joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433598
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef8
mov eax, dword [0x48d838]
mov eax, dword [eax + 0x24]
call fcn.00412904
push 0
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll__lopen
mov dword [esp], eax
cmp dword [esp], 0xffffffff
jne 0x4335d9
mov edx, dword [0x48da44]
mov ax, 1
call fcn.0040de10
jmp 0x43371f
push 0
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push 4
push 0x1000
lea ebx, [esi + 1]
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
test edi, edi
jne 0x433623
mov dword [esp + 4], ebx
fild dword [esp + 4]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.00412abc
mov edx, eax
mov ax, 0xb
call fcn.0040de10
jmp 0x433716
push esi
push edi
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll__lread
mov ebx, edi
inc ebx
mov al, byte [ebx]
test al, al
je 0x43363c
cmp al, 0xa
jne 0x433631
lea eax, [esp + 8]
mov edx, ebx
call fcn.00403304
lea eax, [esp + 8]
mov edx, 0x43372c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402d10
je 0x433716
inc ebx
mov eax, ebx
call fcn.004331d4
push 0x4000
inc esi
push esi
push edi
call sub.kernel32.dll_VirtualFree_1
mov ebp, dword [0x48da40]
movzx ebp, byte [ebp]
test ebp, ebp
jle 0x433716
mov edi, 1
mov ebx, dword [0x48d548]
mov esi, dword [0x48d80c]
mov edx, ebx
mov eax, dword [0x48da44]
call fcn.00405c48
push 0x433730
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push esi
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
push 0x433734
mov eax, dword [0x48da44]
push eax
call sub.kernel32.dll_lstrcatA
mov edx, dword [0x48da44]
mov eax, dword [0x49ba70]
call fcn.0042bb9c
mov edx, edi
dec edx
mov eax, dword [0x48d550]
add eax, 0x1960
call fcn.0040ba5c
cmp al, 1
jne 0x43370c
mov eax, edi
dec eax
push eax
push 1
push 0x185
mov eax, dword [0x49ba70]
push eax
call sub.user32.dll_SendMessageA
inc edi
add esi, 0xc
add ebx, 0x16
dec ebp
jne 0x433698
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
add esp, 0x108
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x438a98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x438acf
mov edi, dword [0x48d510]
mov di, word [edi]
push 0
push 0xb
push 0x111
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x438b18
mov eax, dword [0x48d510]
cmp dword [eax], 1
jg 0x438b26
cmp bl, 1
jne 0x438ae8
mov eax, dword [0x48d510]
cmp dword [eax], 1
je 0x438b26
mov edi, dword [0x48d510]
mov di, word [edi]
mov byte [0x49bafd], 1
push 0
push 0x88
push 0x111
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov byte [0x49bafd], 0
mov eax, dword [0x48d510]
mov eax, dword [eax]
movsx edx, di
cmp eax, edx
jne 0x438b64
mov byte [0x49bae0], bl
mov dl, 0x3e
mov ax, 0x13
call fcn.0042d52c
test eax, eax
je 0x438c32
mov eax, dword [0x48d510]
cmp dword [eax], 0
je 0x438c32
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
cmp dword [eax + 0x4c], 0
jne 0x438b26
xor eax, eax
mov al, bl
mov edx, dword [0x48d5ac]
mov ecx, dword [0x48d930]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov ecx, dword [eax + 0x14]
mov edi, ebx
and edi, 0xff
mov edx, edi
add dx, 0x64
mov eax, esi
call fcn.0042d910
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
movzx edx, word [eax + 0x53c]
dec edx
mov ecx, dword [0x48db48]
movzx ecx, word [ecx]
imul edx, ecx
mov dword [esp], edx
fild dword [esp]
fild qword [eax + 0x188]
faddp st(1)
movzx eax, word [eax + 0x53a]
mov dword [esp + 4], eax
fild dword [esp + 4]
faddp st(1)
fsub dword [0x438c38]
mov eax, dword [0x48d318]
fistp qword [eax]
wait
mov eax, dword [0x48d318]
push dword [eax + 4]
push dword [eax]
call fcn.00410208
mov ecx, eax
mov edx, edi
add dx, 0x12c
mov eax, esi
call fcn.0042d910
mov eax, dword [0x48d5ac]
mov al, byte [eax]
mov edx, dword [0x48d5ac]
cmp al, byte [edx + 1]
setne cl
mov eax, esi
mov dx, 1
call fcn.0042e904
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x43b360
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov esi, dword [0x48da44]
