joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002018]
push 0x104
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x174], ecx
push 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
call fcn.01001149
cmp eax, 1
jl 0x100129e
push ebx
xor ebx, ebx
cmp byte [ebp - 0x160], bl
push esi
lea esi, [ebp - 0x160]
je 0x1001238
cmp byte [esi], 0x3a
je 0x100121b
inc esi
cmp byte [esi], bl
jne 0x100120f
jmp 0x100121e
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x1001238
push 0x10010ac
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100123e
lea esi, [ebp - 0x160]
push 0x29
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100129c
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x100129c
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x100129c
push ebx
lea eax, [ebp - 0x170]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001324
leave
ret 0x10

Function at 0x1001452
Capabilities:
Terminate process

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
add dword [0x10014c5], esp
nop
cmc
xor eax, eax
push 0x10000
push eax
push eax
push 1
push eax
push 0x80000000
push eax
push 2
push 8
push 0x80
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
push 0x400
push ecx
push 0x80000000
push 0x40
push ecx
push ecx
push ecx
push 0x4000
push 1
push ecx
push 0x400
push 0x400
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x409440
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542e5b
mov eax, dword fs:[0]
push eax
mov eax, 0x30d74
call fcn.00525f60
mov eax, dword [0x5a674c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x556670
push str.stack.log
call fcn.005264ba
mov esi, eax
add esp, 8
test esi, esi
je 0x40966b
lea eax, [ebp - 0x30d80]
push eax
push 0x5546e0
push esi
mov dword [ebp - 0x30d80], 0xffffffff
call fcn.005273a7
push esi
call fcn.0052622a
push 0x556670
push 0x556654
call fcn.005264ba
add esp, 0x18
test eax, eax
je 0x40966b
push eax
call fcn.0052622a
push 0x556670
push 0x556644
call fcn.005264ba
add esp, 0xc
test eax, eax
je 0x40966b
push eax
call fcn.0052622a
push str.Send_Log_File
push edi
call fcn.004093b0
push 2
push 0
push str.crash.zip
call fcn.00424a60
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40966b
push 2
push 0
push str.stack.log
push str.stack.log
push esi
call fcn.00425c70
add esp, 0x14
test eax, eax
je 0x409570
push esi
call fcn.00423fe0
add esp, 4
push esi
test al, al
je 0x409558
call fcn.00425d10
add esp, 4
push str.crash.zip
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40966b
call fcn.00421d00
add esp, 4
push str.crash.zip
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40966b
push 2
push 0
push 0x556654
push 0x556654
push esi
call fcn.00425c70
add esp, 0x14
test eax, eax
jne 0x409532
push 2
push eax
push 0x556644
push 0x556644
push esi
call fcn.00425c70
add esp, 0x14
push esi
test eax, eax
jne 0x409533
call fcn.00423fe0
add esp, 4
push esi
test al, al
je 0x4095ba
call fcn.00425d10
jmp 0x4095bf
call fcn.00421d00
add esp, 4
lea ecx, [ebp - 0x30d7c]
call fcn.00414330
lea ecx, [ebp - 0x30d7c]
mov dword [ebp - 4], 0
call fcn.004144f0
mov ecx, dword [ebp - 0x30d80]
push ecx
push 0x556624
lea ecx, [ebp - 0x30d7c]
call fcn.004147d0
push 1
push str.crash.zip
push str.crashfile
lea ecx, [ebp - 0x30d7c]
call fcn.004145e0
push 2
push str.nation
lea ecx, [ebp - 0x30d7c]
call fcn.004147d0
push str.MERONG_0.9__p_
push 3
push str.http:__live.contents.pangya.gametree.co.kr:50005_post_CrashReport.asp
lea ecx, [ebp - 0x30d7c]
call fcn.004143a0
test eax, eax
je 0x409645
lea ecx, [ebp - 0x30d7c]
call fcn.00412df0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.stack.log
call esi
push str.crash.zip
call esi
lea ecx, [ebp - 0x30d7c]
mov dword [ebp - 4], 0xffffffff
call fcn.00414360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525092
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push ebx
push esi
push edi
push ebp
mov esi, ecx
push eax
xor ebx, ebx
push 0x104
xor ebp, ebp
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 0x114], bl
je 0x401a9a
mov edx, 0x26
cmp edi, 0x104
ja 0x401a9a
mov cl, byte [esp + ebp + 0x114]
mov byte [esp + edi + 0x10], cl
cmp cl, dl
jne 0x401a8f
mov byte [esp + edi + 0x11], dl
inc edi
inc ebp
inc edi
cmp byte [esp + ebp + 0x114], bl
jne 0x401a73
mov cl, byte [esp + ebp + 0x114]
test eax, eax
mov byte [esp + edi + 0x10], cl
je 0x401ad8
cmp eax, 0x104
ja 0x401ad8
cmp edi, 0x104
ja 0x401ad8
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00401af0
lea eax, [esp + 0x10]
mov ecx, dword [esi + 0x1c]
push eax
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x401da0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x7c
mov dword [esp + 8], ecx
push ebx
mov eax, dword [esp + 0xc]
push esi
push edi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
mov ecx, dword [eax + 0x1c]
push 0x3f6
push ecx
call esi
push eax
call sub.MFC30.DLL_CWnd::FromHandle
mov ecx, dword [esp + 0x18]
push 0x3f9
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x1c]
push eax
call esi
push eax
call sub.MFC30.DLL_CWnd::FromHandle
mov esi, eax
lea ecx, [esp + 0x1c]
push ecx
xor edi, edi
push 0x6e
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0x1c], 0
mov dword [esp + 0x10], edi
je 0x401e9a
push 0xc
mov ebx, 0
call sub.MSVCRT20.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x401e20
lea ecx, [esp + edi + 0x1c]
push ecx
mov ecx, eax
call sub.MFC30.DLL_CString::CString_1
mov ebx, eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebx + 4]
push 0
inc eax
mov ecx, ebx
add edi, eax
call sub.MFC30.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x401e7b
push 0
mov ecx, ebx
inc dword [esp + 0x14]
call sub.MFC30.DLL_CString::GetBuffer
push eax
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0
push 0x143
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
mov ecx, dword [esi + 0x1c]
push 0
push 0x143
