joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453e90
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x453f33
test eax, eax
jbe 0x453f33
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x453f33
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x453ede
xor esi, esi
jmp 0x453ee4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x453f0f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00455eb0
add esi, eax
push esi
mov ebx, esi
call fcn.00455eb0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x453ef0
pop ebp
test edi, edi
pop edi
jne 0x453f33
test ebx, ebx
je 0x453f33
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00458560
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x454075
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45418d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45418d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004697f0
mov esi, eax
test esi, esi
je 0x45418d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45418d
mov ecx, esi
call fcn.00453fe0
cmp edi, eax
jge 0x45418d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x454113
mov dword [esp + 0x34], 1
jmp 0x45416e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45418d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004535d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x46a194
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46a1cc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046824b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00468223
jmp 0x46a1d8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46b886
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46b8c8
call fcn.004715ff
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46b8c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46b8bf
xor eax, eax
jmp 0x46b8d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046b8d6
pop edi
pop esi
pop ebx
ret 4

Function at 0x471b2f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x471b5d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471b7b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00471a95
jmp 0x471b7b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471b7b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00471a95
test edi, edi
mov eax, edi
jne 0x471b65
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401030
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x415170], esi
jne 0x40106c
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x401062
push str.___.___
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x41516c], eax
mov dword [0x415170], 1
mov eax, dword [0x41516c]
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x401089
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4010c5
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x4010ba
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x4010ab
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x4010b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x4010cd
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x401570
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
mov esi, dword [esp + 0x23c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov dword [esp + 0x1c], 0
mov word [esp + 0x2c], ax
call sub.MSVCR90.dll_memset
mov bx, word [esp + 0x244]
xor edx, edx
add esp, 0xc
cmp dword [esp + 0x234], edx
mov dword [esp + 0x14], 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0xc], edx
test bx, bx
je 0x4015fd
push str.SoftwareAdobeAcrobat_Reader10.0FeatureState
push 0x104
lea eax, [esp + 0x28]
push eax
jmp 0x40160c
push str.SoftwareAdobeAdobe_Acrobat10.0FeatureState
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401695
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401677
cmp dword [esp + 0x14], 4
jne 0x401677
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp dword [esp + 0x18], edx
push ecx
setne dl
mov dword [esp + 0x10], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4016a6
test bx, bx
je 0x401688
test esi, esi
je 0x401688
mov eax, 1
mov word [esi], ax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4016a6
test bx, bx
je 0x4016a6
test esi, esi
je 0x4016a6
mov edx, 1
mov word [esi], dx
mov ecx, dword [esp + 0x228]
mov ax, word [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040cef9
add esp, 0x220
ret
Function at 0x4017f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x674