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, dword [0x48d550]
mov byte [eax + 0x18a4], bl
test bl, bl
jbe 0x43b442
push esp
mov ax, 0x89
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, 0x43b570
call fcn.00412904
mov eax, esi
call fcn.00405bdc
inc eax
push eax
push esi
push 1
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegSetValueA
test eax, eax
je 0x43b3df
mov ax, 0x119
call fcn.0040bc04
mov edx, eax
mov ax, 0x1a
call fcn.0040de10
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
push esp
mov ax, 0x8a
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [0x48d560]
call fcn.00412904
mov eax, esi
call fcn.00405bdc
inc eax
push eax
push esi
push 1
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegSetValueA
test eax, eax
je 0x43b437
mov ax, 0x119
call fcn.0040bc04
mov edx, eax
mov ax, 0x1a
call fcn.0040de10
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x43b4bc
mov ax, 0x89
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov ax, 0x89
call fcn.0040bc04
mov edx, eax
mov eax, esi
call fcn.00405c48
mov eax, esi
mov dl, 0x5c
call fcn.00405e00
mov byte [eax], 0
push esi
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov ax, 0x8a
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov ax, 0x8a
call fcn.0040bc04
mov edx, eax
mov eax, esi
call fcn.00405c48
mov eax, esi
mov dl, 0x5c
call fcn.00405e00
mov byte [eax], 0
push esi
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
cmp bl, 1
jne 0x43b51b
push esp
mov ax, 0x8b
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [0x48d560]
call fcn.00412904
mov eax, esi
call fcn.00405bdc
inc eax
push eax
push esi
push 1
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegSetValueA
test eax, eax
je 0x43b510
mov ax, 0x119
call fcn.0040bc04
mov edx, eax
mov ax, 0x1a
call fcn.0040de10
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x43b558
mov ax, 0x8b
call fcn.0040bc04
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov ax, 0x8b
call fcn.0040bc04
mov edx, eax
mov eax, esi
call fcn.00405c48
mov eax, esi
mov dl, 0x5c
call fcn.00405e00
mov byte [eax], 0
push esi
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
pop edx
pop esi
pop ebx
ret
Function at 0x43b584
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebp, eax
mov eax, 0x15e
call fcn.004024e8
mov esi, eax
mov eax, dword [ebp + 0x18]
test eax, eax
jl 0x43b75f
push esp
push 0xff
mov edx, eax
mov eax, dword [ebp + 4]
mov ecx, 6
call fcn.0040b4b8
mov eax, esp
call fcn.0040cda0
mov eax, dword [0x48dbdc]
xor ecx, ecx
mov edx, 0x80000000
call fcn.0040eba4
mov edi, eax
cmp edi, 0xffffffff
je 0x43b750
push 0
push 0
push 0x10
push edi
call sub.kernel32.dll_SetFilePointer_1
push pe_nt_image_headers32
lea eax, [esp + 0x104]
push eax
push edi
call sub.kernel32.dll__lread
push edi
call sub.kernel32.dll_CloseHandle_1
mov ax, 0x11a
call fcn.0040bc04
mov edx, eax
mov eax, esi
call fcn.00405c48
test bl, bl
je 0x43b638
lea eax, [esp + 0x100]
call fcn.0040fb28
push eax
mov ax, 0x292
call fcn.0040bc04
pop edx
call fcn.0040f5a0
jmp 0x43b64d
mov ax, 0x292
call fcn.0040bc04
lea edx, [esp + 0x100]
call fcn.0040f5a0
mov eax, dword [0x48da44]
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov edx, 2
mov eax, esi
call fcn.00411d74
test al, al
jbe 0x43b75f
mov eax, dword [0x48dbdc]
push eax
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x43b696
mov edx, dword [0x48dbdc]
mov ax, 4
call fcn.0040de10
jmp 0x43b75f
mov eax, dword [0x48dbdc]
call fcn.0040ebbc
or ecx, 0xffffffff
or edx, 0xffffffff
call fcn.00412668
mov edx, dword [ebp + 0x18]
mov eax, ebp
call fcn.0042beb8
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 4]
call fcn.0040b368
dec dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x43b70b
mov dword [ebp + 0x18], 0xffffffff
push 2
mov eax, dword [ebp]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
mov eax, ebp
xor ecx, ecx
mov dx, 1
call fcn.0042e904
mov eax, ebp
xor ecx, ecx
mov dx, 3
call fcn.0042e904
mov eax, ebp
xor ecx, ecx
mov dx, 4
call fcn.0042e904
jmp 0x43b725
cmp eax, dword [ebp + 0x18]
jne 0x43b713
dec dword [ebp + 0x18]
push 2
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 4]
mov ecx, 2
call fcn.0040b488
fild dword [ebp + 0x1c]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov ax, 0x11c
call fcn.0040bc04
call fcn.0040f4d4
mov ecx, dword [0x48da44]
mov eax, ebp
mov dx, 0x65
call fcn.0042d910
jmp 0x43b75f
mov edx, dword [0x48dbdc]
mov ax, 4
call fcn.0040de10
mov eax, esi
call fcn.00402508
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43c0c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
xor ebx, ebx
push 0x163
mov eax, dword [0x48da44]
push eax
push 0x30a
mov eax, dword [esi]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x48da44]
call fcn.00405bdc
cmp eax, 0xff
jle 0x43c111
push 0
push 0xff
mov ax, 0x10f
call fcn.0040bc04
call fcn.0040f4d4
jmp 0x43c1bb
mov esi, dword [0x48da44]
mov edi, dword [0x48d550]
add edi, 0x1b7a
mov edx, 0xff
mov eax, edi
call fcn.00405a9c
mov dl, 0xd
mov eax, esi
call fcn.00405cf8
mov ebp, eax
test ebp, ebp
je 0x43c16a
cmp esi, ebp
je 0x43c165
mov ecx, ebp
sub cx, si
mov edx, esi
mov eax, edi
call fcn.00405c70
mov eax, edi
call fcn.0043c048
test al, al
je 0x43c1bb
mov eax, edi
call fcn.00405bdc
inc eax
add edi, eax
lea esi, [ebp + 2]
jmp 0x43c17e
mov edx, esi
mov eax, edi
call fcn.00405c48
mov eax, edi
call fcn.0043c048
test al, al
je 0x43c1bb
test ebp, ebp
jne 0x43c12f
mov bl, 1
mov edx, dword [0x48d550]
add edx, 0x1b7a
mov eax, dword [0x48d43c]
mov ecx, 0xff
call fcn.00405a94
mov edx, 0xff
mov eax, dword [0x48d43c]
cmp byte [eax], 0
jne 0x43c1b7
cmp byte [eax + 1], 0
je 0x43c1b7
mov byte [eax], 0x3b
inc eax
dec edx
jne 0x43c1a9
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x440f88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, eax
mov eax, dword [0x48d608]
mov byte [eax], 1
push 0x1e
lea eax, [esp + 8]
push eax
xor eax, eax
mov al, bl
mov edx, dword [0x48d994]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x441120
cmp bl, 0xd
jae 0x440ff7
mov eax, dword [0x48d6a4]
push eax
mov eax, dword [0x48d550]
mov al, byte [eax + 0x1889]
push eax
mov eax, dword [0x48d550]
mov al, byte [eax + 0x1887]
push eax
lea eax, [esp + 0xd]
push eax
lea edx, [esp + 0x14]
xor ecx, ecx
mov eax, ebx
call fcn.00440a6c
mov byte [esp], al
jmp 0x4410ed
cmp bl, 0xe
je 0x441001
cmp bl, 0xf
jne 0x44100b
mov byte [esp + 2], 0xe
mov byte [esp + 3], 0xf
cmp bl, 0x10
je 0x441015
cmp bl, 0x11
jne 0x44101f
mov byte [esp + 2], 0x10
mov byte [esp + 3], 0x11
cmp bl, 0x12
je 0x441029
cmp bl, 0x13
jne 0x441033
mov byte [esp + 2], 0x12
mov byte [esp + 3], 0x13
cmp bl, 0x14
je 0x44103d
cmp bl, 0x15
jne 0x441047
mov byte [esp + 2], 0x14
mov byte [esp + 3], 0x15
cmp bl, 0x16
je 0x441051
cmp bl, 0x17
jne 0x44105b
mov byte [esp + 2], 0x16
mov byte [esp + 3], 0x17
cmp bl, 0x18
je 0x441065
cmp bl, 0x19
jne 0x44106f
mov byte [esp + 2], 0x18
mov byte [esp + 3], 0x19
push 0xc
lea eax, [esp + 8]
push eax
xor eax, eax
mov al, byte [esp + 0xa]
mov edx, dword [0x48d994]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x441120
push 0xc
mov eax, dword [0x48d830]
push eax
xor eax, eax
mov al, byte [esp + 0xb]
mov edx, dword [0x48d994]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x441120
mov eax, dword [0x48d6a4]
push eax
mov eax, dword [0x48d550]
mov al, byte [eax + 0x1889]
push eax
mov eax, dword [0x48d550]
mov al, byte [eax + 0x1887]
push eax
lea eax, [esp + 0xd]
push eax
mov ecx, dword [0x48d830]
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00440a6c
mov byte [esp], al
cmp byte [esp], 0
je 0x441120
mov eax, dword [0x48d930]
mov eax, dword [eax]
mov edx, dword [0x48d524]
mov eax, dword [edx + eax*4 - 4]
mov esi, dword [eax]
push esi
call sub.user32.dll_SetFocus
push 0
xor eax, eax
mov al, bl
push eax
push 0x402
push esi
call sub.user32.dll_SendMessageA
jmp 0x441164
