joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4414ca
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov byte [edx], 0
mov dword [esp + 4], 2
mov dword [esp], pe_nt_image_headers32
call sub.msvcrt.dll_calloc
mov dword [esp], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov esi, eax
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0xc
mov dword [ebp - 0x20], eax
call eax
mov dword [ebp - 0x1c], eax
test ebx, ebx
je 0x441561
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x441561
mov eax, dword [ebp - 0x20]
call eax
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x44156d
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c]
mov byte [edi + 0x7f], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x44174b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
xor edx, edx
push ebx
mov ebx, eax
sub esp, 0x4c
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x441793
mov dword [esp + 8], 0x91
mov dword [esp + 4], str.registry.h
mov dword [esp], str.strchr_key_name_____NULL
call dword [0x494088]
lea eax, [ebp - 0x24]
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x4417c7
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x44183b
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4a9780
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
je 0x441813
xor ebx, ebx
mov dword [ebp - 0x20], ebx
jmp 0x44183b
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x44184c
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44185d
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4418d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
sub esp, 0x16c
mov dword [ebp - 0x13c], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x140], eax
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov ecx, edx
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x124], 0xffffffff
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
mov ecx, eax
mov ebx, eax
test ebx, ebx
je 0x4419f1
mov eax, dword [ebp - 0x13c]
cmp byte [eax + ebx], 0x5c
je 0x441957
dec ebx
jmp 0x441940
cmp ebx, 0x103
ja 0x441aed
mov eax, 0x104
inc ecx
mov esi, dword [ebp - 0x13c]
mov edi, edx
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebp - 0x13c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
lea ecx, [eax + 1]
cmp ecx, 0x104
mov ecx, 0x103
cmovae eax, ecx
mov byte [ebp + eax - 0x11c], 0
lea eax, [ebp - 0x12c]
mov byte [ebp + ebx - 0x11c], 0
inc ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x441a86
xor eax, eax
mov dword [ebp - 0x12c], eax
jmp 0x441ac5
lea eax, [ebp - 0x130]
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4a97a2
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x441a34
xor eax, eax
mov dword [ebp - 0x130], eax
jmp 0x441ac5
lea eax, [ebp - 0x128]
xor edi, edi
xor esi, esi
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4a97ab
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x4419e4
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x13c]
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x441ad9
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x441aed
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4427e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ecx, 0xc
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48]
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x442837
cmp dword [ebp + 0xc], 0
je 0x442837
mov dword [esp], ebx
xor esi, esi
call fcn.00442779
mov edi, esi
shl edi, 4
cmp dword [edi + 0x529a00], 0
je 0x44283e
inc esi
cmp esi, 0x80
jne 0x44280c
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], str.Maximum_number_of_tooltips_reached___d__n
call fcn.0043efa9
xor eax, eax
jmp 0x4429a4
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [0x526d60]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov eax, dword [0x526d5c]
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0x80000003
mov dword [esp + 8], ecx
mov dword [esp + 4], str.tooltips_class32
cmp dword [0x526cd4], 0
setne al
shl eax, 0x16
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
lea edx, [edi + 0x529a00]
mov dword [edi + 0x529a00], eax
sub esp, 0x30
test eax, eax
je 0x442837
mov dword [edx + 4], ebx
mov dword [ebp - 0x4c], edx
mov dword [esp + 8], 0x4410d2
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [ebp - 0x4c]
sub esp, 0xc
mov dword [edx + 8], eax
mov eax, dword [ebp + 0xc]
call fcn.0044137e
mov edx, dword [ebp - 0x4c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x403
mov eax, dword [edi + 0x529a00]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x529a00]
mov dword [ebp - 0x48], 0x30
sub esp, 0x10
cmp dword [0x526cd4], 1
mov dword [ebp - 0x40], eax
sbb eax, eax
xor edi, edi
and eax, 0xfffffffc
add eax, 0x15
mov dword [ebp - 0x44], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 4], 0x87
mov dword [esp], ebx
call edi
sub esp, 0x10
bt eax, 0xd
jb 0x44296f
or dword [ebp - 0x44], 0x80000002
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x48]
xor ebx, ebx
shl esi, 4
mov dword [ebp - 0x24], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x432
mov eax, dword [esi + 0x529a00]
mov dword [esp], eax
call edi
mov eax, 1
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x442c10
Capabilities:
Create thread

Disassembly:
push ebp
mov edx, str.SoftwareMicrosoftPowerShell1Install
mov eax, 0x80000002
mov ebp, esp
sub esp, 0x28
call fcn.00441af5
test eax, eax
jg 0x442c4b
mov edx, str.SoftwareMicrosoftPowerShell3Install
mov eax, 0x80000002
call fcn.00441af5
test eax, eax
jg 0x442c4b
mov dword [esp + 8], str.Notice:_The_ISO_download_feature_has_been_deactivated_because_a_compatible_PowerShell_version_was_not_detected_on_this_system.
