joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142e0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5414f1
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x5a38c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x160], ecx
xor edi, edi
push 0x13c
lea eax, [ebp - 0x14c]
push edi
push eax
mov dword [ebp - 0x150], edi
call fcn.00527530
add esp, 0xc
call fcn.00428115
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41434b
push 0x80004005
call fcn.00401050
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x154], esi
mov dword [ebp - 4], edi
call fcn.00428115
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41437a
push 0x80004005
call fcn.00401050
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x158], eax
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], bl
jge 0x4143bb
push 0x104
lea ecx, [ebp - 0x154]
call fcn.004011e0
mov esi, dword [ebp - 0x154]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00527d59
add esp, 8
cmp eax, edi
jl 0x41450e
cmp eax, dword [esi - 8]
jg 0x41450e
push 6
mov dword [esi - 0xc], eax
push str.Plug_
lea ecx, [ebp - 0x154]
mov byte [eax + esi], 0
call fcn.004036e0
push str..dll
lea ecx, [ebp - 0x154]
push ecx
lea edx, [ebp - 0x15c]
push edx
call fcn.00403df0
add esp, 0xc
push eax
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 2
call fcn.00403f10
mov eax, dword [ebp - 0x15c]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41444e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x158]
lea ecx, [ebp - 0x150]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4144a9
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
push ecx
mov edx, esp
mov dword [ebp - 0x164], esp
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x154]
push ecx
push edx
call fcn.00403df0
mov ecx, dword [ebp - 0x160]
add esp, 0xc
call fcn.00413fa0
lea edx, [ebp - 0x150]
push edx
push esi
call edi
test eax, eax
jne 0x414470
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4144c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x154]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4144f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527098
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401050
int3
Function at 0x415470
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4154cd
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [ebp + 0xc]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4154c5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push edi
push ecx
push eax
call fcn.005280b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4154e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x415574
push ebx
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x41550f
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
lea esi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [ebp - 4], eax
call fcn.00426c26
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [esi - 1]
push eax
push ecx
lea edx, [edi + 1]
push edx
mov byte [edi], 0x19
call fcn.005280b0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18c]
push esi
push edi
push ecx
mov ecx, dword [eax + 0x190]
call fcn.0040e0f0
push edi
call fcn.00426c1b
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5415fd
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x5a38c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
mov esi, ecx
push 0xd0
mov dword [ebp - 0x130], esi
call fcn.004286ea
xor ebx, ebx
lea ecx, [esi + 0x100]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CScreenSpyDlg.0
call fcn.004151f0
mov byte [ebp - 4], 1
call fcn.00428115
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4167d8
push 0x80004005
call fcn.00401050
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x194], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push 0x104
lea eax, [ebp - 0x114]
push eax
mov byte [ebp - 4], 2
mov dword [esi + 0x190], ecx
mov dword [esi + 0x18c], edx
mov byte [esi + 0x188], 1
mov dword [esi + 0xd0], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._shell32.dll
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00432eb4
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x44]
push 0x11
lea edx, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconA]
mov dword [esi + 0x94], eax
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov eax, dword [esi + 0x18c]
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x124]
mov dword [ebp - 0x12c], 0x10
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x4168a7
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
jmp 0x4168ac
mov eax, 0x5517ad
cmp eax, ebx
jne 0x4168b4
xor ecx, ecx
jmp 0x4168cd
mov ecx, eax
lea edx, [ecx + 1]
mov dword [ebp - 0x128], edx
nop
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4168c0
sub ecx, dword [ebp - 0x128]
push ecx
push eax
lea ecx, [esi + 0x194]
call fcn.004037a0
mov ecx, dword [esi + 0x18c]
add ecx, 0x24
call fcn.0040dc00
lea edi, [eax - 1]
push edi
call fcn.00426c26
push edi
mov dword [esi + 0xd4], eax
call fcn.00426c26
mov ecx, dword [esi + 0x18c]
add esp, 8
push edi
push 1
add ecx, 0x24
mov dword [esi + 0xd8], eax
call fcn.0040ddc0
push eax
mov eax, dword [esi + 0xd4]
push eax
call fcn.005280b0
mov ecx, dword [esi + 0x18c]
add esp, 0xc
push edi
push 1
add ecx, 0x24
call fcn.0040ddc0
mov ecx, dword [esi + 0xd8]
push eax
push ecx
call fcn.005280b0
add esp, 0xc
