joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4163ff
Capabilities:
Check http status code

Disassembly:
mov esp, 0x50ffffc3
push 0x80000000
push 0
lea eax, [ebp - 0x25a4]
mov dword [ebp - 0x3c30], ecx
push eax
mov dword [ebp - 0x3c14], ecx
call dword [0x42e01c]
test eax, eax
jne 0x416443
call ebx
movzx esi, ax
mov edi, 0x80070000
or esi, edi
test eax, eax
cmovle esi, eax
test esi, esi
js 0x416e2c
jmp 0x416448
mov edi, 0x80070000
lea eax, [ebp - 0x3b78]
push eax
lea eax, [ebp - 0x155c]
push eax
push 0x80000000
lea eax, [ebp - 0x3c44]
push eax
call dword [0x42e020]
test eax, eax
jne 0x416480
call ebx
movzx esi, ax
or esi, edi
test eax, eax
cmovle esi, eax
test esi, esi
js 0x416e2c
xor eax, eax
push eax
push eax
push eax
push eax
push 0x4259dc
call dword [0x42e024]
mov dword [ebp - 0x3b74], eax
test eax, eax
jne 0x4164af
call ebx
movzx esi, ax
or esi, edi
test eax, eax
cmovle esi, eax
test esi, esi
js 0x416e2c
xor eax, eax
mov dword [ebp - 0x3b5c], eax
mov edi, eax
and dword [ebp - 0x3bc4], 0
and dword [ebp - 0x3b94], 0
mov dword [ebp - 0x3bd0], 4
test edi, edi
je 0x4164dc
push edi
call dword [0x42e028]
invalid
invalid

Function at 0x416543
Capabilities:
Check http status code

Disassembly:
inc edx
add byte [ebx - 0x57427608], cl
test al, 0xc4
Function at 0x406aa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406405
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406b16
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406b16
cmp dword [ebp + 0x18], 1
je 0x406b1b
cmp dword [ebp + 0x18], 2
je 0x406b1b
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406b20
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406b83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406bcd
test edi, edi
jne 0x406b90
mov word [esi], ax
jmp 0x406bcf
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406cca
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406cec
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406f69
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x432424], 0
push esi
jne 0x406fa3
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406f7a
mov dword [ecx*4 + 0x432420], edx
inc ecx
cmp ecx, 0x100
jl 0x406f75
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406fcd
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x432420]
inc esi
sub edx, 1
jne 0x406fb5
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x406c30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
je 0x406c5c
mov esi, dword [esp + 8]
push 5
mov eax, dword [esi - 0x5c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi - 0x60]
call fcn.00406240
mov eax, 1
pop esi
ret 8
mov esi, dword [esp + 8]
push 0
mov ecx, dword [esi - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x620]
test eax, eax
je 0x406c80
push 1
lea ecx, [esi - 0x60]
call fcn.00406240
mov eax, 1
pop esi
ret 8

Function at 0x409030
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x44cd05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], eax
lea ebx, [esi + 0x20]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004081a0
lea eax, [esi + 0x5c]
cmp eax, edi
je 0x409079
lea ecx, [eax - 0x5c]
jmp 0x40907b
xor ecx, ecx
push eax
add ecx, 8
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 2
call fcn.00422c80
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 3
call fcn.00422c80
lea ecx, [esi + 0x9c]
mov byte [esp + 0x18], 4
call fcn.00422c80
lea ecx, [esi + 0xb8]
mov byte [esp + 0x18], 5
call fcn.00422c80
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi], 0x4506e0
mov eax, esi
pop edi
mov dword [ebx], 0x4506dc
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40bc90
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x40bcce
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x40bcd0
xor eax, eax
add esp, 0x114
ret

