joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d720
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x50d76a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x50d799
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x50d7db
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x512150
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5af2e4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x512163
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5121a4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5af38c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5121d6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5121da
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5121cb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5121f8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5121fc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5121ed
xor ecx, ecx
mov eax, 0x5af2f4
xor ebx, ebx
mov bl, byte [ecx + 0x5af39c]
cmp byte [esp + ebx + 0x14], 0
je 0x512227
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5af3b4]
cmp byte [esp + ebx + 0x14], 0
je 0x51223e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x51220e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x512197
lea edx, [esp + 0x84]
push edx
call fcn.00512280
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x516f50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x5f1d3c]
test eax, eax
jne 0x516fe0
push str.oleaut32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LoadRegTypeLib
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5f1d3c], eax
jne 0x516f7e
ret
push 0x5f1d38
push 0x40
push 8
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x5f1d3c]
mov byte [0x5f1d1c], 0xb8
mov dword [0x5f1d1d], 0x516e90
mov byte [0x5f1d21], 0xff
mov byte [0x5f1d22], 0xe0
mov byte [0x5f1d23], 0
mov ecx, dword [eax]
mov dword [0x5f1d24], ecx
mov edx, dword [eax + 4]
mov ecx, dword [0x5f1d1c]
mov dword [0x5f1d28], edx
mov dword [eax], ecx
mov eax, dword [0x5f1d3c]
mov edx, dword [0x5f1d20]
mov dword [eax + 4], edx
mov eax, 1
ret

Function at 0x5338a2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5338da
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053192f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00531907
jmp 0x5338e6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x534f94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x534fd6
call fcn.0053b6da
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x534fd6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x534fcd
xor eax, eax
jmp 0x534fde
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00534fe4
pop edi
pop esi
pop ebx
ret 4

Function at 0x53bc0a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x53bc38
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53bc56
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0053bb70
jmp 0x53bc56
mov eax, dword [esi + 0x14]
test eax, eax
je 0x53bc56
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0053bb70
test edi, edi
mov eax, edi
jne 0x53bc40
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4011b0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
setne al
pop esi
ret 4

Function at 0x4011f0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [ecx]
push 0x10
push eax
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
setne al
ret 4

Function at 0x401260
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
push edi
lea edx, [esp + 8]
mov eax, dword [esi]
mov ecx, 0x3f
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
push edx
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x124]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ecx
push eax
push 0
push 0
call sub.WSOCK32.dll_select
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
mov eax, dword [esi]
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
pop edi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x401320
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
lea edx, [esp + 4]
push edi
mov eax, dword [esi]
mov ecx, 0x3f
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 0x18]
push edx
mov dword [esp + 0x14], 1
push eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x1c], ecx
call sub.WSOCK32.dll_select
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
mov eax, dword [esi]
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
pop edi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x401390
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push esi
push eax
call sub.WSOCK32.dll_gethostbyname
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x20]
push edx
mov word [esp + 8], 2
mov esi, dword [ecx]
call sub.WSOCK32.dll_htons
mov esi, dword [esi]
mov word [esp + 6], ax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 4]
mov ecx, eax
mov dword [ecx], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 4], esi
pop esi
mov dword [ecx + 8], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 0xc], edx
add esp, 0x10
ret

Function at 0x401430
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
push esi
add ecx, 4
mov eax, edx
mov esi, 8
test al, 1
je 0x40144a
shr eax, 1
xor eax, 0xedb88320
jmp 0x40144c
shr eax, 1
dec esi
jne 0x40143d
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jl 0x401436
pop esi
ret
Function at 0x401460
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
or eax, 0xffffffff
push edi
mov edi, ecx
test esi, esi
je 0x4014a5
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x4014a5
xor edx, edx
test esi, esi
jbe 0x40149d
push ebx
xor ecx, ecx
mov ebx, eax
mov cl, byte [edx + ebp]
and ebx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [edi + ecx*4 + 4]
xor eax, ecx
inc edx
cmp edx, esi
jb 0x40147f
pop ebx
pop edi
pop esi
not eax
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x401d45
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x46c224]
push esi
mov esi, ecx
push 1
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x401dd0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
je 0x401de0
lea edi, [ecx - 0x20]
mov dword [esp + 8], edi
jmp 0x401dec
mov dword [esp + 8], 0
mov edi, dword [esp + 8]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401e6b
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 4]
push ebx
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [esp + 0x1c]
mov edi, eax
push edi
mov ecx, esi
or ebp, 0xffffffff
call fcn.00401fc0
test eax, eax
je 0x401e5d
mov edx, dword [esi]
mov dword [edx - 8], edi
mov eax, dword [esi]
mov byte [eax + edi], 0
mov eax, dword [esi]
test eax, eax
je 0x401e5d
lea ecx, [edi + 1]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov ebp, eax
call fcn.004020d0
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi]
mov dword [ecx - 8], eax
mov edx, dword [esi]
mov byte [edx + eax], 0
cmp ebp, edi
pop ebp
pop ebx
jge 0x401ebb
mov edi, dword [esp + 8]
xor esi, esi
jmp 0x401e87
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 4]
mov eax, dword [eax]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov esi, eax
test esi, esi
jne 0x401eb3
push 0xffffffffffffffff
add edi, 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x401e9b
lea eax, [edi - 0x20]
jmp 0x401e9d
xor eax, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, esi
pop edi
pop esi
pop ecx
ret 0x18
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401f08
mov eax, dword [esi]
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x24]
cmp ecx, eax
jle 0x401f08
mov edx, dword [esp + 8]
push 0xffffffffffffffff
lea esi, [edx + 0x20]
call dword [sym.imp.USER32.dll_MessageBeep]
test esi, esi
je 0x401ee8
lea eax, [esi - 0x20]
jmp 0x401eea
xor eax, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x18
pop edi
mov eax, 1
pop esi
pop ecx
ret 0x18
Function at 0x402f90
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
mov esi, ecx
push edi
mov ecx, 0xc
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esi], 0x30
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402fe2
mov eax, dword [esp + 0xc]
cmp eax, 5
jae 0x402fe8
cmp eax, 4
jne 0x402fe2
cmp dword [esp + 0x10], 0x5a
jae 0x402fe8
mov dword [esi], 0x2c
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
Function at 0x403df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x46c118]
mov ecx, dword [esp + 4]
push esi
push 2
mov esi, dword [eax + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ax, word [eax + 0xe]
pop esi
ret
Function at 0x408890
Capabilities:
Check os version

