joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce70
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
lea esi, [ebx + 0xd0]
push edi
test esi, esi
jne 0x41ce84
xor eax, eax
jmp 0x41ce87
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41cea2
mov eax, dword [esi]
push 0
push 0
push 0
mov ecx, esi
call dword [eax + 0xec]
mov edi, dword [esp + 0x14]
cmp edi, 5
jne 0x41cf49
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x41cecb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
mov esi, eax
jmp 0x41cecd
xor esi, esi
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call sub.MFC42.DLL_CMDIFrameWnd::MDIGetActive
mov ebp, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41cf49
cmp ebp, ebx
je 0x41cf49
test ebp, ebp
je 0x41cf49
mov ecx, dword [esi + 0xc0]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call edi
push 2
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov edx, dword [ebx + 0x20]
mov ebx, dword [sym.imp.USER32.dll_DeferWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call ebx
mov ecx, dword [ebp + 0x20]
push 0x13
push 0
push 0
push 0
push 0
push 1
push ecx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
mov edx, dword [esi + 0xc0]
push 5
push edx
call edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
push edi
mov ecx, ebx
call sub.MFC42.DLL_CMDIChildWnd::ActivateFrame
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41f6c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x4a1470
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x41f6e0
pop edi
pop esi
pop ebx
ret
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_rewind]
lea ecx, [ebx + 2]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 0x18
mov edi, eax
test edi, edi
push esi
jne 0x41f71d
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 1
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x41f745
push edi
call sub.MFC42.DLL_operatordelete
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x41f759
mov dword [eax], ebx
mov byte [edi + ebx + 1], 0
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x421da0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x100c
call fcn.0047eb00
mov eax, dword [esp + 0x1014]
push ebp
test eax, eax
mov ebp, ecx
jle 0x421e80
push ebx
mov ebx, dword [esp + 0x1020]
push esi
mov esi, dword [esp + 0x101c]
push edi
mov dword [esp + 0x10], eax
push 0
lea eax, [esp + 0x20]
push 0x1000
push eax
push esi
mov ecx, ebp
call fcn.00421ab0
test eax, eax
je 0x421e54
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
call fcn.00428e50
test eax, eax
je 0x421e3a
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x421e2d
mov ecx, dword [eax]
cmp ecx, esi
jb 0x421e2d
lea edx, [esi + 0x1000]
cmp ecx, edx
jae 0x421e2d
sub ecx, esi
mov dl, byte [esp + ecx + 0x1c]
lea ecx, [esp + ecx + 0x1c]
cmp dl, 0xcc
jne 0x421e2d
mov al, byte [eax + 4]
mov byte [ecx], al
lea ecx, [esp + 0x14]
call fcn.00428e80
test eax, eax
jne 0x421e02
xor eax, eax
mov ecx, ebx
movzx dx, byte [esp + eax + 0x1c]
mov word [ecx], dx
inc eax
add ecx, 2
cmp eax, 0x1000
jl 0x421e3e
jmp 0x421e62
mov ecx, 0x800
mov eax, 0xff00ff00
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
add ebx, 0x2000
add esi, 0x1000
dec eax
mov dword [esp + 0x10], eax
jne 0x421dd1
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x100c
ret 0xc

Function at 0x422b70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x128
mov ecx, dword [esp + 0x12c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x140]
push edi
xor ebp, ebp
lea eax, [esi + 4]
mov dword [esi + 0xc], ebp
push eax
push ecx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x10], ebp
mov dword [esi], ebp
call fcn.00445fb0
mov edi, dword [esp + 0x148]
add esp, 8
mov dword [esi + 8], eax
push ebp
push ebp
push 0x3c
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0x1c]
push 4
push eax
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call ebx
cmp dword [esp + 0x10], 4
jne 0x422c3e
mov ecx, dword [esp + 0x14]
push ebp
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0x48]
push 0xf8
push eax
push edi
call ebx
test eax, eax
je 0x422c3e
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x10]
push ebp
push edx
lea eax, [esp + 0x20]
push 0x28
push eax
push edi
mov dword [esi], ecx
call ebx
mov ecx, dword [esp + 0x3c]
and ecx, 0x60000020
cmp ecx, 0x60000020
jne 0x422c3e
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 0xc
Function at 0x425650
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], edi
call fcn.00428e50
mov esi, eax
test esi, esi
je 0x4256e0
