joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call fcn.00438b30
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edi, 0x2b
je 0x414cd2
push esi
mov esi, dword [ebp + 0x14]
cmp edi, 0x4e
je 0x414b78
cmp edi, 0x138
jne 0x414cba
push 0
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 8]
cmp eax, 0xfffffffc
je 0x414b89
cmp eax, 0xfffffffe
jne 0x414cba
mov eax, dword [esi]
push 0x85f
push dword [ebx + 4]
mov dword [ebp + 0x14], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0x14], eax
jne 0x414bdb
push 0x10b8
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0043abd0
add esp, 0xc
cmp dword [ebp - 0x10b4], 0
jne 0x414cba
push 1
push 0
push 0
push str.https:__evkeyvn.com
push 0x4642b8
jmp 0x414cb2
push 0x860
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0x14], eax
jne 0x414c28
push 0x10b8
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0043abd0
add esp, 0xc
cmp dword [ebp - 0x10b4], 0
jne 0x414cba
push 1
push 0
push 0
push str.https:__docs.google.com_forms_d_e_1FAIpQLSd3X5CjDNFBK9M7GkmByLqbXECJc5FSJmEAdafghe8qaZZNRg_viewform
push 0x464390
jmp 0x414cb2
push 0x861
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0x14], eax
jne 0x414c6e
push 0x10b8
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0043abd0
add esp, 0xc
cmp dword [ebp - 0x10b4], 0
jne 0x414cba
push 1
push 0
push 0
push str.https:__www.facebook.com_bogotiengvietevkey
push 0x4643f8
jmp 0x414cb2
push 0x862
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0x14], eax
jne 0x414cba
push 0x10b8
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0043abd0
add esp, 0xc
cmp dword [ebp - 0x10b4], 0
jne 0x414cba
push 1
push 0
push 0
push str.mailto:lamquangminh10_gmail.com
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
push dword [ebp + 0x10]
mov ecx, ebx
push edi
push dword [ebp + 8]
call fcn.00424ae0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push eax
push 0x2b
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45df18
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x488250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [ebx + 4]
call edi
mov dword [ebx + 0x1c], eax
call fcn.00410f90
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push dword [ebx + 4]
call esi
call fcn.00413440
push eax
push 0
push 0x80
push dword [ebx + 4]
call esi
push 0x874
push dword [ebx + 4]
call edi
mov ecx, dword fs:[0x2c]
mov esi, eax
mov edx, dword [0x4930e4]
mov dword [ebp - 0x14], esi
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x489ee4]
cmp ecx, dword [edx + 4]
jle 0x414f01
push 0x489ee4
call fcn.004386a4
add esp, 4
cmp dword [0x489ee4], 0xffffffff
jne 0x414f01
push 0x4605a0
call fcn.0043855b
push 0x489ee4
call fcn.00438665
add esp, 8
test esi, esi
je 0x41500c
cmp dword [0x48326c], 0
mov eax, 0x48325c
jne 0x414ff6
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.LOGTEXT
mov edi, eax
push 0x86
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea ecx, [ebx*2 + 2]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov esi, eax
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.004045e0
push dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
push 0
push edi
mov dword [ebp - 4], 0
call fcn.00439d10
add esp, 0xc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.0043abd0
add esp, 0xc
cmp word [edi], 0
jne 0x414fb4
xor ecx, ecx
jmp 0x414fcf
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414fc0
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, 0x48325c
call fcn.00405750
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.00438227
mov ebx, dword [ebp - 0x10]
add esp, 4
mov esi, dword [ebp - 0x14]
mov eax, 0x48325c
cmp dword [0x483270], 8
cmovae eax, dword [0x48325c]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, ebx
call fcn.00424df0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416910
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, ecx
push 0xff
lea esi, [edi + 0x40]
push esi
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esi], 0
jne 0x416930
push 0
jmp 0x416932
push 1
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp word [esi], 0
je 0x416959
movzx eax, word [esi]
push eax
call fcn.00445836
mov word [esi], ax
lea esi, [esi + 2]
add esp, 4
cmp word [esi], 0
jne 0x416941
pop edi
pop esi
ret
Function at 0x4176b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 8]
lea edi, [esi + 4]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x417762
