joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d20
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x2e1a
push 0x3fc
push esi
call edi
test eax, eax
je 0x416d5e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 0
push 0x2e19
push 0x3fc
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0
push 0x147
push 0x44d
push esi
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebp
push eax
push 0x150
push 0x44d
push esi
call ebx
push eax
call ebp
push eax
call fcn.00432ed0
push 0
push 0
push 0x147
push 0x3fe
push esi
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0
call ebx
push eax
call ebp
cmp eax, 0xffffffff
jne 0x416dd1
lea eax, [esp + 0x14]
push 5
push eax
push 0x3fe
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x416de7
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x148
push 0x3fe
push esi
call ebx
push eax
call ebp
mov al, byte [esp + 0x14]
test al, al
je 0x416f37
lea edx, [esp + 0x14]
push edx
call fcn.0044c8a5
add esp, 4
cmp eax, 0x90
jg 0x416e23
lea eax, [esp + 0x14]
push eax
call fcn.0044c8a5
add esp, 4
cmp eax, 0x10
jge 0x416e23
mov dword [esp + 0x5c], 0x10
jmp 0x416e52
lea ecx, [esp + 0x14]
push ecx
call fcn.0044c8a5
add esp, 4
cmp eax, 0x90
jle 0x416e41
mov dword [esp + 0x5c], 0x90
jmp 0x416e52
lea edx, [esp + 0x14]
push edx
call fcn.0044c8a5
add esp, 4
mov dword [esp + 0x5c], eax
mov edi, dword [esp + 0x5c]
lea eax, [esp + 0x14]
push edi
push 0x45a4b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x3fe
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
push 0x45a49c
push 0x1069
call fcn.004409f0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1c]
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x48
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov edx, dword [esp + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push edi
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 0
push 0
push 0x147
push 0x44e
push esi
call ebx
push eax
call ebp
push eax
push 0x150
push 0x44e
push esi
call ebx
push eax
call ebp
xor ecx, ecx
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x10]
mov cx, word [eax + 0x24]
add eax, 2
mov dword [esp + 0x2c], ecx
mov dl, byte [eax + 0x21]
push eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x38], dl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push 0x2e19
push 0x3fc
push esi
call ebx
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x417550
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x418
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov esi, dword [esp + 0x424]
push edi
push 0
push 0
push 0
push 0x147
push 0x44d
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
push eax
push 0x150
push 0x44d
push esi
call ebx
push eax
call edi
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push eax
call fcn.00432ab0
push 0
push 0
push 0x147
push 0x3fe
push esi
mov byte [esp + 0x20], 0
call ebx
push eax
call edi
cmp eax, 0xffffffff
jne 0x4175d8
lea edx, [esp + 0xc]
push 5
push edx
push 0x3fe
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4175ee
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x148
push 0x3fe
push esi
call ebx
push eax
call edi
mov al, byte [esp + 0xc]
test al, al
je 0x41777b
lea edx, [esp + 0xc]
push ebp
push edx
call fcn.0044c8a5
add esp, 4
cmp eax, 0x12c
jg 0x417628
lea eax, [esp + 0x10]
push eax
call fcn.0044c8a5
add esp, 4
cmp eax, 4
jge 0x417628
mov ebp, 4
jmp 0x417652
lea ecx, [esp + 0x10]
push ecx
call fcn.0044c8a5
add esp, 4
cmp eax, 0x12c
jle 0x417643
mov ebp, 0x12c
jmp 0x417652
lea edx, [esp + 0x10]
push edx
call fcn.0044c8a5
add esp, 4
mov ebp, eax
push ebp
lea eax, [esp + 0x14]
push 0x45a4b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x3fe
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebp
push 0x45a4b4
push 0x1069
call fcn.004409f0
push ebp
push 0
push 0x151
push 0x3fe
push esi
call ebx
push eax
call edi
push 0xffffffffffffffeb
push 0x3f9
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0x31
push 0x3f9
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x4176e6
push 0
push edi
push 0x30
push 0x3f9
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1c]
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x48
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push edi
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea edx, [esp + 0x5a]
mov byte [esp + 0x33], 1
mov eax, dword [esp + 0x7c]
mov cl, byte [esp + 0x7b]
and eax, 0xffff
push edx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x38], cl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
push 0x30
push 0x3f9
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x3f9
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x4178f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [esp + 0x21c]
push ebp
push esi
push edi
xor edi, edi
push eax
mov dword [esp + 0x18], edi
call fcn.00432ed0
mov ebp, eax
mov edx, dword [esp + 0x224]
lea ecx, [ebp + 2]
push ecx
push 0x41d
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x4773e4]
push 0x45a4d4
lea ecx, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push edi
push 3
push edi
push 1
lea edx, [esp + 0x130]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x417a9e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x14]
push edi
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push esi
call ebx
mov edx, dword [0x45a4d0]
mov eax, dword [esp + 0x18]
and edx, 0xffff
or edx, 0x10000
cmp eax, edx
jne 0x417a89
lea eax, [esp + 0x14]
push edi
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417a89
lea edx, [eax*8]
push edx
call fcn.0044c0d4
mov ecx, dword [esp + 0x14]
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push 0
lea edx, [ecx*8]
push eax
push edx
push edi
push esi
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [ecx*8 + 8]
mov dword [esp + 0x1c], eax
xor eax, eax
test ecx, ecx
jbe 0x417a89
mov ebp, dword [ebp + 0x2a]
mov edx, edi
cmp ebp, dword [edx]
je 0x417a10
inc eax
add edx, 8
cmp eax, ecx
jb 0x417a02
jmp 0x417a89
mov ecx, dword [edi + eax*8 + 4]
mov ebp, dword [esp + 0x1c]
push 0
add ecx, ebp
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x28]
push 0x100
push eax
push esi
call ebx
lea ecx, [esp + 0x20]
push 0x45a4cc
push ecx
call fcn.0044c740
add esp, 8
test eax, eax
je 0x417a89
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [esp + 0x228]
push eax
push 0
push 0x180
push 0x403
push edx
call ebp
push eax
call ebx
push 0x45a4cc
push 0
call fcn.0044c740
add esp, 8
test eax, eax
jne 0x417a5c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebx
je 0x417a9e
push edi
call fcn.0044c186
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x214
ret 8
Function at 0x417ab0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x4773e4]
push ebx
push ebp
push esi
push 0x45a4d4
lea ecx, [esp + 0x1c]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push ebx
push 3
push ebx
push 1
lea edx, [esp + 0x2c]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417b0a
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push esi
call edi
mov edx, dword [0x45a4d0]
mov eax, dword [esp + 0x14]
and edx, 0xffff
or edx, 0x10000
cmp eax, edx
jne 0x417ba6
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x417ba6
lea edx, [eax*8]
push edx
call fcn.0044c0d4
mov ecx, dword [esp + 0x14]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x18]
push 0
lea edx, [ecx*8]
push eax
push edx
push ebx
push esi
call edi
xor eax, eax
mov edx, dword [esp + 0x10]
test edx, edx
jbe 0x417ba6
mov ecx, dword [esp + 0x124]
mov edi, dword [ecx + 0x2a]
mov ecx, ebx
cmp edi, dword [ecx]
je 0x417ba1
inc eax
add ecx, 8
cmp eax, edx
jb 0x417b93
jmp 0x417ba6
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
pop edi
je 0x417bbb
push ebx
call fcn.0044c186
add esp, 4
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x41a0a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [0x476e10]
sub esp, 0x160
mov ecx, dword [eax + 0x4ec]
push ebp
test ecx, ecx
je 0x41a2b7
mov ecx, dword [eax + 0x4f4]
push 1
push ecx
push 3
push 3
add eax, 0x104
push 0xc0000000
push eax
call fcn.0044a650
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41a2b7
push ebx
push esi
push edi
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x20]
push 0x155
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [0x476e10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x208]
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41a13c
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea esi, [esp + 0x29]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41a141
mov byte [esp + 0x29], 0
lea edx, [ebx + 0x248]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41a178
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x69]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41a17d
mov byte [esp + 0x69], 0
push 0
push 0
push 0
push ebp
mov dword [esp + 0x28], 0x20000
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 0x155
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x476e10]
mov eax, edi
lea ebp, [edi + 0x104]
mov esi, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41a1e9
test cl, cl
je 0x41a1e5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41a1e9
add eax, 2
add esi, 2
test cl, cl
jne 0x41a1c1
xor eax, eax
jmp 0x41a1ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41a238
push 0
push 0
push ebp
push 0x106f
call fcn.00440b60
mov eax, dword [0x476e10]
mov ecx, dword [0x4773cc]
add eax, 0x104
push eax
push 0xffffffffffffffff
push 0x1a2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [0x476e10]
push eax
add eax, 0x104
push eax
call fcn.00409aa0
mov edi, dword [0x476e10]
mov eax, dword [edi + 0x34c]
test eax, eax
je 0x41a26c
push 4
push edi
push 0x106f
call fcn.004409f0
mov edx, dword [0x476e10]
push 4
push edx
call fcn.0040b9b0
mov eax, dword [0x476e10]
push 4
push eax
call fcn.0043ab30
jmp 0x41a27b
push 0
push 0
push edi
push 0x106f
call fcn.00440b60
mov edi, dword [0x476e10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [edi + 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x476e10]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x4ec], 0
pop ebp
add esp, 0x160
ret
Function at 0x41a2c0
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
push 0x104
xor esi, esi
call fcn.0044c0d4
push 3
mov ebx, eax
call fcn.0044c0d4
mov edi, eax
push 0x100
mov dword [esp + 0x28], edi
call fcn.0044c0d4
add esp, 0xc
mov ebp, eax
mov dword [esp + 0x14], ebp
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x41a465
mov eax, dword [0x477340]
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push ecx
push 0x4571ec
push 1
push esi
push 0x45721c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41a45f
mov eax, dword [esp + 0x10]
push ebx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x22c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x230]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
push 3
push ebx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x10]
push ecx
push 0x45722c
push eax
mov edx, dword [eax]
call dword [edx]
test eax, eax
jl 0x41a455
push esi
push esi
push ebp
mov ebp, dword [esp + 0x240]
push edi
push ebp
call fcn.0044c925
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebx
mov edx, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], 0x5c
jne 0x41a40d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebx - 1], al
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x20]
push 0x104
push eax
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x20]
push 1
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, 1
