joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488910
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edda8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xa
xor eax, eax
push str.ONLINEFLAG
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406400
mov dword [ebp - 4], 0
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ecx + 0xc]
call fcn.00409ba0
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x48899d
push dword [ebp - 0x2c]
call fcn.0049500b
add esp, 4
test bl, bl
je 0x4889cf
push 0
push 1
push 0xf1
push dword [esi + 0x3c4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [esi + 0x3a4]
call fcn.0049c768
push 6
push str.Online
jmp 0x488afb
push 1
lea ecx, [esi + 0x3a4]
call fcn.0049bd20
push 0xd
xor eax, eax
push str.CD_ONLINEFLAG
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00406400
mov dword [ebp - 4], 1
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ecx + 0xc]
call fcn.00409ba0
cmp eax, 1
sete bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x488a36
push dword [ebp - 0x2c]
call fcn.0049500b
add esp, 4
push 0
test bl, bl
je 0x488ae1
push 1
push 0xf1
push dword [esi + 0x3c4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 8
push str.CdOnline
mov ecx, 0x74e3a8
call fcn.00406400
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x488b05
push eax
push eax
push 0xf1
push dword [esi + 0x3c4]
call dword [sym.imp.USER32.dll_SendMessageW]
push str.CD_ONLINEFLAG
lea ecx, [ebp - 0x44]
call fcn.00405d00
mov dword [ebp - 4], 2
mov ecx, dword [0x74e2f4]
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + 0xc]
call fcn.0040a350
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], 8
jb 0x488acb
push dword [ebp - 0x44]
call fcn.0049500b
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
jmp 0x488af4
push 0
push 0xf1
push dword [esi + 0x3c4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0x641434
mov ecx, 0x74e3a8
call fcn.00406400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
Function at 0x48b680
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov word [ebp - 8], 0x500
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x10]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x48b6df
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x78
sete cl
pop edi
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x48b71f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x48b71f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 0x14]
call fcn.00495002
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x48b7a6
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x48b79d
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x48b79d
xor esi, esi
cmp dword [ebx], esi
jbe 0x48b794
lea edi, [ebx + 4]
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x48b78f
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x48b774
xor edi, edi
jmp 0x48b794
mov edi, 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push ebx
call fcn.0049500b
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
pop esi
mov eax, edi
xor ecx, ebp
pop edi
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
Function at 0x48e4a0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push str.Credui.dll
mov edi, ecx
call esi
mov dword [edi], eax
test eax, eax
jne 0x48e4e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Credui.dll
push str.CProxyInfo::LoadProxyLibrary_LoadLibrary___failed___s__:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x18
jmp 0x48e59c
push str.Advapi32.dll
call esi
mov dword [edi + 4], eax
test eax, eax
jne 0x48e4fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Advapi32.dll
jmp 0x48e4c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CredFree
push eax
call esi
push str.CredDeleteW
push dword [edi + 4]
mov dword [0x74e314], eax
call esi
push str.CredEnumerateW
push dword [edi + 4]
mov dword [0x74e310], eax
call esi
push str.CredUIPromptForCredentialsW
push dword [edi]
mov dword [0x74e308], eax
call esi
push str.CredUIConfirmCredentialsW
push dword [edi]
mov dword [0x74e304], eax
call esi
cmp dword [0x74e314], 0
mov dword [0x74e30c], eax
je 0x48e57c
cmp dword [0x74e310], 0
je 0x48e57c
cmp dword [0x74e308], 0
je 0x48e57c
cmp dword [0x74e304], 0
je 0x48e57c
test eax, eax
je 0x48e57c
mov eax, 1
pop edi
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CProxyInfo::LoadProxyLibrary_GetProcAddress___failed_:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x14
push 0x74e818
call fcn.00418730
mov ecx, edi
call fcn.0048e5c0
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x48f5f0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x3ff
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x403]
push 0
push eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
mov byte [ebp - 0x404], 0
call fcn.005bb1c0
add esp, 0xc
mov dword [ebp - 0x410], 0
test esi, esi
je 0x48f667
push edi
push esi
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.005b8864
add esp, 0x10
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x48f699