push 0
mov byte [esi + 0x14], 1
push dword [esi + 0x1c]
push 0x170
push 0x83b
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0x32
push 0x3039
push dword [esi + 0x38]
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], 0
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
mov edx, dword [edi]
sub eax, ecx
push 1
push eax
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
push ecx
push edx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004380af
mov esp, ebp
pop ebp
ret

Function at 0x417840
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x4178c0
push 0x3039
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x24]
mov byte [esi + 0x14], 0
test eax, eax
je 0x417869
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push dword [esi + 0x20]
push 0x170
push 0x83b
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 5
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4178a1
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 4]
sub eax, ecx
push 1
push eax
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
push ecx
push edx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_MoveWindow]
pop esi
ret
Function at 0x4190f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x18], edi
cmp dword [edi], esi
jle 0x419134
cmp esi, dword [0x489f38]
je 0x41912f
mov eax, dword [edi + 4]
push 0
mov ecx, dword [eax + esi*4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push dword [eax + ecx + 4]
call ebx
inc esi
cmp esi, dword [edi]
jl 0x419114
mov eax, dword [0x489f38]
mov ecx, dword [edi + 4]
push 5
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push dword [eax + ecx + 4]
call ebx
mov ebx, dword [edi + 0x2c]
push 0
push 0x1e
add ebx, 6
call fcn.00410070
mov ecx, dword [edi + 0x30]
add esp, 8
add ecx, 7
mov edi, dword [edi + 0x34]
add eax, ecx
sub edi, 6
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x38]
mov ecx, dword [ecx + 4]
sub eax, 6
mov dword [ebp - 0x1c], eax
mov eax, dword [0x489f38]
mov ecx, dword [ecx + eax*4]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
sub eax, esi
sub esi, dword [ebp - 0x14]
sub eax, ebx
add eax, edi
cdq
sub eax, edx
sar eax, 1
add ebx, eax
add esi, ebx
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
movups xmm0, xmmword [ebp - 0x28]
push 0
mov ecx, dword [ebx + 4]
movups xmmword [ebx + 0x3c], xmm0
mov eax, dword [0x489f38]
mov edx, dword [ebx + 0x3c]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x48]
sub eax, ecx
push eax
mov eax, dword [ebx + 0x44]
sub eax, edx
push eax
mov eax, dword [esi]
push ecx
push edx
mov eax, dword [eax + 4]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
lea eax, [ebx + 0x2c]
push eax
push dword [ebx + 0x28]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004380af
mov esp, ebp
pop ebp
ret

Function at 0x419ae0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 8]
push 2
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x419b41
push 0
push 0
push 0x147
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jle 0x419b41
mov dl, byte [ebp - 8]
mov ecx, esi
shl eax, 4
mov byte [ebp - 0x10], dl
mov eax, dword [eax + 0x48300c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00419cc0
mov ecx, esi
call fcn.0041a0e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004380af
mov esp, ebp
pop ebp
ret
Function at 0x41a0e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
mov edi, ecx
push 0
push 0x147
push dword [edi + 0x1c]
call ebx
push 0
push 0xffffffffffffffff
push 0x14e
push dword [edi + 0x1c]
mov dword [ebp - 0xc], eax
call ebx
push 0
push 0xffffffffffffffff
push 0x186
push dword [edi + 0x28]
call ebx
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [edi + 0x34]
call ebx
push 0
push dword [edi + 0x38]
call ebx
push 2
lea eax, [ebp - 8]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x41a19a
mov ebx, dword [edi + 0x40]
push esi
xor esi, esi
test ebx, ebx
jle 0x41a170
mov edx, dword [edi + 0x3c]
mov eax, dword [ebp - 8]
nop
movzx ecx, byte [edx]
cmp cx, ax
je 0x41a1aa
inc esi
add edx, 8
cmp esi, ebx
jl 0x41a160
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
push ecx
cmove eax, ecx
push eax
push 0x14e
push dword [edi + 0x1c]
call ebx
push 1
push dword [edi + 0x34]
mov eax, dword [sym.imp.USER32.dll_EnableWindow]
call eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004380af
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push esi
push 0x186
push dword [edi + 0x28]