mov eax, dword [0x528740]
jmp 0x442c6a
cmp dword [0x526c70], 0
jne 0x442cb6
call fcn.00441b18
test eax, eax
jg 0x442cb6
mov dword [esp + 8], str.Notice:_The_ISO_download_feature_has_been_deactivated_because_Check_for_updates_is_disabled_in_your_settings.
mov eax, dword [0x528740]
mov edx, 0xffc
sub edx, eax
add eax, 0x527740
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov dword [esp], 0x527740
mov byte [0x52873b], 0
call sub.msvcrt.dll_strlen
lea edx, [eax + 2]
mov byte [eax + 0x527740], 0xd
mov dword [0x528740], edx
mov byte [eax + 0x527741], 0xa
mov byte [eax + 0x527742], 0
jmp 0x442cde
xor eax, eax
xor edx, edx
mov dword [esp + 8], 0x4411d7
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
sub esp, 0x18
leave
ret
Function at 0x443f17
Capabilities:
Get graphical window text

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push edx
test eax, eax
jne 0x443f45
xor ebx, ebx
jmp 0x444002
xor eax, eax
mov dword [esp + 4], 0x31
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], edi
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
test eax, eax
je 0x443f3e
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push ecx
test ebx, ebx
jne 0x443fd2
mov dword [esp], edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push edx
test eax, eax
jle 0x443f3e
lea ecx, [eax + 1]
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 2
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x443f3e
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
sub esp, 0xc
test eax, eax
jle 0x444002
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x30]
mov dword [esp + 8], edx
jmp 0x443ff2
mov eax, ebx
call fcn.0044137e
mov ebx, eax
test eax, eax
je 0x444002
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
sub esp, 0x10
mov dword [esp], ebx
call sub.msvcrt.dll_free
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x444021
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.USER32.dll_ReleaseDC]
push eax
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x447162
Capabilities:
Identify system language via api

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
push ecx
sub esp, 0x148
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [esp], eax
call fcn.0043ea0f
mov dword [esp + 0xc], 0x5266c0
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_s_shell32.dll.mui
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, edi
mov byte [ebp - 0x19], 0
call fcn.0044137e
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test esi, esi
je 0x4471ec
mov dword [ebp - 0x12c], eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edx
test ebx, ebx
je 0x447299
mov ecx, 0x52a2a0
mov edx, 0x101d
mov eax, ebx
call fcn.004415d3
test eax, eax
jg 0x447243
movups xmm0, xmmword [str.Microsoft_WindowCould_not_set_pointer_to_position__llu:__s]
mov word [0x52a2b0], 0x73
movups xmmword [0x52a2a0], xmm0
call fcn.0043f53d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Warning:_Could_not_locate_localized_format_prompt_title_string_in__s:__s
call fcn.0043efa9
mov ecx, 0x52a220
mov edx, 0x101e
mov eax, ebx
call fcn.004415d3
test eax, eax
jg 0x44728f
mov dword [0x52a220], 0x6d726f46
mov dword [0x52a224], 0x64207461
mov dword [0x52a228], 0x6b7369
call fcn.0043f53d
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Warning:_Could_not_locate_localized_format_prompt_button_string_in__s:__s
call fcn.0043efa9
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push eax
mov dword [esp], 0xc4d
call fcn.0042291e
test eax, eax
jne 0x4472d7
mov dword [esp], 0xc4d
mov ebx, 1
call fcn.0042291e
test eax, eax
je 0x4472f6
mov dword [esp], 0xc4d
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [eax + 1]
jmp 0x4472f6
mov dword [esp], 0xc4d
mov ebx, pe_nt_image_headers32
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, 0x7f
jbe 0x4472a9
mov dword [esp], 0xc4d
mov edi, 0x52a320
call fcn.0042291e
mov ecx, ebx
mov esi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp], 0xc4d
call fcn.0042291e
test eax, eax
jne 0x447334
mov dword [esp], 0xc4d
call fcn.0042291e
test eax, eax
jne 0x447355
mov eax, 0x52a320
jmp 0x44736e
mov dword [esp], 0xc4d
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, 0x7f
jbe 0x44731d
mov eax, 0x52a39f
jmp 0x44736e
mov dword [esp], 0xc4d
call fcn.0042291e
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 0x52a320
mov byte [eax], 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x448808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26], 0x554e494c
mov word [ebp - 0x22], 0x2058
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], 0x7c3a3e3c
mov dword [ebp - 0x1c], 0x2f5c3f2a
mov dword [ebx], 0x4b38a2
cmp eax, 0xff
ja 0x448849
xor ebx, ebx
jmp 0x4489cb
sub eax, 0x40
mov esi, 0x40
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x26]