xor eax, eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov byte [esi + 0x198], bl
mov dword [esi + 0xdc], ebx
mov byte [esi + 0xfc], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527098
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4174d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5a38c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
call fcn.00428a97
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [ebp - 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417505
push esi
mov ecx, 6
mov esi, str.Service_Unavaileble.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x11c]
push ecx
push 0x14
lea edx, [ebp - 0x18]
push edx
xor eax, eax
push 0x5517ad
push str.Port
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.LocalSetting
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.0052922d
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
push 0x14
lea edx, [ebp - 0x18]
push edx
push 0x5517ad
mov dword [ebx + 0x94], eax
xor eax, eax
push str.CheckHost
push str.LocalSetting
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.0052922d
add esp, 4
mov ecx, ebx
test eax, eax
jle 0x4175bc
push 0x44c
call fcn.00431a67
mov ecx, dword [eax + 0x20]
push 0
push 1
push 0xf1
push ecx
jmp 0x4175d3
push 0x44d
call fcn.00431a67
mov edx, dword [eax + 0x20]
push 0
push 1
push 0xf1
push edx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x11c]
push eax
push 0x14
lea ecx, [ebp - 0x18]
push ecx
push 0x5517ad
push str.WndTest
push str.LocalSetting
call esi
lea edx, [ebp - 0x18]
push edx
call fcn.0052922d
add esp, 4
pop esi
test eax, eax
jle 0x417636
push 0x4ae
mov ecx, ebx
call fcn.00431a67
mov eax, dword [eax + 0x20]
push 0
push 1
push 0xf1
push eax
call edi
push 0
mov ecx, ebx
call fcn.0042d35e
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00527098
mov esp, ebp
pop ebp
ret
Function at 0x417b60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541bf8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a38c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0x100
jne 0x417c99
mov eax, dword [edi + 8]
cmp eax, 0x1b
je 0x417c80
cmp eax, 0x2e
je 0x417c80
cmp eax, 0xd
jne 0x417c5d
mov eax, dword [edi]
cmp eax, dword [esi + 0xd8]
jne 0x417c5d
lea ecx, [esi + 0xb8]
call fcn.00432267
lea ecx, [ebp - 0x10]
call fcn.00401250
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [esi + 0xb8]
mov dword [ebp - 4], 0
call fcn.0042f2ba
push 0x555334
lea ecx, [ebp - 0x10]
call fcn.004052d0
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx - 8]
mov ebx, dword [edx - 0xc]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x417c1c
push 0
lea ecx, [ebp - 0x10]
call fcn.004011e0
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x138]
mov ecx, dword [esi + 0x134]
sub ebx, eax
push ebx
add eax, edx
mov edx, dword [esi + 0x130]
push eax
push edx
call fcn.0040e0f0
lea ecx, [esi + 0xb8]
call fcn.00432267
lea ecx, [ebp - 0x10]
mov dword [esi + 0x138], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040ffb0
mov edi, dword [ebp + 8]
cmp dword [edi + 8], 8
jne 0x417c99
mov eax, dword [edi]
cmp eax, dword [esi + 0xd8]
jne 0x417c99
lea ecx, [esi + 0xb8]
call fcn.00432267
cmp eax, dword [esi + 0x13c]
ja 0x417c99
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 4], 0x102
jne 0x417cf7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x417cf7
lea ecx, [esi + 0xb8]
call fcn.00432267
mov ecx, dword [esi + 0xd8]
mov edi, eax
push edi
push edi
push 0xb1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0xd8]
push 0
push 0
push 0xb7
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp edi, dword [esi + 0x138]
jae 0x417cf4
mov dword [esi + 0x138], edi
mov edi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00426ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41eb00
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push esi
push edi
push 0x25
push 0
mov edi, ecx
mov eax, dword [edi + 0x2b00]
push 0x1036
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push 0x96
push 0
push 0x556d1c
lea esi, [edi + 0x2ae0]
push 0
mov ecx, esi
call fcn.00435cae
push 0xffffffffffffffff
push 0x50
push 0
push 0x556d10
push 1
mov ecx, esi
call fcn.00435cae
push 0xffffffffffffffff
push 0x50
push 0
push 0x556d08
push 2
mov ecx, esi
call fcn.00435cae
push 0xffffffffffffffff
push 0x50
push 0
push 0x556cfc
push 3
mov ecx, esi
call fcn.00435cae
push 1
push 0x96
push 0
push 0x556cf8
push 4
mov ecx, esi
call fcn.00435cae
push 1
push 0x50
push 0
push 0x556cf0
push 5
mov ecx, esi
call fcn.00435cae
push 2
push 2
push 0x21
push 0x10
lea ebx, [edi + 0x2b84]
push 0x10
mov ecx, ebx
call fcn.004362cb
call fcn.00432eb4
mov eax, dword [eax + 0xc]
push 0x83
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [edi + 0x2b88]
push eax
push 0xffffffffffffffff
push ecx
call fcn.00432eb4
mov ecx, dword [eax + 0x78]
mov ecx, dword [ecx]
call fcn.0041e9e0
test ebx, ebx
je 0x41ebea
mov ebx, dword [ebx + 4]
mov edx, dword [edi + 0x2b00]
push ebx
push 1
push 0x1003
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call fcn.0043616c
mov dword [edi + 0x864], esi
pop edi
pop esi
pop ebx
ret
Function at 0x420270
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc8]
push 0
add ecx, 0x24
call fcn.0040ddc0
cmp byte [eax], 0x1c
jne 0x4015a0
mov ecx, esi
pop esi
jmp fcn.00401430
pop esi
ret
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
mov byte [esi + 0x188], 0