mov eax, dword [esi]
test eax, eax
je 0x4256d1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4256a2
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x4256a2
lea ecx, [esi + 4]
push 1
push ecx
push eax
mov ecx, edi
call fcn.00421cb0
test eax, eax
je 0x4256dc
push esi
mov ecx, edi
call fcn.00429680
jmp 0x4256dc
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x4256d1
push 0
lea edx, [esp + 0xf]
push 1
push edx
push eax
mov ecx, edi
call fcn.00421ab0
cmp byte [esp + 0xb], 0xcc
jne 0x4256d1
mov ecx, dword [esi]
lea eax, [esi + 4]
push 1
push eax
push ecx
mov ecx, edi
call fcn.00421cb0
lea ecx, [esp + 0xc]
call fcn.00428e80
mov esi, eax
test esi, esi
jne 0x425672
mov ecx, edi
call fcn.004296b0
pop edi
pop esi
add esp, 0xc
ret

Function at 0x425e30
Capabilities:
Create thread
Resume thread
Suspend thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x520]
test eax, eax
je 0x425e4f
mov dword [edi + 0x520], 0
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [edi + 0x500], eax
je 0x425e6e
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, dword [edi + 0x1e0]
test esi, esi
je 0x425eb2
mov ebx, esi
mov esi, dword [esi]
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebx + 8]
push ecx
mov ecx, edi
call fcn.00425780
test esi, esi
jne 0x425e95
mov esi, dword [edi + 0x1e0]
test esi, esi
je 0x425ede
mov ebx, esi
mov esi, dword [esi]
mov edx, dword [ebx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx + 8]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test esi, esi
jne 0x425ebc
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x528], 5
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [edi + 0x500]
xor ebx, ebx
cmp eax, ebx
pop ebp
je 0x425f6a
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi + 0x500]
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
mov dword [edi + 0x500], ebx
jne 0x425f6a
push 0xffffffffffffffff
push 0x40
push 0xf034
call sub.MFC42.DLL_AfxMessageBox_1
push str.DebugBreak
push str.kernel32
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [edi + 0x544]
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push eax
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4265c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0x7a1200
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi + 0x560], eax
test eax, eax
jne 0x4265ef
push 0xffffffffffffffff
push eax
push 0xf009
call sub.MFC42.DLL_AfxMessageBox_1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x1b0]
mov dword [esi + 0x558], eax
mov eax, 1
mov dword [esi + 0x554], ecx
mov dword [esi + 0x55c], 0
mov dword [esi + 0x528], 0
mov dword [edx + 0xe9c], eax
mov dword [esi + 0x520], eax
mov eax, dword [esi + 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret 8
Function at 0x427690
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
call fcn.00428e50
mov esi, eax
cmp esi, ebx
je 0x42775f
mov eax, dword [esi]
mov ecx, dword [edi + 0x180]
cmp eax, ecx
je 0x42774c
cmp dword [esi + 0xc], ebx
jne 0x4276d6
cmp eax, 0x80000000
jae 0x4276d6
cmp dword [esi + 0x1c], ebx
je 0x4276de
push esi
mov ecx, edi
call fcn.00429680
cmp dword [esi], ebx
je 0x42774c
cmp dword [esi + 0x10], ebx
jne 0x42774c
push esi
mov ecx, edi
call fcn.004277b0
cmp eax, ebx
mov byte [esp + 0xf], bl
jne 0x427796
mov ecx, dword [esi]
push ebx
lea eax, [esp + 0x13]
push 1
push eax
push ecx
mov ecx, edi
call fcn.00421ab0
test eax, eax
je 0x427796
mov eax, dword [esi + 8]
mov dword [esi + 0x14], ebx
cmp eax, ebx
je 0x42774c
mov al, byte [esp + 0xf]
mov cl, byte [esi + 4]
cmp al, cl
jne 0x42776d
mov eax, dword [esi]
lea edx, [esp + 0xf]
push 1
push edx
push eax
mov ecx, edi
mov byte [esp + 0x1b], 0xcc
call fcn.00421cb0
test eax, eax
jne 0x42774c
push esi
mov ecx, edi
call fcn.00429680
lea ecx, [esp + 0x10]
call fcn.00428e80
mov esi, eax
cmp esi, ebx
jne 0x4276b5
mov ecx, edi
call fcn.004296b0
pop edi
pop esi
pop ebx
add esp, 0xc
ret
cmp al, 0xcc
jne 0x427744
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.00426b30
cmp eax, ebx
je 0x427744
lea edx, [esi + 0x24]
add eax, 8
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x42774c
jmp 0x427744
cmp byte [esi + 0x24], bl
je 0x427744
cmp dword [esi + 0x20], ebx
je 0x427744
mov dword [esi + 0x14], 1
jmp 0x42774c
Function at 0x4290d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4815b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x40
push 0x1000
push ebx
mov dword [esp + 0x34], ebx
call fcn.00428860
mov edi, eax
cmp edi, ebx
jne 0x429116
mov ecx, dword [esp + 0x34]
push 0x4a6e48
call fcn.0047dd2a
