joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403060
Capabilities:
Read file on windows

Disassembly:
push 0x1c
push 0x403ab8
call fcn.00403848
mov esi, ecx
mov dword [ebp - 0x24], esi
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x4030ff
cmp dword [esi + 4], 0xffffffff
je 0x4030ff
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x4030ff
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x18]
add eax, 2
push eax
call fcn.00403a21
pop ecx
mov edi, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4030cd
test edi, edi
je 0x4030ff
mov dword [ebp - 0x20], ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x18]
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4030f8
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x403111
mov dword [esi + 0x28], 1
push edi
call fcn.00403a4a
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
mov byte [eax + edi], bl
mov dword [esi + 0x28], ebx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x403142
mov ecx, ebx
mov dword [ebp - 0x24], ebx
lea edx, [eax - 1]
test edx, edx
je 0x403142
mov dl, byte [ecx + edi]
cmp dl, 0xd
je 0x403158
cmp dl, 0xa
je 0x403158
inc ecx
mov dword [ebp - 0x24], ecx
lea edx, [eax - 1]
cmp ecx, edx
jb 0x40312a
cmp byte [eax + edi - 1], 0x1a
jne 0x4031c7
dec eax
mov dword [ebp - 0x20], eax
mov dword [esi + 0x28], 1
mov ecx, ebx
jmp 0x4031ca
mov al, byte [ecx + edi + 1]
mov byte [ebp - 0x19], al
cmp al, 0xa
jne 0x403167
inc ecx
mov dword [ebp - 0x24], ecx
push ebx
push ebx
mov eax, dword [ebp - 0x28]
inc eax
add eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403182
mov eax, ebx
jmp 0x40319b
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp byte [ebp - 0x19], 0xa
sete cl
inc ecx
sub eax, ecx
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov byte [eax + edi + 1], bl
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
push edi
call fcn.00403a4a
pop ecx
lea eax, [esi + 1]
jmp 0x403101
mov ecx, dword [ebp - 0x28]
mov dword [esi + 0x1c], ecx
mov byte [eax + edi], bl
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
push edi
call fcn.00403a4a
pop ecx
mov eax, esi
jmp 0x403101
Function at 0x403500
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x403ad8
call fcn.00403848
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x404380
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x403328
cmp eax, esi
jne 0x40331b
xor esi, esi
inc esi
mov edi, esi
jmp 0x40332b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4032ff
xor esi, esi
inc esi
cmp dword [0x404384], esi
jne 0x40333d
push 0x1f
call fcn.00494000
pop ecx
jmp 0x403377
cmp dword [0x404384], ebx
jne 0x403371
mov dword [0x404384], esi
push 0x4010f4
push 0x4010e8
call fcn.0040345c
pop ecx
pop ecx
test eax, eax
je 0x403377
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40344c
mov dword [0x404014], esi
cmp dword [0x404384], esi
jne 0x40339a
push 0x4010e4
push 0x4010dc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x404384], 2
test edi, edi
jne 0x4033a7
xor eax, eax
mov ecx, 0x404380
xchg dword [ecx], eax
cmp dword [0x404388], 0
je 0x4033d3
push 0x404388
call fcn.004036a0
pop ecx
test eax, eax
je 0x4033d3
push ebx
push 2
push ebx
mov esi, dword [0x404388]
mov ecx, esi
call dword [0x4050f4]
call esi
push dword [0x404020]
push dword [0x40401c]
push dword [0x404018]
call fcn.00401560
add esp, 0xc
mov dword [0x404010], eax
cmp dword [0x404028], 0
jne 0x403431
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404014], 0
jne 0x403445
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00403795
jmp 0x4032e3

Function at 0x403584
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x403af8
call fcn.00403848
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4035e4
cmp eax, 0xffffffff
je 0x4035e4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4035dd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4035dd
cmp edx, 0x10000000
jae 0x4035dd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4035da
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403650
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40368e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403686
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403690
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x403676
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403760
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403791
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403791
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x403791
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x412867
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004126e6

Function at 0x416c5f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004165cd