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, dword [esi + 0x18c]
push 1
add ecx, 0x24
call fcn.0040ddc0
mov edx, dword [esi + 0xd0]
push eax
push edx
call fcn.005280b0
mov eax, dword [esi + 0x20]
add esp, 0xc
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18c]
inc dword [esi + 0xdc]
push 0
add ecx, 0x24
call fcn.0040ddc0
movzx eax, byte [eax]
add eax, 0xffffff8d
cmp eax, 3
ja case.default.0x416254
jmp dword [eax*4 + 0x4162b8]
mov ecx, esi
pop esi
jmp 0x415640
mov ecx, dword [esi + 0x18c]
push 0
add ecx, 0x24
call fcn.0040ddc0
cmp byte [eax + 1], 1
mov ecx, esi
pop esi
jne 0x416281
jmp fcn.004157e0
jmp fcn.00415690
mov ecx, esi
pop esi
jmp fcn.00416010
mov ecx, dword [esi + 0x18c]
add ecx, 0x24
call fcn.0040dc00
mov ecx, dword [esi + 0x18c]
dec eax
push eax
push 1
add ecx, 0x24
call fcn.0040ddc0
push eax
mov ecx, esi
call fcn.00415470
pop esi
ret
push esi
mov esi, ecx
call fcn.00417dc0
lea ecx, [esi + 0xb8]
call fcn.00432267
mov dword [esi + 0x13c], eax
pop esi
ret
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1a0]
push 0
add ecx, 0x24
call fcn.0040ddc0
movzx eax, byte [eax]
sub eax, 0x7d
je 0x418f41
dec eax
je 0x418f39
dec eax
jne 0x418f49
mov ecx, esi
pop esi
jmp fcn.00418220
mov ecx, esi
pop esi
jmp fcn.00418800
mov ecx, esi
pop esi
jmp fcn.00418610
pop esi
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je case.0x4202e1.27
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x48]
test eax, eax
jle 0x4202c1
add eax, 0xfffff6f8
cmp eax, 4
ja case.0x4202e1.27
jmp dword [eax*4 + 0x420380]
pop esi
pop ebp
jmp 0x401580
pop esi
pop ebp
jmp 0x417ec0
pop esi
pop ebp
jmp 0x418f10
pop esi
pop ebp
jmp 0x416230
pop esi
pop ebp
jmp fcn.004094f0
push 0
lea ecx, [esi + 0x24]
call fcn.0040ddc0
movzx ecx, byte [eax]
add ecx, 0xffffffe7
cmp ecx, 0x67
ja case.0x4202e1.27
movzx ecx, byte [ecx + 0x4203b0]
jmp dword [ecx*4 + 0x420394]
mov ecx, dword [0x5a50a8]
inc eax
push eax
push esi
call fcn.0041fac0
pop esi
pop ebp
ret
mov edx, dword [0x5a50a8]
mov eax, dword [edx + 0x20]
push esi
push 0
push 0x903
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebp
ret
mov ecx, dword [0x5a50a8]
mov edx, dword [ecx + 0x20]
push esi
push 0
push 0x904
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebp
ret
mov eax, dword [0x5a50a8]
mov ecx, dword [eax + 0x20]
push esi
push 0
push 0x905
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebp
ret
mov edx, dword [0x5a50a8]
mov eax, dword [edx + 0x20]
push esi
push 0
push 0x906
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebp
ret
mov ecx, dword [0x5a50a8]
mov edx, dword [ecx + 0x20]
push esi
push 0
push 0x907
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ebp
ret
Function at 0x426eff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0042f664
call fcn.00426d53
cmp eax, esi
pop esi
jne 0x426f1b
mov ecx, 0x5a6d00
jmp fcn.00441a3e
ret

Function at 0x428fa4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00432eb4
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x428fdd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00428be6
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x42903b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x42905f
cmp dword [edi + 0x74], 0
jne 0x42905f
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00432eb4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00428ffc
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4312ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4312f3
call fcn.00432eb4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4312f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43130f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00430db1
mov esi, eax
test edi, edi
je 0x43130d
test ebx, ebx
je 0x43130d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4321e8
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x54681f
call fcn.0052a92b
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x43220d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43225f
call fcn.00428115
push eax
lea ecx, [ebp - 0x10]
call fcn.004011b0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0052aa35
push eax
call fcn.00401990
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401070
mov eax, esi
call fcn.0052aa03
ret 8

Function at 0x43501e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00432eb4
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x43504b
xor eax, eax
jmp 0x4350f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x435044
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x435044
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00426bec
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x4350a3
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x435091
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00433d3a
push edi
mov ebx, eax
call fcn.00426c1b
pop ecx
test ebx, ebx
je 0x4350e5
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00434393
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00434447
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x436a36
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004365a8
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x436a80
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042f274
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004133f0
jmp 0x436a8b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00443e16
pop edi
pop esi
pop ebp
ret 0xc