Function at 0x4dc8f0
Capabilities:
Enumerate files on windows
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004d4990
push 0
xor edx, edx
mov ecx, 0x8e
call fcn.004dc450
mov ebp, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
mov esi, eax
test esi, esi
je 0x4d9dbe
lea esp, [esp]
push 0x400
push 0
push esi
call edi
test eax, eax
jne 0x4d9db0
xor ecx, ecx
call fcn.004d8830
mov ebx, dword [0x5aa0e0]
mov dword [0x5aa0e0], 0
call fcn.004d4020
push 0
xor edx, edx
mov ecx, 0x65
call fcn.004dc450
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x4d9e07
test ebx, ebx
je 0x4d9dfc
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041d520
push 0x400
push 0
push esi
call edi
test eax, eax
jne 0x4d9e07
pop edi
mov ecx, esi
pop esi
pop ebp
mov edx, ebx
pop ebx
jmp fcn.004d2170
push ebx
call fcn.004d4990
call fcn.004e27f0
xor edx, edx
mov ecx, 0xad
mov dword [0x5aa558], eax
call fcn.004dc450
mov ebx, eax
test ebx, ebx
je 0x4da5c7
push ebp
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov ebp, dword [sym.imp.USER32.dll_DeleteMenu]
cmp eax, 0xac
mov eax, dword [0x59bd48]
jne 0x4da474
test eax, eax
je 0x4da498
push 0x400
push 2
push ebx
call ebp
jmp 0x4da498
test eax, eax
jne 0x4da498
xor edx, edx
mov ecx, 0xefb
call fcn.0041d620
push eax
push 0xac
push 0x400
push 2
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov edi, eax
test edi, edi
jle 0x4da4c6
lea esi, [edi - 1]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemID]
cmp eax, 0xaf
je 0x4da4c6
push 0x400
push esi
push ebx
call ebp
dec edi
dec esi
test edi, edi
jg 0x4da4a8
mov eax, dword [0x5b430c]
test eax, eax
je 0x4da5c4
push 0x583b74
push 0
push 0x800
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov esi, dword [0x5b430c]
test esi, esi
mov edi, 1
mov ebp, 0x1770
je 0x4da5c4
mov edi, edi
mov eax, dword [esi + 0x708]
test eax, eax
jne 0x4da51a
push 4
mov edx, 0x5aa640
mov ecx, esi
call fcn.004be9a0
jmp 0x4da52a
mov eax, dword [esi]
push 0x3c
push 0x5aa640
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, 0x5aa640
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4da532
sub eax, edx
cmp eax, 0x32
jbe 0x4da54a
mov dword [0x5aa672], 0x2e2e2e
cmp edi, 1
jl 0x4da56f
cmp edi, 9
jg 0x4da56f
push 0x5aa640
push edi
push 0x583f10
push 0x5aaa28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4da593
cmp edi, 0xa
push 0x5aa640
jne 0x4da580
push str.0__s
jmp 0x4da585
push str.____s
push 0x5aaa28
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [0x5b4320]
mov edx, dword [esi]
xor eax, eax
cmp ecx, edx
setne al
push 0x5aaa28
push ebp
dec eax
and eax, 8
push eax
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov esi, dword [esi + 0xd9c]
inc edi
inc ebp
test esi, esi
jne 0x4da500
pop edi
pop esi
pop ebp
pop ebx
ret
sub esp, 0x150
push ebp
call fcn.004d4990
call fcn.004e27f0
xor edx, edx
mov ecx, 0xbe
mov dword [0x5aa558], eax
call fcn.004dc450
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x4daa4e
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetMenuItemCount]
push edi
push ebp
call esi
test eax, eax
jle 0x4da86d
mov ebx, dword [sym.imp.USER32.dll_GetMenuItemID]
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
lea esp, [esp]
push 6
push ebp
call ebx
cmp eax, 0xc2
je 0x4da86d
push 0x400
push 6
push ebp
call edi
push ebp
call esi
test eax, eax
jg 0x4da850
