi
mov eax, dword [0x548dc0]
push dword [eax]
call sub.USER32.dll_GetWindowTextA
cmp byte [esi], 0
je 0x436e13
push 0x20
push esi
call fcn.0051833c
add esp, 8
mov ebx, eax
mov dword [0x548dc4], ebx
test ebx, ebx
je 0x436e13
push ebx
push edi
call fcn.00518300
add esp, 8
mov dword [0x548dc4], edi
mov eax, dword [0x548dc0]
cmp byte [eax + 0x657], 0
je 0x436e38
mov edx, dword [0x548dc4]
cmp byte [edx], 0x40
jne 0x436e38
inc dword [0x548dc4]
push dword [0x548dc4]
push dword [eax]
call sub.USER32.dll_SetWindowTextA
cmp dword [0x536414], 0
je 0x436e59
push dword [0x548dc0]
call fcn.004e6fbd
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x437222
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test byte [0x5321e4], 0x40
je 0x43724c
push 0xb
push 0
push dword [esi]
push 0
call fcn.0045abd0
jmp 0x43747f
mov dword [0x548de0], 1
mov dword [0x548de4], 5
mov eax, dword [esi + 4]
test eax, eax
je 0x43728b
cmp byte [eax], 0x2d
jne 0x43728b
push 0x6e
push eax
call fcn.0051833c
add esp, 8
test eax, eax
je 0x437285
mov dword [0x548de4], 7
inc dword [0x548de0]
mov edx, dword [0x548de0]
cmp dword [esi + edx*4], 0
jne 0x4372a9
push 0
push 0
push dword [esi]
push 0
call fcn.0045abd0
jmp 0x43747f
mov ecx, dword [0x548de0]
mov eax, dword [esi + ecx*4]
cmp byte [eax], 0x22
jne 0x4372f6
push 0
push 0x104
push edi
push dword [0x548de0]
push esi
call fcn.004c0415
mov dword [0x548de0], eax
cmp dword [0x548de0], 0
jge 0x4372eb
push 3
push 0
push dword [esi]
push 0
call fcn.0045abd0
jmp 0x43747f
inc dword [0x548de0]
jmp 0x4373f0
mov byte [edi], 0
jmp 0x4373e1
cmp byte [edi], 0
je 0x437347
cmp byte [edi + 1], 0
je 0x437347
push 0x3a
mov edx, dword [0x548de0]
push dword [esi + edx*4]
call fcn.0051833c
add esp, 8
test eax, eax
jne 0x4373f0
push ebx
push 0x52b10b
push edi
call sub.SHELL32.dll_FindExecutableA
cmp eax, 0x1f
ja 0x4373f0
push 0x52b10e
push edi
call fcn.00518300
add esp, 8
mov ecx, dword [0x548de0]
push dword [esi + ecx*4]
push edi
call fcn.00518300
add esp, 8
mov eax, dword [0x548de0]
mov edx, dword [esi + eax*4]
push esi
push edi
mov edi, edx
mov esi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
call fcn.005207ec
pop ecx
push 0x52b111
push ebx
call fcn.005186f0
add esp, 8
test eax, eax
je 0x4373a7
inc dword [0x548de0]
jmp 0x4373f0
push 0x52b117
push ebx
call fcn.005186f0
add esp, 8
test eax, eax
je 0x4373c1
inc dword [0x548de0]
jmp 0x4373f0
push str..bat
push ebx
call fcn.005186f0
add esp, 8
test eax, eax
je 0x4373db
inc dword [0x548de0]
jmp 0x4373f0
inc dword [0x548de0]
mov eax, dword [0x548de0]
cmp dword [esi + eax*4], 0
jne 0x4372fe
mov byte [ebx], 0
push esi
push ebx
push dword [0x548de0]
call fcn.004bf445
cmp byte [edi], 0
jne 0x437432
cmp byte [ebx], 0
je 0x437432
push esi
push edi
mov esi, edi
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov byte [ebx], 0
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
push dword [0x548de4]
push 0x52feac
push ebx
push edi
push 0x52b123
push dword [0x537420]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x437473
push 0
call sub.KERNEL32.dll_SetErrorMode
push 4
push edi
push dword [esi]
push 0
call fcn.0045abd0
jmp 0x43747f
push 0
call sub.KERNEL32.dll_SetErrorMode
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x439456
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, 0x537420
mov eax, dword [ebx + 4]
test eax, eax
je 0x43964c
cmp byte [eax], 0x2d