Disassembly:
sub esp, 0xc8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov cl, byte [esi + 0x80]
test cl, 2
jne 0x408923
mov edi, dword [esp + 0xe0]
mov ebx, dword [esp + 0xdc]
test edi, edi
je 0x4088d1
cmp edi, dword [esi + 0x40]
je 0x4088d1
mov eax, ebx
shr eax, 0x10
test al, 0x10
je 0x4088d1
mov eax, 1
jmp 0x4088d3
xor eax, eax
and al, 1
and cl, 0xf7
shl al, 3
or al, cl
mov ecx, dword [esi + 0x58]
push ecx
mov byte [esi + 0x80], al
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x408905
mov edx, dword [esp + 0xd8]
mov eax, dword [esi + 0x58]
push edi
push ebx
push edx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
mov eax, 1
mov dword [ecx], 0
pop ebx
add esp, 0xc8
ret 0x10
mov edx, dword [esp + 0xdc]
push ebp
shr edx, 0x10
cmp edx, 0xffff
jne 0x408a62
mov eax, dword [esp + 0xe4]
test eax, eax
jne 0x408a62
test cl, 4
je 0x408a62
mov eax, dword [esi + 0x18]
dec eax
test eax, eax
jl 0x408a62
mov ecx, dword [esi + 0x14]
mov ebx, dword [ecx + eax*4]
mov dword [esi + 0x18], eax
test ebx, ebx
je 0x408a62
push ebx
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jle 0x408952
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x48]
mov esi, 0x30
push edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x48], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4089c9
mov eax, dword [esp + 0x48]
cmp eax, 5
jae 0x4089d1
cmp eax, 4
jne 0x4089c9
cmp dword [esp + 0x4c], 0x5a
jae 0x4089d1
mov dword [esp + 0x14], 0x2c
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esi
push eax
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
mov eax, dword [esp + 0x34]
test eax, eax
mov edi, eax
je 0x408a49
cmp dword [eax], 0x1313
jne 0x408a49
mov dword [esp + 0x18], 0x31
mov ecx, dword [eax + 8]
lea esi, [eax + 4]
mov dword [esp + 0x1c], ecx
mov edx, dword [esi]
mov dword [esp + 0x38], edx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], eax
push ecx
push 1
push ebp
push ebx
mov dword [esp + 0x44], 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoA]
mov edx, dword [esi]
push edx
call fcn.00427e30
push edi
mov dword [edi], 0x6666
call fcn.00427e30
add esp, 8
push ebx
inc ebp
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp ebp, eax
jl 0x40897c
mov esi, dword [esp + 0x10]
jmp 0x408952
mov eax, dword [esp + 0xe8]
pop ebp
pop edi
pop esi
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0xc8
ret 0x10
Function at 0x40b2a0
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45546c
push eax
mov dword fs:[0], esp
sub esp, 0x9c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 0x522
cmp byte [0x46c230], bl
jne 0x40b383
mov eax, dword [0x46c118]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x46c230], bl
jne 0x40b373
lea ecx, [esp + 8]
push edi
push ecx
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x40b35d
mov eax, dword [esp + 0x14]
cmp eax, 5
jae 0x40b359
cmp eax, 4
jne 0x40b35d
cmp dword [esp + 0x18], 0x5a
jb 0x40b35d
xor eax, eax
jmp 0x40b362
mov eax, 1
cmp al, bl
mov byte [0x46c230], 1
sete al
mov byte [0x46c108], al
mov ecx, dword [0x46c118]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xa4]
mov dword [esi + 0x38], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xa8
ret
Function at 0x40fc91
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x40fd2c
mov eax, dword [esi + 0x68]
push 0x466718
push 0
push 0x181
push eax
mov dword [esi + 0xb8], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x46c224]
push 0x466700
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esi + 0x194]
call fcn.00418c30
push 0x2d
mov ecx, esi
call fcn.00412e20
mov eax, dword [0x46c324]
push eax
call fcn.0041dca0
push 0x46c300
call fcn.0041d9a0
mov ecx, dword [0x46c2f8]
push ecx
call fcn.004191a0
mov edx, dword [esi + 4]
add esp, 0xc
push 0x3ea
push edx
call edi
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 4]
push 0x3eb
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
call ebx
mov ecx, dword [esi + 4]
push 0x3ec
push ecx
call edi
push 0