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push ebp
mov ebp, dword [esp + 0x680]
push esi
push edi
mov edi, dword [esp + 0x68c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x27a]
push ecx
mov dword [esp + 0x20], ebp
mov word [esp + 0x27c], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x40f548
push ebp
mov ebp, dword [sym.imp.kernel32.dll_lstrcpyW]
mov dword [esp + 0x20], 0x104
xor esi, esi
mov bl, 1
call ebp
lea edx, [esp + 0x10]
push edx
push 0x20019
push esi
push str.SoftwareAdobeAcrobat_Reader10.0Languagecurrent
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4018fb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x274]
push ecx
push esi
push esi
push 0x40f4d8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4018f0
push eax
push str.3156557
call fcn.004016d0
movzx eax, ax
add esp, 8
mov dword [esp + 0x1c], eax
test ax, ax
je 0x4019d1
lea eax, [esp + 0x270]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcsnlen]
add esp, 8
cmp eax, 0x104
je 0x4018ee
cmp eax, 3
jle 0x4018ee
lea esi, [esp + eax*2 + 0x26a]
push esi
call fcn.004017b0
add esp, 4
test al, al
jne 0x4018f0
xor bl, bl
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x1c], 0
je 0x40190b
test bl, bl
je 0x4019b8
test esi, esi
je 0x4019b8
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 3
jne 0x4019b8
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x482]
push ecx
mov word [esp + 0x484], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x47c]
push edx
call ebp
mov edi, dword [sym.imp.kernel32.dll_lstrcatW]
push str.Legal_
lea eax, [esp + 0x47c]
push eax
call edi
push esi
lea ecx, [esp + 0x47c]
push ecx
call edi
push 0x24c
lea edx, [esp + 0x28]
push 0
push edx
mov dword [esp + 0x2c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x47c]
push ecx
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4019b8
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [esp + 0x20], 0x10
je 0x4019b8
mov edx, dword [esp + 0x14]
push esi
push edx
call ebp
mov ecx, dword [esp + 0x680]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040cef9
add esp, 0x674
ret
lea ecx, [esp + 0x270]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenW]
lea esi, [esp + eax*2 + 0x26a]
jmp 0x4018f0
Function at 0x401d70
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x415150], edi
je 0x401d86
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [0x415148], edi
je 0x401d97
mov eax, 1
pop edi
ret 4
push esi
cmp dword [0x415150], edi
jne 0x401da9
call fcn.00401b60
test eax, eax
je 0x401deb
mov eax, dword [0x41517c]
mov esi, dword [0x414010]
test eax, eax
jne 0x401dd5
push str.ActivateActCtx
push 0x415174
push 0x40f3b8
call fcn.00401030
mov dword [0x41517c], eax
test eax, eax
je 0x401deb
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x401deb
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7f
je 0x401e00
cmp eax, 0x7e
je 0x401e00
cmp eax, 0x78
jne 0x401e0f
mov eax, 1
pop esi
mov dword [0x415148], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4

Function at 0x402df0
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
push esi
push edi
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ebx, [ebp + ebp]
push ebx
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x2c]
add esp, 0x10
push edi
push esi
call dword [sym.imp.kernel32.dll_lstrcpyW]
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add esp, 0xc
add eax, 0x254
push eax
push ebp
push edi
push esi
push ecx
push str.labels
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4034e0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x40d8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x415120]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor edi, edi
cmp ecx, edi
je 0x403516
add ecx, 0xffffffe0
mov dword [esp + 0x14], ecx
jmp 0x40351a
mov dword [esp + 0x14], edi
mov ebx, dword [esp + 0x78]
movzx eax, word [ebx + 6]
cmp ax, 8
jle 0x403532
mov eax, 0x80004005
jmp 0x40360f
mov ecx, dword [esp + 0x7c]
movsx esi, ax
neg esi
sbb esi, esi
lea eax, [esp + 0x40]
and esi, eax
xor eax, eax
cmp dword [ecx + 0xc], edi
jbe 0x403569
test esi, esi
je 0x403528
mov edx, dword [ecx + 4]
mov edx, dword [edx + eax*4]
cmp edx, 8
jae 0x403528
mov ebp, dword [ecx]
add ebp, edi
inc eax
mov dword [esi + edx*4], ebp
add edi, 0x10
cmp eax, dword [ecx + 0xc]
jb 0x40354a
cmp eax, dword [ecx + 8]
jae 0x40358e
mov edx, eax
