joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403910
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0x1d6ff853
mov edx, 0x1db8b287
mov eax, dword [ebp - 4]
sub edx, eax
mov ax, word [0x48ba4c]
push esi
push edi
mov esi, dword [edx]
mov edi, ecx
mov ecx, 0xffff
add esi, 0x152e162e
cmp ax, cx
jne 0x403957
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x2c]
mov word [0x48ba4c], ax
test ax, ax
jne 0x403967
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x48d4cc], 0
jne 0x4039a3
lea eax, [esi + esi]
mov ecx, 0x4d7c1f32
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x403999
mov ecx, 0x26e17325
sub ecx, esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48d4c8], eax
mov dword [0x48d4cc], 1
cmp dword [0x48d4c8], 0
jne 0x4039b4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 3
push 0
push 0
push 0
push 6
call fcn.00423a70
add esp, 0x14
neg eax
sbb eax, eax
and eax, 0xc00
push edi
add eax, 0x400
push 0
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4039ac
lea eax, [ebp - 8]
push eax
push edi
call dword [0x48d4c8]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
pop edi
sbb esi, esi
and esi, dword [ebp - 8]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403a10
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push 0x110
mov dword [ebp - 0x128], eax
xor ebx, ebx
lea eax, [ebp - 0x114]
mov dword [ebp - 0x124], edx
push ebx
push eax
mov dword [ebp - 0x120], ecx
call fcn.00434d70
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403b7a
cmp dword [ebp - 0x114], 5
jne 0x403a9a
cmp dword [ebp - 0x110], 2
jne 0x403a9a
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x3000
push 0x52
push 0
call esi
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x403b79
push 0x40
push 0x3000
push 0x14c
push 0
call esi
mov edx, eax
mov dword [ebp - 0x12c], edx
test edx, edx
je 0x403b50
push edi
mov edi, dword [ebp - 0x11c]
mov ecx, 0x14
mov esi, 0x48b9d8
mov eax, dword [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4b
movsw word es:[edi], word [esi]
mov edi, edx
mov esi, 0x48b8a0
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x12c]
mov dword [esi], eax
mov eax, dword [ebp - 0x124]
push esi
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
push edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], ebx
call dword [ebp - 0x11c]
pop edi
test eax, eax
jne 0x403b32
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x403b50
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x403b43
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x403b50
mov ecx, dword [ebp - 0x128]
mov ebx, 1
mov dword [ecx], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push dword [ebp - 0x11c]
call esi
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x403b79
push 0x8000
push 0
push eax
call esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
Function at 0x404630
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa78
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa1c], 0x3442b359
mov edx, 0x348b6d8d
mov eax, dword [ebp - 0xa1c]
sub edx, eax
push esi
mov esi, ecx
lea ecx, [ebp - 0x210]
push edi
mov edi, dword [edx]
call fcn.00404760
test eax, eax
je 0x404740
lea edi, [edi*2 + 0x2354c796]
mov eax, 0x46760104
sub eax, edi
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004373ff
add esp, 0xc
test eax, eax
jne 0x404740
test esi, esi
je 0x4046ca
push esi
lea eax, [ebp - 0x210]
push eax
mov eax, 0x46760120
sub eax, edi
push eax
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea esi, [ebp - 0xa18]
jmp 0x4046cc
xor esi, esi
push 0x44
lea eax, [ebp - 0xa78]
push 0
push eax
call fcn.00434d70
add esp, 0xc
mov dword [ebp - 0xa78], 0x44
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa78]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404740
push dword [ebp - 0xa28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa2c]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00431ac5
mov esp, ebp
pop ebp
ret

Function at 0x404760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x3926ebf8
mov edx, 0x396fa62c
mov eax, dword [ebp - 0xc]
sub edx, eax
push esi
push edi
mov edi, ecx
mov eax, dword [edx]
lea esi, [eax*2 + 0x3e59a1e8]
lea eax, [ebp - 4]
push eax
push 1
push 0
mov eax, 0x617adb86
sub eax, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404822
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, 0x617adc02
sub eax, esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x404822
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x4047e2
cmp eax, 2
jne 0x404822
mov eax, dword [ebp - 8]
test eax, eax
je 0x404822
test al, 1
jne 0x404822
shr eax, 1
dec eax
cmp word [edi + eax*2], 0
jne 0x404822
test eax, eax
je 0x404822
lea ecx, [edi - 2]
lea ecx, [ecx + eax*2]
cmp word [ecx], 0x5c
jne 0x40480f
sub ecx, 2
sub eax, 1
jne 0x404801
test eax, eax
je 0x404822
xor ecx, ecx
mov word [edi + eax*2], cx
pop edi
pop esi
lea eax, [ecx + 1]
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404fd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c320
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x48b088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x405010
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 4], 0
push 2
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetAncestor]
mov esi, eax
mov eax, dword [edi + 8]
sub eax, 1
je 0x405154
sub eax, 1
je 0x405170
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405170
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, eax
je 0x405059
push dword [edi]
push 0x1f4
jmp 0x405162
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test ax, ax
js 0x40504d