push eax
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40fd61
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x78]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
inc ebx
cmp ebx, 1
jg 0x40fd7d
pop esi
xor eax, eax
pop ebx
ret 0x10
push ebp
push edi
push ebx
call fcn.00428524
mov ecx, dword [esi + 0x78]
add esp, 4
mov edi, eax
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push edi
mov ecx, esi
call fcn.00411390
mov edx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3fb
push edx
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebp
mov eax, dword [esi + 4]
push 0x3fc
push eax
call ebx
push 1
push eax
call ebp
push edi
call fcn.00427e30
add esp, 4
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
Function at 0x4107a0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x78]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
inc eax
cmp eax, 1
mov dword [esp + 0xc], eax
jle 0x410873
push eax
call fcn.00428524
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x78]
add esp, 4
mov ebx, eax
push ecx
push ebx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 1
mov dword [esp + 0xc], ecx
jle 0x41086a
push 0x1a
mov ecx, esi
call fcn.00412e20
test al, al
je 0x41086a
lea edi, [esi + 0x54]
push 5
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, edi
call fcn.00401210
mov ecx, dword [esp + 0xc]
push 5
push ecx
push ebx
mov ecx, edi
call fcn.00401210
mov ecx, esi
call fcn.00414650
test eax, eax
jne 0x410838
mov edx, dword [esi + 0x68]
push 0x466938
push eax
push 0x181
push edx
jmp 0x410864
cmp eax, 1
jne 0x41084f
mov eax, dword [esi + 0x68]
push 0x466918
push 0
push 0x181
push eax
jmp 0x410864
cmp eax, 0xfffffffd
jne 0x41086a
mov ecx, dword [esi + 0x68]
push 0x46665c
push 0
push 0x181
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call fcn.00427e30
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x41092c
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x100
mov ecx, dword [esi + 0x5c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x10]
lea ebp, [esi + 0xbc]
test edx, edx
jne 0x410952
xor edi, edi
jmp 0x41095f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
push edi
mov ecx, ebp
call fcn.00416760
test eax, eax
je 0x41098e
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push edi
lea edx, [edi + 1]
push ecx
push edx
push eax
call fcn.00410080
mov ecx, dword [ebp]
add esp, 0x10
mov dword [ecx - 8], edi
mov edx, dword [ebp]
mov byte [edx + edi], 0
mov eax, dword [ebp]
mov ebx, dword [eax - 8]
cmp ebx, 0xfa
jle 0x4109c1
mov ecx, dword [esi + 4]
push 0x10
push 0x4664a0
push 0x466a0c
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 0x10
test ebx, ebx
push 0x10
jge 0x4109ea
mov edx, dword [esi + 4]
push 0x4664a0
push 0x4669f4
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 0x10
mov ecx, esi
call fcn.00412e20
test al, al
je 0x410a98
test ebx, ebx
jle 0x410a1b
mov al, bl
mov ecx, esi
inc al
push eax
call fcn.00412e20
mov ecx, dword [ebp]
inc ebx
push 5
push ebx
push ecx
lea ecx, [esi + 0x54]
call fcn.00401210
jmp 0x410a24
push 0
mov ecx, esi
call fcn.00412e20
mov ecx, esi
call fcn.00414650
cmp eax, 0xffffffff
jne 0x410a37
push 0x4669d4
jmp 0x410a6d
cmp eax, 1
jne 0x410a4e
mov eax, dword [esi + 0x68]
push 0x4669c0
push 0
push 0x181
push eax
jmp 0x410a78
test eax, eax
jne 0x410a63
mov ecx, dword [esi + 0x68]
push 0x4669ac
push eax
push 0x181
push ecx
jmp 0x410a78
cmp eax, 0xfffffffd
jne 0x410a7e
push 0x46665c
mov edx, dword [esi + 0x68]
push 0
push 0x181
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x46c2d8]
mov ecx, dword [ebp]
push eax
push ecx
push 0x4669a0
push 0x466998
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 0x10

Function at 0x4111b1
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3fb
mov eax, dword [esi + 4]
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
call ebx
mov ecx, dword [esi + 4]
push 0x3fc
push ecx
call edi
push 0
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10