joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403190
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push 0x7f
xor ebx, ebx
push 0x439ca0
push str.wsftple_
push str.MAILADDR
call fcn.00402ec0
add esp, 0x10
mov byte [0x437b80], bl
mov byte [0x437cd0], bl
mov byte [0x437d20], bl
push 0x4f
mov byte [0x437dc0], bl
mov dword [0x43800c], 0x1770
mov dword [0x438008], 0x41
mov dword [0x43802c], 6
push 0x437b80
push 0x42f0f0
push str.SESSION
call fcn.00402ec0
add esp, 0x10
mov eax, dword [0x42f7d0]
push 0x437b80
push eax
call fcn.00403a60
add esp, 8
mov eax, dword [0x42fcb0]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x438470
push eax
push str.balloon
push 0x42fa20
call esi
push 0x438470
mov ecx, dword [0x42f814]
push ecx
mov dword [0x42fcb0], eax
push str.VERBOSE
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f814], eax
mov eax, dword [0x42f804]
push eax
push str.HASH
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f804], eax
push ebx
push str.tranrate
push 0x42fa20
call esi
push 0x438470
mov dword [0x42fcd4], eax
push ebx
push str.DateFmt
push 0x42fa20
call esi
mov dword [0x431c5c], eax
push 0x438470
push ebx
push str.AUTOSAVE
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f81c], eax
push 1
push str.LONGDIR
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f7f8], eax
push ebx
push str.DBLCLK
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f840], eax
mov eax, dword [0x42f848]
push eax
push str.AUTOSTART
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f848], eax
push ebx
push str.LAYOUT
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f84c], eax
push ebx
push str.BONTOP
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f854], eax
push ebx
push str.HIDBTN
push 0x42fa20
call esi
push 0x438470
mov dword [0x430e1c], eax
push 3
push str.FONT
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f828], eax
push ebx
push str.SCALE
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f82c], eax
push 1
push str.LONGDATE
push 0x42fa20
call esi
mov dword [0x42f830], eax
push 0x438470
push 1
push str.VRFYDEL
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f858], eax
push ebx
push str.UseFindExec
push 0x42fa20
call esi
push 0x438470
mov dword [0x43039c], eax
mov dword [0x42f818], 1
push 0x1000
push 0x42f9cc
push 0x42fa20
call esi
push 0x438470
mov dword [0x42f7e8], eax
push 0x200
push 0x42f9d0
push 0x42fa20
call esi
mov dword [0x42f7e4], eax
call fcn.004156d0
xor eax, eax
pop esi
pop ebx
ret
Function at 0x403870
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x114
push ebx
push esi
mov ebx, dword [esp + 0x124]
push edi
push ebp
test ebx, ebx
jne 0x40389e
mov edi, dword [esp + 0x128]
push 0
push 0
push 0x14b
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4038a5
mov edi, dword [esp + 0x128]
xor ebp, ebp
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
test ebx, ebx
je 0x4038b9
push str.rdir_u
jmp 0x4038be
push str.ldir_u
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x30]
lea ecx, [esp + 0x1c]
add esp, 0xc
push 0x438470
push 0x100
push eax
push 0x42f0f0
push ecx
push 0x437b80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40391b
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x158
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x40391b
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x14a
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
inc ebp
cmp ebp, 0x14
jl 0x4038ad
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x114
ret
Function at 0x4061d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
push ebp
call fcn.0040c140
test eax, eax
je 0x4061f0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
cmp dword [0x42f864], 0xffffffff
jne 0x40643e
call fcn.00417430
mov eax, dword [0x438580]
mov ebx, dword [esp + 0x114]
push eax
push ebx
call fcn.00401070
add esp, 8
mov esi, eax
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
test esi, esi
je 0x4063da
mov esi, 0x439d20
mov edi, 0x437b80
mov ecx, 0x12c
push 0x43a180
mov dword [0x42f330], 0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x437488]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call esi
push 0x43a194
mov ecx, dword [0x437560]
push ecx
call esi
push 1
push str.RSORT
call fcn.00402f10
add esp, 8
mov dword [0x42fa30], eax
push 1
push str.LSORT
call fcn.00402f10
add esp, 8
mov dword [0x42fa34], eax
cmp dword [0x431644], 0
je 0x4062a6
push 0
mov eax, dword [0x437350]
push eax
call fcn.00403870
add esp, 8
cmp byte [0x437e50], 0
je 0x4062d9
push str.origdir
push 0x437e50
call fcn.00429c00
add esp, 8
test eax, eax
jne 0x4062cc
push 0x437a70
jmp 0x4062d1
push 0x437e50
call fcn.00416af0
add esp, 4
push 0xd
mov eax, dword [0x437488]
push 0x42f7b0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call fcn.0041ea00
add esp, 4
mov eax, dword [0x438018]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x430e80], eax
push 0x437b80
call fcn.0040fa90
add esp, 4
mov ecx, dword [0x430e80]
mov edx, dword [0x42f330]
cmp eax, 0xffffffff
jne 0x406342
mov ebp, ecx
dec ecx
mov dword [0x430e80], ecx
test ebp, ebp
jle 0x406342
mov dword [0x42f864], eax
test edx, edx
jne 0x406342
push 0x1f4
call edi
jmp 0x406305
mov dword [0x42f864], eax
cmp eax, 0xffffffff
je 0x4063da
lea eax, [esp + 0x10]
push 0x100
push eax
mov ecx, dword [0x438580]
push 0x2348
mov ebp, dword [sym.imp.USER32.dll_LoadStringA]
push ecx
call ebp
lea ecx, [esp + 0x10]
mov eax, dword [0x437650]
push ecx
push eax
call esi
cmp byte [0x437dc0], 0
je 0x406397
push 0x437dc0
mov eax, dword [0x42f864]
push eax
call fcn.004161e0
add esp, 8
cmp word [esp + 0x118], 0x2328
jne 0x4063da
push 0x14
mov eax, dword [0x437560]
push 0x42f798
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 1
push ebx
call fcn.00417970
add esp, 8
cmp dword [0x431644], 0
je 0x4063da
push 1
mov eax, dword [0x437368]
push eax
call fcn.00403870
add esp, 8
push ebx
call fcn.00414060
add esp, 4
mov eax, dword [0x430354]
mov ebp, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebp
push 0
push 0x1fa4
push 0x111
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x42f7dc], 0
je 0x406411
push 2
jmp 0x406413
push 4
call fcn.0040bb30
add esp, 4
cmp dword [0x42f7dc], 0
je 0x406431
push 0x437b80
call fcn.00401dc0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
mov ebx, dword [esp + 0x114]
push ebx
call fcn.00406180
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x408c50
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x110
cmp dword [0x42fcb0], 0
push esi
push edi
je 0x408dea
mov eax, dword [esp + 0x128]
cmp eax, dword [0x42fcb4]
je 0x408dea
mov dword [0x42fcb4], eax
mov eax, dword [0x42fcb8]
test eax, eax
je 0x408c97
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x42fcb8], 0
cmp dword [0x42fcb4], 0
je 0x408dea
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov dword [esp + 8], eax
lea eax, [esp + 8]
mov dword [esp + 0xc], ecx
push eax
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [esp + 0x18]
push 0x100
push ecx
mov eax, dword [0x42fcb4]
push eax
mov edx, dword [0x438580]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
mov ecx, dword [0x438580]
push ecx
mov eax, dword [0x42f7d0]
push 0
push eax
mov eax, dword [esp + 0x1c]
push 0xa
push 0x32
add eax, 0xa
lea ecx, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
add eax, 5
push eax
push 0x80800081
push ecx
push 0x42fcbc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x42fcb8], eax
test eax, eax
je 0x408dea
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0x17
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x18
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push esi
mov eax, dword [0x42fcb8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x14]
push 0
add eax, 4
push eax
mov eax, dword [esp + 0x18]
add eax, 8
push eax
mov ecx, dword [0x42fcb8]
mov eax, dword [esp + 0x18]
add eax, 0xa
push eax
mov eax, dword [esp + 0x18]
add eax, 5
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0xfffffffffffffffc
mov ecx, dword [0x42fcb8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x408ab0
mov ecx, dword [0x42fcb8]
push 0xfffffffffffffffc
mov dword [0x437010], eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 4
mov ecx, dword [0x42fcb8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
add esp, 0x110
ret
Function at 0x409770
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x114
lea eax, [esp]
push esi
push 0xff
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0xf4
push 0xff
push str._c_c_c
push eax
call esi
lea ecx, [esp + 0x18]
add esp, 0x14
mov eax, dword [0x42f864]
push 1
push 3
push ecx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x4097fa
lea eax, [esp + 0x18]
push 0x100
push eax
mov ecx, dword [0x438580]
push 0x3766
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
call sub.WSOCK32.dll_WSAGetLastError
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x124]
push ecx
push eax
push str.__u__IP__s__u
call fcn.0040cf50
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x114
ret
lea eax, [esp + 4]
push 0xf2
push str._cABOR_r_n
push eax
call esi
lea eax, [esp + 0x10]
add esp, 0xc
mov ecx, dword [0x42f864]
push 0
push 7
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x40986e
lea eax, [esp + 0x18]
push 0x100
push eax
mov ecx, dword [0x438580]
push 0x3766
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
call sub.WSOCK32.dll_WSAGetLastError
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x124]
push ecx
push eax
push str.__u__ABOR__s__u
call fcn.0040cf50
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x114
ret
lea eax, [esp + 4]
push 0xf2
push 0xff
push str._c_c
push eax
call esi
lea eax, [esp + 0x28]
add esp, 0x10
mov ecx, dword [0x438580]
push 0x100
push eax
push 0x37e1
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x18]
mov esi, dword [esp + 0x120]
push ecx
push esi
push str.__u___s_ABOR
call fcn.0040cf50
add esp, 0xc
push esi
call fcn.0040b610
add esp, 4
pop esi
add esp, 0x114
ret

Function at 0x409e20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
cmp byte [0x42f7c4], 0x41
push ebx
push esi
mov ebx, dword [esp + 0x110]
push edi
push ebp
jne 0x409e4e
mov eax, dword [esp + 0x11c]
cmp byte [ebx + eax], 0x1a
jne 0x409e4e
dec dword [esp + 0x11c]
mov ebp, dword [esp + 0x11c]
test ebp, ebp
jle 0x409e79
mov edi, dword [esp + 0x114]
push 0
push ebp
push ebx
push edi
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
mov esi, eax
je 0x409e8d
sub ebp, esi
add ebx, esi
test ebp, ebp
jg 0x409e60
mov eax, dword [esp + 0x11c]
sub eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
call sub.WSOCK32.dll_WSAGetLastError
mov edi, eax
push 0x100
lea eax, [esp + 0x14]
mov ecx, dword [0x438580]
push eax
push 0x37be
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.0041a860
add esp, 8
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x40b950
Capabilities:
Get socket status

Disassembly:
sub esp, 0x168
mov dword [0x42fdec], 0
push esi
mov esi, dword [esp + 0x170]
cmp esi, 0xffffffff
je 0x40b9c0
mov dword [esp + 0xc], 0
lea eax, [esp + 4]
mov dword [esp + 0x10], esi
lea ecx, [esp + 0xc]
push eax
inc dword [esp + 0x10]
push 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x64
push 0
push ecx
push 0
call sub.WSOCK32.dll_select
test eax, eax
je 0x40b9c0
lea eax, [esp + 0x110]
push 0x7d00
push 0
push 0x52
push eax
push esi
call fcn.0040d8b0
add esp, 0x14
xor eax, eax
pop esi
add esp, 0x168
ret

Function at 0x40cdf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
push edi
push ebp
push esi
call fcn.0041f030
add esp, 4
test eax, eax
jle 0x40cf0f
lea eax, [esp + 0x10]
mov ecx, dword [0x433f20]
push eax
push ecx
push esi
call fcn.0041f050
add esp, 0xc
cmp eax, 0xffffffff
je 0x40cf0f
cmp eax, 4
jge 0x40cf0f
push 0x410
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40cf0f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x40cf08
lea ebx, [edi + 0x20c]
lea eax, [esp + 0x10]
push eax
lea ebp, [edi + 0x30c]
push 0x437960
push ebx
call fcn.0040c790
add esp, 0xc
push ebp
push 0
push 0x4303f8
push 0x437020
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x2e
push ebx
call fcn.004202c0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40cec8
push str..TMP
push ebp
call fcn.004202f0
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x40cec8
push 4
push ebx
push ebp
call fcn.00420c90
mov byte [ebp + 4], 0
add esp, 0xc
mov eax, dword [esp + 0x118]
push esi
mov dword [edi + 0x40c], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0
push 0x40cb10
call fcn.00420af0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40cf08
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x40d8b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
mov ecx, 0x3e8
mov dword [esp + 8], 0
push esi
push edi
mov esi, dword [esp + 0x118]
mov edi, dword [esp + 0x128]
mov eax, edi
mov dword [esp + 0x14], esi
cdq
idiv ecx
inc dword [esp + 0x10]
mov dword [esp + 8], eax
mov eax, edi
cdq
idiv ecx
lea ecx, [esp + 8]
lea eax, [edx + edx*4]
push ecx
push 0
lea edx, [eax + eax*4]
push 0
lea eax, [edx + edx*4]
lea edx, [esp + 0x1c]
shl eax, 3
push edx
mov dword [esp + 0x1c], eax
push 1
call sub.WSOCK32.dll_select
test eax, eax
jle 0x40d939
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
push eax
push ecx
push edx
push esi
call sub.WSOCK32.dll_recv
pop edi
pop esi
add esp, 0x10c
ret
jne 0x40d94a
push 0x2714
call sub.WSOCK32.dll_WSASetLastError
mov eax, 0xffffffff
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x40d960
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, 0x3e8
mov dword [esp + 8], 0
push esi
push edi
mov esi, dword [esp + 0x118]
mov edi, dword [esp + 0x124]
mov eax, edi
mov dword [esp + 0x14], esi
cdq
idiv ecx
inc dword [esp + 0x10]
mov dword [esp + 8], eax
mov eax, edi
cdq
idiv ecx
lea ecx, [esp + 8]
lea eax, [edx + edx*4]
lea edx, [eax + eax*4]
push ecx
push 0
lea eax, [edx + edx*4]
lea edx, [esp + 0x18]
shl eax, 3
push edx
mov dword [esp + 0x18], eax
push 0
push 1
call sub.WSOCK32.dll_select
test eax, eax
jle 0x40d9e3
mov eax, dword [esp + 0x120]
push 0
mov ecx, dword [esp + 0x120]
push eax
push ecx
push esi
call sub.WSOCK32.dll_send
pop edi
pop esi
add esp, 0x10c
ret
jne 0x40d9f4
push 0x2714
call sub.WSOCK32.dll_WSASetLastError
mov eax, 0xffffffff
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x40f890
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0x200
test edx, edx
push esi
mov esi, dword [esp + 0x208]
push edi
jne 0x40f8b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
lea edi, [esp + 8]
mov eax, dword [esp + 0x210]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
xor eax, eax
test edx, edx
jle 0x40f8d4
mov cl, byte [esp + eax + 8]
xor byte [esi + eax], cl
inc eax
cmp eax, edx
jl 0x40f8c8
mov eax, edx
pop edi
pop esi
add esp, 0x200
ret
Function at 0x410d20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
push edi
push eax
call fcn.0041fda0
lea eax, [esp + 0xc]
add esp, 4
push eax
call fcn.00420e90
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push 0x8f
push eax
call fcn.00420370
add esp, 8
push 0x438470