call ebx
mov eax, dword [edi + 0x3c]
mov ecx, 0x489470
mov eax, dword [eax + esi*8 + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406570
mov eax, dword [ebp - 0x14]
push 0
push dword [eax + 0x14]
push 0x14e
push dword [edi + 0x1c]
call ebx
push 1
push dword [edi + 0x38]
jmp 0x41a192
Function at 0x41afb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e43c
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push 0xff
push eax
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
jne 0x41b021
xor ecx, ecx
jmp 0x41b03f
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b030
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00405750
lea eax, [ebp - 0x228]
push eax
call fcn.0040f540
add esp, 4
cmp dword [ebp - 0x218], 0
je 0x41b1f0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x278]
call fcn.0040ee10
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.004115a0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 2
jb 0x41b09e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040a020
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x41b0c8
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00405850
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
mov eax, dword [ebp - 0x264]
mov byte [ebp - 4], 5
cmp eax, 8
jb 0x41b107
inc eax
lea ecx, [ebp - 0x278]
push eax
push dword [ebp - 0x278]
call fcn.00405850
xor eax, eax
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x268], 0
mov word [ebp - 0x278], ax
cmp dword [ebp - 0x230], eax
jne 0x41b13e
push 4
push 0x464a54
lea ecx, [ebp - 0x228]
call fcn.0040be20
push dword [ebp - 0x244]
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x228]
push eax
push 0
lea eax, [ebp - 0x248]
push eax
call fcn.0040f140
cmp byte [ebp - 0x244], 0
je 0x41b1a1
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0
push 0x180
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x464a60
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, esi
call fcn.0041b450
jmp 0x41b1c9
cmp dword [esi + 0x40], 0
mov ecx, 0x464a7c
push 0x40
push 0x464a94
mov eax, 0x464a64
cmove eax, ecx
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push dword [eax + esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x22c]
cmp eax, 8
jb 0x41b1f0
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.00405850
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x41b20e
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004380af
mov esp, ebp
pop ebp
ret
Function at 0x41ee40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
movlpd qword [ebp - 0xc], xmm0
movaps xmm0, xmmword [0x468880]
mov ebx, dword [ebp - 0xc]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0x14], esi
xor esi, esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0x30], xmm0
nop dword [eax]
push 0
push 0
push 0xf0
push dword [ebp + esi - 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x41eeb1
mov eax, dword [ebp + esi - 0x30]
cdq
or ebx, eax
or edi, edx
add esi, 4
cmp esi, 0x10
jl 0x41ee90
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41ef6a
push 6
lea ecx, [ebp - 0xc]
mov byte [ebp - 0xc], 0
push ecx
push eax
mov dword [ebp - 0xb], 0
mov byte [ebp - 7], 0
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41eee6
sub ecx, edx
je 0x41ef6a
mov ecx, 0x464cd0
lea eax, [ebp - 0xc]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41ef20
test dl, dl
je 0x41ef1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41ef20
add eax, 2
add ecx, 2
test dl, dl
jne 0x41ef00
xor eax, eax
jmp 0x41ef25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41ef48
push 0x20
call fcn.00407280
add esp, 4
or eax, ebx
or edx, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380af
mov esp, ebp
pop ebp
ret
movsx eax, byte [ebp - 0xc]
push eax
call fcn.00406c30
add esp, 4
or eax, ebx
or edx, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004380af
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, edi
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004380af
mov esp, ebp
pop ebp
ret
Function at 0x421fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.00438b30
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x102c]
mov ebx, ecx
push 0x801
push eax
push dword [ebx + 0x20]
call esi
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [ebx + 0x48]
call esi
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebx + 0x1c]
call fcn.00421ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x42207b