mov dword [esp + 8], 6
mov dword [esp + 4], eax
lea eax, [edi + esi]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4489b3
mov al, byte [edi + esi - 3]
cmp al, 0x49
jne 0x448890
cmp byte [edi + esi - 2], 0x53
jne 0x4489b3
cmp byte [edi + esi - 1], 0x4f
jmp 0x4488a8
cmp al, 0x53
jne 0x4489b3
cmp byte [edi + esi - 2], 0x59
jne 0x4489b3
cmp byte [edi + esi - 1], 0x53
jne 0x4489b3
add esi, 6
lea edx, [ebp - 0x2c]
mov dword [esp + 8], 0xa
lea eax, [edi + esi]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0x3c], eax
call sub.msvcrt.dll_strtoul
lea edx, [ebp - 0x2c]
mov dword [esp + 8], 0xa
mov ebx, eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], edx
shl ebx, 8
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
movzx eax, al
add bx, ax
je 0x4489b3
mov esi, dword [ebp - 0x2c]
xor eax, eax
test esi, esi
je 0x44890b
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x2c]
mov byte [eax], 0x2f
mov esi, dword [ebp - 0x2c]
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov edi, eax
mov cl, byte [ecx + eax]
inc eax
mov dl, byte [esi + eax]
cmp cl, 0x20
je 0x44892f
cmp cl, dl
je 0x44891a
cmp dl, 0x2d
cmovne eax, edi
cmp eax, 3
jbe 0x448941
mov byte [esi + eax], 0x2f
add dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
or eax, 0xffffffff
test edx, edx
je 0x448954
mov dword [esp], edx
call sub.msvcrt.dll_strlen
dec eax
mov edx, dword [ebp - 0x2c]
test eax, eax
je 0x44896e
add edx, eax
mov cl, byte [edx]
cmp cl, 0x20
je 0x448969
cmp cl, 0x2a
jne 0x44896e
mov byte [edx], 0
jmp 0x448953
mov edi, 1
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x4489c4
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp edi, eax
jae 0x4489a1
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov cl, byte [ebp + eax - 0x20]
add edx, edi
cmp byte [edx], cl
jne 0x448998
mov byte [edx], 0x5f
inc eax
cmp eax, 8
jne 0x448988
inc edi
jmp 0x448973
cmp byte [esi + 1], 0
jne 0x4489ac
mov esi, 0x4b38a2
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
jmp 0x4489cb
mov eax, dword [ebp - 0x40]
inc esi
cmp esi, eax
jb 0x448854
jmp 0x448842
mov al, byte [1]
ud2
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44b36c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x16c
mov eax, dword [0x526d5c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDC]
push ecx
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push ebx
push ebx
xor ebx, ebx
mov dword [esp + 8], 0x48
mov dword [esp + 4], eax
mov dword [esp], 0xe
call dword [sym.imp.KERNEL32.DLL_MulDiv]
xor edx, edx
xor ecx, ecx
sub esp, 0xc
neg eax
mov dword [esp + 0x34], str.Segoe_UI
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 2
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x258
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.GDI32.dll_CreateFontA]
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], eax
sub esp, 0x38
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x10], 1
lea esi, [ebp - 0x118]
mov edi, esi
mov ebx, dword [eax*4 + 0x4b3e00]
mov eax, dword [ebp - 0x130]
mov dword [esp + 8], 0x30
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
sub esp, 0x14
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 0x40
push edx
mov ebx, eax
xor eax, eax
push edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x7c
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 0x7d
jbe 0x44b4bf
mov dword [esp + 8], 0x243
mov dword [esp + 4], str.ui.c
mov dword [esp], str.wlen___ARRAYSIZE_wtmp____2
call dword [0x494088]
mov word [ebp + eax*2 - 0x118], 0x20
lea edi, [ebp - 0x128]
mov word [ebp + eax*2 - 0x116], 0x20
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
push edx
push edx
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 0xc], 2
mov eax, dword [ebp + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00443f17
mov dword [esp + 0x18], 4
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x128]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
inc dword [ebp - 0x12c]
sub esp, 0x1c
cmp dword [ebp - 0x12c], 3
jne 0x44b41e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x450144
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x44f0bd
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x52a8e0], eax
sub esp, 0x18
test eax, eax
jne 0x4501a8
mov dword [esp], str.Unable_to_start_unmount_image_thread
call fcn.0043efa9
xor eax, eax
jmp 0x4501ff
mov edx, dword [0x4929fc]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov eax, dword [0x52a8e0]
push ecx
push ecx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [0x52a8e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
push edx
push edx
test eax, eax
jne 0x4501f5
xor edx, edx
mov dword [ebp - 0x1c], edx
xor eax, eax
mov dword [0x52a8e0], eax
mov eax, dword [ebp - 0x1c]
leave
ret