joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b0af
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xba
push eax
mov dword [ebp - 0x48], eax
call ebx
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x1c]
xor ecx, ecx
test eax, eax
sete cl
test ecx, ecx
je 0x40b10f
push 0
push 0
push 0x110f
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x40
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x44]
mov dword [esi + 0x1c], eax
jmp 0x40b1f8
push edi
mov edi, dword [esi + 0x30]
mov ecx, dword [edi + 8]
push 0x40
push eax
lea eax, [edi + 0x10]
push eax
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [edi + 0x4f], 0
push dword [esi + 0x1c]
push dword [esi + 0x10]
push dword [ebp - 0x50]
call fcn.0040b8b3
add esp, 0xc
cmp dword [ebp - 0x4c], 0
je 0x40b1f7
cmp dword [ebp - 0x4c], 0xffffffff
je 0x40b1f7
cmp dword [edi + 0xc], 0
jne 0x40b162
push dword [esi + 0x1c]
push dword [ebp - 0x4c]
call fcn.00408c13
pop ecx
pop ecx
push 0xaf
push dword [ebp - 0x48]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
push eax
mov dword [ebp - 0x54], eax
call ebx
and dword [ebp - 0x48], 0
test eax, eax
mov dword [ebp - 0x58], eax
jle 0x40b1cd
push 0
push dword [ebp - 0x48]
push 0x150
push dword [ebp - 0x54]
call ebx
mov eax, dword [eax]
mov edi, dword [eax]
jmp 0x40b1be
mov eax, dword [ebp - 0x4c]
cmp dword [edi + 8], eax
jne 0x40b1bc
push 0x40
push dword [esi + 0x1c]
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [edi + 0x4f], 0
mov edi, dword [edi]
test edi, edi
jne 0x40b1a1
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x58]
jl 0x40b18c
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x110a
push dword [ebp - 0x50]
call ebx
push eax
push dword [ebp - 0x50]
call fcn.0040aa3a
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00456f61
leave
ret

Function at 0x40b408
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
mov eax, dword [ebp + 8]
dec eax
je 0x40b44d
dec eax
je 0x40b47a
sub eax, 7
jne 0x40b484
cmp dword [ebp + 0xc], 0
jne 0x40b484
push 0x92
push 0
push esi
call fcn.00419be1
add esp, 0xc
jmp 0x40b484
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x65
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x104]
push eax
push dword [edi + 8]
call fcn.00408d24
pop ecx
pop ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00456f61
leave
ret
Function at 0x40c710
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 8
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
mov eax, dword [ebp + 8]
dec eax
je 0x40c752
dec eax
je 0x40c776
sub eax, 7
jne 0x40c780
cmp dword [ebp + 0xc], 0
jne 0x40c780
push 0x91
push 0
push esi
call fcn.00419be1
add esp, 0xc
jmp 0x40c780
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0x65
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x54]
push eax
push dword [edi + 8]
call fcn.00408864
pop ecx
pop ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00456f61
leave
ret

Function at 0x40cc9c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1f94]
mov eax, 0x2014
call fcn.004571d0
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x1f90], eax
mov eax, dword [ebp + 0x1f9c]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
mov esi, 0x2000
push esi
lea eax, [ebp - 0x70]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x40cd36
cmp dword [ebp - 0x74], esi
jne 0x40cd3c
push esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.NfoMgr4.dll_Nfo_WriteObject]
test eax, eax
jne 0x40cd50
add ebx, dword [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push dword [ebp + 0x1fa0]
call fcn.00446561
test eax, eax
je 0x40cd50
push 0
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call edi
test eax, eax
jne 0x40ccf1
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.NfoMgr4.dll_Nfo_WriteObject]
test eax, eax
je 0x40cd54
xor eax, eax
jmp 0x40cd57
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1f90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x1f94
leave
ret
Function at 0x40cd6f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1f94]
mov eax, 0x2014
call fcn.004571d0
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x1f90], eax
mov eax, dword [ebp + 0x1f9c]
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
mov edi, ecx
push eax
push edi
mov dword [ebp - 0x80], edi
xor ebx, ebx
call dword [sym.imp.NfoMgr4.dll_Nfo_GetObjectSize]
test eax, eax
je 0x40cdb3
mov dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x74]
push eax
mov esi, 0x2000
push esi
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.NfoMgr4.dll_Nfo_ReadObject]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40ce1c
cmp dword [ebp - 0x74], esi
jne 0x40ce20
push 0
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x40ce36
add ebx, dword [ebp - 0x74]
push 0
push dword [ebp - 0x7c]
push 0x64
push ebx
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
push dword [ebp + 0x1fa0]
call fcn.00446561
test eax, eax
je 0x40ce36
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.NfoMgr4.dll_Nfo_ReadObject]
test eax, eax
je 0x40cdd0
push 0
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call edi
test eax, eax
jne 0x40ce3a
xor eax, eax
jmp 0x40ce3d
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1f90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x1f94
leave
ret
Function at 0x40f15a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x20
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [ebp + 0xc], 0
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
je 0x40f192
call dword [sym.imp.MSVCR80.dll_strtol]
jmp 0x40f198
call dword [sym.imp.MSVCR80.dll_strtoul]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0xc
call fcn.00456f61
leave
ret

