joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4996ac
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4998dc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x49972f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4998dc
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x49972f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4998f8
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4997b8
xor eax, eax
push ebp
push 0x4997b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004994f4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x499796
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x499918
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x499796
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4997b8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4998d2
cmp byte [ebp - 0xd], 0
jne 0x4997ff
cmp byte [ebp - 0x12], 0
je 0x4998d2
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x499818
dec ebx
cmp byte [ebx], 0x2e
je 0x499827
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x499817
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4998d2
inc ebx
cmp byte [ebp - 0x12], 0
je 0x499864
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4998d2
cmp byte [ebp - 0xd], 0
je 0x4998d2
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4998d2
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a050
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x53dc74], 1
jae 0x49a0d6
mov byte [0x5364ac], 2
mov dword [0x53d6c4], 0x4a74b6
mov dword [0x53d6c8], 0x4a74c8
mov byte [0x53d702], 2
mov dword [0x53d6b0], 0x498cdc
call fcn.004970a8
test al, al
je 0x49a093
call fcn.004970d8
call fcn.0049719c
mov word [0x53d708], 0xd7b0
mov word [0x53d8d4], 0xd7b0
mov word [0x53daa0], 0xd7b0
call fcn.00498bbc
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x53d6f4], eax
call fcn.00495064
mov dword [0x53d6f0], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x53d6e8], eax
ret
Function at 0x49c4dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0049d48c
test byte [ebp + 0xd], 0xc0
jne 0x49c500
mov eax, dword [0x5373bc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49c50d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x49c53a
je 0x49c54c
sub ecx, 0x100
je 0x49c55a
sub ecx, 0x100
je 0x49c561
sub ecx, 0x100
je 0x49c553
jmp 0x49c568
sub ecx, 0x600
je 0x49c561
sub ecx, 0x100
je 0x49c54c
jmp 0x49c568
mov edi, 1
jmp 0x49c56d
mov edi, 2
jmp 0x49c56d
mov edi, 4
jmp 0x49c56d
mov edi, 5
jmp 0x49c56d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x49c594
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x536e34]
test al, 0x80
je 0x49c58d
mov ebx, 0x80
jmp 0x49c5a6
mov ebx, 1
jmp 0x49c5a6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49c5a6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x49c5b8
je 0x49c5c1
dec eax
je 0x49c5ca
jmp 0x49c5d3
mov dword [ebp - 4], SysStringLen
jmp 0x49c5e2
mov dword [ebp - 4], 0x40000000
jmp 0x49c5e2
mov dword [ebp - 4], 0xc0000000
jmp 0x49c5e2
push 1
call fcn.0049d884
pop ecx
mov ebx, eax
jmp 0x49c6d2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49c5fe
sub eax, 0x10
je 0x49c605
sub eax, 0x10
je 0x49c60e
sub eax, 0x10
je 0x49c617
jmp 0x49c617
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49c61e
mov dword [ebp - 8], 1
jmp 0x49c61e
mov dword [ebp - 8], 2
jmp 0x49c61e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49c68b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x49c680
test byte [ebp + 0xd], 1
je 0x49c67b
mov ebx, 0x50
jmp 0x49c680
mov ebx, 2
push ebx
call fcn.0049d884
pop ecx
mov ebx, eax
jmp 0x49c6d2
mov edi, esi
push edi
call fcn.0049c440
pop ecx
test eax, eax
je 0x49c69f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49c6ab
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0049d5ac
add esp, 8
mov ebx, eax
inc eax
jne 0x49c6d2
push 4
call fcn.0049d884
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0049d4c0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a160c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4a166e
call fcn.004a15bc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0049b078
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0049b078
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4a16ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x538354], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4a17c6
cmp dword [0x538350], 0
jne 0x4a17c6
cmp dword [0x5384b4], 0
je 0x4a1780
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004a14bc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4a1766
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004a14bc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4a1766
lea ebx, [ebp - 0x84]
jmp 0x4a1767
inc ebx
call fcn.004a16a8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4a1801
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x538358
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0049b078
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x53835b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4a1801
cmp dword [0x538350], 0
je 0x4a17e0
cmp dword [0x538350], 0xffffffff
je 0x4a1801
push esi
call dword [0x538350]
pop ecx
mov eax, dword [0x538354]
test eax, eax
je 0x4a1801
cmp dword [0x538354], 0xffffffff
je 0x4a1801
cmp byte [eax], 0
je 0x4a1801
push esi
push eax
call fcn.004a160c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1e04
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x53e60c], 0
jne 0x4a1e85
cmp dword [0x53e630], 0
jne 0x4a1e34
