joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42441f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 0x14]
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
jne 0x42445b
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424511
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
adc dword [esi + 0xc], ebx
jmp 0x424511
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0x18]
cmp eax, dword [ebp + 8]
jl 0x424469
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
test eax, eax
mov dword [ebp - 8], eax
jle 0x42449e
push eax
mov eax, dword [esi + 0x18]
add eax, ecx
push edi
push eax
call sub.MSVCRT.dll_memcpy
mov edx, dword [ebp - 8]
add dword [esi + 0x18], edx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
add esp, 0xc
cmp ecx, eax
jbe 0x424495
mov eax, ecx
add dword [ebp - 4], edx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jae 0x42450e
cmp dword [esi + 0x20], 0
je 0x4244b1
call fcn.00413661
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor edx, edx
sub eax, ecx
add ecx, edi
cmp eax, dword [esi + 0x10]
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
jae 0x4244e6
push eax
push ecx
push dword [esi + 0x14]
mov dword [esi + 0x1c], eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x1c]
add dword [esi + 0x18], eax
add esp, 0xc
add dword [ebp - 4], eax
mov dword [esi + 0x20], ebx
jmp 0x42450e
push edx
mov dword [ebp - 8], edx
lea edx, [ebp - 8]
push edx
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424502
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
push esi
call fcn.0041e06e
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x42906e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
movsx edi, ax
shr eax, 0x10
cmp dword [esi + 0xbc], 0
movsx ebx, ax
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
je 0x429118
cmp dword [esi + 0xc0], 0
je 0x429118
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
cmp dword [esi + 0x6c], eax
je 0x4290b5
sub ebx, dword [esi + 0xcc]
mov dword [esi + 0xc4], ebx
jmp 0x4290c1
sub edi, dword [esi + 0xc8]
mov dword [esi + 0xc4], edi
xor ebx, ebx
cmp dword [esi + 0xc4], eax
je 0x4290f6
lea edi, [esi + 0x10c]
cmp dword [edi], eax
mov dword [ebp - 4], eax
je 0x4290f6
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.00425dad
test eax, eax
je 0x4290f4
mov edi, dword [edi]
push dword [ebp - 4]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
je 0x42918d
push 1
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x42918d
lea ecx, [ebp - 8]
mov eax, esi
call fcn.00428d82
test eax, eax
jl 0x42918d
cmp eax, dword [esi + 0x114]
jge 0x42918d
lea ecx, [esi + 0x110]
call fcn.0040f0a0
add eax, 4
mov edi, dword [eax]
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x429151
mov eax, dword [esi + 0x60]
jmp 0x42915a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push 0x7f9
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x42918d
push 1
push eax
push eax
push edi
push 0x4fb5a0
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004af6f1
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x42a916
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
cmp dword [esi + 0xc], 0x202
push ebx
jne 0x42a978
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
and ax, 0xfffe
je 0x42a978
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
push 4
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x42a978
push edi
mov edi, dword [esp + 0xc]
push ebx
push dword [esi + 0x1c]
add edi, 4
push dword [esi + 0x18]
push edi
call fcn.0042a9ef
push 1
push 0
push 0
push ebx
push 0x4fb5a0
push dword [edi]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop edi
xor eax, eax
pop ebx
ret 4
Function at 0x42fe1e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x517ad4]
or dword [edi + 8], 0xffffffff
xor eax, ebp
mov dword [ebp + 0x98], eax
push esi
lea eax, [ebp - 0x7c]
xor esi, esi
push eax
mov dword [edi], esi
mov dword [edi + 0xc], esi
mov dword [ebp - 0x7c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42fe68
cmp dword [ebp - 0x78], 5
jb 0x42fe68
xor eax, eax
inc eax
cmp dword [ebp - 0x74], eax
jae 0x42fe6a
xor eax, eax
cmp eax, esi
mov dword [edi + 4], eax
je 0x42fe79
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
jmp 0x42feb0
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0xc
push esi
push 3
push 0xc
mov dword [ebp - 0x80], eax
pop eax
lea esi, [ebp - 0x80]
call fcn.0042fda9
push 0xc
push 1
push 3
push 0xc
mov dword [edi + 0x10], eax
pop eax
call fcn.0042fda9
push dword [ebp - 0x80]
mov dword [edi + 0x14], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.004ebd70
add ebp, 0x9c
leave
ret