Function at 0x40cb00
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x44d309
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004081a0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
lea eax, [esi + 0x5c]
cmp eax, edi
je 0x40cb43
lea ecx, [eax - 0x5c]
jmp 0x40cb45
xor ecx, ecx
push eax
add ecx, 0x44
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
call fcn.00422c80
lea ecx, [esi + 0x8c]
mov byte [esp + 0x14], 3
call fcn.00422c80
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xa8], 1
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xac], edi
mov dword [esi], 0x450744
mov dword [esi + 0x3c], 0x450738
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40de60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44d468
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
xor ebp, ebp
cmp eax, ebp
jne 0x40de94
mov edi, 3
jmp 0x40deac
cmp dword [esi + 0x64], ebp
je 0x40dea0
mov edi, 2
jmp 0x40deac
mov eax, dword [esi + 0x68]
xor ecx, ecx
cmp eax, ebp
setne cl
mov edi, ecx
mov eax, dword [esi + 0x40]
lea edx, [esp + 0x10]
push ebx
push edx
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0xa8]
push edi
lea edx, [esi + 0x70]
push ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0040e070
mov eax, dword [0x458050]
mov dword [esp + 0x10], eax
mov ecx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
cmp ecx, 1
mov dword [esp + 0x2c], ebp
mov edi, 0x80
jg 0x40df0b
cmp dword [eax - 4], edi
jge 0x40df71
mov ebp, dword [eax - 8]
cmp ebp, edi
jle 0x40df18
test ebp, ebp
mov edi, ebp
je 0x40df43
lea edx, [edi + edi + 0xe]
push edx
call fcn.0043936a
add esp, 4
test eax, eax
je 0x40e061
mov dword [eax], 1
mov word [eax + edi*2 + 0xc], 0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
add eax, 0xc
lea ecx, [ebp + ebp + 2]
lea edx, [ebx + 0xc]
push ecx
lea ecx, [edi + edi + 2]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00402e50
mov edx, dword [esp + 0x20]
add esp, 0x10
push ebx
mov dword [edx - 8], ebp
call fcn.00403f10
mov eax, dword [esp + 0x10]
xor ebp, ebp
push 0x80
push eax
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0x10]
pop ebx
mov eax, dword [ecx - 0xc]
lea edi, [ecx - 0xc]
cmp eax, 1
jle 0x40dfcc
lea ecx, [esp + 0xc]
call fcn.00403ed0
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push edx
call fcn.00403db0
test eax, eax
je 0x40dfcc
mov eax, dword [edi + 4]
add edi, 0xc
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push ecx
push edi
mov edx, dword [eax - 4]
lea ecx, [edx + edx + 2]
push ecx
push eax
call fcn.00402e50
add esp, 0x10
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0xc]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0xc]
mov word [edx + eax*2], bp
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], ebp
je 0x40e022
mov ecx, dword [esi + 0x24]
push 0xff
push 1
push ebp
push ebp
push 1
lea eax, [esp + 0x24]
push 0x424242
push eax
mov eax, dword [esp + 0x4c]
add esi, 0x20
push ecx
lea edx, [esp + 0x2c]
push esi
push edx
push eax
call fcn.00427db0
mov eax, dword [esp + 0x38]
add esp, 0x2c
mov edx, dword [0x458054]
lea ecx, [eax - 0xc]
pop edi
pop esi
cmp ecx, edx
pop ebp
je 0x40e050
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40e050
mov edx, dword [esp]
add edx, 0xfffffff4
push edx
call fcn.0042d78e
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
xor eax, eax
jmp 0x40df6f
Function at 0x40e4d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x44d4b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004081a0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
lea eax, [esi + 0x5c]
cmp eax, edi
je 0x40e513
lea ecx, [eax - 0x5c]
jmp 0x40e515
xor ecx, ecx
push eax
add ecx, 0x44
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x64]
mov byte [esp + 0x14], 2
call fcn.00422c80
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 3
call fcn.00422c80
lea ecx, [esi + 0x9c]
mov byte [esp + 0x14], 4
call fcn.00422c80
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi], 0x450754
mov dword [esi + 0x3c], 0x450748
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40f180
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004081a0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x58], eax
lea eax, [esi + 0x5c]
mov dword [esi + 0x54], edi
cmp eax, edi
je 0x40f1a5
lea ecx, [eax - 0x5c]
jmp 0x40f1a7
xor ecx, ecx
push eax
push 0x40
add ecx, 0x44
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x458050]
mov eax, esi
mov dword [esi + 0x64], ecx
mov dword [esi + 0x28], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi], 0x450768
mov dword [esi + 0x3c], 0x45075c
pop edi
pop esi
ret

Function at 0x40f920
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
mov dword [esi + 0x18], edi
cmp eax, edi
je 0x40f940
lea ecx, [eax - 0x20]
jmp 0x40f942
xor ecx, ecx
push eax
push 0x40
add ecx, 8
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi], 0x45076c
mov dword [esi + 0x2c], 0x42c80000
mov eax, esi
pop edi
pop esi
ret