jne 0x43964c
push 0x6f
push eax
call fcn.0051833c
add esp, 8
test eax, eax
je 0x439491
push 1
push dword [esi]
call fcn.004f7e3e
jmp 0x4394ab
push 0x70
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x4394ab
push 0
push dword [esi]
call fcn.004f7e3e
push 0x6e
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x43951f
mov edx, dword [0x536cac]
mov dword [0x548ea4], edx
xor ecx, ecx
mov dword [0x536cac], ecx
mov eax, dword [0x536ca4]
mov dword [0x548ea8], eax
xor edx, edx
mov dword [0x536ca4], edx
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
cmp dword [0x536ca8], 0
je 0x439504
push 2
call fcn.004f181f
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x548ea4]
mov dword [0x536cac], ecx
mov eax, dword [0x548ea8]
mov dword [0x536ca4], eax
jmp 0x43964c
push 0x78
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x439563
cmp dword [0x536ca8], 0
je 0x439540
push 2
call fcn.004f181f
push 3
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x43964c
push 0x73
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x4395a7
cmp dword [0x536ca8], 0
je 0x439584
push 2
call fcn.004f181f
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x43964c
push 0x72
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x4395f1
cmp dword [0x536ca8], 0
je 0x4395d1
push 2
call fcn.004f181f
push 8
push dword [esi]
call sub.USER32.dll_ShowWindow
push 9
push dword [esi]
call sub.USER32.dll_ShowWindow
push dword [esi]
call sub.USER32.dll_SetForegroundWindow
push dword [esi]
call sub.USER32.dll_SetActiveWindow
push dword [esi]
call sub.USER32.dll_SetFocus
jmp 0x43964c
push 0x74
push dword [ebx + 4]
call fcn.0051833c
add esp, 8
test eax, eax
je 0x43964c
mov edx, dword [0x536cac]
mov dword [0x548ea4], edx
mov dword [0x536cac], 1
cmp dword [0x536ca4], 0
je 0x439637
push 1
call fcn.004f181f
test eax, eax
je 0x439637
push 0
push dword [esi]
call sub.USER32.dll_ShowWindow
jmp 0x439640
push 7
push dword [esi]
call sub.USER32.dll_ShowWindow
mov ecx, dword [0x548ea4]
mov dword [0x536cac], ecx
mov eax, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43ac6d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
jne 0x43aca3
mov byte [0x558244], 0
cmp dword [0x52a6bc], 0
jne 0x43ac99
push edi
push esi
call fcn.0041686d
mov eax, 1
jmp 0x43ae1e
mov edx, dword [ebx + 4]
cmp byte [edx], 0x40
jne 0x43ad8b
push dword [ebx + 4]
call fcn.004f9bfc
mov dword [0x548eec], eax
cmp dword [0x548eec], 0
jne 0x43acd7
push 7
push 0
push dword [ebx]
push 0
call fcn.0045abd0
jmp 0x43ae1e
mov eax, dword [0x548eec]
mov edx, eax
add edx, 4
mov dword [0x548ef0], edx
cmp byte [eax + 0x657], 0
je 0x43acf6
inc dword [0x548ef0]
push dword [0x548ef0]
push 0x52b473
push esi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push ebx
push esi
push 2
call fcn.004bf445
push 0xf
push esi
call fcn.004e51c7
mov ecx, dword [0x548eec]
push dword [ecx]
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
push esi
call fcn.005183dc
pop ecx
cmp ebx, eax
jne 0x43ad73
push 0x3b5
push edi
mov eax, dword [0x548eec]
push dword [eax]
call sub.USER32.dll_GetWindowTextA
mov eax, esi
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x43ad73
test cl, cl
je 0x43ad67
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x43ad73
add eax, 2
add edx, 2
test cl, cl
jne 0x43ad4b
jne 0x43ad73
mov eax, 1
jmp 0x43ae1e
push esi
mov edx, dword [0x548eec]
push dword [edx]