Function at 0x416c6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416808

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4050f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x405126
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x40512e
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x40515d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x405183
mov eax, 0x4091d4
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x4051ac
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x4051ac
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4051ac
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00404daf
leave
ret
Function at 0x406e90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x10325476
push 0x40
push 0
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
mov ecx, dword [ebp - 4]
call fcn.004083a0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x5c], 0x80
add esp, 4
cmp ebp, esp
call fcn.00614e40
mov esp, ebp
pop ebp
ret
Function at 0x406f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push edi
push ecx
lea edi, [ebp - 0x84]
mov ecx, 0x21
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov byte [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
push 0x6727b8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00619890
add esp, 0xc
cmp dword [ebp - 0x24], 0
jne 0x406f69
xor al, al
jmp 0x4070a5
push 2
push 0
mov eax, dword [ebp - 0x24]
push eax
call fcn.00615920
add esp, 0xc
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.006192a0
add esp, 4
mov dword [ebp - 0x2c], eax
push 0
push 0
mov edx, dword [ebp - 0x24]
push edx
call fcn.00615920
add esp, 0xc
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00619270
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 1
mov eax, dword [ebp - 0x30]
push eax
call fcn.00616930
add esp, 0x10
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 4]
call fcn.00407130
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call fcn.00407260
cmp dword [ebp - 0x30], 0
je 0x406feb
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004218d0
add esp, 4
mov edx, dword [ebp - 0x24]
push edx
call fcn.00619060
add esp, 4
mov byte [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov byte [ebp - 0x64], 0
xor ecx, ecx
mov word [ebp - 0x63], cx
mov dword [ebp - 0x6c], 0
jmp 0x407031
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0x10
jge 0x40708b
push 0x10
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x6c]
movzx edx, byte [ebp + ecx - 0x18]
push edx
call fcn.00656e10
add esp, 0xc
movsx eax, byte [ebp - 0x63]
test eax, eax
jne 0x407079
push 0x6727b4
lea ecx, [ebp - 0x58]
push ecx
call fcn.00617700
add esp, 8
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.00617700
add esp, 8
jmp 0x407089
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00617700
add esp, 8
jmp 0x407028
lea eax, [ebp - 0x58]
push eax
call fcn.006568c0
add esp, 4
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00408430
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4070cc]
call fcn.00614e70
pop eax
pop edx
pop edi
add esp, 0x84
cmp ebp, esp
call fcn.00614e40
mov esp, ebp
pop ebp
ret 8
Function at 0x40d340
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x657828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push esi
push edi
lea edi, [ebp - 0x110]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x30]
call fcn.00403b90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00403b90
mov byte [ebp - 4], 1
push 0x6e88f8
lea ecx, [ebp - 0x30]
call fcn.00408430
push str.ImageAutopatchUpDataLuch.exe
lea ecx, [ebp - 0x30]
call fcn.00403c10
push 0x6e8f80
lea ecx, [ebp - 0x58]
call fcn.00408430
push 0x672fe0
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x6e9080
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x673038
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x6e88f8
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x671a34
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x6e9080
lea ecx, [ebp - 0x58]
call fcn.00403c10
push 0x10
push 0
lea eax, [ebp - 0xbc]
push eax
call fcn.00614f30
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0xa4]
push ecx
call fcn.00614f30
add esp, 0xc
mov dword [ebp - 0xa4], 0x44
cmp dword [ebp - 0x40], 0x10
jb 0x40d443
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x10c], edx
jmp 0x40d44c
lea eax, [ebp - 0x54]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x18], 0x10
jb 0x40d45d
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x110], ecx
jmp 0x40d466
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x110], edx
mov esi, esp
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xa4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.00614e40
test eax, eax
je 0x40d4cf
mov esi, esp
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00614e40
mov esi, esp
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00614e40
jmp 0x40d50a
push 0
push 0
push str.Failed_to_run
call fcn.00440ad0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.00614e40
mov dword [ebp - 0xc4], eax
mov esi, esp
push 0
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.00614e40
push 0
push 0
push 0x10
call fcn.00448330
mov ecx, eax
call fcn.004323e0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004062e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00411ae0
mov dword [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004062e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00411ae0
push edx
mov ecx, ebp
push eax
lea edx, [0x40d588]
call fcn.00614e70
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x110
cmp ebp, esp
call fcn.00614e40
mov esp, ebp
pop ebp
ret
Function at 0x420d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658bf4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00406e40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x9c
call fcn.004032f0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xa0
call fcn.004214c0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc0
call fcn.00419f20
mov esi, esp
push 0x6e95a8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.00614e40
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.00614e40
mov esp, ebp
pop ebp
ret

Function at 0x423cf0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x423d20
push 0x477
push 0x67a740
call fcn.00458050
test eax, eax
je 0x423d20
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6c], 0
jne 0x423d66
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042ed50
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.0042eda0
jmp 0x423d80
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4
Function at 0x423d90
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x423dc0
push 0x48c
push 0x67a740
call fcn.00458050
test eax, eax
je 0x423dc0
int3
push 0x672fef
mov ecx, dword [ebp + 0xc]
call fcn.0042ebc0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x68], 0
jne 0x423e27
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x423e25
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0042ed50
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0042eda0
jmp 0x423e48
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00435380
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x423e48
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00423cf0
mov ecx, dword [ebp + 0xc]
call fcn.0042ed80
mov esp, ebp
pop ebp
ret 8

Function at 0x42b7f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x42b875
call fcn.00448270
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42b875
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42b84e
xor eax, eax
jmp 0x42b8a6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b875
push 0x117f
push 0x67a740
call fcn.00458050
test eax, eax
je 0x42b875
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0042b8b0
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x42b8a3
cmp dword [ebp - 0xc], 0
je 0x42b8a3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047e330
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x435860
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667828
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6e5134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4358b8
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x6c], 0
jne 0x4358b8
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.00458050
test eax, eax
je 0x4358b8
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0
jne 0x4358da
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x43593d
lea ecx, [ebp - 0x10]
call fcn.0042eb20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6c]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0044af20
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00435950
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00417640
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x43eaf0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jne 0x43eb15
push 0x8d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00458050
test eax, eax
je 0x43eb15
int3
cmp dword [ebp + 0xc], 0
jne 0x43eb2f
push 0x8e
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00458050
test eax, eax
je 0x43eb2f
int3
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x58], 0
je 0x43ebd1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0043ea40
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43eb5b
mov eax, dword [ebp + 0x10]
jmp 0x43ec07
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x43ebca
cmp dword [ebp - 4], 4
je 0x43ebab
push 0x9c
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00458050
test eax, eax
je 0x43ebab
int3
cmp dword [ebp - 0xc], 4
je 0x43ebc5
push 0x9d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00458050
test eax, eax
je 0x43ebc5
int3
mov eax, dword [ebp - 0x14]
jmp 0x43ec07
mov eax, dword [ebp + 0x10]
jmp 0x43ec07
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x6c], 0
jne 0x43ebee
push 0xa4
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.00458050
test eax, eax
je 0x43ebee
int3
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x6c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
ret 0xc