Function at 0x4e95b0
Capabilities:
Enumerate files on windows
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004e0630
push 0
xor edx, edx
mov ecx, 0x8e
call fcn.004e9100
mov ebp, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
mov esi, eax
test esi, esi
je 0x4e5a0e
lea esp, [esp]
push 0x400
push 0
push esi
call edi
test eax, eax
jne 0x4e5a00
xor ecx, ecx
call fcn.004e4480
mov ebx, dword [0x5ee9a0]
mov dword [0x5ee9a0], 0
call fcn.004e01e0
push 0
xor edx, edx
mov ecx, 0x65
call fcn.004e9100
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x4e5a57
test ebx, ebx
je 0x4e5a4c
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041f0a0
push 0x400
push 0
push esi
call edi
test eax, eax
jne 0x4e5a57
pop edi
mov ecx, esi
pop esi
pop ebp
mov edx, ebx
pop ebx
jmp fcn.004de1e0
push ebx
call fcn.004e0630
call fcn.004f0b80
xor edx, edx
mov ecx, 0xae
mov dword [0x5eee18], eax
call fcn.004e9100
mov ebx, eax
test ebx, ebx
je 0x4e622d
push ebp
push esi
push edi
push 3
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov ebp, dword [sym.imp.USER32.dll_DeleteMenu]
cmp eax, 0xad
mov eax, dword [0x5bfdbc]
jne 0x4e60c6
test eax, eax
jne 0x4e60b1
mov eax, dword [0x5f8b8c]
test eax, eax
je 0x4e60fc
mov eax, dword [0x5bfdd0]
test eax, eax
je 0x4e60fc
push 0x400
push 3
push ebx
call ebp
jmp 0x4e60fc
test eax, eax
jne 0x4e60d3
mov eax, dword [0x5f8b8c]
test eax, eax
je 0x4e60dc
mov eax, dword [0x5bfdd0]
test eax, eax
jne 0x4e60fc
xor edx, edx
mov ecx, 0xefb
call fcn.0041f1a0
push eax
push 0xad
push 0x400
push 3
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov edi, eax
test edi, edi
jle 0x4e612e
lea esi, [edi - 1]
lea esp, [esp]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xb0
je 0x4e612e
push 0x400
push esi
push ebx
call ebp
dec edi
dec esi
test edi, edi
jg 0x4e6110
mov eax, dword [0x5f92e4]
test eax, eax
je 0x4e622a
push 0x5a4bec
push 0
push 0x800
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov esi, dword [0x5f92e4]
test esi, esi
mov edi, 1
mov ebp, 0x1770
je 0x4e622a
mov eax, dword [esi + 0x71c]
test eax, eax
jne 0x4e6180
push 4
mov edx, 0x5eef00
mov ecx, esi
call fcn.004c9c40
jmp 0x4e6190
mov eax, dword [esi]
push 0x3c
push 0x5eef00
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, 0x5eef00
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e6198
sub eax, edx
cmp eax, 0x32
jbe 0x4e61b0
mov dword [0x5eef32], 0x2e2e2e
cmp edi, 1
jl 0x4e61d5
cmp edi, 9
jg 0x4e61d5
push 0x5eef00
push edi
push 0x5a4fa0
push 0x5ef2e8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4e61f9
cmp edi, 0xa
push 0x5eef00
jne 0x4e61e6
push str.0__s
jmp 0x4e61eb
push str.____s
push 0x5ef2e8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x5f92f8]
mov edx, dword [esi]
xor eax, eax
cmp ecx, edx
setne al
push 0x5ef2e8
push ebp
dec eax
and eax, 8
push eax
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov esi, dword [esi + 0xe08]
inc edi
inc ebp
test esi, esi
jne 0x4e6166
pop edi
pop esi
pop ebp
pop ebx
ret
sub esp, 0x150
push ebp
call fcn.004e0630
call fcn.004f0b80
xor edx, edx
mov ecx, 0xbe
mov dword [0x5eee18], eax
call fcn.004e9100
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x4e647e
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetMenuItemCount]
push edi
push ebp
call esi
test eax, eax
jle 0x4e629d
mov ebx, dword [sym.imp.USER32.dll_GetMenuItemID]
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
lea esp, [esp]
push 6
push ebp