call sub.USER32.dll_SetWindowTextA
mov eax, 1
jmp 0x43ae1e
push 0x52b478
push dword [ebx + 4]
call fcn.005185a0
add esp, 8
test eax, eax
jne 0x43adab
mov dword [0x548ef4], 2
jmp 0x43adb5
mov dword [0x548ef4], 1
mov edx, dword [0x548ef4]
cmp dword [ebx + edx*4], 0
je 0x43ae02
mov byte [esi], 0
push ebx
push esi
push dword [0x548ef4]
call fcn.004bf445
mov byte [esi + 0xfa], 0
push esi
push edi
mov edi, esi
mov esi, 0x558244
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x43ae09
mov byte [0x558244], 0
cmp dword [0x52a6bc], 0
jne 0x43ae19
push edi
push esi
call fcn.0041686d
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x43fbb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
push 0x52b958
push dword [ebp + 8]
call fcn.0051bf28
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43fbda
xor eax, eax
jmp 0x43fc51
push dword [ebp - 4]
push pe_nt_image_headers32
push 1
push 0x54923c
call fcn.0051c1c0
add esp, 0x10
mov esi, eax
test esi, esi
jbe 0x43fc2e
xor edx, edx
mov eax, 0x54923c
cmp esi, edx
jbe 0x43fc26
mov ecx, ebx
xor cl, byte [eax]
and ecx, 0xff
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x52b558]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
inc eax
cmp esi, edx
ja 0x43fc02
cmp esi, 0x200
jae 0x43fbda
mov eax, dword [ebp - 4]
test byte [eax + 0x12], 0x10
je 0x43fc44
push dword [ebp - 4]
call fcn.0051b82c
pop ecx
xor eax, eax
jmp 0x43fc51
push dword [ebp - 4]
call fcn.0051b82c
pop ecx
not ebx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x442547
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edx, 0x549940
mov eax, dword [ebx + 0xfe8]
mov dword [edx], eax
jmp 0x44256c
cmp ecx, dword [eax + 4]
je 0x442572
mov eax, dword [eax + 0x30]
mov dword [edx], eax
mov eax, dword [edx]
test eax, eax
jne 0x442562
mov ecx, dword [edx]
test ecx, ecx
jne 0x44257f
xor eax, eax
jmp 0x4427bc
mov eax, dword [ecx + 8]
mov dword [0x5499ac], eax
test eax, eax
jne 0x442595
mov eax, 1
jmp 0x4427bc
push eax
call sub.USER32.dll_IsWindowEnabled
test eax, eax
jne 0x4425bb
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x5499ac]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4427bc
push dword [0x5499ac]
push ebx
call fcn.0044239a
test eax, eax
jne 0x4425e7
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x5499ac]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4427bc
push 0x549c6c
push 0x3e7
push 0xd
push dword [0x5499ac]
call sub.USER32.dll_SendMessageA
cmp byte [0x549c6c], 0
je 0x442748
push dword [ebx + 0xc8]
call sub.USER32.dll_GetDC
mov esi, eax
mov dword [0x5499b0], esi
test esi, esi
jne 0x44262c
mov eax, 1
jmp 0x4427bc
push 0
push 0
push 0x31
push dword [ebx + 0xc8]
call sub.USER32.dll_SendMessageA
mov esi, eax
mov dword [0x549944], esi
push 0x549950
push 0x3c
push esi
call sub.GDI32.dll_GetObjectA
test eax, eax
jne 0x442671
push dword [0x5499b0]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x4427bc
mov byte [0x549965], 1
push 0x549950
call sub.GDI32.dll_CreateFontIndirectA
mov esi, eax
mov dword [0x54994c], esi
test esi, esi
jne 0x4426a9
push dword [0x5499b0]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
mov eax, 1
jmp 0x4427bc
push dword [0x54994c]
push dword [0x5499b0]
call sub.GDI32.dll_SelectObject
mov dword [0x549948], eax
push 0x54998c
push dword [0x5499ac]
call sub.USER32.dll_GetWindowRect
push 2
push 0x54998c
