joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45df00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41514c]
call fcn.004049fc
xor eax, eax
push ebp
push 0x45e044
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48fe1c], 0
jne 0x45df53
mov ecx, dword [0x490d5c]
mov dl, 1
mov eax, dword [0x407368]
call fcn.0040c3e0
call fcn.00403aac
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402d10
mov eax, ebx
call fcn.004048cc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45e054
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405980
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004048dc
test eax, eax
jle 0x45dfeb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45dfe4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404318
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404300
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004082a0
test eax, eax
jne 0x45dfe4
mov ebx, 0x15
jmp 0x45dff0
mov ebx, 0x10
jmp 0x45dff0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x48fe1c]
call fcn.0045de58
mov eax, dword [ebp - 8]
call fcn.0045de58
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e04b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004040b4
lea eax, [ebp - 0x10]
mov edx, dword [0x41514c]
call fcn.00404acc
ret
Function at 0x46ace8
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x490230], 0
mov eax, dword [0x491424]
cmp dword [eax], 2
jne 0x46aec1
mov eax, dword [0x490f6c]
cmp dword [eax], 5
jl 0x46aec1
call fcn.00467e84
test al, al
jne 0x46ad19
call fcn.00467e90
call fcn.00467e7c
mov dword [0x490238], eax
push 0x46aec4
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4901fc], eax
cmp dword [0x4901fc], 0
jne 0x46ad74
mov edx, 0x8000
mov eax, 0x46aed8
call fcn.0040dda4
mov dword [0x490234], eax
mov eax, dword [0x490234]
mov dword [0x490238], eax
push 0x46aec4
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4901fc], eax
cmp dword [0x4901fc], 0
je 0x46aebc
push 0x46aee4
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490200], eax
cmp dword [0x490200], 0
je 0x46aebc
push 0x46aef0
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490204], eax
cmp dword [0x490204], 0
je 0x46aebc
mov byte [0x490230], 1
push 0x46af00
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490208], eax
push 0x46af0c
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49020c], eax
push 0x46af18
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490210], eax
push 0x46af28
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490214], eax
push 0x46af38
mov eax, dword [0x490238]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490218], eax
mov edx, 0x8000
mov eax, 0x46af50
call fcn.0040dda4
mov dword [0x49023c], eax
cmp dword [0x49023c], 0
je 0x46aec1
push 0x46af60
mov eax, dword [0x49023c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49021c], eax
push 0x46af7c
mov eax, dword [0x49023c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490220], eax
push 0x46af9c
mov eax, dword [0x49023c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490224], eax
push 0x46afb8
mov eax, dword [0x49023c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x490228], eax
push 0x46afd0
mov eax, dword [0x49023c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x49022c], eax
ret
call fcn.0046ac68
ret
Function at 0x46d5f4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46d71c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046d4e0
mov eax, dword [esi]
call fcn.0040510c
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x465958]
call fcn.004052c8
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402958
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402958
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040510c
mov dword [ebp - 0xc], eax
mov eax, dword [0x491338]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.00466634
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00402d10
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040510c
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.00466564
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.0046654c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0046662c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d723
lea eax, [ebp - 8]
mov edx, dword [0x465958]
call fcn.004052d4
ret
Function at 0x47612c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404540
xor eax, eax
push ebp
push 0x476258
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404090
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404550
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x476235
mov eax, ebx
call fcn.0040275c
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404550
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x476268
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040851c
push dword [ebp - 0x14]
push 0x476274
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.0040851c
push dword [ebp - 0x18]
push 0x476274
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040851c
push dword [ebp - 0x1c]
push 0x476274
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040851c
push dword [ebp - 0x20]
mov eax, edi
mov edx, 7
call fcn.00404410
mov eax, esi
call fcn.0040277c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47625f
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004040b4
lea eax, [ebp - 4]
call fcn.00404090
ret

Function at 0x47647c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x476519
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [0x4911cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00408d18
lea ecx, [ebp - 0x108]
mov eax, dword [ebx]
mov edx, 1
call fcn.0042eef8
mov eax, dword [ebp - 0x108]
mov edx, 0x476530
call fcn.0040449c
je 0x476500
mov eax, ebx
mov edx, 0x476530
call fcn.00404358
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476520
lea eax, [ebp - 0x108]
call fcn.00404090
ret
Function at 0x476534
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp + 4], 1
push esp
push 0xf003f
push 0
push 0x4765b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4765fc
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47659a
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, pe_nt_image_headers32
call fcn.00404300
jmp 0x4765a6
mov eax, ebx
mov edx, 0x476608
call fcn.004040e4
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x10c
pop ebx
ret

Function at 0x4772f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], ecx
xor eax, eax
push ebp
push 0x4774bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4774cc
push 0
push edx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x477497
push 0
push 0x4774d4
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x477497
push 0
push 0x4774e4
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x4774f8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x477497
call fcn.004760c8
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x47739c
cmp eax, dword [esp]
pop edx
pop eax
je 0x477497
