joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x594
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ecx
cmp eax, ebx
je 0x40ebf0
cmp word [eax], bx
je 0x40ebf0
cmp dword [ecx + 0x10], 8
jl 0x40ebf0
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x38a]
mov word [ebp - 0x38c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x38c]
push 0x24
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x102]
mov word [ebp - 0x104], bx
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push 0x424044
lea eax, [ebp - 0x104]
push 0x3f
push eax
call esi
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x182]
mov word [ebp - 0x184], bx
push 0x1f
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebp - 0x38c]
push eax
push 0x424014
lea eax, [ebp - 0x184]
push 0x3f
push eax
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x592]
mov word [ebp - 0x594], bx
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x594]
push 0x28
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x82]
mov word [ebp - 0x84], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x594]
push eax
push 0x4220a0
lea eax, [ebp - 0x84]
push 0x3f
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x38c]
push edi
push eax
mov ecx, esi
call fcn.0040ebf7
test eax, eax
jne 0x40ebe7
lea eax, [ebp - 0x104]
push edi
push eax
mov ecx, esi
call fcn.0040ebf7
test eax, eax
jne 0x40ebe7
lea eax, [ebp - 0x184]
push edi
push eax
mov ecx, esi
call fcn.0040ebf7
test eax, eax
jne 0x40ebe7
lea eax, [ebp - 0x84]
push edi
push eax
mov ecx, esi
call fcn.0040ebf7
test eax, eax
je 0x40ebea
lea eax, [ebp - 0x594]
push edi
push eax
mov ecx, esi
call fcn.0040ebf7
test eax, eax
jne 0x40ebea
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
jmp 0x40ebf2
xor eax, eax
pop ebx
leave
ret 4
Function at 0x40eca5
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x208
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x81
mov ebx, dword [ebp + 0x1c]
lea edi, [esp + 0x12]
neg ebx
sbb ebx, ebx
and word [esp + 0x10], 0
xor eax, eax
add ebx, reloc.OLEAUT32.dll_SysReAllocString
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x74]
test eax, eax
jne 0x40ecdf
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0x423c40
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, 0x424128
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, 0x423d94
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x424110
push esi
push ebx
call edi
mov ecx, dword [ebp + 0x84]
mov eax, dword [ebp + 0x88]
test ecx, ecx
jne 0x40ed35
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push 0x4240f8
push esi
push ebx
call edi
mov eax, dword [ebp + 0x48]
mov ebp, dword [ebp + 0x44]
test ebp, ebp
jne 0x40ed54
mov ebp, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebp
push 1
push 0x4240d8
push esi
push ebx
call edi
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x4240c0
call ebp
pop ecx
shl eax, 1
push eax
push 0x4240c0
push 1
push 0x4240ac
push esi
push ebx
call edi
push 0x42407c
call ebp
pop ecx
shl eax, 1
push eax
push 0x42407c
push 1
push 0x424068
push esi
push ebx
call edi
lea eax, [esp + 0x10]
push eax
call ebp
pop ecx
shl eax, 1
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0x423a84
push esi
push ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40edc5
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, 0x423cac
push ebx
mov esi, dword [edi + 0x1c]
neg esi
sbb esi, esi
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [edi + 0x84]
mov eax, dword [edi + 0x88]
test ecx, ecx
jne 0x40edfb
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add eax, eax
push eax
push ecx
push 1
push 0x42483c
push ebx
push esi
call ebp
mov eax, dword [edi + 0x78]
mov edi, dword [edi + 0x74]
test edi, edi
jne 0x40ee20
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push edi
push 1
push 0x423aa4
push ebx
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40f057
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push 1
cmp dword [esi + 0x20], edi
pop eax
je 0x40f078
cmp dword [esi + 0x10], 9
mov dword [ebp - 4], eax
jge 0x40f07b
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
mov ebx, dword [esi + 0x24]
jne 0x40f089
cmp ebx, edi
jne 0x40f0a9
jmp 0x40f101
mov eax, dword [esi + 0x84]
cmp eax, edi
jne 0x40f098
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push 0x424260
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov word [ebp - 0x20c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push ebx
push dword [ebp - 4]
stosw word es:[edi], ax
push 0x424210
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov esi, dword [esi + 0x84]
add esp, 0x14
test esi, esi
jne 0x40f0ef
mov esi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
lea eax, [ebp - 0x20c]
push 0
push eax
push esi
call fcn.00402158
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f137
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x84]
test eax, eax
jne 0x40f149
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f17b
mov eax, dword [esi + 0x54]
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
test eax, eax
jne 0x40f163
mov eax, ecx
mov esi, dword [esi + 0x84]
test esi, esi
jne 0x40f16f
mov esi, ecx
push 0
push eax
push esi
call fcn.00402158
add esp, 0xc
pop esi
ret