push dword [ebx + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
cmp byte [0x549c6c], 0
je 0x442719
mov esi, 0x54998c
mov edi, 0x54999c
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push 0x2c10
push 0x54999c
push 0xffffffffffffffff
push 0x549c6c
push dword [0x5499b0]
call sub.USER32.dll_DrawTextA
push dword [0x549948]
push dword [0x5499b0]
call sub.GDI32.dll_SelectObject
push dword [0x54994c]
call sub.GDI32.dll_DeleteObject
push dword [0x5499b0]
push dword [ebx + 0xc8]
call sub.USER32.dll_ReleaseDC
jmp 0x442788
push 0x54999c
push dword [0x5499ac]
call sub.USER32.dll_GetWindowRect
push 2
push 0x54999c
push dword [ebx + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
mov eax, dword [0x54999c]
add eax, 0xa
mov dword [0x5499a4], eax
mov edx, dword [0x5499a0]
add edx, 0xa
mov dword [0x5499a8], edx
push dword [ebp + 0x10]
push 0
push 0xc
push dword [0x5499ac]
call sub.USER32.dll_SendMessageA
push 1
push 0x54999c
push dword [ebx + 0xc8]
call sub.USER32.dll_InvalidateRect
push dword [ebx + 0xc8]
call sub.USER32.dll_UpdateWindow
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x443595
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x549af0
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x44369c
mov eax, dword [ebx + 0xc]
cmp eax, dword [esi + 0xfdc]
je 0x443691
push dword [ebx + 8]
call sub.USER32.dll_GetDlgCtrlID
mov dword [edi], eax
push dword [edi]
push esi
call fcn.0044300c
test eax, eax
jne 0x4435e5
push dword [edi]
push esi
call fcn.004423e3
test eax, eax
je 0x443627
lea edx, [ebp - 0x10]
push edx
push dword [ebx + 8]
call sub.USER32.dll_GetWindowRect
sub dword [ebp - 0x10], 2
sub dword [ebp - 0xc], 2
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 2
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc8]
push 0
call sub.USER32.dll_MapWindowPoints
push 1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xc8]
call sub.USER32.dll_InvalidateRect
jmp 0x443631
push 0
push dword [ebx + 8]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x443691
push 0x562938
push 0x3e7
push 0xd
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
push 0x26
push 0x562938
call fcn.0051833c
add esp, 8
mov dword [0x549aec], eax
cmp dword [0x549aec], 0
je 0x443691
mov edx, dword [0x549aec]
mov byte [edx], 1
push 0x562938
push 0
push 0xc
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x4435b4
push dword [esi + 0xc8]
call sub.USER32.dll_UpdateWindow
mov ebx, dword [esi + 0xfd4]
test ebx, ebx
je 0x443761
mov eax, dword [ebx + 0xc]
cmp eax, dword [esi + 0xfdc]
jne 0x443756
push dword [ebx + 8]
call sub.USER32.dll_GetDlgCtrlID
mov dword [edi], eax
cmp dword [ebx + 0x18], 0
je 0x4436f6
push dword [edi]
push esi
call fcn.0044300c
test eax, eax
jne 0x4436f6
push dword [edi]
push esi
call fcn.004423e3
test eax, eax
jne 0x4436f6
push 4
push dword [ebx + 8]
call sub.USER32.dll_ShowWindow
push 0
push 0
push 0xc1
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
test eax, eax
jg 0x443756
push 0x562938
push 0x3e7
push 0xd
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
push 1
push 0x562938
call fcn.0051833c
add esp, 8
mov dword [0x549aec], eax
cmp dword [0x549aec], 0
je 0x443756
mov edx, dword [0x549aec]
mov byte [edx], 0x26
push 0x562938
push 0
push 0xc
push dword [ebx + 8]
call sub.USER32.dll_SendMessageA
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x4436b5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4