shl edx, 4
test esi, esi
je 0x403528
movsx ebp, word [ebx + 6]
mov edi, dword [ecx]
add edi, edx
sub ebp, eax
inc eax
mov dword [esi + ebp*4 - 4], edi
add edx, 0x10
cmp eax, dword [ecx + 8]
jb 0x403573
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x70]
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x3c], 0x40cbf4
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x80]
mov dword [esp + 0x68], 0
test eax, eax
jne 0x4035d8
lea eax, [esp + 0x18]
movzx ecx, word [ebx + 4]
push eax
movsx eax, word [ebx + 6]
push esi
lea edx, [ebx + 8]
push edx
mov edx, dword [ebx]
push eax
push ecx
push edx
push 0
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantChangeTypeEx]
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov dword [esp + 0x6c], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x14
Function at 0x404410
Capabilities:
Copy file

Disassembly:
sub esp, 0x4d0
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x4cc], eax
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, 0x18
mov esi, str.HTML_Files__.HTML_
lea edi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xd2]
push ecx
movsw word es:[edi], word [esi]
mov word [esp + 0xd4], ax
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.kernel32.dll_lstrcpyW]
add esp, 0xc
push str.License.html
lea edx, [esp + 0xcc]
push edx
call esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2da]
push ecx
mov word [esp + 0x2dc], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.License.html
lea edx, [esp + 0x2d4]
push edx
call esi
push 0x54
lea eax, [esp + 0x14]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x70]
mov eax, 0x104
mov dword [esp + 0x24], edx
add esp, 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
lea edx, [esp + 0xc]
lea eax, [esp + 0xc8]
lea ecx, [esp + 0x2d0]
push edx
mov dword [esp + 0x10], 0x58
mov dword [esp + 0x4c], str.html
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], 0x802
call fcn.00403260
test eax, eax
je 0x40451f
push 0
lea eax, [esp + 0xcc]
push eax
add ebx, 0x45c
push ebx
call dword [sym.imp.kernel32.dll_CopyFileW]
mov ecx, dword [esp + 0x4d8]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040cef9
add esp, 0x4d0
ret 0x10
Function at 0x404ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x40da3b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x415120]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
movzx eax, word [esp + 0x25c]
mov esi, dword [0x415264]
push 0xf0
push eax
mov edi, 1
push esi
mov ebp, ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x40505b
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x40505b
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40505b
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x404f36
mov edi, dword [esp + 0x14]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x40505b
add esi, 2
mov edx, dword [esi + 2]
movzx edi, ax
movzx eax, word [esi]
add esi, 2
mov ecx, 0x403
add esi, 4
mov dword [esp + 0x18], edx
cmp cx, ax
jne 0x404fdb
push 3
lea edx, [esp + 0x14c]
push esi
lea ecx, [esp + 0x14c]
mov dword [esp + 0x14c], edx
call fcn.004036e0
mov eax, dword [esp + 0x144]
mov edx, dword [ebp + 4]
push eax
push 0
movzx ecx, di
push 0x143
push ecx
push edx
mov dword [esp + 0x268], 0
call ebx
cmp eax, 0xffffffff
jne 0x404fb2
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x148]
mov dword [esp + 0x254], 0xffffffff
cmp eax, ecx
je 0x405046
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
jmp 0x405046
mov edx, 0x1234
cmp dx, ax
jne 0x405046
push 3
lea eax, [esp + 0x48]
push esi
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x48], eax
call fcn.004036e0
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], eax
cmp eax, ecx
je 0x405023
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov ecx, dword [ebp + 4]
lea edx, [esp + 0x1c]
push edx
push 0
movzx eax, di
push 0x40b
push eax
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x405046
mov dword [esp + 0x14], 0
add esi, dword [esp + 0x18]
cmp dword [esp + 0x14], 0
jne 0x404f32
mov eax, dword [esp + 0x14]
jmp 0x40505d
mov eax, edi
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.0040cef9
add esp, 0x244
ret 4
Function at 0x409850
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x414
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x430]
push 0xcf
mov esi, ecx
call fcn.00404ea0
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x16]