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x48f75e
push 0
push edi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x48f75e
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea eax, [ebp - 0x410]
push eax
push 0
push 2
push dword [ebp - 0x408]
call edi
test eax, eax
je 0x48f75e
push dword [ebp - 0x410]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x48f764
push 0
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push dword [ebp - 0x408]
call edi
test eax, eax
je 0x48f746
mov eax, dword [ebp - 0x410]
push eax
push esi
push eax
push dword [ebp - 0x414]
call fcn.005b8864
add esp, 0x10
jmp 0x48f74c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48f764
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x48f775
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x40c]
test eax, eax
je 0x48f788
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret

Function at 0x491760
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.004a0a81
mov ecx, esi
call fcn.004917b0
push 0
push 4
push 0
push 0
push esi
push 0x4918a0
call fcn.0049f725
mov dword [esi + 0x98], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0x98]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x4917b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ee810
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x677000]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x677000]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
push str.MSM2096
lea eax, [esp + 0x24]
push eax
call fcn.00471e50
mov dword [esp + 0x48], 0
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.0049c724
push str.MSM2097
lea eax, [esp + 0xc]
push eax
call fcn.00471e50
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
lea ecx, [esi + 0x9c]
call fcn.0049c724
cmp dword [esp + 0x1c], 8
jb 0x491855
push dword [esp + 8]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [esp + 0x34], 8
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
jb 0x49187f
push dword [esp + 0x20]
call fcn.0049500b
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
Function at 0x491e50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ee9e0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x677000]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x677000]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
push 3
xor eax, eax
push 0x6295b4
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00406400
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x54], 0
mov ecx, dword [0x74e2f4]
lea eax, [esp + 0x2c]
push eax
add ecx, 0x1c
call fcn.00409910
mov byte [esp + 0x50], 2
cmp dword [esp + 0x24], 8
jb 0x491ee8
push dword [esp + 0x10]
call fcn.0049500b
add esp, 4
push 0x5c
xor eax, eax
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.00414110
push 0xc
push str.cnwiduns.dll
lea ecx, [esp + 0x30]
call fcn.004062d0
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x491f41
push str.CUSBLanSetup::Initialize__LoadLibrary___Failed
jmp 0x492008
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CNWIDUNS_CreateInstance
push eax
call esi
push str.CNWIDUNS_DestroyInstance
push dword [edi + 0x3c]
mov dword [edi + 0x14], eax
call esi
push str.CNWIDUNS_Search
push dword [edi + 0x3c]
mov dword [edi + 0x18], eax
call esi
push str.CNWIDUNS_GetDeviceId
push dword [edi + 0x3c]
mov dword [edi + 0x1c], eax
call esi
push str.CNWIDUNS_CommStart
push dword [edi + 0x3c]
mov dword [edi + 0x20], eax
call esi
push str.CNWIDUNS_CommEnd
push dword [edi + 0x3c]
mov dword [edi + 0x24], eax
call esi
push str.CNWIDUNS_GetInfo
push dword [edi + 0x3c]
mov dword [edi + 0x28], eax
call esi
push str.CNWIDUNS_SetInfo
push dword [edi + 0x3c]
mov dword [edi + 0x2c], eax
call esi
push str.CNWIDUNS_Control
push dword [edi + 0x3c]
mov dword [edi + 0x30], eax
call esi
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x34], eax
test ecx, ecx
je 0x492003
cmp dword [edi + 0x18], 0
je 0x492003
cmp dword [edi + 0x1c], 0
je 0x492003
cmp dword [edi + 0x20], 0
je 0x492003
cmp dword [edi + 0x24], 0
je 0x492003
cmp dword [edi + 0x28], 0
je 0x492003
cmp dword [edi + 0x2c], 0
je 0x492003
cmp dword [edi + 0x30], 0
je 0x492003
test eax, eax
je 0x492003
call ecx
mov dword [edi + 0x38], eax
test eax, eax
jne 0x491fff
push str.CUSBLanSetup::CNWIDUNS_CreateInstance____Failed
jmp 0x492008
mov bl, 1
jmp 0x49200f
push str.CUSBLanSetup::Initialize____Failed
call fcn.00418730
xor bl, bl
cmp dword [esp + 0x3c], 8
jb 0x492022
push dword [esp + 0x28]
call fcn.0049500b
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret
Function at 0x494850
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
xor eax, eax
push 0x624350
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00406400
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
mov ecx, dword [0x74e2f4]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ecx + 0x1c]
call fcn.00409910
cmp dword [ebp - 0x2c], 8
jb 0x4948ca
push dword [ebp - 0x40]
call fcn.0049500b
