joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4533e4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
sub eax, 0x110
push edi
mov esi, ecx
je 0x41d15c
dec eax
je 0x41d03c
sub eax, 0x27
jne 0x41d058
push eax
call dword [sym.imp.GDI32.dll_GetStockObject]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
movzx ecx, word [ebp + 0xc]
mov dword [esi + 0x10], ecx
mov byte [esi + 0xc], 1
jmp 0x41d140
cmp ebx, 0x110
ja 0x41d134
je 0x41d0a4
mov eax, ebx
sub eax, 2
je 0x41d094
dec eax
je 0x41d0e5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push ebx
mov ecx, esi
call fcn.0041be60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x38]
test eax, eax
je 0x41d070
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x41d070
mov eax, dword [0x455ca8]
call fcn.00408560
test al, al
je 0x41d0e5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [esi + 4]
push eax
push 0
push edx
push 0x1e
push 0x5a
push 0
push 0
push 0x90000000
push str.Exit
push str.Button
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x38], eax
cmp dword [esi + 0x38], 0
je 0x41d070
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x1c]
push eax
push ecx
call edi
mov eax, dword [esi + 0x38]
lea edx, [esp + 0xc]
push edx
push eax
call edi
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push 0x15
push 0
push 0
lea eax, [ecx + edx - 0xe]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x38]
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x41d070
cmp ebx, 0x111
jne 0x41d070
mov eax, dword [esi + 0x38]
test eax, eax
je 0x41d070
cmp dword [ebp + 0x10], eax
jne 0x41d070
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0041c890
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042c039
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41e120
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00430c00
add esp, 0xc
lea ecx, [ebp - 0x14c]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x14c]
cmp ax, 9
jne 0x41e183
test ebx, ebx
js 0x41e190
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x41e172
test ebx, 0x40000000
je 0x41e172
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 2
mov edx, ebx
shr edx, 8
push 0
and edx, 0xff
push 0
mov dword [ebp - 0x124], edx
call esi
push 3
push 1
movzx ecx, bl
push edx
push eax
mov dword [ebp - 0x120], ecx
call esi
mov ecx, 3
test ebx, 0x10000000
je 0x41e1d5
mov byte [ebp - 0xe], 1
jmp 0x41e1e8
test ebx, 0x20000000
je 0x41e1e2
mov byte [ebp - 0xe], cl
jmp 0x41e1e8
cmp byte [ebp - 0xe], 0
jbe 0x41e1f8
push 1
push 0x80
push edx
push eax
call esi
mov ecx, 0x83
push edx
push eax
push ecx
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp eax, 1
jne 0x41e172
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, al
pop esi
call fcn.0042c039
mov esp, ebp
pop ebp
ret
Function at 0x420330
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
push esi
mov dword [ebp - 0x680], eax
mov ebx, ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push ebx
lea ecx, [ebp - 0x214]
push 0x104
push ecx
mov dword [ebp - 0x684], eax
call fcn.0042cbdd
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push str..inf
lea edx, [ebp - 0x214]
push edx
call edi
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420392
sub eax, edx
mov edx, dword [ebp - 0x680]
sar eax, 1
xor ecx, ecx
push edx
mov word [ebp + eax*2 - 0x212], cx
lea eax, [ebp - 0x624]
push 0x104
push eax
call fcn.0042cbdd
add esp, 0xc
push esi
lea ecx, [ebp - 0x624]
push ecx
call edi
lea eax, [ebp - 0x624]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4203e0
sub eax, edx
sar eax, 1
xor edx, edx
push ebx
mov word [ebp + eax*2 - 0x622], dx
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.0042cbdd
mov ecx, dword [ebp - 0x684]
add esp, 0xc
push ecx
lea edx, [ebp - 0x41c]
push edx
call edi
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420427
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
sub eax, edx
xor ecx, ecx
sar eax, 1
mov word [ebp + eax*2 - 0x41a], cx
mov dword [ebp - 0x6a4], ecx
lea ecx, [ebp - 0x6a4]
lea edx, [ebp - 0x214]
mov eax, 0x614
push ecx
mov dword [ebp - 0x6a0], 3
mov dword [ebp - 0x69c], edx
mov word [ebp - 0x694], ax
call esi
test eax, eax
je 0x4204a8
push 0x31c
push eax
lea edx, [ebp - 0x67c]
push edx
mov ecx, str.Hardware.cpp
mov ebx, str.SHFileOperation_returned_an_error__Code_is_not_always_a_Win32_code_.