push 2
call esi
test ax, ax
js 0x40504d
cmp word [edi + 0x18], 9
jne 0x405119
mov esi, dword [edi + 0x20]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x40508c
mov eax, dword [esi]
push esi
call dword [eax + 4]
xor ecx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x4050b8
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push 0x483464
push esi
call dword [eax]
xor ecx, ecx
test eax, eax
sets cl
dec ecx
and ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x4050f7
mov eax, 3
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
push ecx
mov ecx, edi
call fcn.00405190
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4050f7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x405170
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x20]
mov ecx, 3
mov word [ebp - 0x24], cx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ecx
push eax
push dword [edi + 0x14]
mov ecx, edi
call fcn.00405190
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi]
mov dword [edi + 8], 2
push 0x190
push dword [edi + 4]
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408145
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408186
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x408182
lea ebx, [ebx]
cmp esi, edx
jae 0x408186
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408170
cmp esi, edx
jb 0x40818b
xor eax, eax
pop esi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x4084a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x40851c
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4084d5
push edi
mov ecx, esi
call fcn.00408440
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x4084fd
mov ecx, dword [esi]
test ecx, ecx
je 0x408501
push dword [ecx - 8]
push ecx
call fcn.00437710
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x40851c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40851c
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00408540
int3
Function at 0x408db0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x41c], 0x54b65460
mov esi, 0x54ff0e94
mov eax, dword [ebp - 0x41c]
mov ebx, edx
sub esi, eax
mov eax, dword [0x48ba54]
push edi
mov edi, ecx
mov esi, dword [esi]
add esi, 0x1c4603a4
cmp eax, 0xffffffff
jne 0x408e22
lea eax, [esi + esi]
mov ecx, 0x5babfa1e
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
test ecx, ecx
je 0x408e1b
mov eax, 0x2dfad0df
sub eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x408e1d
xor eax, eax
mov dword [0x48ba54], eax
xor esi, esi
mov dword [ebp - 0x418], 0x208
push edi
push esi
test eax, eax
je 0x408e61
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x408edd
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push edi
call dword [0x48ba54]
jmp 0x408e86
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x408edd
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x408e8f
mov esi, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x408edd
lea eax, [ebp - 0x414]
xor esi, esi
push 0x5c
push eax
call fcn.00432dc2
add esp, 8
test eax, eax
je 0x408eca
add eax, 2
push eax
push dword [ebp + 8]
push ebx
call fcn.00437237
add esp, 0xc
test eax, eax
jne 0x408eca
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret

Function at 0x408fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov dword [ebx], edi
push eax
push dword [ebp - 4]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 4], 0x35116265
mov eax, dword [ebp - 4]
je 0x409886
push esi
mov esi, dword [ecx + 0x40]
cmp dword [esi + 4], 0
je 0x409885
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40987d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [esi + 4]
call fcn.0040a090
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x409fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 8], eax
mov esi, ecx
mov ax, word [ebp + 0x18]
push 0
mov word [ebp - 4], ax
lea eax, [ebp + 0x18]
push eax
push 0x18
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 2
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40a025
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov ecx, esi
call fcn.0040a090
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40a530
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x50], eax
push esi
mov dword [ebp - 0x48], 0x123170b0
mov esi, 0x127a2ae4
mov eax, dword [ebp - 0x48]
sub esi, eax
push edi
mov edi, ecx
mov eax, dword [esi]
add eax, 0x1996fcfa
lea ebx, [eax + eax]
mov eax, 0x564f6092
sub eax, ebx
mov cx, word [edx]
cmp cx, word [eax]
jne 0x40a599
test cx, cx
je 0x40a595
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x40a599
add edx, 4
add eax, 4
test cx, cx
jne 0x40a573
xor eax, eax
jmp 0x40a59e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a699
push eax
mov eax, 0x564f6012
sub eax, ebx
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x40a699
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x40a699
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x40a699
mov eax, 0x564f60da
lea ecx, [ebp - 0x44]
sub eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40a618
test dx, dx
je 0x40a614
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40a618
add ecx, 4
add eax, 4
test dx, dx
jne 0x40a5f2
xor eax, eax
jmp 0x40a61d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a699
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40a699
mov eax, 0x564f60be
lea ecx, [ebp - 0x44]
sub eax, ebx
lea esp, [esp]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40a666
test dx, dx
je 0x40a662
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40a666
add ecx, 4
add eax, 4
test dx, dx
jne 0x40a640
xor eax, eax
jmp 0x40a66b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a699