Function at 0x40f198
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
and word [ebp - 0x88], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x86]
mov esi, 0x422bc0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov edi, 0x4237ac
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40f202
cmp word [ebp - 0x88], ax
jne 0x40f295
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x7e
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40f24f
cmp word [ebp - 0x88], ax
jne 0x40f295
mov ecx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x38]
test ecx, ecx
jne 0x40f25f
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebx + 0x38]
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x40f282
mov ebx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebx
push 1
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f29a
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x74]
test ecx, ecx
jne 0x40f2aa
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ecx
push 1
push 0x423c90
push 0x422bc0
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret

Function at 0x40f764
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x40f78f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40f78d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x4100a8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
dec eax
je 0x4100bf
dec eax
jne 0x4100d6
push 1
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x4100d6
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00410269
mov ecx, eax
call fcn.0040d737
xor eax, eax
ret 0x10
Function at 0x410898
Capabilities:
Delete directory
Set file attributes

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x41d6e0
push dword [edi + 4]
mov ecx, esi
push dword [edi]
call fcn.00410b2a
add edi, 8
cmp edi, 0x41d700
jb 0x4108a1
cmp dword [esi + 0x14], 0
jne 0x41090f
push 1
push 0x4244b4
mov ecx, esi
call fcn.00410b2a
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4108d8
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
je 0x41090f
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4108ef
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [esi + 0x30]
test esi, esi
jne 0x410908
mov esi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
ret