Function at 0x4307d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea edi, [esi + 0x20]
mov dword [edi], eax
cmp dword [esi + 4], 0
jne 0x430803
lea ebx, [ebp - 4]
mov eax, edi
call fcn.00410ceb
mov eax, dword [eax]
push 0
push eax
mov eax, esi
call fcn.0043897d
test eax, eax
je 0x43088d
mov eax, dword [edi]
test eax, eax
je 0x430856
lea ecx, [ebp - 8]
push ecx
push 0
push 0x434
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
push 2
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x430856
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.0042a9ef
test eax, eax
jle 0x43084e
push ebx
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x24]
push eax
call fcn.00438534
push dword [ebp + 8]
mov ecx, esi
call fcn.00430990
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x430893
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
lea edi, [esi + 0x24]
push dword [edi]
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
test ebx, ebx
je 0x4308c5
lea eax, [ebx + ebx + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x4308cd
or eax, 0xffffffff
jmp 0x43098b
inc ebx
push ebx
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3f6
push dword [esi + 4]
call edi
mov ebx, eax
neg ebx
push 0x3f2
push dword [esi + 4]
sbb ebx, ebx
inc ebx
call edi
test eax, eax
je 0x430900
or ebx, 4
push 0x3f4
push dword [esi + 4]
call edi
test eax, eax
je 0x430911
or ebx, 2
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x14]
push eax
push 0
push 0x434
push dword [esi + 0x20]
call edi
test bl, 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
je 0x43093b
mov eax, dword [ebp - 0x10]
or dword [ebp - 0x24], 0xffffffff
jmp 0x430942
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x47c
push dword [esi + 0x20]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x430965
push eax
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x430975
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call edi
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
call fcn.00440612
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430d92
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [edi + 0x2c], esi
jne 0x430dc0
push 1
mov ecx, edi
call fcn.00430990
push 1
push dword [edi + 0x28]
push 0x28
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x430e8c
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x14]
push eax
push esi
push 0x434
push dword [edi + 0x20]
call ebx
push 0x3f6
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x430e02
push esi
push esi
push 0xe
push dword [edi + 0x20]
call ebx
dec eax
cmp dword [ebp - 0x10], eax
jge 0x430dfa
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x430e10
cmp dword [ebp - 0x14], esi
jle 0x430e0a
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x437
push dword [edi + 0x20]
call ebx
mov eax, edi
call fcn.00430893
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x430e33
or eax, 0xffffffff
jmp 0x430e8b
lea esi, [edi + 0x28]
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x430e2e
mov ecx, dword [ebp - 8]
inc ecx
push ecx
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 4]
push 1
push 0xc2
push dword [edi + 0x20]
call ebx
mov ebx, dword [ebp - 4]
call fcn.00440612
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, edi
call fcn.00430893
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
leave
ret
Function at 0x430e8f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push esi
push edi
mov esi, eax
push dword [esi + 0x24]
call ebx
mov edi, eax
test edi, edi
je 0x430ebe
lea eax, [edi + edi + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jne 0x430ec6
or eax, 0xffffffff
jmp 0x430ffe
inc edi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
push eax
push dword [esi + 0x24]
call edi
push dword [esi + 0x28]
call ebx
mov ebx, eax
lea eax, [ebx + ebx + 2]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0xc], eax
jne 0x430eff
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
or eax, 0xffffffff
jmp 0x430ffd
inc ebx
push ebx
push eax
push dword [esi + 0x28]
call edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x14]
push eax
push 0
push 0x434
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 8]
mov ebx, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3f8
push dword [esi + 4]
mov dword [ebp - 0x20], eax
call ebx
test eax, eax
je 0x430f47
xor eax, eax
push eax
push eax
push 0xe
push dword [esi + 0x20]
mov dword [ebp - 0x28], eax
call edi
jmp 0x430f5e
push 0x3f9
push dword [esi + 4]
call ebx
test eax, eax
je 0x430f61
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
push 0x3f2
push dword [esi + 4]
mov dword [ebp - 4], 1
call ebx
test eax, eax
je 0x430f7d
mov dword [ebp - 4], 5
push 0x3f4
push dword [esi + 4]
call ebx
test eax, eax
je 0x430f8f
or dword [ebp - 4], 2
mov eax, dword [ebp - 0xc]
call fcn.00430bee
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00430bee
sub ebx, eax
jmp 0x430fd4
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call edi
push dword [ebp - 0xc]
push 1
push 0xc2
push dword [esi + 0x20]
call edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x24], ebx
add eax, ebx
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jge 0x430fea
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
push 0x47c
push dword [esi + 0x20]
call edi
cmp eax, 0xffffffff
jne 0x430fa5
push dword [ebp - 8]
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push dword [ebp - 0xc]
call esi
pop ecx
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432498
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x517ad4]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0x100c
lea esi, [ebx + 0x24]
push dword [esi]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
and word [ebp - 0x58], 0
mov dword [ebp - 0x5c], eax
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x56]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
mov ecx, ebx
call fcn.00431aa4
push dword [eax]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov eax, dword [ebp - 0x60]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
pop ecx
pop ecx
je 0x43250a
push eax
call fcn.004013b2
mov eax, dword [ebx + 4]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x78], eax
xor edi, edi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x74], edi
mov word [ebp - 0x70], 0x40
mov dword [ebp - 0x6e], edi
mov dword [ebp - 0x6a], edi
mov dword [ebp - 0x66], edi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x43254e
cmp dword [ebp - 0x6e], edi
jne 0x43254e
push dword [ebp - 0x5c]
mov eax, esi
call fcn.0041a499
mov ecx, dword [ebp + 0x1b4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004ebd70
add ebp, 0x1b8
leave
ret