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call fcn.0044c186
push edi
call fcn.0044c186
push ebp
call fcn.0044c186
add esp, 0xc
push 0x2bc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 0xc
Function at 0x41a4a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456b28
push 0x44bffc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x13c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
call fcn.0041b1f0
mov ebx, eax
mov dword [ebp - 0x140], ebx
test ebx, ebx
jne 0x41a518
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
mov dword [ebp - 0x158], edi
mov byte [ebp - 0x11c], 1
push 5
push 0x99
mov ecx, dword [0x4773fc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov edx, dword [0x4773fc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x150], esi
lea eax, [ebp - 0x11c]
push eax
push 0x41b300
push edi
push esi
mov ecx, dword [0x477340]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov edi, eax
mov dword [ebp - 0x154], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
jne 0x41a59d
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x11c]
push edx
call fcn.00448e70
mov eax, dword [0x477358]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], 2
mov word [ebp - 0x12c], 1
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x13c]
push eax
push ebx
call fcn.0041aa90
test eax, eax
je 0x41a609
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov eax, dword [ebp - 0x144]
test eax, eax
je 0x41a636
push eax
call fcn.0044c186
add esp, 4
jmp 0x41a636
mov dword [ebp - 4], 0xffffffff
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x41a67d
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x134]
push ecx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x41a683
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x41a6a7
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x130]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cb70
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x200
call fcn.0044c0d4
push 0x200
mov esi, eax
call fcn.0044c0d4
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 8
mov edi, eax
mov eax, dword [0x4773fc]
push 0xff
push esi
push 0x4b
push eax
call ebx
push 0xff
push edi
mov ebp, dword [esp + 0x1c]
push 0x400
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41cbd6
cmp byte [edi], 0
je 0x41cbd6
push edi
jmp 0x41cbd8
push 0
push 0x45a5dc
push 0x106a
call fcn.00440860
mov ecx, dword [0x4773fc]
push 0x100
push esi
push 0x4c
push ecx
call ebx
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [0x4773fc]
add eax, esi
push eax
push 0x4d
push edx
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x200
push edi
push 0x401
push ebp
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41cc4a
cmp byte [edi], 0
je 0x41cc4a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
jmp 0x41cc4e
push 0
push 0
push 0x45a5d0
push 0x106a
call fcn.00440b60
push 0
push 0
push 0xf0
push 0x404
push ebp
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x41cc7d
push 1
jmp 0x41cc7f
push 0
push 0x45a5c4
push 0x106a
call fcn.004409f0
push esi
call fcn.0044c186
push edi
call fcn.0044c186
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x41cdf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x4773fc]
push esi
push edi
push 5
push 0x603
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x4773fc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x476df0]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push edx
mov dword [0x476dec], eax
call edi
test eax, eax
je 0x41ce30
call fcn.0041cd80
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, dword [0x476dec]
push eax
push 0x41ccb0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [0x477340]
push eax
push edx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push eax
mov dword [0x476df0], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
call edi
test eax, eax
je 0x41ce76
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
ret 8
Function at 0x41d240
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov ecx, dword [0x4773b4]
sub esp, 0x98
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [0x4773b4]
push 0x100
push 0x476ce0
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x4773fc]
lea eax, [esp + 0x28]
push 0x80
push eax
push 0x15
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [0x4773b4]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
mov eax, dword [0x477380]
push eax
push esi
call edi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push 0x10
push edx
push esi
mov ebx, eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push ebx
push esi
call edi
mov eax, dword [0x4773b4]
push esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [0x4773b4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x28]
push ecx
push 0x100
push 0x401
push edx
call esi
mov eax, dword [0x4773b4]
mov edi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call edi
mov ebx, dword [esp + 0x14]
mov ecx, dword [0x477340]
mov eax, dword [esp + 0x1c]
mov edx, dword [0x4773b4]
mov ebp, dword [esp + 0x10]
push 0
sub eax, ebx
push ecx
mov ecx, dword [esp + 0x20]
push 0
sub eax, 6
push edx
push eax
sub ecx, ebp
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
add ebx, 4
push edx
mov edx, dword [esp + 0x38]
push ebx
lea eax, [edx + ebp + 8]
push eax
push 0x50000000
push 0
push 0x45a5e8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x476ccc], eax
mov ecx, dword [esp + 0xac]
and ecx, 0xffff
shl ecx, 0x10
push ecx
push 0
push 0x401
push eax
call esi
mov eax, dword [0x476ccc]
push 0
mov edx, dword [esp + 0xb4]
push edx
push 0x404
push eax
call esi
mov ecx, dword [0x476ccc]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x476ccc]
push edx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 8