Function at 0x40f1f3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x20
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [ebp + 0xc], 0
push 0xa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
je 0x40f22b
call dword [sym.imp.MSVCR80.dll_strtol]
jmp 0x40f231
call dword [sym.imp.MSVCR80.dll_strtoul]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0xc
call fcn.00456f61
leave
ret
Function at 0x415de2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x4c]
sub esp, 0x128
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x54]
mov edx, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x6c]
push ebx
mov ebx, dword [ebp + 0x5c]
push esi
mov esi, dword [ebp + 0x64]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x58]
push edi
mov edi, dword [ebp + 0x78]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x84], ebx
mov ebx, dword [ebp + 0x60]
push 0x58
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x5c], edx
mov edx, dword [ebp + 0x7c]
mov dword [ebp - 0x80], ebx
mov ebx, dword [ebp + 0x70]
lea eax, [ebp - 0xdc]
push 0
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], esi
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x9c
call ebx
test eax, eax
jne 0x415e77
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x94
call ebx
test eax, eax
je 0x415e87
cmp dword [ebp - 0x50], 5
mov dword [ebp - 0xdc], 0x58
jae 0x415e91
mov dword [ebp - 0xdc], 0x4c
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xd8], eax
mov eax, dword [0x47d724]
mov dword [ebp - 0xd4], eax
mov eax, dword [edi]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x58]
push 0x289f
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xbc], 0x104
mov dword [ebp - 0xb0], eax
call fcn.0046708d
mov dword [ebp - 0xac], eax
mov eax, dword [0x47b4c8]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x880000
or ecx, 0x866
neg eax
sbb eax, eax
add eax, 0xb6
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xa8], ecx
lea eax, [ebp - 0xdc]
lea ecx, [ebp - 0x84]
push eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], 0x415d79
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
mov ecx, dword [ebp - 0xc4]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x48]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x4c
leave
ret

Function at 0x4160b0
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
xor esi, esi
push esi
push esi
push dword [esp + 0x14]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x4160cd
inc esi
mov eax, esi
pop esi
ret

Function at 0x416448
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x104]
push eax
push dword [esi + 0x440]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0xc]
lea edi, [esi + 0x3c]
call fcn.0046708d
push eax
push edi
call dword [sym.imp.MSVCR80.dll_vsprintf]
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
push edi
push dword [esi + 0x440]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00456f61
leave
ret
Function at 0x419733
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x350]
sub esp, 0x3d0
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x34c], eax
push ebx
push esi
push 0x60
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [0x47a690]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x80], esi
je 0x4197b6
lea ecx, [ebp - 0x80]
push ecx
push 0xffffffffffffffff
push eax
call sub.USER32.dll_DdeQueryConvInfo
test eax, eax
jne 0x419790
push dword [0x47a690]
call sub.USER32.dll_DdeDisconnect
mov dword [0x47a690], ebx
cmp dword [0x47a690], ebx
je 0x4197b6
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4197b6
push dword [0x47a690]
call sub.USER32.dll_DdeDisconnect
mov dword [0x47a690], ebx
mov eax, dword [0x47a688]
cmp eax, ebx
je 0x419934
cmp dword [0x47a690], ebx
jne 0x419934
mov esi, 0x3ec
push esi
push str.Folio_HELP
push eax
call sub.USER32.dll_DdeCreateStringHandleA
push esi
push str.System
push dword [0x47a688]
mov dword [ebp + 0x3c], eax
call sub.USER32.dll_DdeCreateStringHandleA
push ebx
push eax
push dword [ebp + 0x3c]
mov dword [ebp + 0x38], eax
push dword [0x47a688]
call sub.USER32.dll_DdeConnect
cmp eax, ebx
mov dword [0x47a690], eax
jne 0x419918
cmp byte [0x47a698], bl
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x248]
jne 0x419836
push str.SoftwareFolio4FolioHelp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x419846
push 0x47a698
push str._sFolioHelp
push eax
call esi
add esp, 0xc
mov eax, dword [0x47a718]
cmp eax, ebx
je 0x41986a
push eax
lea eax, [ebp + 0x248]
push eax
lea eax, [ebp + 0x144]
push str.__FolioHelp__C_s__L_lu
push eax
call esi
add esp, 0x10
jmp 0x419882
lea eax, [ebp + 0x248]
push eax
lea eax, [ebp + 0x144]
push str.__FolioHelp__C_s
push eax
call esi
add esp, 0xc
push edi
lea edi, [ebp + 0x34]
lea esi, [ebp + 0x40]
mov dword [ebp + 0x34], 0x104
call fcn.00419584
push 0x44
pop esi
push esi
lea eax, [ebp - 0x20]
push ebx
push eax
call sub.MSVCR80.dll_memset
push 0x10
lea eax, [ebp + 0x24]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0x18
xor eax, eax
inc eax
mov dword [ebp + 0xc], eax
mov word [ebp + 0x10], ax
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x144]
push eax
lea eax, [ebp + 0x40]
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x419918
push 0x7530
push dword [ebp + 0x24]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x28]
call esi
push ebx
push dword [ebp + 0x38]
push dword [ebp + 0x3c]
push dword [0x47a688]
call sub.USER32.dll_DdeConnect
mov dword [0x47a690], eax
push dword [ebp + 0x3c]
push dword [0x47a688]
call sub.USER32.dll_DdeFreeStringHandle
push dword [ebp + 0x38]
push dword [0x47a688]
call sub.USER32.dll_DdeFreeStringHandle
mov ecx, dword [ebp + 0x34c]
mov eax, dword [0x47a690]
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x350
leave
ret
Function at 0x419da7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0x28]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x419df5
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
je 0x419e25
cmp dword [ebp - 0x18], 2
jne 0x419e13
cmp dword [ebp - 0x24], 4
jae 0x419e07
cmp dword [ebp - 0x24], 5
jb 0x419e25
mov dword [0x47a720], 0x20a
jmp 0x419e35
cmp dword [ebp - 0x18], 1
jne 0x419e01
cmp dword [ebp - 0x24], 4
jne 0x419e01
cmp dword [ebp - 0x20], 0xa
je 0x419e07
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x47a720], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.00456f61
add ebp, 0x78
leave
ret