Function at 0x43264a
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x432718
cmp word [eax], 0
je 0x432718
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.00431aa4
mov eax, dword [0x51b438]
mov dword [ebp - 4], eax
mov eax, 0x104
push eax
lea ecx, [ebp - 4]
call fcn.00403201
push eax
push 1
push dword [esi + 0x10]
lea eax, [edi + 0x24]
push eax
call fcn.0041a41c
or eax, 0xffffffff
lea ecx, [ebp - 4]
call fcn.0040322d
push dword [esi + 0x20]
lea eax, [ebp - 4]
push eax
call fcn.00403184
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x43271e
push 0x8187
lea eax, [ebp - 8]
call fcn.00401692
pop ecx
push 0x10
push dword [0x52324c]
push dword [eax]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 8]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4326f6
push eax
call fcn.004013b2
lea eax, [esi - 0xc]
cmp eax, dword [0x51b43c]
je 0x432707
push eax
call fcn.004013b2
lea eax, [ebx - 0xc]
cmp eax, dword [0x51b43c]
je 0x432718
push eax
call fcn.004013b2
xor eax, eax
pop esi
pop ebx
leave
ret
lea eax, [esi - 0xc]
cmp eax, dword [0x51b43c]
je 0x43272f
push eax
call fcn.004013b2
lea eax, [ebx - 0xc]
cmp eax, dword [0x51b43c]
je 0x432740
push eax
call fcn.004013b2
xor eax, eax
inc eax
jmp 0x43271a
Function at 0x436f04
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push esi
push 0x4fccb0
lea eax, [ebp - 4]
push eax
add ecx, 0x258
call fcn.0042477d
mov esi, dword [ebp - 4]
cmp dword [esi - 8], 0
jne 0x436f45
lea eax, [esi - 0xc]
cmp eax, dword [0x51b43c]
je 0x437057
push eax
call fcn.004013b2
jmp 0x437057
push ebx
push edi
call fcn.004ae9cb
neg eax
sbb eax, eax
and eax, 0xc
inc eax
cmp eax, 0xd
mov dword [ebp - 0xc], eax
jne 0x436fb9
lea ecx, [ebp - 4]
lea esi, [ebp - 8]
call fcn.0040306f
mov esi, dword [ebp - 8]
mov edi, dword [esi - 8]
lea edi, [edi + edi + 2]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x436f92
add esi, 0xfffffff4
cmp esi, dword [0x51b43c]
je 0x437041
push esi
jmp 0x436fea
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
add esi, 0xfffffff4
cmp esi, dword [0x51b43c]
je 0x43701b
push esi
jmp 0x437016
lea eax, [ebp - 8]
push 0
push eax
mov eax, esi
call fcn.0040160b
mov edi, dword [ebp - 8]
mov esi, dword [edi - 8]
pop ecx
pop ecx
inc esi
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x436ff1
lea eax, [edi - 0xc]
cmp eax, dword [0x51b43c]
je 0x437041
push eax
call fcn.004013b2
jmp 0x437041
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [edi - 0xc]
cmp eax, dword [0x51b43c]
je 0x43701b
push eax
call fcn.004013b2
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x437041
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x437055
push eax
call fcn.004013b2
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 4

Function at 0x437513
Capabilities:
Hide graphical window

Disassembly:
push ebx
xor ebx, ebx
push edi
inc ebx
push ebx
mov ecx, esi
call fcn.00434c06
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp word [esp + 0xc], ax
mov dword [0x522740], ebx
push eax
jne 0x43753f
mov eax, esi
call fcn.004389af
jmp 0x437544
push dword [esi + 4]
call edi
push 5
push dword [esi + 0x3f0]
call edi
cmp dword [0x52264c], 0
je 0x43755f
mov dword [0x5226d8], ebx
jmp 0x437565
mov dword [0x52265c], ebx
pop edi
xor eax, eax
pop ebx
ret 4
Function at 0x4389af
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
push edi
mov edi, dword [ebx + 0xdc]
and dword [ebx + 0xdc], 0
cmp dword [esp + 0x10], 0
jne 0x4389ec
test edi, edi
mov esi, dword [ebx + 0x60]
je 0x4389df
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
mov eax, 0xff
je 0x4389e1
mov eax, esi
push 5
push eax
call fcn.0043959d
mov dword [ebx + 0x60], esi
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0x10], 0
je 0x438a2c
push dword [ebx + 4]
mov esi, dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_BringWindowToTop]
test edi, edi
mov eax, 0xff
jne 0x438a1f
mov eax, esi
push eax
push 5
call fcn.0043959d
mov dword [ebx + 0x60], esi
jmp 0x438a36
push 0xffffffffffffffff
push dword [ebx + 0x60]
call fcn.0043959d
mov dword [ebx + 0xdc], edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43aca7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
ret

Function at 0x43b8e2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x43b902
cmp word [eax], 0
je 0x43b902
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b902
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x43c039
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x517ad4]
xor eax, ebp
push ebx
mov dword [ebp + 0x798], eax
push edi
lea eax, [ebp - 0x80]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
and word [ebp - 0x68], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x66]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x400
lea eax, [ebp - 0x68]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 2
mov dword [ebp - 0x6c], 0x20
je 0x43c0a7
mov dword [ebp - 0x6c], 0x22
jmp 0x43c0b2
test al, 1
je 0x43c0b2
mov dword [ebp - 0x6c], 0x21
test ah, 2
je 0x43c0bb
or dword [ebp - 0x6c], 4
push dword [esi + 0x24]
mov ebx, dword [ebp + 0x7a4]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push 1
push ebx
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esi + 0x28]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x6c]
lea eax, [ebp - 0x80]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x70]
push ebx
call edi
mov ecx, dword [ebp + 0x798]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ebd70
add ebp, 0x79c
leave
ret 4
Function at 0x43c98a
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x517ad4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x5c]
xor eax, ebp
test ecx, ecx
push edi
mov dword [ebp + 0x798], eax
lea edi, [ebp - 0x68]
jne 0x43c9c6
push 0x400
mov eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x43c9db
mov eax, dword [esi + 0x40]
test eax, eax
jl 0x43ca0f
cmp eax, ecx
jge 0x43ca0f
lea ecx, [esi + 0x58]
call fcn.004ae4da
mov edi, dword [eax]
lea eax, [ebp - 0x78]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
lea edi, [ebp - 0x80]
mov eax, esi
call fcn.0043cc25
mov ecx, dword [eax]
mov dword [esi + 0x44], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x78]
xor ecx, ecx
cmp dword [esi + 0x44], eax
setg cl
mov dword [esi + 0x3c], ecx
mov ecx, dword [ebp + 0x798]
pop edi
xor ecx, ebp
pop esi
call fcn.004ebd70
add ebp, 0x79c
leave
ret

Function at 0x43d3ef
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 4], edi
jne 0x43d3fb
mov eax, esi
cmp dword [esp + 0x10], ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], 7
mov dword [esi + 0x14], eax
je 0x43d429
push 0x40
push dword [esp + 0x14]
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43d459
cmp dword [esi + 0x14], ebx
jne 0x43d447
push ebx
push ebx
push 0x7f
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
cmp word [eax], bx
jne 0x43d459
push 0x40
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
inc eax
pop ebx
ret 0xc

Function at 0x43d5dc
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x118
mov eax, dword [0x517ad4]
push edi
xor eax, ebp
push 0x44
mov dword [ebp + 0x74], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x43d654
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jne 0x43d638
cmp dword [ebp - 0x9c], 4
jb 0x43d654
cmp dword [ebp - 0x98], 0x5a
jmp 0x43d652
cmp dword [ebp - 0x90], 2
jne 0x43d654
cmp dword [ebp - 0x9c], 5
ja 0x43d656
jne 0x43d654
cmp dword [ebp - 0x98], eax
jae 0x43d656
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004ebd70
add ebp, 0x78
leave
ret