joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x408831
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040357c
jmp 0x40883a
mov eax, ebx
mov edx, esi
call fcn.004034e8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408844
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x408865
mov al, byte [esp]
jmp 0x408867
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e3e0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x40e3f5
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x40eb10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0040e774
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004038b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40eb6e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x416464]
mov dl, 1
mov eax, dword [0x40e66c]
call fcn.00409054
call fcn.00402ee0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40eb78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004038b4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40ebd0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x416548]
mov dl, 1
mov eax, dword [0x40e66c]
call fcn.00409054
call fcn.00402ee0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0040e7a4
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f144
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40f1d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403494
mov eax, dword [ebp - 4]
call fcn.004036f0
test al, al
jbe 0x40f1c1
mov byte [ebp - 9], al
mov bl, 1
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.0040363c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004036f8
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 9]
jne 0x40f183
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f1de
lea eax, [ebp - 0x10]
call fcn.00403494
ret

Function at 0x40f1e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40f298
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00403494
xor eax, eax
push ebp
push 0x40f278
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004036f0
test al, al
jbe 0x40f26e
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov dl, byte [edi + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.0040363c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004036f8
mov eax, dword [ebp + 8]
xor eax, eax
mov al, bl
movzx eax, byte [edi + eax - 1]
add esi, eax
imul esi, dword [ebp - 4]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x40f231
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40f282
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f29f
lea eax, [ebp - 0xc]
call fcn.00403494
ret
Function at 0x41033c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov ebx, eax
mov eax, 0x10000
call fcn.004025a8
mov dword [ebx + 0x2bc], eax
mov edi, ebp
test edi, edi
jle 0x410378
mov esi, 1
mov eax, ebp
dec eax
call fcn.004028a8
inc eax
mov edx, dword [ebx + 0x2bc]
mov word [edx + esi*2 - 2], ax
inc esi
dec edi
jne 0x410360
mov esi, ebp
cmp esi, 1
jl 0x4103ec
mov eax, dword [ebx + 0x2bc]
movzx eax, word [eax + esi*2 - 2]
mov ecx, dword [ebx + 0x2b4]
mov al, byte [ecx + eax - 1]
mov edx, dword [ebx + 0x2b4]
cmp al, byte [edx + esi - 1]
je 0x4103e7
mov ecx, dword [ebx + 0x2bc]
movzx ecx, word [ecx + esi*2 - 2]
mov edi, dword [ebx + 0x2b4]
xor byte [edx + esi - 1], al
mov edx, dword [ebx + 0x2bc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2b4]
mov cl, byte [eax + esi - 1]
xor byte [eax + edx - 1], cl
mov edx, dword [ebx + 0x2bc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2b4]
mov dl, byte [eax + edx - 1]
xor byte [eax + esi - 1], dl
dec esi
test esi, esi
jne 0x41037f
mov edx, 0x10000
mov eax, dword [ebx + 0x2bc]
call fcn.004025c0
mov edi, ebp
test edi, edi
jle 0x410474
mov esi, 1
mov eax, dword [ebx + 0x2b4]
mov dl, byte [eax + esi - 1]
mov byte [eax + esi - 1], dl
mov eax, dword [ebx + 0x2b4]
mov al, byte [eax + esi - 1]
mov byte [esp], al
mov al, byte [ebx + 0x17]
xor al, byte [ebx + 0x16]
xor al, byte [ebx + 0x15]
xor al, byte [ebx + 0x14]
mov byte [esp + 1], al
mov eax, 0xff
call fcn.004028a8
mov edx, dword [ebx + 0x2b4]
mov dl, byte [edx + esi - 1]
xor dl, byte [esp + 1]
xor al, dl
mov edx, dword [ebx + 0x2b4]
mov byte [edx + esi - 1], al
xor eax, eax
mov al, byte [esp]
add eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x10]
imul dword [ebx + 0x2cc]
add eax, dword [ebx + 0x2d0]
mov dword [ebx + 0x14], eax
inc esi
dec edi
jne 0x410407
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x410648
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4106de
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x18], 0
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 4], esi
inc esi
jne 0x4106c1
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x194]
call fcn.00406c78
mov edx, dword [ebp - 0x194]
lea eax, [ebx + 0x28]
mov ecx, 0x4106f4
call fcn.0040373c
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4106c5
mov byte [ebx + 0x18], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4106e5
lea eax, [ebp - 0x194]
call fcn.00403494
ret
Function at 0x410708
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x410796
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403494
cmp byte [ebx + 0x18], 0
je 0x410780
xor edx, edx
push ebp
push 0x410776
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x410780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41079d
lea eax, [ebp - 4]
call fcn.00403494
ret