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test ebx, ebx
je 0x401e8f
mov ecx, ebx
call fcn.00405c36
push ebx
call sub.MSVCRT20.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + edi + 0x1c], 0
jne 0x401dff
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x124], 0
jbe 0x401ed1
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x14e
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ecx, dword [esi + 0x1c]
push 0
push 0x14e
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x7c
ret
Function at 0x4023e0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4024af
push eax
mov dword fs:[0], esp
sub esp, 0x11c
lea eax, [ebp - 0x128]
push ebx
push esi
push 0
mov esi, ecx
push eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0x5c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.MSVCRT20.dll_strchr]
add esp, 8
push eax
call dword [sym.imp.USER32.dll_CharNextA]
lea ecx, [ebp - 0x128]
mov byte [eax], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4024c1
lea ecx, [ebp - 0x18]
call fcn.00405ce4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00405ce4
push 0xe72c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC30.DLL_CString::LoadStringA
push 0xe70e
lea ecx, [ebp - 0x24]
call sub.MFC30.DLL_CString::LoadStringA
push 0x10
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, esi
call sub.MFC30.DLL_CWnd::MessageBoxA
mov byte [ebp - 4], 0
call fcn.004024a7
mov dword [ebp - 4], 0xffffffff
call fcn.004024b9
xor eax, eax
jmp 0x4024c6
mov eax, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404900
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
mov dword [esp], 0
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4090a4]
mov edi, dword [esp + 0x34]
add ecx, 0xfa
cmp eax, ecx
jbe 0x4049e7
test edi, edi
jne 0x40497d
lea eax, [esp + 0x14]
push 1
push 0
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push eax
call ebp
test eax, eax
je 0x4049dc
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call ebx
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x40495a
jmp 0x4049dc
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [edi + 0x20], 0
je 0x40499b
test byte [edi + 0x1c], 1
je 0x4049d5
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0
push eax
call ebp
test eax, eax
je 0x4049d5
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4049c5
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40498f
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call ebx
jmp 0x40498f
mov eax, dword [edi + 0x20]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4090a4], eax
test edi, edi
je 0x4049f6
mov eax, dword [edi + 0x20]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x404ca0
Capabilities:
Check for time delay via gettickcount
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x404d18
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x404d2b
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x404d3e
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x404d51
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x404d64
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1f8
push ebx
push esi
mov ebx, dword [esp + 0x204]
push edi
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x404dcf
mov edi, dword [esp + 0x210]
and edi, 0xffff
cmp dword [ebx + edi*4 + 4], ebp
lea esi, [ebx + edi*4]
je 0x404dcf
cmp dword [esp + 0x214], ebp
jne 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x28]
cmp eax, dword [ebx + 0x24]
jbe 0x404dcf
lea eax, [esp + 0x218]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
push eax
mov byte [esp + 0x14], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
cmp edi, 4
ja case.default.0x404d11
jmp dword [edi*4 + 0x404ddc]
push 0x413
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x414
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x415
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x416
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
push 0x417
mov eax, dword [ebx + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
jmp 0x404d7e
mov edi, dword [esp + 0x10c]
test edi, edi
je 0x404dc1
lea eax, [esp + 0x10c]
push 0xfb
mov byte [esp + 0x110], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404dc1
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1f8
ret
Function at 0x405e98
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408a80
push 0x406030
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [0x407118], 0xffffffff
mov eax, dword [0x407118]
mov dword [0x40711c], eax
call dword [sym.imp.MSVCRT20.dll___p__fmode]
mov ecx, dword [0x4090d0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT20.dll___p__commode]
mov ecx, dword [0x4090cc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT20.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x407114], eax
call fcn.0040602f
call fcn.0040601c
push 0x4092d8
push 0x4092d4
call sub.MSVCRT20.dll__initterm
add esp, 8
mov eax, dword [0x4090c8]
push eax
mov eax, dword [0x4090c4]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCRT20.dll___getmainargs]
add esp, 0x14
push 0x4092d0
push 0x4092c4
call sub.MSVCRT20.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT20.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x405f74
mov al, byte [ebp - 0x3c]
inc esi
mov al, byte [esi]
test al, al
je 0x405f6c
cmp al, 0x22
jne 0x405f61
cmp byte [esi], 0x22
jne 0x405f7e
inc esi
jmp 0x405f7e
cmp al, 0x20
jbe 0x405f7e
inc esi
cmp byte [esi], 0x20
ja 0x405f78
cmp byte [esi], 0
je 0x405f8e
cmp byte [esi], 0x20
ja 0x405f8e
inc esi
cmp byte [esi], 0
jne 0x405f83
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
mov eax, 0xa
je 0x405fb1
movzx eax, word [ebp - 0x54]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT20.dll_exit]
jmp 0x405fef
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x46bf2352
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x337e321e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219