mov eax, dword [ebp - 0x4c]
mov ecx, 0x409
pop edi
pop esi
pop ebx
mov dword [eax], 0x3e
mov eax, dword [ebp - 0x50]
mov word [eax], cx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
Function at 0x40ae40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, 0x54650b81
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x541c514d
mov eax, dword [ebp - 0x48]
sub edx, eax
push edi
push 4
push ecx
mov esi, dword [edx]
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x40af48
push 0x20
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x40af48
lea esi, [esi*2 + 0x3b529096]
mov eax, 0x5e73fa60
sub eax, esi
lea ecx, [ebp - 0x44]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40aece
test dx, dx
je 0x40aeca
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40aece
add ecx, 4
add eax, 4
test dx, dx
jne 0x40aea8
xor eax, eax
jmp 0x40aed3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40af48
push 0x20
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40af48
mov eax, 0x5e73fa84
lea ecx, [ebp - 0x44]
sub eax, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40af18
test dx, dx
je 0x40af14
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40af18
add ecx, 4
add eax, 4
test dx, dx
jne 0x40aef2
xor eax, eax
jmp 0x40af1d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40af48
mov eax, dword [ebp - 0x4c]
mov ecx, 0x409
pop edi
mov dword [ebx], 0x3f
pop esi
mov word [eax], cx
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
Function at 0x40b000
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x50], eax
push esi
mov dword [ebp - 0x48], 0x4861557c
mov esi, 0x48aa0fb0
mov eax, dword [ebp - 0x48]
sub esi, eax
push edi
mov edi, ecx
mov eax, dword [esi]
add eax, 0x13fae9b3
lea ebx, [eax + eax]
mov eax, 0x4b173dc8
sub eax, ebx
mov cx, word [edx]
cmp cx, word [eax]
jne 0x40b069
test cx, cx
je 0x40b065
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x40b069
add edx, 4
add eax, 4
test cx, cx
jne 0x40b043
xor eax, eax
jmp 0x40b06e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b14b
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x40b14b
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x40b14b
mov eax, 0x4b173b70
lea ecx, [ebp - 0x44]
sub eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40b0ce
test dx, dx
je 0x40b0ca
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40b0ce
add ecx, 4
add eax, 4
test dx, dx
jne 0x40b0a8
xor eax, eax
jmp 0x40b0d3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b14b
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40b14b
mov eax, 0x4b173dd8
lea ecx, [ebp - 0x44]
sub eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40b118
test dx, dx
je 0x40b114
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40b118
add ecx, 4
add eax, 4
test dx, dx
jne 0x40b0f2
xor eax, eax
jmp 0x40b11d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40b14b
mov eax, dword [ebp - 0x4c]
mov ecx, 0x415
pop edi
pop esi
pop ebx
mov dword [eax], 0x27
mov eax, dword [ebp - 0x50]
mov word [eax], cx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
Function at 0x40b9d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x50], eax
push esi
mov dword [ebp - 0x48], 0x5936bdb7
mov esi, 0x597f77eb
mov eax, dword [ebp - 0x48]
sub esi, eax
push edi
mov edi, ecx
mov eax, dword [esi]
add eax, 0x1d126087
lea ebx, [eax + eax]
mov eax, 0x5d462b70
sub eax, ebx
mov cx, word [edx]
cmp cx, word [eax]
jne 0x40ba39
test cx, cx
je 0x40ba35
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x40ba39
add edx, 4
add eax, 4
test cx, cx
jne 0x40ba13
xor eax, eax
jmp 0x40ba3e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40bb1b
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x40bb1b
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x40bb1b
mov eax, 0x5d462918
lea ecx, [ebp - 0x44]
sub eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40ba9e
test dx, dx
je 0x40ba9a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40ba9e
add ecx, 4
add eax, 4
test dx, dx
jne 0x40ba78
xor eax, eax
jmp 0x40baa3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40bb1b
push 0x20
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40bb1b
mov eax, 0x5d462dd8
lea ecx, [ebp - 0x44]
sub eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40bae8
test dx, dx
je 0x40bae4
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40bae8
add ecx, 4
add eax, 4
test dx, dx
jne 0x40bac2
xor eax, eax
jmp 0x40baed
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40bb1b
mov eax, dword [ebp - 0x4c]
mov ecx, 0x409
pop edi
pop esi
pop ebx
mov dword [eax], 0x39
mov eax, dword [ebp - 0x50]
mov word [eax], cx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret

Function at 0x40be50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x7c67e4ef
mov edx, 0x7cb09f23
mov eax, dword [ebp - 4]
sub edx, eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [edx]
cmp eax, 0x402
ja 0x40beb4
je 0x40bea3
cmp eax, 0x7b
je 0x40be94
cmp eax, 0x202
jne 0x40bf01
xor ecx, ecx
call fcn.00404630
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.0040bf10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov byte [esi + 0x3c0], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x404
jbe 0x40beee
cmp eax, 0x405
jne 0x40bf01
mov byte [esi + 0x3c0], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x3c4], eax
mov ecx, 0x23216d8e
lea eax, [edi + edi]
sub ecx, eax
call fcn.00404630
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov byte [esi + 0x3c0], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x3c4], eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8