push 0
push eax
push 0x182
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [ebx + 0x28]
call esi
xor eax, eax
cmp word [ebp - 0x102c], ax
setne al
push eax
push dword [ebx + 0x24]
call esi
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x4c], 0
push dword [eax*4 + 0x483658]
push dword [ebx + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.004226f0
mov ecx, ebx
call fcn.00422960
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004380af
mov esp, ebp
pop ebp
ret
Function at 0x422090
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e8fb
mov eax, dword fs:[0]
push eax
mov eax, 0x2074
call fcn.00438b30
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x207c], edi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x34]
push 0x10
push eax
push dword [edi + 0x48]
call esi
push 0x801
lea eax, [ebp - 0x1038]
push eax
push dword [edi + 0x20]
call esi
xor eax, eax
mov dword [ebp - 0x2060], 7
mov dword [ebp - 0x2064], 0
mov word [ebp - 0x2074], ax
cmp word [ebp - 0x1038], ax
je 0x42212f
lea eax, [ebp - 0x1038]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422120
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x2074]
call fcn.00405750
mov ebx, dword [ebp - 0x2060]
lea esi, [ebp - 0x2074]
mov eax, dword [ebp - 0x2064]
lea edx, [ebp - 0x2075]
mov edi, dword [ebp - 0x2074]
cmp ebx, 8
push edx
cmovae esi, edi
mov dword [ebp - 4], 0
lea ecx, [eax + eax]
mov byte [ebp - 0x2075], 0xa
add esi, ecx
lea eax, [ebp - 0x2074]
cmp ebx, 8
cmovae eax, edi
add eax, ecx
cmp ebx, 8
lea ecx, [ebp - 0x2074]
cmovae ecx, edi
push eax
push ecx
call fcn.004204a0
add esp, 0xc
lea ecx, [ebp - 0x2074]
cmp dword [ebp - 0x2060], 8
cmovae ecx, dword [ebp - 0x2074]
sub esi, eax
sub eax, ecx
sar esi, 1
push esi
sar eax, 1
lea ecx, [ebp - 0x2074]
push eax
call fcn.004058b0
cmp dword [ebp - 0x2060], 8
lea eax, [ebp - 0x2074]
cmovae eax, dword [ebp - 0x2074]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x205c]
push 0x4689f0
push eax
call fcn.00420510
mov ebx, dword [ebp - 0x207c]
lea eax, [ebp - 0x2080]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 0x1c]
call fcn.00421ad0
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x422225
push 0
push eax
push 0x182
push dword [ebx + 0x1c]
call edi
push 0
lea eax, [ebp - 0x205c]
push eax
push 0
push 0x180
push dword [ebx + 0x1c]
call edi
push eax
push 0x186
push dword [ebx + 0x1c]
call edi
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x4c], 1
push dword [eax*4 + 0x483650]
push dword [ebx + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [ebx + 0x24]
call esi
push 1
push dword [ebx + 0x28]
call esi
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebx + 0x48]
call edi
mov ecx, ebx
call fcn.00422960
mov ecx, ebx
call fcn.004226f0
mov eax, dword [ebp - 0x2060]
cmp eax, 8
jb 0x4222b6
inc eax
lea ecx, [ebp - 0x2074]
push eax
push dword [ebp - 0x2074]
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004380af
mov esp, ebp
pop ebp
ret
Function at 0x422540
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.00438b30
mov eax, dword [0x488250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x102c]
push edi
mov edi, ecx
push 0x801
push eax
push dword [edi + 0x20]
call esi
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x48]
call esi
cmp word [ebp - 0x28], 0
je 0x422601
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x1c]
call fcn.00421ad0
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x4225a5
mov ecx, esi
jmp 0x4225b5
or ecx, 0xffffffff
cmp dword [ebp - 0x1030], ecx
cmovne ecx, dword [ebp - 0x1030]
push 0
push ecx
push 0x186
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 0xffffffff
je 0x422613
mov eax, dword [edi + 0x50]
mov dword [edi + 0x4c], 1
push dword [eax*4 + 0x483650]
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
cmp word [ebp - 0x102c], ax
setne al
push eax
push dword [edi + 0x24]
call esi
push 1
jmp 0x422655
push 0
push 0xffffffffffffffff
push 0x186
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x50]
mov dword [edi + 0x4c], 0
push dword [eax*4 + 0x483658]
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp word [ebp - 0x28], 0
je 0x422645
cmp word [ebp - 0x102c], 0
je 0x422645
mov eax, 1
jmp 0x422647
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
push dword [edi + 0x24]
call esi
push 0
push dword [edi + 0x28]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004380af
mov esp, ebp
pop ebp
ret