Function at 0x40f9d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
cmp eax, 0x64
mov esi, ecx
jne 0x40fa2d
fld dword [esi + 0x2c]
fsub dword [0x450778]
fst dword [esi + 0x2c]
fcomp dword [0x450758]
fnstsw ax
test ah, 0x41
jne 0x40f9fe
call fcn.0040faa0
pop esi
ret 4
mov eax, dword [esi + 4]
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 0x30]
test esi, esi
je 0x40fa2d
push 0
push 0
push 0xbd1
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret 4
Function at 0x411600
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x44d85c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x18], ebx
or eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov byte [esi + 0x94], bl
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
lea edi, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.0041bb30
mov dword [esi], 0x450814
mov dword [edi], 0x450808
mov dword [esi + 0x58], 0x4507e0
lea eax, [esi + 0x98]
mov dword [esp + 0x18], 2
cmp eax, ebx
je 0x411692
lea ebx, [eax - 0x98]
push eax
lea ecx, [ebx + 8]
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.0040f180
lea ecx, [esi + 0x110]
mov byte [esp + 0x18], 4
call fcn.0040f180
lea ecx, [esi + 0x180]
mov byte [esp + 0x18], 5
call fcn.0040f180
lea ecx, [esi + 0x1f0]
mov byte [esp + 0x18], 6
call fcn.0040cb00
lea ecx, [esi + 0x2b0]
mov byte [esp + 0x18], 7
call fcn.0040cb00
lea ecx, [esi + 0x370]
mov byte [esp + 0x18], 8
call fcn.0040cb00
lea ecx, [esi + 0x430]
mov byte [esp + 0x18], 9
call fcn.0040cb00
mov eax, dword [0x458050]
mov dword [esi + 0x4f0], eax
lea ecx, [esi + 0x4f4]
mov byte [esp + 0x18], 0xb
call fcn.00409f50
mov ecx, dword [esp + 0x10]
mov dword [edi], 0x4507d4
mov dword [esi], 0x4507c8
mov dword [esi + 0x58], 0x4507a0
mov dword [esi + 0x74], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x411a30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x411c56
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp eax, 0x111
jne 0x411b10
cmp di, 0x3ed
jne 0x411a75
call fcn.00411ca0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3f6
jne 0x411a8f
mov ecx, esi
call fcn.00411e60
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3ef
jne 0x411aa9
mov ecx, esi
call fcn.00411fc0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3ea
jne 0x411ac3
mov ecx, esi
call fcn.004134e0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3ee
jne 0x411b53
push 1
mov ecx, esi
call fcn.004119e0
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x2c], esp
push 0x3ee
mov dword [eax], ebx
mov eax, edi
shr eax, 0x10
push eax
call fcn.00412ec0
mov ecx, esi
mov dword [ebp], 0
call fcn.004119d0
test eax, eax
je 0x411b4f
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp eax, 0x110
jne 0x411b53
push 1
mov ecx, esi
call fcn.004119e0
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edi
call fcn.00407220
mov ecx, esi
call fcn.00412d40
mov ecx, esi
mov dword [ebp], eax
call fcn.004119d0
test eax, eax
je 0x411b4f
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push ebp
push ebx
push edi
push eax
push ecx
lea ecx, [esi + 0x1c]
call fcn.0041bbf0
test eax, eax
jne 0x411c0e
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0x78]
cmp ecx, 5
jne 0x411be7
test eax, eax
je 0x411b83
lea esi, [eax - 0x78]
jmp 0x411b85
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x411bba
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x411bab
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x411bbf
test edi, edi
jne 0x411bba
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x411bbf
cmp edi, 1
je 0x411c07
mov eax, ebx
shr eax, 0x10
movsx ecx, ax
movsx edx, bx
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.00414590
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ecx, 0x24
jne 0x411c1a
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x411c07
cmp dword [eax + 0x18], ecx
je 0x411c07
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x1c], edx
mov dword [ebp], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ecx, 0xf
jne 0x411c56
push 1
mov ecx, esi
call fcn.004119e0
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x1c], esp
mov dword [eax], edi