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push str.AP_SEARCH_TIMEOUT
push str.USB_LAN_SETUP
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
test esi, esi
mov eax, 0x1d4c0
cmove esi, eax
cmp dword [ebp - 0x14], 8
jb 0x494905
push dword [ebp - 0x28]
call fcn.0049500b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret

Function at 0x4969ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x749668]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x4969f9
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x496a16
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x749668], eax
jmp 0x496a02
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x496a16
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x496a83
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x496a31
xor eax, eax
jmp 0x496a83
lea eax, [ebp - 0x210]
push eax
call fcn.005bb2fa
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x496a62
push 0x630b1c
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005bb250
add esp, 0xc
test eax, eax
jne 0x496a2d
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005bb250
add esp, 0xc
test eax, eax
jne 0x496a2d
lea eax, [ebp - 0x210]
push eax
call fcn.0049b7ea
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005b7f8f
leave
ret
Function at 0x49727a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x4972bf
call fcn.004a1d75
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4972bf
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4972db
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004a0e07
mov ebx, eax
test edi, edi
je 0x4972d9
test esi, esi
je 0x4972d9
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x49c263
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5e1529
call fcn.005bacf9
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x49c289
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x49c2dd
call fcn.0049f407
push eax
lea ecx, [ebp - 0x10]
call fcn.00407840
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.005b9367
push eax
call fcn.0040b8b0
add esp, 0x14
test edi, edi
je 0x49c2d0
push edi
call fcn.005bb2fa
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004078c0
mov eax, esi
call fcn.005bacc7
ret 8

Function at 0x4a03c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.004a1d75
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4a03fa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004a0419
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4a2cff
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, dword [esi + 4]
push eax
push dword [ebp + 0xc]
call fcn.0049be72
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4a2d3b
call fcn.004a2fbd
mov dword [esi + 0xc], 1
jmp 0x4a2d40
call fcn.004a2fbd
cmp dword [esi], 0
je 0x4a2d89
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4a2d63
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0049526a
jmp 0x4a2d74
push 0xff
mov ecx, esi
call fcn.00407a20
push pe_nt_image_headers32
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00495480
jmp 0x4a2dad
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4a2dad
push dword [esi]
push dword [ebp - 4]
call fcn.004b55d4
pop esi
leave
ret 0xc

Function at 0x4a2f14
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004a2fbd
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4a2f5c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0049526a
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00495480
jmp 0x4a2f67
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004b55d4
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4a43aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test byte [esi + 4], 1
push edi
mov dword [ebp - 4], ebx
je 0x4a43c4
mov edi, dword [esi + 0xc]
jmp 0x4a4404
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4a43dd
call fcn.0049d779
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4a43f2
call fcn.0049d779
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4a4404
call fcn.0049d779
call fcn.004a1d75
cmp dword [eax + 0x3c], 0
je 0x4a4419
push edi
mov ecx, ebx
call fcn.004a3c3e
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004a45dc
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7c]
test ecx, ecx
je 0x4a443c
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x7c], 0
test ebx, ebx
je 0x4a4445
mov edi, ebx
mov dword [eax + 0x7c], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4a6c7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x4a6cc5
call fcn.004a1d75
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4a6cc2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4a6cfe
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test edi, edi
je 0x4a6ce7
push dword [ebp + 0x10]
mov edx, dword [eax]
push edi
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x20]
mov ebx, eax
test esi, esi
je 0x4a6ce7
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x4a6cfc
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0xa0]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc