joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401800
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x401885
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.msys_2.0.dll_strrchr
test eax, eax
je 0x401870
lea ebp, [eax + 1]
mov ecx, ebp
sub ecx, ebx
cmp ecx, 6
jle 0x401870
lea esi, [eax - 6]
mov ecx, 7
mov edi, str._.libs_
repe cmpsb byte [esi], byte es:[edi]
seta cl
mov esi, ecx
setb cl
mov edx, esi
cmp dl, cl
jne 0x401870
mov ecx, 3
mov edi, 0x406500
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
mov ebx, ebp
seta dl
setb cl
cmp dl, cl
jne 0x401870
lea ebx, [eax + 4]
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_short_name]
mov dword [eax], ebx
mov eax, dword [sym.imp.msys_2.0.dll_program_invocation_name]
mov dword [0x40a020], ebx
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msys_2.0.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x37
mov dword [esp + 4], 1
mov dword [esp], str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov dword [esp + 0xc], eax
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x403ef0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0
call sub.msys_2.0.dll_nl_langinfo
test eax, eax
je 0x404091
mov edi, str.US_ASCII
mov ecx, 9
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
mov ebp, eax
je 0x403fa0
mov ebx, dword [0x40a190]
test ebx, ebx
je 0x404010
movzx esi, byte [ebx]
mov eax, esi
test al, al
jne 0x403f59
jmp 0x403f83
lea ebx, [ebx + edi + 1]
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
lea ebx, [ebx + eax + 1]
movzx esi, byte [ebx]
mov eax, esi
test al, al
je 0x403f83
mov dword [esp], ebx
call sub.msys_2.0.dll_strlen
mov edi, eax
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x403f7f
mov eax, esi
cmp al, 0x2a
jne 0x403f40
cmp byte [ebx + 1], 0
jne 0x403f40
lea ebp, [ebx + edi + 1]
cmp byte [ebp], 0
mov eax, str.ASCII
cmove ebp, eax
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.LC_ALL
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403fb5
cmp byte [eax], 0
jne 0x404030
mov dword [esp], str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403fca
cmp byte [eax], 0
jne 0x404030
mov dword [esp], str.LANG
call sub.msys_2.0.dll_getenv
test eax, eax
je 0x403fdf
cmp byte [eax], 0
jne 0x404030
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esp + 4], str.CP_u
mov dword [esp + 8], eax
mov ebp, 0x40a180
mov dword [esp], 0x40a180
call sub.msys_2.0.dll_sprintf
mov ebx, dword [0x40a190]
test ebx, ebx
jne 0x403f2f
mov dword [0x40a190], str.CP936
mov edi, 5
mov esi, 0x43
mov ebx, str.CP936
jmp 0x403f63
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x403fdf
lea ebp, [eax + 1]
mov dword [esp + 4], 0x40
mov dword [esp], ebp
call sub.msys_2.0.dll_strchr
test eax, eax
je 0x403f8f
sub eax, ebp
cmp eax, 0xc
mov ebx, eax
ja 0x403fdf
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov ebp, 0x40a180
mov dword [esp], 0x40a180
call sub.msys_2.0.dll_memcpy
mov byte [ebx + 0x40a180], 0
jmp 0x403f8f
mov ebp, 0x406e7c
jmp 0x403f21
Function at 0x402af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45bd14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x402b27
cmp dword [ebp - 0xc], 0
jne 0x402b31
mov eax, 1
jmp 0x402b97
inc word [0x46423e]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x402b5b
push 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.004032d1
add esp, 8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402b7d
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
push eax
call fcn.00402b9c
add esp, 4
dec word [0x46423e]
xor eax, eax
jmp 0x402b97
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410340
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x10]
push eax
call fcn.00426fb6
add esp, 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test ah, 0x80
je 0x4103cb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4103cb
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [0x45bae0]
mov eax, dword [eax + 0x16]
push eax
call dword [sym.imp.GDI32.dll_PtVisible]
test eax, eax
je 0x4103cb
mov eax, dword [0x45bdac]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4103d7
mov eax, dword [0x45bd6c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410750
add dword [ebp - 4], 2
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410767
inc dword [ebp - 4]
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x41077f
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
jmp 0x410788
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412c79
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push str.SoftwareMicrosoftShared
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412d40
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.OfficeUILanguage
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412d12
cmp dword [ebp - 0x28], 0
je 0x412d12
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call fcn.00412df7
add esp, 8
test eax, eax
jne 0x412d19
mov dword [ebp - 0x28], 0x409
mov eax, dword [ebp - 0x28]
push eax
push 0x454844
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x412dc0
push str.msi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412dc0
push str.MsiProvideQualifiedComponentA
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x412db6
mov dword [ebp - 0x38], 0x100
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push str.71358FC1_E43B_11D1_A17F_00A0C90AB50F
call dword [ebp - 0x34]
test eax, eax
jl 0x412db6
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xc], 0
jne 0x412dd8
push str.eeintl.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412dea
mov eax, dword [0x45bd44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x412df2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414b35
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
push edi
mov dword [ebp - 0x314], 0x100
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x318], 8
cmp dword [0x454c54], 1
jne 0x414c22
mov dword [0x454c54], 0
lea eax, [ebp - 0x30c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x304]
push eax
mov eax, dword [0x454c4c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414c1d
inc dword [0x454c4c]
push 0x454c48
push 0x20019
push 0
lea eax, [ebp - 0x304]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414c1d
lea eax, [ebp - 0x304]
push eax
call fcn.0041522c
add esp, 4
lea eax, [ebp - 0x304]
push eax
push 0x454c7c
mov eax, dword [ebp + 0x10]
push eax
call fcn.00417c00
add esp, 0xc
mov dword [ebp - 0x318], 0
jmp 0x414d8f
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x204]
push eax
mov eax, dword [0x454c50]
push eax
mov eax, dword [0x454c48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414c9b
inc dword [0x454c50]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x204]
push eax
push str._s_s
mov eax, dword [ebp + 0x10]
push eax
call fcn.00417c00
add esp, 0x10
mov dword [ebp - 0x318], 0
jmp 0x414d8f
cmp dword [ebp - 0x104], 0x103
jne 0x414d8f
mov dword [0x454c50], 0
mov dword [ebp - 0x310], 0x100
mov eax, dword [0x454c48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x304]
push eax
mov eax, dword [0x454c4c]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414d75
inc dword [0x454c4c]
push 0x454c48
push 0x20019
push 0
lea eax, [ebp - 0x304]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x414d70
lea eax, [ebp - 0x304]
push eax
call fcn.0041522c
add esp, 4
lea eax, [ebp - 0x304]
push eax
push str.__s_
mov eax, dword [ebp + 0x10]
push eax
call fcn.00417c00
add esp, 0xc
mov dword [ebp - 0x318], 0
jmp 0x414d8f
cmp dword [ebp - 0x104], 0x103
jne 0x414d8f
mov dword [ebp - 0x318], 1
cmp dword [ebp - 0x318], 0
je 0x414dba
mov dword [0x454c54], 1
mov dword [0x454c50], 0
mov eax, dword [0x454c50]
mov dword [0x454c4c], eax
mov eax, dword [ebp - 0x318]
jmp 0x414dc5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414dca
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x108], 0
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 0x5b
jne 0x414e9b
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x210], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 0x210]
movsx eax, byte [eax]
cmp eax, 0x5d
je 0x414e1b
jmp 0x414df8
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00415080
add esp, 4
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x45a858
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x45a858
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414e96
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414f8e
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
test eax, eax
je 0x414f8e
lea eax, [ebp - 0x108]
push eax
push 0xf003f
push 0
push 0x45a858
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414f8e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x214], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 0x214]
movsx eax, byte [eax]
cmp eax, 0x3d
je 0x414ef7
jmp 0x414ed4
mov edi, dword [ebp - 4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x104]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x208]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
lea eax, [ebp - 0x104]
push eax
push 1
push 0
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x414f93
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418750
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov word [ebp - 4], 0
movsx eax, word [ebp + 8]
test al, 8
je 0x418774
movsx eax, word [ebp - 4]
inc eax
mov word [ebp - 4], ax
movsx eax, word [ebp + 8]
test al, 4
je 0x41878b
movsx eax, word [ebp - 4]
add eax, 2
mov word [ebp - 4], ax
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test ah, 0x80
je 0x4187aa
movsx eax, word [ebp - 4]
add eax, 8
mov word [ebp - 4], ax
mov ax, word [ebp - 4]
jmp 0x4187b3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41b87c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
movsx eax, word [ebp + 8]
mov ecx, dword [0x45a9bc]
movsx ecx, word [ecx + 0x400]
sub eax, ecx
mov dword [ebp - 0x28], eax
push 0xd
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x18
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov eax, dword [0x45a9bc]
mov dword [eax + 0x41c], 1
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0041c32d
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41b8f8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0x18