Function at 0x41db9d
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x25c
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x1d8], eax
mov eax, dword [ebp + 0x1e8]
push ebx
mov ebx, dword [ebp + 0x1e4]
push esi
mov dword [ebp - 0x74], eax
push 0x103
lea eax, [ebp + 0x94]
push eax
push dword [0x47d72c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x94]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x41dcad
push edi
push esi
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x80], edi
je 0x41dcac
push edi
push esi
push dword [ebp - 0x78]
lea eax, [ebp + 0x94]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
push 0x4b0
push 0x409
lea eax, [ebp - 0x6c]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41dca3
cmp dword [ebp - 0x7c], 0
je 0x41dca3
cmp dword [ebp - 0x70], 0
je 0x41dca3
push dword [ebp - 0x70]
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.MSVCR80.dll_strtok]
lea eax, [ebp + 0x198]
push 0x46a2b8
push eax
call esi
mov edi, dword [sym.imp.MSVCR80.dll_atoi]
push eax
call edi
push 0x46b310
push 0
mov dword [ebx], eax
call esi
push eax
call edi
mov ecx, dword [ebp - 0x74]
add esp, 0x18
mov dword [ecx], eax
push dword [ebp - 0x80]
call sub.MSVCR80.dll_free
pop ecx
pop edi
mov ecx, dword [ebp + 0x1d8]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00456f61
add ebp, 0x1dc
leave
ret
Function at 0x41f81b
Capabilities:
Get geographical location
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push 0x64
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp byte [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], ecx
je 0x41f87c
mov dl, byte [eax]
cmp dl, byte [ebp - 0x24]
je 0x41f876
mov byte [ecx], dl
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
inc eax
cmp byte [eax], 0
jne 0x41f866
push 0xa
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ecx], 0
call dword [sym.imp.MSVCR80.dll_strtoul]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0xc
call fcn.00456f61
leave
ret