push 1
push str.dolog
push 0x42fa20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x410e24
push 0x9c
push 0x430fa0
push str.WS_FTP.LOG
push str.logfile
call fcn.00402ec0
add esp, 0x10
push 0x42f1ec
push 0x430fa0
call fcn.00420090
add esp, 8
mov edi, eax
test edi, edi
je 0x410e24
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x11c]
push eax
mov eax, dword [esp + 0x11c]
push ecx
push edx
mov ecx, 0x430e44
cmp dword [esp + 0x120], 1
je 0x410ddd
mov ecx, 0x430e40
push ecx
push eax
lea eax, [esp + 0x20]
push eax
mov al, byte [0x42f7c4]
sub al, 0x41
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
cmp al, 1
sbb eax, eax
add eax, 0x42
push eax
push ecx
push edx
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x10]
inc eax
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str._04d._02d._02d__02d:_02d__c__s_s__s__s__s__s_n
push edi
call fcn.00420000
add esp, 0x38
push edi
call fcn.0041ff60
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x108
ret

Function at 0x411350
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push esi
shr eax, 0x10
push edi
movzx eax, ax
cmp eax, 7
je 0x411374
cmp eax, 8
je 0x41139a
cmp eax, 0x32
je 0x4113f8
xor eax, eax
pop edi
pop esi
ret
call fcn.0040c140
test eax, eax
je 0x41143e
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x14f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop edi
pop esi
ret
mov esi, dword [esp + 0x14]
push 0
push 0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x147
push esi
call edi
cmp eax, 0xffffffff
je 0x41143e
push 0x42f538
push eax
push 0x148
push esi
call edi
cmp eax, 0xffffffff
je 0x41143e
push 0x42f538
mov eax, dword [0x42f864]
push eax
call fcn.004161e0
add esp, 8
cmp eax, 2
jne 0x41143e
mov eax, dword [esp + 0xc]
push 1
push eax
call fcn.00417970
add esp, 8
xor eax, eax
pop edi
pop esi
ret
call fcn.0040c140
test eax, eax
jne 0x41143e
mov eax, dword [esp + 0x14]
push 0x100
push 0x42f538
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x42f538
mov ecx, dword [0x42f864]
push ecx
call fcn.004161e0
add esp, 8
cmp eax, 2
jne 0x41143e
mov eax, dword [esp + 0xc]
push 1
push eax
call fcn.00417970
add esp, 8
xor eax, eax
pop edi
pop esi
ret
Function at 0x411480
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push esi
shr eax, 0x10
push edi
movzx eax, ax
cmp eax, 8
je 0x41149f
cmp eax, 0x32
je 0x411542
xor eax, eax
pop edi
pop esi
ret
mov esi, dword [esp + 0x14]
push 0
push 0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x147
push esi
call edi
cmp eax, 0xffffffff
je 0x4115bb
push 0x42f538
push eax
push 0x148
push esi
call edi
cmp eax, 0xffffffff
je 0x4115bb
push 2
push 0x4310dc
push 0x42f538
call fcn.00420e50
add esp, 0xc
test eax, eax
jne 0x41151b
movsx eax, byte [0x42f53a]
push eax
call fcn.00420690
add esp, 4
sub eax, 0x60
push eax
call fcn.004211f0
mov eax, dword [esp + 0x10]
add esp, 4
push eax
call fcn.0041ea00
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0x42f538
call fcn.00411450
add esp, 4
test eax, eax
jne 0x4115bb
mov eax, dword [esp + 0xc]
push eax
call fcn.0041ea00
add esp, 4
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
push 0x100
push 0x42f538
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 2
push 0x4310dc
push 0x42f538
call fcn.00420e50
add esp, 0xc
test eax, eax
jne 0x41159d
movsx eax, byte [0x42f53a]
push eax
call fcn.00420690
add esp, 4
sub eax, 0x60
push eax
call fcn.004211f0
mov eax, dword [esp + 0x10]
add esp, 4
push eax
call fcn.0041ea00
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0x42f538
call fcn.00411450
add esp, 4
test eax, eax
jne 0x4115bb
mov eax, dword [esp + 0xc]
push eax
call fcn.0041ea00
add esp, 4
xor eax, eax
pop edi
pop esi
ret

Function at 0x4120f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
cmp eax, 0x135
push esi
je 0x41211e
cmp eax, 0x136
je 0x4121e0
cmp eax, 0x138
je 0x412148
xor eax, eax
pop esi
add esp, 0x100
ret
mov esi, dword [esp + 0x110]
push esi
call fcn.0041fbb0
add esp, 4
mov eax, dword [0x437a64]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [0x42fab0]
pop esi
add esp, 0x100
ret
mov eax, dword [esp + 0x114]
cmp dword [0x437380], eax
je 0x412167
cmp dword [0x437398], eax
je 0x412167
cmp dword [0x4373b0], eax
jne 0x4121c3
lea ecx, [esp + 4]
push 0xfa
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [esp + 4], 0x21
je 0x4121b0
cmp byte [esp + 4], 0x35
je 0x4121b0
lea eax, [esp + 4]
push 3
push 0x431128
push eax
call fcn.004213c0
add esp, 0xc
test eax, eax
je 0x4121b0
cmp byte [esp + 4], 0x2b
jne 0x4121ac
push 0xffff
jmp 0x4121b5
push 0
jmp 0x4121b5
push 0xc0
mov eax, dword [esp + 0x114]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov esi, dword [esp + 0x110]
push esi
call fcn.0041fbb0
add esp, 4
mov eax, dword [0x437a64]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [0x42fab0]
pop esi
add esp, 0x100
ret
Function at 0x412430
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x300
cmp dword [esp + 0x30c], 0
push ebx
push esi
push edi
push ebp
je 0x4124d8
mov edi, dword [0x43039c]
mov esi, dword [esp + 0x318]
lea eax, [esp + 0x10]
push esi
mov dword [0x43039c], 1
push esi
push eax
call fcn.0040c8c0
add esp, 0xc
test eax, eax
jne 0x41247e
lea eax, [esp + 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x210]
push 0x100
push eax
mov ecx, dword [0x438580]
push 0x36e4
mov dword [0x43039c], edi
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x210]
lea eax, [esp + 0x10]
push ecx
push eax
call fcn.00411820
add esp, 8
test eax, eax
je 0x4126a4
lea eax, [esp + 0x10]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x300
ret
mov esi, dword [esp + 0x318]
push 5
push 0x42f0f0
mov eax, dword [0x42f7d0]
push 0
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jge 0x4126a4
push eax
push str._ShellExecute_return__u
call fcn.0040cf50
add esp, 8
push 0x2e
push esi
call fcn.00420180
add esp, 8
mov edi, eax
test edi, edi
je 0x4126a4
inc edi
cmp byte [edi], 0
je 0x4126a4
push 0x4303d8
push edi
call fcn.00429c00
add esp, 8
test eax, eax
je 0x41269b
push 0x4303d4
push edi
call fcn.00429c00
add esp, 8
test eax, eax
je 0x41269b
push 0x4303dc
push edi
call fcn.00429c00
add esp, 8
test eax, eax
je 0x41269b
push 0x4303d0
push edi
call fcn.00429c00
add esp, 8
test eax, eax
je 0x41269b
push 0x100
mov ebp, dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push 0x438c30
push 0x42f0f0
push edi
push str.Extensions
call ebp
test eax, eax
je 0x4125fd
push 0x5e
push 0x438c30
call fcn.00420180
add esp, 8
test eax, eax
push esi
je 0x4125c6
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4125e5
push 0x42f214
push 0x438c30
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x438c30
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
push 0x438c30
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x300
ret
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42f538
call ebx
mov eax, dword [esp + 0x314]
push 0
push 0x40da00
mov ecx, dword [0x438580]
push eax
push str.DLG_ASSOCIATE
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x4126a4
push 0x100
push 0x438c30
push 0x42f0f0
push edi
push str.Extensions
call ebp
test eax, eax
je 0x4126a4
push 0x5e
push 0x438c30
call fcn.00420180
add esp, 8
test eax, eax
push esi
je 0x412664
push eax
call ebx
jmp 0x412683
push 0x42f214
push 0x438c30
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x438c30
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
push 0x438c30
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x300
ret
push 5
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x300
ret