call fcn.00402e10
push 0x44d9ac
lea eax, [ebp - 0x67c]
push eax
call fcn.0042db23
lea eax, [ebp - 0x6a4]
lea ecx, [ebp - 0x624]
lea edx, [ebp - 0x41c]
push eax
mov dword [ebp - 0x6a0], 2
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x698], edx
call esi
test eax, eax
je 0x420504
push 0x326
push eax
lea ecx, [ebp - 0x67c]
push ecx
mov ecx, str.Hardware.cpp
mov ebx, str.SHFileOperation_returned_an_error__Code_is_not_always_a_Win32_code_.
call fcn.00402e10
push 0x44d9ac
lea edx, [ebp - 0x67c]
push edx
call fcn.0042db23
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c039
mov esp, ebp
pop ebp
ret 4
Function at 0x424520
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440508
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
xor ecx, ecx
mov edi, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], eax
push 0xb
mov eax, str.GlobalIIF_
lea esi, [ebp - 0x2c]
call fcn.00402c20
mov eax, edi
lea edx, [eax + 2]
jmp 0x424580
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424580
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [ebp - 0x2c]
call fcn.004057c0
mov eax, dword [ebx]
test eax, eax
je 0x4245ad
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebx], 0
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4245b9
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
test eax, eax
jne 0x424624
call edi
mov esi, eax
cmp esi, 2
jne 0x42460a
push str.Mutex_with_given_name_doesnt_exist._Creating_new_one._n
push 0x4549c8
mov ecx, 0x4462a0
call fcn.00406230
mov eax, dword [ebp - 0x2c]
add esp, 8
cmp dword [ebp - 0x18], 8
jae 0x4245ff
lea eax, [ebp - 0x2c]
push eax
call fcn.004246d0
mov dword [ebp - 0x30], eax
jmp 0x42463b
push esi
push str.Error_opening_mutex:__lu_n
push 0x4549c8
mov ecx, 0x446820
call fcn.00406230
add esp, 0xc
jmp 0x42463e
push str.Opened_existing_mutex_n
push 0x4549c8
mov ecx, 0x4462a0
call fcn.00406230
add esp, 8
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebx]
test ebx, ebx
je 0x424694
push 0x7d0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x424674
push str.Obtained_mutex_succesfully.
push 0x4549c8
mov ecx, 0x4462a0
call fcn.00406230
add esp, 8
mov dword [ebp - 0x30], 0
jmp 0x424691
push esi
push str.GetMutex:_wait_unsuccseffull___lu_
push 0x4549c8
mov ecx, 0x446820
call fcn.00406230
add esp, 0xc
call edi
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x18], 8
jb 0x4246a6
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0042c048
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret
Function at 0x425270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
push 0x31
mov esi, eax
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4252ee
push ebx
lea ebx, [eax + 1]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b2bc
add esp, 4
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0x510
push eax
push 0xffffffffffffffff
push esi
push ecx
call dword [sym.imp.USER32.dll_DrawTextW]
push esi
call fcn.0042ccc5
mov esi, dword [ebp - 4]
add esp, 4
pop ebx
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425b50
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44166b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
mov dword [ebp - 4], ebx
mov ecx, dword [ecx + 4]
push ecx
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
call dword [sym.imp.USER32.dll_GetParent]
lea edx, [ebp - 0x238]
push edx
push ebx
push ebx
push 0x11
push ebx
mov dword [ebp - 0x258], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov eax, dword [ebp - 0x238]
lea ecx, [ebp - 0x234]
push ecx
mov ecx, 0x208a
mov edx, 0x455cb8
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x248], 0x41
call fcn.00412860
cmp dword [ebp - 0x220], 8
jb 0x425c36
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x24c], edx
jmp 0x425c42
lea eax, [ebp - 0x234]
mov dword [ebp - 0x24c], eax
mov edi, dword [0x455ca8]
push esi
add edi, 4
mov dword [ebp - 0x244], 0x424ae0
call fcn.00403fe0
push eax
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0042cbdd
add esp, 0xc
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x218]
push eax
mov dword [ebp - 0x240], edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, ebx
je 0x425cb4
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [0x455ca8]
lea edx, [ebp - 0x218]
push edx
add ecx, 4
mov ebx, esi
call fcn.004040d0
mov bl, 1
cmp dword [ebp - 0x220], 8
jb 0x425ccc
mov eax, dword [ebp - 0x234]
push eax
call fcn.0042c048
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret
Function at 0x425fb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4404d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
sub eax, 2
mov esi, ecx
jne 0x4260cb
lea ecx, [esi + 0x74]
lea edi, [eax + 6]