jmp 0x429186
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.0044a8b0
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x28], 1
lea edx, [ecx + ecx]
lea ecx, [esp + 0x10]
push edx
call fcn.0044a980
push eax
push edi
mov ecx, esi
call fcn.00421cb0
test eax, eax
je 0x42916b
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push ecx
push ebx
push ebx
mov ecx, esi
call fcn.00425d40
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x4291ad
mov ecx, dword [esp + 0x34]
push 0x4a6e3c
call fcn.0047dd2a
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.0044a920
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call fcn.0044a920
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x42a590
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x2d4]
test eax, eax
jle 0x42a5ca
mov edx, dword [esp + 0x14]
add ecx, 0x2d8
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, 1
ret
mov edx, dword [esp + 0x10]
mov ecx, dword [0x4ba864]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
push ebp
push edx
push esi
push edi
call fcn.00421ab0
test eax, eax
mov dword [esp + 0x24], eax
je 0x42a62a
mov ecx, dword [ebp]
xor ebx, ebx
test ecx, ecx
jle 0x42a62a
sub edi, esi
cmp byte [esi], 0xcc
jne 0x42a61d
mov ecx, dword [0x4ba864]
lea eax, [edi + esi]
push eax
call fcn.00426020
test eax, eax
je 0x42a61d
mov cl, byte [eax + 4]
mov byte [esi], cl
mov eax, dword [ebp]
inc ebx
inc esi
cmp ebx, eax
jl 0x42a600
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42ea10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x481ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00465920
xor ebx, ebx
push 0x10000
mov dword [esp + 0x20], ebx
mov dword [esi], 0x48c980
mov dword [esi + 0x68], 0x10000
call sub.MFC42.DLL_operatornew
mov edi, 0x1000
mov dword [esi + 0x64], eax
push edi
mov dword [esi + 0x70], edi
call sub.MFC42.DLL_operatornew
push edi
mov dword [esi + 0x6c], eax
mov dword [esi + 0x78], edi
call sub.MFC42.DLL_operatornew
push 0x13880
mov dword [esi + 0x74], eax
call sub.MFC42.DLL_operatornew
add esp, 0x10
mov dword [esi + 0x7c], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
lea edi, [esi + 0x80]
mov dword [esi + 0x60], eax
push 0x208
add eax, 0x85c
push edi
push 0x4a7144
mov dword [esi + 0x5c], eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x58], 0xffffffff
mov word [edi], bx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push edi
call ebp
add esp, 4
cmp eax, ebx
mov dword [esi + 0x490], eax
jle 0x42eaf1
cmp word [esi + eax*2 + 0x7e], 0x31
je 0x42eadf
mov dword [esi + 0x490], ebx
jmp 0x42eaf1
mov word [esi + eax*2 + 0x7e], bx
mov eax, dword [esi + 0x490]
dec eax
mov dword [esi + 0x490], eax
lea edi, [esi + 0x494]
mov ecx, esi
push edi
mov word [edi], bx
call fcn.0042f8c0
push edi
call ebp
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x594], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x42ee60
Capabilities:
Get system information on windows

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov esi, ecx
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x64]
push 0
push eax
push ecx
push 0x10
call edi
cmp eax, 0xc0000004
jne 0x42eea2
mov edx, dword [esi + 0x64]
push edx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esi + 0x68]
shl eax, 1
push eax
mov dword [esi + 0x68], eax
call sub.MFC42.DLL_operatornew
add esp, 8
mov dword [esi + 0x64], eax
test eax, eax
je 0x42eea6
jmp 0x42ee6a
test eax, eax
je 0x42eeac
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x64]
pop edi
pop esi
mov eax, dword [eax]
ret
Function at 0x42f8c0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
sub esp, 0x120
push ebx
push ebp
push esi
push str.ConvertSidToStringSidW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
xor esi, esi
cmp ebp, esi
je 0x42f9b3
lea eax, [esp + 0x18]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x14]
push esi
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call ebx
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x42f9b3
inc eax
push edi
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x18]
mov esi, eax
lea edx, [ecx + ecx + 2]
push edx
call sub.MFC42.DLL_operatornew
add esp, 8
mov edi, eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x18]
push edi
push edx
lea eax, [esp + 0x40]
push esi
push eax
push 0
call ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push esi
call ebp
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42f9a3
mov edx, dword [esp + 0x134]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov eax, dword [esp + 0x20]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call sub.MFC42.DLL_operatordelete
