joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e1d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4965e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0046dd80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0046de00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0046de00
lea ecx, [esi + 0xc]
call fcn.0048742c
lea ecx, [esi + 0x10]
call fcn.0048742c
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00470630
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00470630
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00470630
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004874a1
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004874a1
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x46ee78
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x496808
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x46ee88
call fcn.0046f3a0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x46ef6b
cmp byte [edi], 0
je 0x46ef6b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x46eead
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0046dba0
test eax, eax
jne 0x46eecd
push 0x83a2ac
lea ecx, [esi + 0x38]
call fcn.004875de
jmp 0x46ef6b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0046dbf0
test eax, eax
jne 0x46eefc
mov ecx, esi
call fcn.0046dcf0
push edi
add esi, 0x38
push 0x83a288
push esi
call fcn.00484ec7
add esp, 0xc
jmp 0x46ef6b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0046fc20
test eax, eax
je 0x46ef64
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0046f040
test eax, eax
jne 0x46ef80
push edi
lea eax, [esi + 0x38]
push 0x83a264
push eax
call fcn.00484ec7
add esp, 0xc
mov ecx, esi
call fcn.0046f3a0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x46f028
mov ecx, dword [0x83a5a8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00484ec7
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0046dca0
test eax, eax
jne 0x46efea
push 0x83a248
lea ecx, [esi + 0x38]
call fcn.004875de
jmp 0x46effa
push 0xfa
mov ecx, esi
call fcn.0046fc20
test eax, eax
jne 0x46f017
mov ecx, esi
call fcn.0046f3a0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004874a1
jmp 0x46ef6b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004874a1
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x471140
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4711e3
test eax, eax
jbe 0x4711e3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4711e3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47118e
xor esi, esi
jmp 0x471194
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4711bf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00474b90
add esi, eax
push esi
mov ebx, esi
call fcn.00474b90
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4711a0
pop ebp
test edi, edi
pop edi
jne 0x4711e3
test ebx, ebx
je 0x4711e3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00477360
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x471305
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47141d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47141d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00488ea4
mov esi, eax
test esi, esi
je 0x47141d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47141d
mov ecx, esi
call fcn.00471290
cmp edi, eax
jge 0x47141d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4713a3
mov dword [esp + 0x34], 1
jmp 0x4713fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47141d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00470880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x489848
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x489880
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004878fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004878d4
jmp 0x48988c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48af36
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48af78
call fcn.00490cb4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48af78
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48af6f
xor eax, eax
jmp 0x48af80
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048af86
pop edi
pop esi
pop ebx
ret 4

Function at 0x4911e4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x491212
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491230
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049114a
jmp 0x491230
mov eax, dword [esi + 0x14]
test eax, eax
je 0x491230
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049114a
test edi, edi
mov eax, edi
jne 0x49121a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4030fa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00445ab0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40313f
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40316d
push 6
call fcn.00443b7d
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x403189
push eax
mov ebx, eax
call fcn.00401010
inc eax
push eax
call fcn.00443b71
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40318e
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40319f
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4031a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x4031c5
mov dword [ebp + 0x14], 0
jmp 0x4031e2
cmp dword [ebp + 0x14], 2
jne 0x4031db
mov dword [ebp + 0x14], 7
jmp 0x4031e2
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x44d226
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40321d
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x403239
mov eax, 0
jmp 0x403243
mov eax, 1
jmp 0x403243
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403249
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x403264
call fcn.004032d4
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x403290
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4032ba
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x4032ce
mov esp, ebp
pop ebp
ret 8
Function at 0x403d02
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403d45
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403d6f
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403da3
push 6
call fcn.00443b7d
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x403dab
mov esp, ebp
pop ebp
ret 4
Function at 0x414ab1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00445ab0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414af6
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414b21
push 6
call fcn.00443b7d
add esp, 4
push 0x44d26e
push dword [ebp - 4]
mov ecx, 2
call fcn.0040107b
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x414b41
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414b52
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x415c51
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 2
jne 0x415d99
mov dword [ebp - 8], esp
push str.Comet_Thread
push dword [ebp + 8]
call dword [0x456f2b]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415c92
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415ce8
mov dword [ebp - 8], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415cc6
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415ce8
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Image
push dword [ebp + 8]
call dword [0x456f2b]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415d0f
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415d3e
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415d3e
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Stream
push dword [ebp + 8]
call dword [0x456f2b]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415d65
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415d94
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415d94
push 6
call fcn.00443b7d
add esp, 4
jmp 0x415e60
cmp dword [ebp + 0xc], 0x201
jne 0x415e60
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x456f2f]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415dd1
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push str.CometHitMove
push dword [ebp + 8]
call dword [0x456f2b]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415dfb
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x415e58
mov dword [ebp - 8], esp
call dword [0x456f33]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415e27
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 8], esp
push 0
push 2
push 0xa1
push dword [ebp + 8]
call dword [0x456f37]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415e58
push 6
call fcn.00443b7d
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x415e90
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x456f2f]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415e8b
push 6
call fcn.00443b7d
add esp, 4
jmp 0x415e90
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42ac18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x42ac53
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00449100
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42acb6
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00446740
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x42acda
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00449100
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42ad3d
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00446740
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x42ad61
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00449100
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42adc4
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00446740
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x42adcc
mov esp, ebp
pop ebp
ret
Function at 0x42f0b9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42f0ff
push 6
call fcn.00443b7d
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x44d516]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.004016d2
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00445ab0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42f152
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42f18b
push 6
call fcn.00443b7d
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42f1a7
push eax
mov ebx, eax
call fcn.00401010
inc eax
push eax
call fcn.00443b71
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42f1ac
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x42f1bd
push ebx
call fcn.00443b77
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x445960
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4459c9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00445540
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x445f50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00449780
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x4460a0
test ecx, ecx
je 0x4460a0
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x445fc9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44608d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x446051
cmp eax, 0xea
jne 0x446079
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44601c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x44605f
cmp eax, 2
jne 0x446079
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00449740
add esp, 8
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x4460ce
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4460da
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4460da
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00449740
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x447060
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4470f2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4470e4
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4470dc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4470a5
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x447100
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x44716a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x44713a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x447186
push ecx
push esi
call fcn.00449740
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4471e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4471fe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4471f3
pop esi
ret