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x53e630], eax
test eax, eax
jne 0x4a1e34
push str.GetEnvironmentStrings_failed
call fcn.004a1818
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x53e630]
jmp 0x4a1e48
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0049b078
pop ecx
mov edi, eax
test eax, eax
jne 0x4a1e40
lea edi, [ebp + 1]
push edi
call fcn.0049a91c
pop ecx
mov ebx, eax
mov dword [0x53e610], ebx
test ebx, ebx
jne 0x4a1e72
xor eax, eax
jmp 0x4a1f48
push edi
mov edx, dword [0x53e630]
push edx
push ebx
call fcn.0049aed4
add esp, 0xc
jmp 0x4a1ea5
xor esi, esi
mov ebx, dword [0x53e60c]
jmp 0x4a1e9f
push eax
call fcn.0049b078
pop ecx
test eax, eax
jne 0x4a1e9b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4a1e8f
lea ebx, [esi + 4]
push 4
mov dword [0x53e614], ebx
inc ebx
push ebx
call fcn.0049a0d8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4a1ec8
xor eax, eax
jmp 0x4a1f48
cmp dword [0x53e60c], 0
jne 0x4a1ef9
xor esi, esi
mov ebx, dword [0x53e610]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4a1eea
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0049b078
pop ecx
mov edi, eax
test eax, eax
jne 0x4a1ee0
jmp 0x4a1f2a
xor esi, esi
mov ebx, dword [0x53e60c]
mov eax, dword [esp]
mov edi, eax
jmp 0x4a1f24
push eax
call fcn.0049b078
pop ecx
test eax, eax
je 0x4a1f19
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4a1f1d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4a1f08
mov eax, dword [0x53e60c]
test eax, eax
je 0x4a1f3a
push eax
call fcn.0049a92c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x53e60c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a24b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0x4a2536
mov eax, dword [0x53e664]
inc dword [0x53e664]
test eax, eax
jne 0x4a2536
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x53e630], eax
mov edx, dword [ebp + 0x10]
mov dword [0x4a8087], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0049ce9c
pop ecx
cmp dword [0x538390], 0
je 0x4a2521
call fcn.004a2334
mov ebx, eax
test eax, eax
je 0x4a2521
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x4a2521
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0x4a2536
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x538390], eax
call fcn.004a233c
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.004a2644
mov ebx, eax
test edi, edi
jne 0x4a25a5
test edi, edi
jne 0x4a2576
dec dword [0x53e664]
jne 0x4a2576
cmp dword [0x53e630], 0
je 0x4a2576
mov eax, dword [0x53e630]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x53e630], edx
cmp dword [0x53e664], 0
jne 0x4a25a5
cmp dword [0x538390], 0
jne 0x4a25a5
cmp dword [0x538380], 0
je 0x4a2597
call dword [0x538380]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.004a233c
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4046cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x4046cb
lcall 0x5de5, 0x8b10c483
jmp loc.007af180
Function at 0x408470
Capabilities:
Set registry value

Disassembly:
sub esp, 0x3c
mov edx, dword [ecx + 4]
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
push eax
push edx
mov dword [esp + 0x24], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [esp + 0xc]
push eax
push 0x2001f
xor esi, esi
push esi
push str.SoftwareExplore
push SysReAllocStringLen
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4084b8
mov esi, dword [esp + 0xc]
jmp 0x4084eb
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareExplore
push SysReAllocStringLen
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4084eb
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp eax, 3
je 0x40850f
push 0x10
lea eax, [esp + 0x3c]
push eax
push 3
push 0
push str.OldArea
push esi
call edi
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.OldAreaOf
push esi
mov dword [esp + 0x2c], ebx
call edi
test esi, esi
je 0x408549
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x4c]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 4
mov eax, dword [esp + 0x4c]
pop edi
pop esi
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x3c
ret 4
Function at 0x408680
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x14]
call fcn.00409980
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.0041ce04
add esp, 8
test eax, eax
jl 0x4087e6
cmp eax, dword [edi - 8]
jg 0x4087e6
xor ecx, ecx
cmp dword [esp + 0x1c], 0x8002
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
jne 0x4086df
mov edx, dword [esp + 0x20]
push edx
push 1
push edi
mov eax, esi
call fcn.00406920
jmp 0x4087bb
push str.about:blank
push edi
call fcn.0041d72f
add esp, 8
test eax, eax
jne 0x408719
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40870d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esi + 0x224]
lea ebx, [esi + 0x224]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [0x43d4c4]
mov ebp, eax
mov eax, dword [edx + 0xc]
mov ecx, 0x43d4c4
call eax
mov esi, eax
mov edx, dword [esi + 8]
add esi, 0x10
mov ecx, 1
sub ecx, dword [esi - 4]
sub edx, ebp
or ecx, edx
mov dword [esp + 0x1c], esi
jge 0x408767
mov ecx, ebp
lea eax, [esp + 0x1c]
call fcn.00401d00
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
inc ebp
push ebp
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebx]
push ebp
push 0xffffffffffffffff
push 0x158
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x408795
push ebx
mov edx, ebp
call fcn.0040fe30
mov edx, dword [ebx]
push edi
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4087bb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4087d7
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 0xc