Function at 0x410912
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [ebx + 0x18]
mov ebp, reloc.OLEAUT32.dll_SysReAllocString
neg esi
sbb esi, esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esi, ebp
push 0x424128
push esi
call edi
push 0x423cac
push esi
call edi
mov esi, 0x422bc0
push esi
push SysReAllocString
call edi
push esi
push ebp
call edi
cmp dword [ebx + 0x14], 0
je 0x41097a
mov eax, dword [ebx + 0x34]
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x410963
mov ebx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
add eax, eax
push eax
push ebx
push 1
push 0x423c90
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410ab3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
xor edx, edx
cmp esi, edx
je 0x410b22
cmp word [esi], dx
je 0x410b22
cmp dword [ecx + 0x10], 8
jge 0x410b22
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x28
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
push eax
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0x10
neg eax
sbb eax, eax
pop edi
inc eax
jmp 0x410b25
push 1
pop eax
pop esi
leave
ret 4
Function at 0x412b6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x412bff
lea ecx, [esi + 0x10]
push 0x42457c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x412bff
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x412bf8
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x412bf8
mov dword [esi + 0x230], eax
push 0x10
mov dword [esi + 0x22c], edi
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x412bf0
and dword [edi + 4], 0
lea eax, [edi + 4]
push eax
lea eax, [esi + 0x220]
push eax
mov dword [edi], 0x41d8bc
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [edi + 8], eax
jmp 0x412bf2
xor edi, edi
mov dword [esi + 0x21c], edi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esi + 0x21c]
lea edi, [esi + 0x21c]
xor ebx, ebx
cmp ecx, ebx
mov dword [esi + 0xc], ebx
mov word [esi + 0x10], bx
je 0x412c34
call fcn.0041378c
mov ecx, dword [edi]
mov dword [esi + 4], eax
call fcn.004137b0
mov dword [esi + 8], eax
xor eax, eax
cmp dword [esi + 4], ebx
setg al
jmp 0x412c36
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x413c02
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x413d0f
push ebx
mov ebx, dword [esi + 0x10]
sub ebx, dword [esi + 8]
push edi
mov edi, dword [esi + 0xc]
push dword [esi + 0x14]
sub edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 4]
mov dword [ebp - 0x18], ebx
call fcn.00413f03
mov eax, dword [esi]
push 0
push 0
mov ecx, esi
push dword [ebp - 4]
call dword [eax + 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x413cac
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_OffsetRgn]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xcc0020
push 0
push 0
push dword [ebp - 4]
push ebx
mov ebx, dword [ebp - 8]
push edi
push dword [esi + 8]
push dword [esi + 4]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0x10], 1
jne 0x413ce1
push dword [ebp - 0xc]
jmp 0x413ce3
push 0
push ebx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push dword [ebp - 0xc]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x14]
call edi
push ebx
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x416165
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041b1d0
push ebx
mov ebx, ecx
and dword [ebp - 4], 0
push esi
push dword [ebx + 0xa0]
lea esi, [ebx + 0xa0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4161fa
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x4161fa
and word [ebp - 0x1004], 0
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1002]
push 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
pop edi
cmp dword [ebp + 0xc], eax
je 0x41620f
lea ecx, [ebp - 0x1004]
lea esi, [ebx + 0x1c]
test ecx, ecx
je 0x4161eb
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x1004]
push ecx
push eax
mov ecx, esi
call fcn.004086c7
mov ecx, dword [ebp + 8]
add ebx, 0x1c
push ebx
call fcn.00417b0a
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1004]
push eax
call fcn.00417b50
jmp 0x416206
Function at 0x4180e1
Capabilities:
Check os version

Disassembly:
mov eax, 0x41c10c
call fcn.0041b220
sub esp, 0x178
and dword [ebp - 0x70], 0
push ebx
push esi
push edi
mov esi, ecx
push 0x16
pop ecx
xor eax, eax
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x184], 0x114
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x174], 2
jne 0x418204
cmp dword [ebp - 0x180], 6
jne 0x418204
lea eax, [ebp - 0x54]
push 0x424684
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
mov dword [ebp - 0x70], 0xfffffff4
pop ecx
push 0x422698
lea ecx, [ebp - 0x10]
call fcn.00417b50
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
lea edi, [esi + 0x14]
mov esi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [eax], ebx
call fcn.0040869b
push 0x422948
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x70], 0xfffffff2
call fcn.00417b50
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 1
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [eax], ebx
call fcn.0040869b
push 0x422748
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x70], 0xfffffff4
mov byte [ebp - 0x5b], 1
call fcn.00417b50
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 2
push eax
call esi
mov esi, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
mov dword [eax], esi
lea ecx, [ebp - 0x10]
jmp 0x4182d1
lea eax, [ebp - 0x54]
push 0x424674
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
mov dword [ebp - 0x70], 0xe
pop ecx
push 0x422698
lea ecx, [ebp - 0x10]
call fcn.00417b50
lea eax, [ebp - 0x70]
lea edi, [esi + 0x14]
mov esi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
mov dword [ebp - 4], 3
call esi
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [eax], ebx
call fcn.0040869b
push 0x422948
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x70], 0x12
call fcn.00417b50
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 4
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [eax], ebx
call fcn.0040869b
push 0x422748
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x70], 0xe
mov byte [ebp - 0x5b], 1
call fcn.00417b50
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 5
push eax
call esi
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00418779
or dword [ebp - 4], 0xffffffff
mov dword [eax], esi
lea ecx, [ebp - 0x14]
call fcn.0040869b
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4