push esi
call sub.MFC42.DLL_operatordelete
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 4
Function at 0x434c80
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4821cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_5
mov ebx, dword [esp + 0x22c]
push 0
push 0
push 0
push ebx
mov dword [esp + 0x234], 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x434e08
lea eax, [esp + 0x14]
push 0x104
push eax
push esi
mov byte [esp + 0x124], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x14]
test al, al
jne 0x434d53
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [eax + 0x85c]
call fcn.004273b0
test eax, eax
je 0x434d53
lea ecx, [esp + 0x14]
push ecx
push 0x104
push 0xd
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x118]
push 0x104
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
mov al, byte [esp + 0x14]
test al, al
je 0x434d91
lea eax, [esp + 0x14]
lea ecx, [esp + 0x118]
push eax
push ecx
push esi
lea edx, [esp + 0x1c]
push str.HWND0x_p__s____s_
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
jmp 0x434dac
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
push esi
push str.HWND0x_p__s_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x10]
push 0xffff0002
push edx
push 0
push 0
push 0
push 0
push 0
push eax
push 1
mov ecx, ebp
call sub.MFC42.DLL_CTreeCtrl::InsertItem
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
mov edi, eax
push 0
push 4
push edi
mov ecx, ebp
call sub.MFC42.DLL_CTreeCtrl::SetItem
push edi
push esi
mov ecx, ebp
call fcn.00434c80
push 0
push 0
push esi
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
jne 0x434d03
lea ecx, [esp + 0x10]
mov dword [esp + 0x224], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret 8
Function at 0x435190
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x80c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x5c]
mov dword [esi + 0x74], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x60], ebx
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x58]
call sub.MFC42.DLL_CString::Empty
lea eax, [esi + 0x64]
xor ecx, ecx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x7c], ebx
mov ebp, dword [esp + 0x820]
mov dword [eax], ecx
push ebp
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [esi + 0x4c], ebp
call dword [sym.imp.USER32.dll_GetParent]
cmp ebp, ebx
mov dword [esi + 0x50], eax
je 0x43536d
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x41d]
mov byte [esp + 0x41c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x1c]
push 0x400
push edx
push ebp
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [esp + 0x1c], bl
jne 0x435256
mov ecx, dword [esi + 0xa8]
call fcn.004273b0
test eax, eax
je 0x435256
lea eax, [esp + 0x1c]
push eax
push 0x400
push 0xd
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x41c]
push 0x400
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
lea edx, [esp + 0x1c]
lea ecx, [esi + 0x58]
push edx
call fcn.0047dd2a
lea eax, [esp + 0x41c]
lea ecx, [esi + 0x5c]
push eax
call fcn.0047dd2a
push ebx
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esi + 0x60], eax
lea eax, [esi + 0x64]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffff0
push ebp
call edi
push 0xffffffffffffffec
push ebp
mov dword [esi + 0x74], eax
call edi
push 0xfffffffffffffff4
push ebp
mov dword [esi + 0x78], eax
call edi
mov ecx, dword [esi + 0xa8]
mov dword [esi + 0x54], eax
mov dword [esp + 0x14], ebx
mov dword [esi + 0x7c], ebx
call fcn.004273b0
test eax, eax
je 0x435347
lea ecx, [esp + 0x14]
push ebx
push ecx
push ebp
mov ecx, esi
call fcn.00435380
mov edi, eax
test edi, 0x80000000
jne 0x435301
mov ecx, dword [esi + 0xa8]
push ebx
lea edx, [esp + 0x17]
push 1
push edx
push edi
call fcn.00421ab0
test eax, eax
jne 0x435312
lea eax, [esp + 0x14]
push 1
push eax
push ebp
mov ecx, esi
call fcn.00435380
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, 0x80000000
jne 0x435335
push ebx
lea ecx, [esp + 0x17]
push 1
push ecx
mov ecx, dword [esi + 0xa8]
push eax
call fcn.00421ab0
test eax, eax
jne 0x435344
lea edx, [esp + 0x14]
push 1
push edx
push ebp
mov ecx, esi
call fcn.00435380
mov dword [esi + 0x7c], edi
mov eax, dword [esp + 0x14]
mov dword [esi + 0x80], eax
push eax
mov eax, dword [esi + 0x7c]
push eax
push ecx
lea eax, [esi + 0x5c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call sub.MFC42.DLL_CString::CString_4
mov ecx, esi
call fcn.00436520
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80c
ret 4