cmp byte [esp + 1], 0
je 0x44113a
mov ax, 0xd1
call fcn.0040bc04
mov edx, 3
call fcn.00411d74
mov byte [esp], 0
mov eax, dword [0x48d608]
mov byte [eax], 0
mov eax, 1
call fcn.0040f448
xor eax, eax
mov al, bl
mov edx, dword [0x48d994]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_SetFocus
mov al, byte [esp]
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x44121c
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
push 0x1e
mov eax, dword [0x48da44]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4412e8
mov eax, dword [0x48d994]
cmp ebx, dword [eax + 0x30]
je 0x4412e8
mov eax, dword [0x48dae0]
cmp byte [eax], 0
jne 0x4412e8
mov eax, dword [0x48d304]
mov byte [eax], 1
xor edx, edx
mov ax, 1
call fcn.00405a7c
push eax
push 3
push 0xd3
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xcf
push ebx
call sub.user32.dll_SendMessageA
push 0x50810080
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_SetWindowLongA
push 0x20
push 0xf
mov eax, dword [0x48d550]
mov eax, dword [eax + 0x17cc]
mov edx, dword [0x48d550]
sub eax, dword [edx + 0x17c4]
sub eax, 0x37
sub eax, 7
mov edx, dword [0x48d70c]
movzx edx, byte [edx]
add edx, edx
lea edx, [edx + edx*2]
sub eax, edx
push eax
push 0xfffffffffffffff4
push ebx
call sub.user32.dll_GetWindowLongA
movzx eax, ax
dec eax
push eax
mov eax, dword [0x48d70c]
movzx eax, byte [eax]
mov edx, eax
shl eax, 3
sub eax, edx
add eax, 0x3a
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
pop ebx
ret

Function at 0x441408
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x48d550]
cmp byte [edx + 0x190f], 0
je 0x441458
mov edx, dword [0x48d510]
cmp dword [edx], 0
jle 0x441435
test al, al
je 0x441435
push 4
mov eax, dword [0x48d6ac]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x48d510]
cmp dword [eax], 0
je 0x441449
mov eax, dword [0x48d5a8]
cmp byte [eax], 0
je 0x441458
push 0
mov eax, dword [0x48d6ac]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x441b80
Capabilities:
Get graphical window text

Disassembly:
test al, al
je 0x441c6d
mov eax, dword [0x48d550]
mov byte [eax + 0x18e0], 0
push 0x11
mov eax, dword [0x48d550]
add eax, 0x867
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x48d550]
add eax, 0x867
call fcn.00405bdc
test eax, eax
jle 0x441c50
mov eax, dword [0x48d550]
add eax, 0x867
call fcn.00405bdc
cmp eax, 0x10
jge 0x441c50
mov eax, dword [0x48d550]
add eax, 0x867
mov dl, 1
call fcn.0040c12c
mov eax, dword [0x48d318]
fistp qword [eax]
wait
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x441c42
mov eax, dword [0x48d550]
mov edx, dword [0x48d318]
mov ecx, dword [edx]
mov dword [eax + 0x16dc], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x16e0], ecx
mov eax, dword [0x48d550]
push dword [eax + 0x16e0]
push dword [eax + 0x16dc]
call fcn.004123c0
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x441d54
mov eax, dword [0x48d6c8]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetFocus
ret
mov ax, 0x14a
call fcn.0040bc04
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x441d54
mov eax, dword [0x48d550]
mov byte [eax + 0x18e0], 1
push 0x11
mov eax, dword [0x48d7ec]
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x48d7ec]
call fcn.00405bdc
test eax, eax
jle 0x441d3d
mov eax, dword [0x48d7ec]
call fcn.00405bdc
cmp eax, 0x10
jge 0x441d3d
mov al, 1
call fcn.0040bd78
mov eax, dword [0x48d318]
fistp qword [eax]
wait
mov eax, dword [0x48d6d4]
cmp byte [eax], 0
jne 0x441d2e
mov eax, dword [0x48d550]
mov edx, dword [0x48d318]
mov ecx, dword [edx]
mov dword [eax + 0x16dc], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x16e0], ecx
mov eax, dword [0x48d550]
push dword [eax + 0x16e0]
push dword [eax + 0x16dc]
xor edx, edx
mov al, 1
call fcn.0040fe88
mov edx, eax
mov eax, dword [0x48d550]
add eax, 0x867
call fcn.00405c48
mov eax, dword [0x48d550]
add eax, 0x867
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x441d54
mov eax, dword [0x48d6c8]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetFocus
ret
mov ax, 0x14a
call fcn.0040bc04
push eax
mov eax, dword [0x48d6c8]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
ret

Function at 0x444e00
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x48d550]
cmp byte [edx + 0x1939], 0
je 0x444e50
mov edx, dword [0x48d510]
cmp dword [edx], 0
jle 0x444e32
test al, al
je 0x444e32
call fcn.00444cb4
push 4
mov eax, dword [0x48d3b0]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x48d510]
cmp dword [eax], 0
jne 0x444e50
call fcn.00444da8
push 0
mov eax, dword [0x48d3b0]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x445a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov byte [esp], dl
mov ebx, eax
mov eax, dword [0x48d338]
cmp dword [eax], 0
jne 0x445aac
push 0x48c464
push 1
mov eax, dword [0x48e700]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x48e700]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [0x48d338]
mov dword [edx], eax
push 0x48c464
push 2
mov eax, dword [0x48e700]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x48e700]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [0x48d40c]
mov dword [edx], eax
mov byte [esi], 0
cmp bl, 0xf
jne 0x445acc
mov eax, dword [0x48d4bc]
cmp byte [eax], 1
jbe 0x445af6
mov cl, 1
mov edx, esi
mov al, byte [esp]
call fcn.00445920
jmp 0x445af6
mov eax, ebx
and eax, 0xff
bt dword [0x48c440], eax
setb al
test al, al
je 0x445aeb
mov eax, dword [0x48d4bc]
cmp byte [eax], 1
jbe 0x445af6
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00445920
pop edx
pop esi
pop ebx
ret

Function at 0x44694c
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x48c478], 0
jne 0x446a1e
mov byte [0x48c478], 1
xor eax, eax
mov dword [0x48c470], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x446994
cmp dword [esp + 0x1c], 3
jne 0x4469f4
cmp dword [esp + 0x20], 0x33
jbe 0x4469f4
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x446a28
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x446a1e
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x446a58
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x446a1e
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x446a1e
cmp byte [esp + 9], 0
jne 0x446a1e
jmp 0x446a09
push 0
push 0x446a58
push 0x446a60
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x446a1e
mov eax, dword [0x48c46c]
call fcn.0040485c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48c470], eax
add esp, 0xac
ret
Function at 0x446ee4
Capabilities:
Open clipboard

Disassembly:
push ebx
push ecx
mov byte [esp + 1], 1
mov byte [esp], 1
test al, al
je 0x446f53
mov eax, dword [0x48d7c4]
cmp byte [eax], 0
je 0x446f38
call sub.user32.dll_CountClipboardFormats
test eax, eax
jle 0x446f38
mov eax, dword [0x48d2f8]
mov byte [eax], 1
mov ax, 0x57
call fcn.0040bc04
mov edx, 0x12
call fcn.00411d74
cmp al, 3
je 0x447000
cmp al, 1
sete byte [esp]
test al, al
sete byte [esp + 1]
jmp 0x446f53
mov ax, 0x58
call fcn.0040bc04
mov edx, 2
call fcn.00411d74
test al, al
je 0x447000
mov eax, dword [0x48d7c4]
cmp byte [eax], 0
je 0x446fba
cmp byte [esp], 0
je 0x446f90
push 0x4000
mov eax, dword [0x48d4a8]
mov eax, dword [eax]
push eax
mov eax, dword [0x48d438]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x48d7c4]
mov byte [eax], 0
mov eax, dword [0x48d4a8]
xor edx, edx
mov dword [eax], edx
mov bl, 1
cmp byte [esp + 1], 0
je 0x446fe8
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x446fe8
call sub.user32.dll_EmptyClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.user32.dll_CloseClipboard
jmp 0x446fe8
mov eax, dword [0x48d858]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x446fe6
call sub.user32.dll_EmptyClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.user32.dll_CloseClipboard
mov eax, dword [0x48d4a8]
xor edx, edx
mov dword [eax], edx
jmp 0x446fe8
xor ebx, ebx
test bl, bl
jne 0x447000
mov ax, 0x59
call fcn.0040bc04
mov edx, eax
mov ax, 0x1b
call fcn.0040de10
pop edx
pop ebx
ret