Function at 0x4244d2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x180]
sub esp, 0x200
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x17c], eax
mov eax, dword [ebp + 0x188]
push ebx
push 8
push eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x104
lea eax, [ebp + 0x78]
push eax
xor ebx, ebx
push 0x30d4
mov byte [edi], bl
push dword [0x47d724]
mov byte [ebp + 0x78], bl
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x4245b8
cmp byte [ebp + 0x78], bl
lea eax, [ebp + 0x78]
je 0x42453d
cmp byte [eax], 0x7c
jne 0x424538
mov byte [eax], bl
inc eax
cmp byte [eax], bl
jne 0x424531
push esi
push 0x58
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x9c
call esi
cmp eax, ebx
jne 0x424575
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x94
call esi
cmp eax, ebx
je 0x424582
cmp dword [ebp - 0x20], 5
mov dword [ebp - 0x80], 0x58
jae 0x424589
mov dword [ebp - 0x80], 0x4c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x78]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 0x200
mov dword [ebp - 0x4c], 0x1004
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
pop esi
mov ecx, dword [ebp + 0x17c]
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x180
leave
ret 4
Function at 0x4245d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 8
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
lea eax, [ebp - 0x104]
push eax
push 0x80
push 0xd
push 0xaf
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4246e0
mov eax, dword [esi + 0x10]
xor edi, edi
cmp dword [eax], edi
jne 0x424631
cmp dword [eax + 4], edi
jne 0x424631
cmp dword [eax + 8], edi
jne 0x424631
cmp dword [eax + 0xc], edi
je 0x424679
lea ecx, [ebp - 0x84]
push ecx
push eax
push dword [esi]
call dword [sym.imp.NfoMgr4.dll_Nfo_GetDestinationNameA]
test eax, eax
jne 0x424679
cmp dword [esi + 0x24], edi
je 0x42465e
push 0x40
push 0x30fb
call fcn.0046708d
push eax
push 0x31ec
jmp 0x4246a7
lea eax, [ebp - 0x84]
push eax
push 0x40
push 0x30fb
call fcn.0046708d
push eax
push 0x30fa
jmp 0x4246d1
push dword [esi + 0x10]
lea eax, [ebp - 0x104]
push edi
push eax
push dword [esi]
call dword [sym.imp.NfoMgr4.dll_Nfo_AddDestinationA]
test eax, eax
je 0x4246e4
cmp dword [esi + 0x24], edi
je 0x4246b8
push 0x30
push 0x30fb
call fcn.0046708d
push eax
push 0x31ee
call fcn.0046708d
push eax
push ebx
call fcn.00455173
add esp, 0x10
jmp 0x4246e0
call dword [sym.imp.NfoMgr4.dll_Nfo_GetErrorA]
push eax
push 0x30
push 0x30fb
call fcn.0046708d
push eax
push 0x30fc
call fcn.0046708d
push eax
push ebx
call fcn.00455173
add esp, 0x14
xor eax, eax
jmp 0x4246e7
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00456f61
leave
ret

Function at 0x4246f5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 8
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x424725
push dword [esi + 0x14]
push eax
call dword [sym.imp.NfoMgr4.dll_Nfo_GetID]
lea eax, [ebp - 0x84]
push eax
push 0x80
push 0xd
push 0xaf
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4247aa
mov eax, dword [esi + 4]
test eax, eax
jne 0x424753
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.NfoMgr4.dll_Nfo_GetDestinationIDA]
test eax, eax
jne 0x424782
mov eax, dword [esi + 4]
test eax, eax
jne 0x424771
mov eax, dword [esi]
push dword [esi + 0x1c]
push dword [esi + 0x10]
push eax
call dword [sym.imp.NfoMgr4.dll_Nfo_GetDestinationNameA]
test eax, eax
je 0x4247ae
call dword [sym.imp.NfoMgr4.dll_Nfo_GetErrorA]
push eax
push 0x30
push 0x30fe
call fcn.0046708d
push eax
push 0x30fd
call fcn.0046708d
push eax
push edi
call fcn.00455173
add esp, 0x14
xor eax, eax
jmp 0x4247b1
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00456f61
leave
ret
Function at 0x4247be
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x47a4b0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
mov esi, ecx
push 8
push esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xaf
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x78]
push ecx
mov edi, 0x80
push edi
push 0xd
push eax
mov dword [ebp - 0x80], eax
call esi
test eax, eax
je 0x424887
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x30ff
call fcn.0046708d
push eax
push dword [ebx + 0x24]
push dword [ebp - 0x7c]
call fcn.00447ea1
add esp, 0x18
test eax, eax
je 0x424887
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebx]
call dword [sym.imp.NfoMgr4.dll_Nfo_RenameDestinationA]
test eax, eax
je 0x42488b
cmp dword [ebx + 0x14], 0
je 0x42485b
push 0x30fe
jmp 0x424860
push 0x30fb
call fcn.0046708d
mov esi, eax
call dword [sym.imp.NfoMgr4.dll_Nfo_GetErrorA]
push eax
push 0x30
push esi
push 0x3100
call fcn.0046708d
push eax
push dword [ebp - 0x7c]
call fcn.00455173
add esp, 0x14
xor eax, eax
jmp 0x4248b9
push dword [ebx + 8]
push dword [ebp - 0x80]
call dword [sym.imp.FcCtrl4.dll_VComboBox_SetIterator]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.FcCtrl4.dll_VComboBox_SelectString]
push dword [ebp - 0x80]
push 0x100af
push 0x111
push dword [ebp - 0x7c]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456f61
add ebp, 0x8c
leave
ret