call fcn.00413430
mov ecx, esi
mov dword [ebp], 0
call fcn.004119d0
test eax, eax
je 0x411c56
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x411ca0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
mov al, byte [0x45f8b0]
push ebx
mov ebx, ecx
push esi
test al, 1
push edi
mov dword [esp + 0x14], ebx
jne 0x411cd7
mov dl, al
mov ecx, 0x45f8c0
or dl, 1
mov byte [0x45f8b0], dl
call fcn.00429af0
push 0x403fb0
call fcn.00438cb0
add esp, 4
push ebp
push 0xd
mov ecx, 0x45f8c0
call fcn.00429dc0
mov eax, dword [ebx + 4]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
add ebx, 0x4f0
mov dword [esp + 0x14], eax
mov esi, 0x104
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x411d14
cmp dword [eax - 4], esi
jge 0x411d7a
mov edi, dword [eax - 8]
cmp edi, esi
mov dword [esp + 0x10], edi
jle 0x411e28
test edi, edi
mov esi, edi
jne 0x411e28
mov ecx, dword [0x458050]
mov dword [ebx], ecx
lea ecx, [edi + edi + 2]
lea eax, [esi + esi + 2]
cmp eax, ecx
jb 0x411d58
mov edi, dword [ebx]
mov edx, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx]
mov dword [eax - 8], edi
mov eax, dword [0x458054]
cmp ebp, eax
je 0x411d7a
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411d7a
push ebp
call fcn.0042d78e
add esp, 4
mov eax, dword [ebx]
mov ecx, dword [esp + 0x14]
push 0x104
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebx]
pop ebp
mov ecx, dword [eax - 0xc]
lea esi, [eax - 0xc]
cmp ecx, 1
jle 0x411dfc
mov ecx, dword [0x458054]
add eax, 0xfffffff4
cmp eax, ecx
je 0x411dc8
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x411dc1
mov edx, dword [ebx]
sub edx, 0xc
push edx
call fcn.0042d78e
add esp, 4
mov eax, dword [0x458050]
mov dword [ebx], eax
mov ecx, dword [esi + 4]
push ecx
mov ecx, ebx
call fcn.00403db0
test eax, eax
je 0x411dfc
mov edi, dword [ebx]
mov edx, dword [esi + 4]
mov eax, dword [edi - 4]
lea ecx, [edx + edx + 2]
lea edx, [eax + eax + 2]
cmp edx, ecx
jb 0x411dfc
mov eax, ecx
add esi, 0xc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebx]
push 0
mov dword [edx - 8], eax
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
mov word [ecx + eax*2], 0
mov eax, dword [edx + 0x70]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
lea edx, [esi + esi + 0xe]
push edx
call fcn.0043936a
add esp, 4
test eax, eax
je 0x411e56
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
mov dword [ebx], eax
jmp 0x411d35
xor eax, eax
jmp 0x411d7c
Function at 0x411fc0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x44d9cb
push eax
mov eax, 0x4024
mov dword fs:[0], esp
call fcn.0043a440
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x3ee
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x2034]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2034]
push 0x1000
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov al, byte [0x45f8b0]
test al, 1
jne 0x412045
mov dl, al
mov ecx, 0x45f8c0
or dl, 1
mov byte [0x45f8b0], dl
call fcn.00429af0
push 0x403fb0
call fcn.00438cb0
add esp, 4
push 9
mov ecx, 0x45f8c0
call fcn.00429dc0
mov edx, dword [esi + 4]
xor ebp, ebp
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
lea eax, [esp + 0x2034]
lea ecx, [esp + 0x2034]
push edx
mov dword [esp + 0x24], 0x4584c0
mov dword [esp + 0x28], 0x59
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edx, eax
cmp edx, ebp
je 0x41214f
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x41214f
mov ecx, dword [0x458050]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x4044], ebp
call fcn.00412170
test eax, eax
je 0x4120f8
lea ecx, [esp + 0x34]
push ecx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
jmp 0x412115
lea edx, [esp + 0x34]
push edx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0xa0]
push eax
call fcn.0040f570
push ebp
lea ecx, [esi + 0x370]
call fcn.0040ddd0
mov eax, dword [esp + 0x10]
mov edx, dword [0x458054]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x41214f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41214f
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0042d78e
add esp, 4
mov ecx, dword [esp + 0x4034]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4030
ret