mov eax, dword [ecx + 0x10]
push str.LAUNCH
call fcn.00410900
test eax, eax
jne 0x4260cb
lea eax, [esi + 0x3c]
mov ebx, 8
cmp dword [eax + 0x14], ebx
jb 0x426013
mov eax, dword [eax]
mov edi, dword [0x455ca8]
add edi, 4
call fcn.00404030
test al, al
je 0x4260cb
cmp dword [esi + 0xa8], ebx
lea eax, [esi + 0x94]
jb 0x426039
mov eax, dword [eax]
push eax
mov eax, dword [0x455ca8]
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404550
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x42605d
lea eax, [ebp - 0x2c]
push eax
push str.__Launching:__s
push 0x4549c8
mov ecx, 0x4462a0
call fcn.00406230
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], ebx
jae 0x426080
lea eax, [ebp - 0x2c]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4260ba
test eax, eax
jne 0x4260a2
mov eax, 0xe
push eax
push str.__Launch_error_0x_X
push 0x4549c8
mov ecx, 0x446470
call fcn.00406230
add esp, 0xc
cmp dword [ebp - 0x18], ebx
jb 0x4260cb
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042c048
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 4

Function at 0x4262d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x200
push esi
mov esi, ecx
jne 0x426344
mov eax, dword [esi + 4]
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b2bc
add esp, 4
mov ebx, eax
mov eax, dword [esi + 4]
push edi
push ebx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
add esi, 0x3c
cmp dword [esi + 0x14], 8
jb 0x426325
mov esi, dword [esi]
mov ecx, dword [0x455ca8]
push ebx
add ecx, 4
mov ebx, esi
call fcn.004040d0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042ccc5
add esp, 4
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x426c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441630
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xfffffffe
je 0x426c3e
cmp ecx, 0xfffffffc
jne 0x426d2b
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], dx
mov dword [ebp - 4], ecx
lea ebx, [ecx + 8]
cmp dword [eax + 0xa4], ecx
je 0x426ca1
add eax, 0x94
cmp dword [eax + 0x14], ebx
jb 0x426c6a
mov eax, dword [eax]
push eax
mov eax, dword [0x455ca8]
add eax, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.00404550
mov edi, eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00405410
mov byte [ebp - 4], 0
cmp dword [ebp - 0x34], ebx
jb 0x426cd8
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0042c048
add esp, 4
jmp 0x426cd8
add eax, 0x3c
cmp dword [eax + 0x14], ebx
jb 0x426cab
mov eax, dword [eax]
mov edi, dword [0x455ca8]
push eax
add edi, 4
call fcn.00403fe0
mov ecx, eax
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x426cc0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x2c]
call fcn.00402c20
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x426ce3
lea eax, [ebp - 0x2c]
push eax
push str.Link:_Launching__s
push 0x4549c8
mov ecx, 0x4462a0
call fcn.00406230
mov eax, dword [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], ebx
jae 0x426d06
lea eax, [ebp - 0x2c]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], ebx
jb 0x426d2b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0042c048
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 4
Function at 0x429110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x4533e4]
xor eax, esp
mov dword [esp + 4], eax
movzx eax, word [ebp + 8]
push esi
push edi
mov edi, ecx
cmp eax, 0x401
jg 0x4291d8
je 0x4291cc
sub eax, 2
je 0x429172
sub eax, 0x3fa
jne 0x4291df
mov esi, dword [edi + 0x54]
mov eax, dword [edi + 0x44]
mov ecx, dword [eax + esi*4 - 4]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
dec esi
call eax
test al, al
je 0x429150
mov ecx, edi
mov dword [edi + 0x54], esi
call fcn.00428810
jmp 0x429269
mov ecx, dword [edi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x429269
mov ecx, dword [edi + 4]
push 0x1f86
push 2
push 3
push 0x4e20
call fcn.0041bf20
add esp, 0x10
cmp eax, 6
jne 0x429269
mov esi, dword [0x455ca8]
mov ecx, 0x642
call fcn.0040b990
push 0x40b
mov esi, edi
call fcn.0041be40
jmp 0x429269
mov esi, edi
call fcn.00428980
jmp 0x429269
cmp eax, 0x40b
je 0x429208
mov edi, dword [edi + 0x38]
test edi, edi
je 0x4291f3
cmp dword [ebp + 0xc], edi
jne 0x4291f3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0042c039
mov esp, ebp
pop ebp
ret 8
cmp byte [edi + 0x5c], 0
jne 0x429252
mov eax, dword [0x455ca8]
call fcn.00408560
test al, al
jne 0x429252
mov ecx, dword [edi + 4]
push 0x1f86
push 2
push 3
push 0x4e20
call fcn.0041bf20
add esp, 0x10
cmp eax, 6
jne 0x429269
mov esi, dword [0x455ca8]
mov ecx, 0x642
call fcn.0040b990
mov edx, dword [edi + 4]
push 0
push edx
jmp 0x429258
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov byte [edi + 0xc], 1
mov dword [edi + 0x10], 0x40b