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
cmp edi, 1
jne 0x4da8a1
push 0x5a9798
push 0x589344
push 0x5aa640
call ebp
mov ecx, 0xf02
jmp 0x4da8dd
cmp edi, 3
jne 0x4da8be
push 0x5a9798
push str._s.txt
push 0x5aa640
call ebp
mov ecx, 0xf03
jmp 0x4da8dd
cmp edi, 4
jne 0x4daa27
push 0x5a9798
push str._s.htm
push 0x5aa640
call ebp
mov ecx, 0xf13
mov edx, 0x5aaa28
add esp, 0xc
call fcn.0041d620
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, eax
test ebx, ebx
je 0x4daa27
mov dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push 0x5aa640
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4da971
lea esp, [esp]
test byte [esp + 0x20], 0x10
jne 0x4da95a
lea edx, [esp + 0x4c]
push edx
call fcn.00580fc6
movzx eax, byte [esp + 0x50]
push eax
call fcn.00571012
mov ecx, dword [esp + 0x18]
add esp, 8
push 0
lea edx, [esp + 0x50]
mov byte [esp + 0x50], al
call fcn.004c7e10
test eax, eax
je 0x4da95a
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4da920
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 1
jne 0x4da99b
push 0x5a9798
push str._s.chm
push 0x5aa640
mov dword [esp + 0x20], 2
call ebp
mov edi, dword [esp + 0x20]
add esp, 0xc
jmp 0x4da902
mov ecx, dword [esp + 0x10]
push 0
xor edx, edx
call fcn.0051f5e0
xor edi, edi
test eax, eax
mov dword [esp + 0x10], eax
mov esi, eax
je 0x4da9db
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
push edx
add eax, 0x1388
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov ecx, dword [esp + 0x18]
mov esi, dword [esi + 0x40]
inc edi
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
jne 0x4da9b4
lea ecx, [esp + 0x10]
call fcn.004c8280
test edi, edi
je 0x4daa10
mov ecx, dword [esp + 0x1c]
push 0x5aaa28
push ebx
push 0x10
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
mov edi, eax
jmp 0x4da884
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
mov edi, eax
jmp 0x4da884
mov eax, dword [esp + 0x18]
test eax, eax
pop edi
pop esi
pop ebx
jle 0x4daa4e
mov edx, dword [esp + 0x10]
push 0x583b74
push 0
push 0x800
push 0xc2
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
pop ebp
add esp, 0x150
ret
push ebx
mov ebx, ecx
test ebx, ebx
je 0x4dc9d9
mov eax, dword [0x5b4314]
push esi
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push edi
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetSystemMenu]
jne 0x4dc924
mov ecx, dword [0x5b4314]
push 0
push ecx
call edi
test eax, eax
je 0x4dc931
push 0
push 0x65
xor edx, edx
mov ecx, eax
call fcn.004db390
cmp ebx, eax
jne 0x4dc93d
pop edi
pop esi
pop ebx
jmp 0x4d9d80
mov edx, dword [0x5b4314]
push edx
call esi
test eax, eax
jne 0x4dc957
push eax
mov eax, dword [0x5b4314]
push eax
call edi
test eax, eax
je 0x4dc967
push 0
push 0x8e
xor edx, edx
mov ecx, eax
call fcn.004db390
cmp ebx, eax
jne 0x4dc973
pop edi
pop esi
pop ebx
jmp fcn.004d9e70
cmp ebx, dword [0x5aa0e8]
jne 0x4dc98a
pop edi
pop esi
xor edx, edx
mov ecx, 1
pop ebx
jmp fcn.004d3710
mov ecx, dword [0x5b4314]
push ecx
call esi
test eax, eax
jne 0x4dc9a5
mov edx, dword [0x5b4314]
push eax
push edx
call edi
test eax, eax
je 0x4dc9b5
push 0
push 0xad
xor edx, edx
mov ecx, eax
call fcn.004db390
cmp ebx, eax
jne 0x4dc9c1
pop edi
pop esi
pop ebx
jmp 0x4da420
xor edx, edx
mov ecx, 0xbe
call fcn.004dc450
cmp ebx, eax
pop edi
pop esi
jne 0x4dc9d9
pop ebx
jmp 0x4da800
pop ebx
ret