call ebx
cmp eax, 0xc2
je 0x4e629d
push 0x400
push 6
push ebp
call edi
push ebp
call esi
test eax, eax
jg 0x4e6280
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
cmp edi, 1
jne 0x4e62d1
push 0x5ee048
push str._s.hlp
push 0x5eef00
call ebp
mov ecx, 0xf02
jmp 0x4e630d
cmp edi, 3
jne 0x4e62ee
push 0x5ee048
push str._s.txt
push 0x5eef00
call ebp
mov ecx, 0xf03
jmp 0x4e630d
cmp edi, 4
jne 0x4e6457
push 0x5ee048
push str._s.htm
push 0x5eef00
call ebp
mov ecx, 0xf13
mov edx, 0x5ef2e8
add esp, 0xc
call fcn.0041f1a0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, eax
test ebx, ebx
je 0x4e6457
mov dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push 0x5eef00
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e63a1
lea esp, [esp]
test byte [esp + 0x20], 0x10
jne 0x4e638a
lea edx, [esp + 0x4c]
push edx
call fcn.005a2fa6
movzx eax, byte [esp + 0x50]
push eax
call fcn.00592262
mov ecx, dword [esp + 0x18]
add esp, 8
push 0
lea edx, [esp + 0x50]
mov byte [esp + 0x50], al
call fcn.004d38f0
test eax, eax
je 0x4e638a
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4e6350
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 1
jne 0x4e63cb
push 0x5ee048
push str._s.chm
push 0x5eef00
mov dword [esp + 0x20], 2
call ebp
mov edi, dword [esp + 0x20]
add esp, 0xc
jmp 0x4e6332
mov ecx, dword [esp + 0x10]
push 0
xor edx, edx
call fcn.00531820
xor edi, edi
test eax, eax
mov dword [esp + 0x10], eax
mov esi, eax
je 0x4e640b
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
push edx
add eax, 0x1388
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov ecx, dword [esp + 0x18]
mov esi, dword [esi + 0x40]
inc edi
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
jne 0x4e63e4
lea ecx, [esp + 0x10]
call fcn.004d3d60
test edi, edi
je 0x4e6440
mov ecx, dword [esp + 0x1c]
push 0x5ef2e8
push ebx
push 0x10
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
mov edi, eax
jmp 0x4e62b4
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
mov edi, eax
jmp 0x4e62b4
mov eax, dword [esp + 0x18]
test eax, eax
pop edi
pop esi
pop ebx
jle 0x4e647e
mov edx, dword [esp + 0x10]
push 0x5a4bec
push 0
push 0x800
push 0xc2
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
pop ebp
add esp, 0x150
ret
push ebx
mov ebx, ecx
test ebx, ebx
je 0x4e9699
mov eax, dword [0x5f92ec]
push esi
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push edi
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMenu]
jne 0x4e95e4
mov ecx, dword [0x5f92ec]
push 0
push ecx
call edi
test eax, eax
je 0x4e95f1
push 0
push 0x65
xor edx, edx
mov ecx, eax
call fcn.004e77b0
cmp ebx, eax
jne 0x4e95fd
pop edi
pop esi
pop ebx
jmp 0x4e59d0
mov edx, dword [0x5f92ec]
push edx
call esi
test eax, eax
jne 0x4e9617
push eax
mov eax, dword [0x5f92ec]
push eax
call edi
test eax, eax
je 0x4e9627
push 0
push 0x8e
xor edx, edx
mov ecx, eax
call fcn.004e77b0
cmp ebx, eax
jne 0x4e9633
pop edi
pop esi
pop ebx
jmp fcn.004e5ac0
cmp ebx, dword [0x5ee9a8]
jne 0x4e964a
pop edi
pop esi
xor edx, edx
mov ecx, 1
pop ebx
jmp fcn.004df7b0
mov ecx, dword [0x5f92ec]
push ecx
call esi
test eax, eax
jne 0x4e9665
mov edx, dword [0x5f92ec]
push eax
push edx
call edi
test eax, eax
je 0x4e9675
push 0
push 0xae
xor edx, edx
mov ecx, eax
call fcn.004e77b0
cmp ebx, eax
jne 0x4e9681
pop edi
pop esi
pop ebx
jmp 0x4e6060
xor edx, edx
mov ecx, 0xbe
call fcn.004e9100
cmp ebx, eax
pop edi
pop esi
jne 0x4e9699
pop ebx
jmp 0x4e6230
pop ebx
ret