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0042c039
mov esp, ebp
pop ebp
ret 8
Function at 0x42aa30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b2bc
add esp, 4
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
push 0x31
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x10
or eax, 0x400
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0xffffffffffffffff
push edi
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call fcn.0042ccc5
add esp, 4
push 0x80
lea edx, [ebp - 0x108]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, str.Button
lea eax, [ebp - 0x108]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42ab26
test dx, dx
je 0x42ab22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42ab26
add eax, 4
add ecx, 4
test dx, dx
jne 0x42ab00
xor eax, eax
jmp 0x42ab2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42ab54
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 0xb
jle 0x42ab54
push 0x47
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x110]
add ecx, eax
mov dword [ebp - 0x110], ecx
jmp 0x42ab5a
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x114]
sub ecx, dword [ebp - 0x118]
push 6
inc eax
push eax
inc ecx
push ecx
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c039
mov esp, ebp
pop ebp
ret 8

Function at 0x42c039
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4533e4]
jne 0x42c043
repz ret
jmp fcn.00430c7a
Function at 0x439ec5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4533e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004317d4
and dword [ebp - 0x14], 0
cmp dword [0x455bd8], 0
mov dword [ebp - 0x18], eax
jne 0x439f78
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x43a020
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x446164
push ebx
call edi
test eax, eax
je 0x43a020
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x455bd8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x455bdc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x455be0], eax
call edi
push eax
call esi
mov dword [0x455be8], eax
test eax, eax
je 0x439f78
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x455be4], eax
mov eax, dword [0x455be4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x439fd1
cmp dword [0x455be8], ecx
je 0x439fd1
push eax
call esi
push dword [0x455be8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x439fd1
test ebx, ebx
je 0x439fd1
call edi
test eax, eax
je 0x439fc8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x439fc8
test byte [ebp - 8], 1
jne 0x439fd1
or dword [ebp + 0x10], 0x200000
jmp 0x43a004
mov eax, dword [0x455bdc]
cmp eax, dword [ebp - 0x18]
je 0x43a004
push eax
call esi
test eax, eax
je 0x43a004
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43a004
mov eax, dword [0x455be0]
cmp eax, dword [ebp - 0x18]
je 0x43a004
push eax
call esi
test eax, eax
je 0x43a004
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x455bd8]
call esi
test eax, eax
je 0x43a020
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43a022
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c039
leave
ret
Function at 0x10002e31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10002e40
pop dword [ebp - 0x10]
mov eax, 0x48e2f890
sub eax, 0x38e2ca50
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb329d5c9
sub dword [ebp - 0x20], 0x64d7907e
mov dword [ebp - 0x1c], 0xb5094ba2
sub dword [ebp - 0x1c], 0x82d5ff5d
mov dword [ebp - 0x18], 0x90b1a328
sub dword [ebp - 0x18], 0x44655efa
mov dword [ebp - 0x14], 0x399cf887
sub dword [ebp - 0x14], 0x399cf887
lea eax, [ebp - 0x20]
push eax
mov eax, 0x804d3cc0
add eax, 0x8fb3937c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf9b4f033
sub dword [ebp - 0x20], 0x854286dd
mov dword [ebp - 0x1c], 0x78c3b6e
sub dword [ebp - 0x1c], 0xc61fd9f9
mov dword [ebp - 0x18], 0xdad77750
sub dword [ebp - 0x18], 0x77680ae4
mov dword [ebp - 0x14], 0x7452d071
add dword [ebp - 0x14], 0x8bad2f8f
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x96a9e1be
add eax, 0x7956eeaa
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3b946
push 0
call eax
mov ecx, 0x593e
mov esi, eax
mov edx, 0x84a08e42
add edx, 0x8b60c3be
add edx, dword [ebp - 0x10]
mov ebx, 0x64a7170f
add ebx, 0xe7eb991f
xor dword [ebp - 8], ecx
mov edi, dword [edx]
mov dword [ebp - 4], 0x2462f027
sub edi, ebx
xor dword [ebp - 8], eax
mov dword [esi], edi
mov dword [ebp - 0xc], 0x512c094c
add esi, 0xb6260506
add esi, 0x49d9fafe
add edx, 0x291a6b36
add edx, 0xd6e594ce
loop 0x10002f5c
add eax, 0xc7f0d80e
sub eax, 0xc7ef8043
mov ebx, eax
add eax, 0x90f57fa1
add eax, 0x6f0a8064
mov ecx, 0x3ba56a1f
add ecx, 0xd45a95e1
add ecx, dword [ebp - 0x10]
invalid
invalid
invalid
call ebx
leave
ret