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x41b952
mov eax, dword [ebp - 0x28]
add eax, 0x18
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x24], eax
push 1
mov eax, dword [ebp - 0x24]
push eax
push 0x28
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xd
push 0
push 0xb1
mov eax, dword [ebp - 0x28]
add eax, 0x18
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0xb7
mov eax, dword [ebp - 0x28]
add eax, 0x18
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [0x45a9bc]
mov dword [eax + 0x41c], 0
mov eax, dword [ebp - 0x20]
jmp 0x41b969
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e8ad
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0
push 4
push 0xc5
push 0x15
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
movsx eax, word [0x454762]
push eax
push 0x4553d8
lea eax, [ebp - 0xc]
push eax
call fcn.00417c00
add esp, 0xc
movsx eax, word [0x45bd1c]
mov dword [ebp - 0x18], eax
jmp 0x41e94d
mov dword [ebp - 0x10], 0x13
jmp 0x41e98e
mov dword [ebp - 0x10], 0x12
jmp 0x41e98e
mov dword [ebp - 0x10], 0x11
jmp 0x41e98e
mov dword [ebp - 0x10], 0x10
jmp 0x41e98e
mov dword [ebp - 0x10], 0x14
movsx eax, word [0x45bd1c]
push eax
push str._d__
lea eax, [ebp - 0xc]
push eax
call fcn.00417c00
add esp, 0xc
jmp 0x41e98e
cmp dword [ebp - 0x18], 0xc8
jg 0x41e96f
je 0x41e8ff
cmp dword [ebp - 0x18], 0x64
je 0x41e8f3
jmp 0x41e923
cmp dword [ebp - 0x18], 0x12c
je 0x41e90b
cmp dword [ebp - 0x18], 0x190
je 0x41e917
jmp 0x41e923
lea eax, [ebp - 0xc]
push eax
push 0x15
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0xffffffffffffffff
push 0
push 0xb1
push 0x15
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0xb7
push 0x15
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [ebp - 0x10]
push eax
push 0x14
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
cmp dword [ebp - 0x10], 0x14
jne 0x41e9f0
mov dword [ebp - 0x14], 0x15
jmp 0x41e9f6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422746
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
movsx eax, word [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [ebp + 8]
movsx eax, byte [ecx + eax - 2]
cmp eax, 0x5c
je 0x422790
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x455598]
mov word [edi - 1], ax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4256d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x24], sym.EqnEdt32.EXE_EqnFrameWinProc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov eax, dword [0x45bd44]
mov dword [ebp - 0x18], eax
push 1
mov eax, dword [0x45bd44]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0x202b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x4555c0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x425746
xor eax, eax
jmp 0x425781
mov dword [ebp - 0x28], 0x2b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x4555e8
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x425777
xor eax, eax
jmp 0x425781
mov eax, 1
jmp 0x425781
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425786
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x24], sym.EqnEdt32.EXE_EqnFrameWinProc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 4
mov eax, dword [0x45bd44]
mov dword [ebp - 0x18], eax
push 1
mov eax, dword [0x45bd44]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x28], 0x202b
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.EQNWINCLASS
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
movzx eax, ax
test eax, eax
jne 0x4257fc
xor eax, eax
jmp 0x425837
mov dword [ebp - 0x28], 0x2b
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.EQNINSITUCLASS
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
movzx eax, ax
test eax, eax
jne 0x42582d
xor eax, eax
jmp 0x425837
mov eax, 1
jmp 0x425837
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425c8c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push edi
push 0xc8
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [0x45bd14]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x425cf9
lea edi, [0x45bd76]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edi, [ecx + ebp - 0xc6]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 8]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x425cff
mov eax, dword [ebp + 8]
mov byte [eax], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4273b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov dword [eax + 4], 0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov ax, word [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov word [ecx + 0xc], ax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
push eax
mov eax, dword [ebp + 0x10]
and eax, 0xffff
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax + 8], 0
jne 0x427415
xor eax, eax
jmp 0x42744a
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0
jne 0x427440
xor eax, eax
jmp 0x42744a
mov eax, 1
jmp 0x42744a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4274f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x427556
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427556
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x42755e
pop edi
pop esi
pop ebx
leave
ret