Function at 0x4107a4
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41086e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x19], 0
cmp byte [ebx + 0x18], 0
je 0x410858
cmp dword [ebx + 0x20], 0
jne 0x4107d8
cmp dword [ebx + 0x24], 0
je 0x410858
cmp dword [ebx + 0x20], 0
je 0x4107f1
mov eax, dword [ebx + 0x20]
call fcn.004038b4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0xc], eax
jmp 0x410815
cmp dword [ebx + 0x24], 0
je 0x410815
lea ecx, [ebp - 4]
mov edx, dword [ebx + 0x24]
mov eax, ebx
call fcn.00410708
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0xc], eax
mov word [ebx + 8], 2
mov ax, word [ebx + 0x1c]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0xa], ax
push 0x10
lea eax, [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x410850
lea eax, [ebx + 0x28]
mov edx, 0x410884
call fcn.004034e8
mov byte [ebx + 0x19], 0
jmp 0x410858
mov byte [ebx + 0x19], 1
test eax, eax
jne 0x410829
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410875
lea eax, [ebp - 4]
call fcn.00403494
ret
Function at 0x410894
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x410970
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [edi + 0x18], 0
je 0x410955
cmp byte [edi + 0x19], 0
je 0x410955
mov eax, dword [ebp - 4]
call fcn.004036f0
mov esi, eax
test esi, esi
je 0x410955
cmp esi, 0x7d0
jbe 0x410930
mov ebx, 1
cmp esi, ebx
jbe 0x410930
lea eax, [ebp - 8]
call fcn.00403494
lea eax, [ebp - 8]
push eax
mov ecx, 0x7d0
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004038f8
push 0
mov eax, dword [ebp - 8]
call fcn.004036f0
push eax
lea eax, [ebp - 8]
call fcn.004038c0
push eax
mov eax, dword [edi + 4]
push eax
call sub.wsock32.dll_send
add ebx, 0x7d0
jmp 0x4108ec
cmp esi, 0x7d0
ja 0x410955
push 0
mov eax, dword [ebp - 4]
call fcn.004036f0
push eax
lea eax, [ebp - 4]
call fcn.004038c0
push eax
mov eax, dword [edi + 4]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410977
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret

Function at 0x410f50
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411037
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x411001
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403494
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x410fc3
pop dword fs:[0]
add esp, 8
jmp 0x411016
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x410feb
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.00407154
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.004036f8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x410fca
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41100b
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004034e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41103e
lea eax, [ebp - 0x204]
call fcn.00403494
lea eax, [ebp - 8]
call fcn.00403494
ret

Function at 0x4120f4
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x41210a
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x413434
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413598
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40b6bc]
call fcn.00402af4
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.004025a8
mov esi, eax
test ebx, ebx
jbe 0x4134c9
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.0040364c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00406bf4
cmp dword [ebp - 0x10], 0
je 0x4134bb
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.0040364c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x41347f
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x41356e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x41356e
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00406b08
mov edx, dword [ebp - 0xc]
mov eax, 0x4135b0
call fcn.00403980
test eax, eax
je 0x41353b
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x413568
mov edx, dword [ebp - 0xc]
mov eax, 0x4135cc
call fcn.00403980
test eax, eax
je 0x413568
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x4134f3
mov eax, esi
call fcn.004025c0
mov eax, dword [ebp - 4]
call fcn.00402b24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41359f
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004034b8
ret
Function at 0x41369c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413895
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov edi, eax
mov eax, 0xc8
call fcn.004025a8
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push edi
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 8]
mov edx, edi
call fcn.0040364c
mov eax, dword [ebp - 8]
mov edx, 0x4138ac
call fcn.00403800
jne 0x41386c
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0xc]
mov edx, 0x4138bc
call fcn.00403800
jne 0x41386c
push 0
push 0x4138c8
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x41374a
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 0x4138dc
call fcn.0040373c
lea eax, [ebp - 4]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x416384]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x4138e8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x41386c
mov eax, dword [0x416434]
mov eax, dword [eax]
mov edx, 0x4138f8
call fcn.00403800
jne 0x41380c
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_SendMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 0x413904
call fcn.0040373c
lea eax, [ebp - 4]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x41639c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
jmp 0x41386c
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 0x413904
call fcn.0040373c
lea eax, [ebp - 4]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x41639c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, edi
call fcn.004025c0
mov eax, ebx
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41389c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004034b8
ret
Function at 0x413910
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413ab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov edi, eax
mov eax, 0xc8
call fcn.004025a8
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
push 0xc8
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040364c
mov eax, dword [ebp - 0x10]
mov edx, 0x413acc
call fcn.00403800
jne 0x413a8a
xor ebx, ebx
push 0
push 0x413ad8
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x413a8a
push 0
push 0x413ae8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x413a8a
push 0
push 0x413af4
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov dword [ebp - 8], eax
push 0
push 0x413b00
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
cmp dword [ebp - 8], 0
jle 0x413a8a
test ebx, ebx
jle 0x413a8a
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.0040364c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 0x413b10
call fcn.0040373c
lea eax, [ebp - 0xc]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x416384]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.0040364c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 0x413b20
call fcn.0040373c
lea eax, [ebp - 0xc]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x41639c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, edi
call fcn.004025c0
mov eax, esi
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413aba
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004034b8
ret
Function at 0x413bf4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x413bfc
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413dfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov ebx, eax
mov eax, 0xc8
call fcn.004025a8
mov edi, eax
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0x10]
mov edx, 0x413e10
call fcn.00403800
jne 0x413cbf
push 0
push 0x413e1c
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x413cbf
push edi
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
test edi, edi
je 0x413ca5
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.0040364c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 0x413e30
call fcn.0040373c
lea eax, [ebp - 0xc]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x416384]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0x18]
mov edx, 0x413e44
call fcn.00403800
jne 0x413dc9
push 0xc8
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x1c]
mov edx, 0x413e58
call fcn.00403800
jne 0x413dc9
push 0
push 0x413e68
push 0
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x413dc9
push edi
push 0xc8
push 0xd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
test edi, edi
je 0x413d54
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.0040364c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 0x413e78
call fcn.0040373c
lea eax, [ebp - 0xc]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x416384]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x413e68
mov eax, dword [ebp - 8]
push eax
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jbe 0x413dc9
push edi
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
test edi, edi
je 0x413daf
lea eax, [ebp - 0x24]
mov edx, edi
call fcn.0040364c
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 0x413e88
call fcn.0040373c
lea eax, [ebp - 0xc]
call fcn.004038c0
push eax
push 0
push 0xc
mov eax, dword [0x41639c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
mov eax, ebx
call fcn.004025c0
mov eax, edi
call fcn.004025c0
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413e01
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004034b8
ret