lea eax, [ebp - 0x404]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0x477508
lea edx, [ebp - 0x408]
mov eax, 0x57e0b7c
call fcn.00408430
push dword [ebp - 0x408]
push 0x47752c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x40c]
call fcn.00408938
test al, al
jne 0x477497
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x410]
call fcn.004750f8
test al, al
je 0x477497
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 4]
call fcn.0040cfd0
test eax, eax
jne 0x477497
lea eax, [ebp - 0x418]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004045b0
mov eax, dword [ebp - 0x418]
push eax
push 0x3ff
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4774c4
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004040b4
lea eax, [ebp - 4]
call fcn.00404090
ret
Function at 0x477534
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], ecx
xor eax, eax
push ebp
push 0x4776fd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x47770c
push 0
push edx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4776d7
push 0
push 0x477714
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4776d7
push 0
push 0x477724
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x477738
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4776d7
call fcn.004760c8
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4775dc
cmp eax, dword [esp]
pop edx
pop eax
je 0x4776d7
lea eax, [ebp - 0x404]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0x477748
lea edx, [ebp - 0x408]
mov eax, 0x57e0b7c
call fcn.00408430
push dword [ebp - 0x408]
push 0x47776c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x40c]
call fcn.00408938
test al, al
jne 0x4776d7
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x410]
call fcn.004750f8
test al, al
je 0x4776d7
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 4]
call fcn.0040cfd0
test eax, eax
jne 0x4776d7
lea eax, [ebp - 0x418]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004045b0
mov eax, dword [ebp - 0x418]
push eax
push 0x3ff
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477704
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004040b4
lea eax, [ebp - 4]
call fcn.00404090
ret
Function at 0x477774
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], ecx
xor eax, eax
push ebp
push 0x47794e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x47795c
push 0
push edx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x477928
push 0
push 0x477964
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x477928
push 0
push 0x477974
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x477984
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x477990
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x477928
call fcn.004760c8
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x47782d
cmp eax, dword [esp]
pop edx
pop eax
je 0x477928
lea eax, [ebp - 0x404]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0x4779a0
lea edx, [ebp - 0x408]
mov eax, 0x57e0b7c
call fcn.00408430
push dword [ebp - 0x408]
push 0x4779c4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x40c]
call fcn.00408938
test al, al
jne 0x477928
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x410]
call fcn.004750f8
test al, al
je 0x477928
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x404]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x414]
mov eax, dword [ebp - 4]
call fcn.0040cfd0
test eax, eax
jne 0x477928
lea eax, [ebp - 0x418]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004045b0
mov eax, dword [ebp - 0x418]
push eax
push 0x3ff
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477955
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004040b4
lea eax, [ebp - 4]
call fcn.00404090
ret
Function at 0x477b3c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x477d1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x477d2c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jne 0x477beb
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x41c]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x418]
add eax, 0x28
push eax
mov eax, dword [ebp - 0x41c]
add eax, 0x190
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0x477d2c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x477cf7
lea eax, [ebp - 0x40c]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0x477d48
lea edx, [ebp - 0x420]
mov eax, 0x57e0b7c
call fcn.00408430
push dword [ebp - 0x420]
push 0x477d6c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x424]
call fcn.00408938
test al, al
jne 0x477cf7
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x428]
call fcn.004758e8
test al, al
je 0x477cf7
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 4]
call fcn.0040cfd0
test eax, eax
jne 0x477cf7
lea eax, [ebp - 0x430]
push eax
mov ecx, 0x46
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004045b0
mov eax, dword [ebp - 0x430]
push eax
push 0x3ff
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477d24
lea eax, [ebp - 0x430]
mov edx, 5
call fcn.004040b4
lea eax, [ebp - 4]
call fcn.00404090
ret
Function at 0x477d74
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
xor eax, eax
push ebp
push 0x478008
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x478018
push 0
push edx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x478028
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x47803c
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x477fdd
call fcn.004760c8
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x477e10
cmp eax, dword [esp]
pop edx
pop eax
je 0x477fdd
lea eax, [ebp - 0x40c]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0x47805c
lea edx, [ebp - 0x410]
mov eax, 0x1f3ba8
call fcn.00408430
push dword [ebp - 0x410]
push 0x478070
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404410
push 0x478080
lea edx, [ebp - 0x414]
mov eax, 0x57e0b7c
call fcn.00408430
push dword [ebp - 0x414]
push 0x4780a4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x418]
call fcn.00408938
test al, al
jne 0x477fdd
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x41c]
call fcn.004758e8
test al, al
je 0x477fdd
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 4]
call fcn.0040cfd0
test eax, eax
jg 0x477fdd
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
call fcn.0040cfd0
test eax, eax
jg 0x477fdd
mov dword [ebp - 0xc], 6
push 0x4780ac
push 0xff
push 0xc
push ebx
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
call fcn.00404350
mov esi, eax
test esi, esi
jle 0x477f76
mov edi, 1
push 2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
push eax
push 0x102
push ebx
call sub.user32.dll_SendMessageA
inc edi
dec esi
jne 0x477f5c
lea eax, [ebp - 0x40c]
push eax
push 0x3ff
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.00404300
mov eax, dword [ebp - 0x428]
mov edx, dword [ebp - 4]
call fcn.0040449c
je 0x477fb5
dec dword [ebp - 0xc]
jne 0x477f37
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47800f
lea eax, [ebp - 0x428]
mov edx, 7
call fcn.004040b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040b4
ret