push 0x80070057
call fcn.00401730
int3
Function at 0x4091b0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
push edi
jge 0x4091d0
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
mov esi, dword [ecx]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x419
push esi
call edi
lea edx, [esp + 0x10]
push edx
push eax
push 0x41d
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
je 0x40920b
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
mov eax, dword [ebp + 0xc]
cmp eax, 0x7d01
je 0x40924e
cmp eax, 0xe146
jne 0x40928d
mov eax, dword [ebx + 0x90]
push 5
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push 0
push edx
push ecx
push 0x40
lea esi, [ebx + 0x4c]
mov edi, eax
call fcn.0040adf0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x14
ret 4
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push 1
push 1
push 1
push 0xa
lea edx, [ebx + 0x10c]
mov edi, eax
push edx
call fcn.0040c100
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
push 0x40
lea esi, [ebx + 0x4c]
call fcn.0040adf0
test edi, edi
je 0x40928d
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret 4

Function at 0x4092a0
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [edx + 0x15c]
sub esp, 0x28
cmp ecx, 0xffffffff
je 0x4093d0
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 4]
push eax
push ecx
mov ecx, dword [edx + 0x130]
push 0x133c
push ecx
mov dword [esp + 0x14], 8
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x409302
add esp, 0x28
ret 4
movzx ecx, word [esp + 0x2c]
cmp ecx, 0xe122
jg 0x409393
je 0x409381
cmp ecx, 0x8072
jg 0x4093d0
je 0x409358
sub ecx, 0x7d1
je 0x409346
sub ecx, 1
jne 0x4093d0
push 0x11
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
push 0x20
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
push 5
push 0x43438c
push 0x434390
push str.control.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
add esp, 0x28
ret 4
push 0xc
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
sub ecx, 0xe123
je 0x4093c9
sub ecx, 2
je 0x4093b7
sub ecx, 6
jne 0x4093d0
push 0xf
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
push 0xd
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
push 0xb
call fcn.00403ee0
mov eax, 1
add esp, 0x28
ret 4
Function at 0x409500
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x43d4c4]
mov edx, dword [eax + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ecx, 0x43d4c4
call edx
mov esi, eax
mov eax, dword [ebp + 0x224]
add esi, 0x10
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edx, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov edi, eax
sub edx, edi
or ecx, edx
jge 0x40954f
mov ecx, edi
lea eax, [esp + 0x14]
call fcn.00401d00
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x224]
inc edi
push edi
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0041ce04
add esp, 8
test eax, eax
jl 0x4095c7
cmp eax, dword [esi - 8]
jg 0x4095c7
xor ecx, ecx
mov dword [esi - 0xc], eax
lea ebx, [esp + 0x14]
mov word [esi + eax*2], cx
call fcn.00401ad0
call fcn.00401a50
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
je 0x4095a2
push 0
push 0
push esi
mov eax, ebp
call fcn.00406920
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4095be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
push 0x80070057
call fcn.00401730
int3
Function at 0x40b850
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0
mov ebx, eax
mov eax, dword [ebx + 4]
push 0xb
push eax
call esi
mov ecx, dword [ebx + 0x50]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
cmp ecx, 0xffffffff
je 0x40b8c1
xor eax, eax
lea edx, [esp + 0x14]
push edx
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x24]
push 0x133c
push eax
mov dword [esp + 0x24], 8
call esi
mov ecx, dword [esp + 0x2c]
push 0
push ecx
call edi
mov edx, dword [ebx + 0x24]
push 0
push ebp
push 0x130c
push edx
mov dword [ebx + 0x50], ebp
call esi
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x24]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push ecx
push 0x133c
mov ebp, 8
push edx
mov dword [esp + 0x24], ebp
call esi
mov eax, dword [esp + 0x2c]
push 1
push eax
call edi
call fcn.00403740
mov ecx, dword [ebx + 4]
push 0
push 1
push 0xb
push ecx
call esi
mov edx, dword [ebx + 4]
push 0x581
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov edi, dword [ebx + 0x24]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
je 0x40b98d
mov ecx, dword [ebx + 0x50]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push ecx
push 0x133c
push edi
mov dword [esp + 0x24], ebp
call esi
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
lea edi, [ebx + 0xb8]
call fcn.004030f0
mov edi, ebx
call fcn.0040c7a0
mov edi, dword [ebx + 0x60]
test edi, edi
je 0x40b9e0
mov al, byte [ebx + 0x7c]
mov cl, al
shr cl, 3
and cl, 1
movzx edx, cl
mov cl, al
shr cl, 2
push edx
and cl, 1
movzx edx, cl
mov cl, al
push edx
shr cl, 5
and cl, 1
shr al, 4
movzx edx, cl
mov ecx, dword [ebx + 0x68]
and al, 1
push edx
movzx eax, al
push eax
push ecx
push ebx
call fcn.0040c100
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x40b9f0
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi + 0x70]
push eax
call fcn.0041cb06
add esp, 4
mov dword [esi + 0x70], 0
mov dword [esi + 0x6c], edi
test edi, edi
je 0x40ba59
mov ecx, edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041cf65
add esp, 4
mov dword [esi + 0x70], eax
test eax, eax
je 0x40ba59
push edi
push eax
mov eax, dword [esi + 0x6c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esi + 0xb8]
call fcn.004030f0
mov edi, esi
call fcn.0040c7a0
pop edi
ret