push ecx
mov dword [edi], 1
mov word [esp + 0x18], ax
call sub.MSVCR90.dll_memset
mov eax, dword [esi + 4]
add esp, 0xc
push 0x208
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x208
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x20]
push str.DeclTitle
call fcn.00402df0
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x208
lea eax, [esp + 0x10]
push eax
push 0xcf
push ecx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea edx, [esp + 0x10]
push edx
push str.DeclText1
call fcn.00402df0
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push eax
mov eax, dword [esi + 4]
push 0xcf
push eax
call ebx
mov edx, dword [esi + 4]
push 0x208
lea ecx, [esp + 0x10]
push ecx
push 0xd0
push edx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea eax, [esp + 0x10]
push eax
push str.DeclText2
call fcn.00402df0
mov ecx, dword [esi + 4]
push eax
push 0xd0
push ecx
call ebx
mov eax, dword [esi + 4]
push 0x208
lea edx, [esp + 0x10]
push edx
push 1
push eax
call edi
push 0x208
lea ecx, [esp + 0x10]
push ecx
push 0x40fd44
mov ecx, dword [esi + 0x20]
call fcn.00402df0
mov edx, dword [esi + 4]
push eax
push 1
push edx
call ebx
mov ecx, dword [esi + 4]
push 0x208
lea eax, [esp + 0x10]
push eax
push 2
push ecx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea edx, [esp + 0x10]
push edx
push 0x40fd38
call fcn.00402df0
push eax
mov eax, dword [esi + 4]
push 2
push eax
call ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040cef9
add esp, 0x414
ret 0x10
Function at 0x4099d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x414
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x430]
push 0xce
mov esi, ecx
call fcn.00404ea0
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x16]
push ecx
mov dword [edi], 1
mov word [esp + 0x18], ax
call sub.MSVCR90.dll_memset
mov eax, dword [esi + 4]
add esp, 0xc
push 0x208
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x208
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x20]
push str.DeclTitle
call fcn.00402df0
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x208
lea eax, [esp + 0x10]
push eax
push 0xcf
push ecx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea edx, [esp + 0x10]
push edx
push str.DeclText1
call fcn.00402df0
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push eax
mov eax, dword [esi + 4]
push 0xcf
push eax
call ebx
mov edx, dword [esi + 4]
push 0x208
lea ecx, [esp + 0x10]
push ecx
push 0xd0
push edx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea eax, [esp + 0x10]
push eax
push str.DeclText2
call fcn.00402df0
mov ecx, dword [esi + 4]
push eax
push 0xd0
push ecx
call ebx
mov eax, dword [esi + 4]
push 0x208
lea edx, [esp + 0x10]
push edx
push 1
push eax
call edi
push 0x208
lea ecx, [esp + 0x10]
push ecx
push 0x40fd44
mov ecx, dword [esi + 0x20]
call fcn.00402df0
mov edx, dword [esi + 4]
push eax
push 1
push edx
call ebx
mov ecx, dword [esi + 4]
push 0x208
lea eax, [esp + 0x10]
push eax
push 2
push ecx
call edi
mov ecx, dword [esi + 0x20]
push 0x208
lea edx, [esp + 0x10]
push edx
push 0x40fd38
call fcn.00402df0
push eax
mov eax, dword [esi + 4]
push 2
push eax
call ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040cef9
add esp, 0x414
ret 0x10
Function at 0x40bb40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call fcn.0040b9a0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.kernel32.dll_FindResourceW]
push 5
push edi
push esi
mov dword [esp + 0x20], 0xffffffff
call ebx
mov ebp, eax
test ebp, ebp
je 0x40bc23
push 0xf0
push edi
push esi
call ebx
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
xor edi, edi
test eax, eax
je 0x40bb94
push eax
push esi
call ebx
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push ebp
push esi
mov dword [esp + 0x18], 0
call ebx
test eax, eax
je 0x40bbfc
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40bbfc
push edi
push ebx
call fcn.004013a0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push esi
call fcn.00403260
mov esi, eax
test esi, esi
je 0x40bbde
cmp esi, 0xffffffff
jne 0x40bbe8
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp edi, ebx
je 0x40bc0a
push edi
call dword [sym.imp.kernel32.dll_GlobalHandle]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x40bc0a
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bc19
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret