joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c09b9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push eax
push ecx
call fcn.00433830
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.MirrorScreenDriver.0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], vtable.FrameBuffer.0
mov dword [esi + 0x28], vtable.Dimension.0
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
xor eax, eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov word [esi + 0x44], ax
mov edx, dword [esp + 0x24]
mov byte [esp + 0x14], 1
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], edx
call fcn.0041ada0
mov eax, dword [esp + 0x28]
mov byte [esp + 0x14], 2
push 0x10ec
mov dword [esi + 0x58], eax
call fcn.00480ed5
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x14], 3
cmp eax, edi
je 0x4320df
mov ecx, dword [esi + 0x58]
push ecx
push eax
call fcn.00436640
jmp 0x4320e1
xor eax, eax
mov byte [esp + 0x14], 2
mov edi, esi
mov dword [esi + 0x1c], eax
call fcn.00432230
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x10

Function at 0x4321f0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne cl
mov byte [esi + 0xc], cl
pop esi
ret

Function at 0x432230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c0f78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [edi + 0x1c]
lea eax, [esp + 8]
mov ecx, esi
call fcn.00436a30
mov dword [esp + 0x30], 0
mov eax, dword [esi + 0x1098]
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x109c]
mov dword [esp + 0x18], ecx
mov edx, dword [esi + 0x10a0]
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 0x10a4]
mov edx, dword [edi + 0x24]
mov edx, dword [edx + 0x50]
mov dword [esp + 0x20], eax
mov cx, word [esi + 0x10a8]
mov word [esp + 0x24], cx
lea eax, [esp + 0x14]
lea ecx, [edi + 0x24]
push eax
lea eax, [esp + 0xc]
push eax
call edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x432d50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
sub esp, 0x40
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push edi
test eax, eax
jle 0x432d6e
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 8]
test ecx, ecx
jg 0x432d78
mov dword [esp + 0x54], 0
jmp 0x432d7f
imul ecx, eax
mov dword [esp + 0x54], ecx
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call edi
mov edx, dword [ebp]
test eax, eax
mov eax, dword [edx + 0x10]
push esi
mov ecx, ebp
setne bl
call eax
test al, al
jne 0x432dbe
push str.Grabber_failed._Is_it_not_ready_
lea ecx, [esp + 0x2c]
push ecx
call fcn.004048f0
push 0x56e6e0
lea edx, [esp + 0x2c]
push edx
call fcn.004841dc
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
setne al
test bl, bl
je 0x432e28
test al, al
je 0x432e28
mov edi, dword [esp + 0x10]
sub edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
sbb ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x50]
push ebp
mov edx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
call fcn.00432d10
test al, al
je 0x432e1b
fild dword [ebp]
sub esp, 8
fild qword [esp + 0x28]
mov eax, ebp
fmulp st(1)
fidiv dword [esp + 0x5c]
fstp qword [esp]
call fcn.00432e40
mov ecx, ebp
call fcn.00433240
mov eax, edi
mov edx, ebx
pop edi
pop ebp
pop ebx
add esp, 0x40
ret 8
pop edi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
add esp, 0x40
ret 8
Function at 0x432f40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push 0xffffffffffffffff
push 0x4bd328
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esi + 0xc]
test eax, eax
setne byte [esp + 0x13]
cmp edi, dword [esi + 0x10]
jbe 0x432f85
call fcn.00480e22
mov ebx, dword [esi]
mov ebp, edi
lea esp, [esp]
mov edi, dword [esi + 0x10]
cmp dword [esi + 0xc], edi
jbe 0x432f9d
call fcn.00480e22
mov eax, dword [esi]
test ebx, ebx
je 0x432fa7
cmp ebx, eax
je 0x432fac
call fcn.00480e22
cmp ebp, edi
jae 0x43303d
test ebx, ebx
jne 0x432ff3
call fcn.00480e22
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x432fc9
call fcn.00480e22
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push ebp
call eax
test al, al
je 0x432ffb
test ebx, ebx
jne 0x432ff7
call fcn.00480e22
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x432fee
call fcn.00480e22
add ebp, 0x14
jmp 0x432f90
mov eax, dword [ebx]
jmp 0x432fbf
mov eax, dword [ebx]
jmp 0x432fe4
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], vtable.Exception.0
call fcn.00404990
mov dword [esp + 0x58], 0
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 4]
push str.Grabber_failed._Is_it_not_ready_
lea ecx, [esp + 0x38]
call eax
push 0x56e6e0
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x60], 0xffffffff
call fcn.004841dc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
setne al
cmp byte [esp + 0x13], 0
je 0x433124
test al, al
je 0x433124
mov edi, dword [esp + 0x14]
sub edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
sbb ebp, dword [esp + 0x20]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
cmp eax, 0xa
jb 0x43310b
mov ecx, dword [esp + 0x60]
cmp dword [ecx + 0x1c], 0
jbe 0x43310b
mov ebx, esi
call fcn.00432c90
fild qword [esp + 0x24]
mov ebx, dword [esp + 0x60]
mov edx, dword [ebx + 0x1c]
fild dword [ebx + 0x1c]
mov dword [esp + 0x64], eax
test edx, edx
jge 0x4330c1
fadd qword [0x565f30]
fdivr qword [ebx + 0x20]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x66666667
fimul dword [esp + 0x64]
imul ecx
sar edx, 3
fidiv dword [ebx]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x60], eax
fsubp st(1)
fild dword [esp + 0x60]
test eax, eax
jge 0x4330f5
fadd qword [0x565f30]
fdivp st(1)
sub esp, 8
mov eax, ebx
fstp qword [esp]
call fcn.00433140
mov ecx, ebx
call fcn.00433240
mov eax, edi
mov edx, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x4c
ret 8
or eax, 0xffffffff
or edx, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x4c
ret 8
Function at 0x433830
Capabilities:
Create thread

Disassembly:
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x413f30
push 0
mov dword [esi], vtable.Thread.0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400001cf
push 1
push 0
mov dword [esi + 4], eax
mov dword [esi], vtable.GuiThread.0
mov dword [esi + 0x10], 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.UpdateDetector.0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov eax, esi
ret 8

Function at 0x433a00
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf4c3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x413f30
push 0
mov dword [esi], vtable.Thread.0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov dword [esp + 0x10], 0
lea ecx, [esi + 0x10]
mov dword [esi], vtable.HookUpdateTimer.0
call fcn.0041ada0
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.0041ada0
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
push edx
mov dword [esi + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8

Function at 0x434950
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push edi
push esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
push 0x4349f0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.USER32.dll_EnumWindows]
lea ebx, [esi + 0x3c]
lea edi, [esi + 0x20]
cmp edi, ebx
je 0x4349b5
mov ebp, dword [ebx + 0x14]
mov eax, dword [ebx]
mov ecx, dword [ebp]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
call fcn.00434d20
mov edx, dword [edi + 0x14]
mov eax, dword [edx]
mov edx, dword [esp + 0x10]
mov ecx, dword [edi]
push ebp
mov ebp, dword [esp + 0x1c]
push edx
push ebp
push edx
push eax
mov eax, dword [esp + 0x34]
push ecx
push eax
push edi
call fcn.00434f10
mov edi, ebx
call fcn.00434d20
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 8], edx
mov ecx, dword [esi + 0x10]
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x14]
mov dword [eax + 0x10], edx
mov ecx, dword [esi + 0x18]
mov eax, dword [esp + 0x24]
pop edi
mov dword [eax], ecx
mov edx, dword [esi + 0x1c]
pop ebp
mov dword [eax + 4], edx
pop ebx
add esp, 0x10
ret 8
Function at 0x435440
Capabilities:
Access peb ldr_data
Create thread
Get ntdll base address
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4bf45d
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
lea eax, [ebp + 8]
push eax
push 4
push ebp
push 0x413f30
xor esi, esi
push esi
mov dword [ebp], vtable.Thread.0
mov byte [ebp + 0xc], 0
push esi
mov byte [ebp + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400001cf
push 1
push esi
mov dword [ebp + 4], eax
mov dword [ebp], vtable.GuiThread.0
mov dword [ebp + 0x10], esi
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp + 0x10], eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x18], esi
mov dword [ebp], vtable.Win8DeskDuplicationThread.0
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], vtable.Rect.0
mov eax, dword [ebx + 4]
mov dword [ebp + 0x20], eax
mov ecx, dword [ebx + 8]
mov dword [ebp + 0x24], ecx
mov edx, dword [ebx + 0xc]
mov dword [ebp + 0x28], edx
mov eax, dword [ebx + 0x10]
mov dword [ebp + 0x2c], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x18], 1
mov dword [ebp + 0x34], edx
mov edx, dword [esp + 0x40]
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x30], ecx
mov ecx, dword [esp + 0x34]
lea eax, [ebp + 0x40]
push edx
push eax
mov dword [ebp + 0x3c], ecx
call fcn.00436290
mov ecx, dword [esp + 0x38]
lea esi, [ebp + 0x58]
mov byte [esp + 0x18], 2
call fcn.00439200
lea edi, [ebp + 0x60]
lea edx, [ebp + 0x40]
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.00437c40
lea eax, [ebp + 0x6c]
mov byte [esp + 0x18], 4
push eax
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x69], 0
call fcn.00403ea0
lea ecx, [ebp + 0x84]
push ecx
mov byte [esp + 0x1c], 5
call fcn.00403ea0
mov byte [esp + 0x18], 6
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0xc]
sub ecx, dword [ebx + 8]
sub esi, dword [ebx + 4]
mov eax, dword [ebp + 0x4c]
lea edx, [ebp + 0xa0]
mov dword [ebp + 0x9c], vtable.WinCustomD3D11Texture2D.0
mov dword [edx], esi
mov dword [edx + 4], ecx
mov ecx, 1
xor esi, esi
lea edi, [ebp + 0xcc]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], 0x57
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], esi
mov dword [edx + 0x1c], 3
mov dword [edx + 0x20], esi
mov dword [edx + 0x24], 0x20000
mov dword [edx + 0x28], esi
call fcn.00438fd0
mov edx, dword [esp + 0x40]
mov dword [ebp + 0xd4], vtable.FrameBuffer.0
mov dword [ebp + 0xd8], vtable.Dimension.0
mov dword [ebp + 0xdc], esi
mov dword [ebp + 0xe0], esi
xor eax, eax
mov dword [ebp + 0xf8], esi
mov dword [ebp + 0xe4], eax
mov dword [ebp + 0xe8], eax
mov dword [ebp + 0xec], eax
mov dword [ebp + 0xf0], eax
mov word [ebp + 0xf4], ax
mov eax, dword [ebp + 4]
push eax
mov dword [ebp + 0xfc], edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne cl
mov byte [ebp + 0xc], cl
mov eax, ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x24
Function at 0x435f30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bd258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esi + 0x38]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], vtable.AutoLock.0
mov dword [esp + 0x14], ebx
call edx
mov dword [esp + 0x30], 0
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov eax, edx
or eax, ecx
je 0x436050
mov eax, dword [esi + 0x34]
cmp ecx, dword [eax + 4]
jl 0x436050
jg 0x435fa7
cmp edx, dword [eax]
jbe 0x436050
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ebx, dword [edi + 0x24]
mov edx, dword [edi + 0x20]
test ebx, ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x30]
setne al
cmp byte [ecx + 8], al
mov dword [esp + 0x1c], edx
setne dl
test dl, dl
je 0x435feb
mov edx, dword [esi + 0x14]
test al, al
jne 0x435fdb
cmp dword [ecx + 4], edx
jne 0x435fe1
mov byte [ecx + 8], al
mov dword [ecx + 4], edx
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov edi, dword [edi + 0x2c]
test edi, edi
setne al
test al, al
je 0x436013
mov eax, dword [esi + 0x30]
add eax, 0x54
push eax
lea ecx, [esi + 0x60]
push ecx
mov ecx, edi
call fcn.00438000
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
test ebx, ebx
je 0x43604c
mov eax, dword [esi + 0x30]
cmp byte [eax + 8], 0
je 0x436025
add eax, 0x54
jmp 0x436028
add eax, 0xc
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov ebx, dword [esi + 0x24]
mov ecx, dword [esi + 0x3c]
mov edi, dword [ecx]
add ebx, eax
mov eax, dword [esi + 0x20]
add ebx, dword [esp + 0x1c]
add eax, edx
add eax, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push eax
call edx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436640
Capabilities:
Access peb ldr_data
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4c08cd
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
lea eax, [edi + 8]
push eax
push 4
push edi
xor ebx, ebx
push 0x413f30
push ebx
mov dword [edi], vtable.Thread.0
mov byte [edi + 0xc], bl
push ebx
mov byte [edi + 0xd], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400001cf
push 1
push ebx
mov dword [edi + 4], eax
mov dword [edi], vtable.GuiThread.0
mov dword [edi + 0x10], ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [edi + 0x10], eax
mov dword [esp + 0x38], ebx
mov dword [edi + 0x14], vtable.WindowMessageHandler.0
mov dword [edi], vtable.MirrorDriverClient.0
mov dword [edi + 0x14], vtable.MirrorDriverClient.1.0
mov byte [edi + 0x18], bl
mov byte [edi + 0x19], bl
mov byte [edi + 0x1a], bl
mov byte [edi + 0x1b], bl
mov dword [edi + 0x1c], ebx
lea ecx, [edi + 0x374]
mov dword [edi + method.RegistryKey.virtual_0], vtable.RegistryKey.0
call fcn.00404990
mov byte [esp + 0x38], 1
lea esi, [edi + 0x1078]
mov ecx, esi
mov dword [edi + 0x106c], ebx
mov dword [edi + 0x1070], ebx
mov dword [edi + 0x1074], ebx
call fcn.0041ada0
push ebx
mov byte [edi + 0x1080], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.MIRROR_DRIVER_MESSAGE_WINDOW_CLASS_NAME
mov dword [edi + 0x1084], 0x562e94
mov dword [edi + 0x1088], ebx
mov dword [edi + 0x108c], ebx
mov dword [edi + 0x1090], eax
mov dword [edi + 0x1094], ebx
call fcn.004816f3
add esp, 4
mov dword [edi + 0x1094], eax
xor eax, eax
mov dword [edi + 0x1098], eax
mov dword [edi + 0x109c], eax
mov dword [edi + 0x10a0], eax
mov dword [edi + 0x10a4], eax
mov word [edi + 0x10a8], ax
mov dword [edi + 0x10ac], 0x558e10
mov dword [edi + 0x10b0], ebx
mov dword [edi + 0x10b4], ebx
lea ecx, [edi + 0x10c0]
mov byte [esp + 0x38], 4
push ecx
mov dword [edi + 0x10b8], ebx
mov dword [edi + 0x10bc], ebx
call fcn.0046e180
mov edx, dword [esp + 0x44]
push 0xcdc
lea eax, [edi + 0x390]
push ebx
mov byte [esp + 0x40], 5
push eax
mov dword [edi + 0x10e8], edx
call fcn.00483dc0
add esp, 0xc
mov ecx, 0xdc
mov eax, edi
mov word [edi + 0x3d4], cx
call fcn.00436a50
call fcn.00436f70
call fcn.004374d0
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [edi + 0xc], al
mov esi, dword [esi + 4]
cmp esi, ebx
je 0x436803
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
cmp dword [edi + 0x1088], ebx
jne 0x436830
call fcn.004369e0
push 0x55f420
lea ecx, [esp + 0x14]
push ecx
call fcn.004048f0
push 0x56e6e0
lea edx, [esp + 0x14]
push edx
call fcn.004841dc
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 8
Function at 0x437140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
movzx eax, bl
mov dword [esp + 4], eax
mov eax, dword [esi + 0x36c]
test eax, eax
je 0x43717a
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push str.Attach.ToDesktop
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
test al, al
jne 0x437198
push str.Cant_set_the_Attach.ToDesktop.
lea edx, [esp + 0xc]
push edx
call fcn.004048f0
push 0x56e6e0
lea eax, [esp + 0xc]
push eax
call fcn.004841dc
mov byte [esi + 0x1a], bl
mov esp, ebp
pop ebp
ret
Function at 0x43a2f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb832
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push ebp
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov word [esp + 0x68], ax
mov dword [esp + 0x48], vtable.FrameBuffer.0
mov dword [esp + 0x4c], vtable.Dimension.0
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov word [esp + 0x68], ax
mov eax, dword [esp + 0x8c]
push eax
push edi
lea ecx, [esp + 0x50]
mov dword [esp + 0x84], ebx
call fcn.004685a0
push ebx
push ebx
push ebx
lea ecx, [esp + 0x54]
call fcn.00467990
mov ecx, dword [esp + 0x88]
push ebx
push ebx
push ecx
lea ecx, [esp + 0x54]
call fcn.00468040
lea eax, [esp + 0x1c]
mov ecx, edi
call fcn.00415520
mov ecx, eax
lea eax, [esp + 0xc]
mov byte [esp + 0x7c], 1
call fcn.00462d50
lea edx, [esp + 0x30]
mov byte [esp + 0x7c], 3
push edx
mov dword [esp + 0x20], vtable.Rect.0
call fcn.00477d50
push ebp
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x88], 4
mov eax, dword [esi + 0x310]
push ecx
push eax
call fcn.0043bca0
push ebx
mov ebx, dword [esi + 0x25c]
call fcn.00423290
mov ebx, dword [esi + 0x25c]
push 0
call fcn.00423290
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov ebx, dword [esi + 0x25c]
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, ax
call fcn.004232c0
mov eax, dword [esi + 0x310]
push ebp
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x38]
push edx
push eax
push esi
call fcn.0043bde0
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x80], 3
call fcn.00416210
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43a474
cmp dword [eax], 0
je 0x43a474
push eax
call fcn.00481665
add esp, 4
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x48], vtable.FrameBuffer.0
test eax, eax
je 0x43a48d
push eax
call fcn.00481b5a
add esp, 4
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x74
ret 0xc
Function at 0x440e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bb75d
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x57e030]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea eax, [esi + 0x58]
mov dword [esi], vtable.ServerConfig.0
mov dword [esi + 4], 0x170c
mov dword [esi + 8], 0x16a8
mov byte [esi + 0xc], 1
mov byte [esi + 0xd], 1
mov byte [esi + 0xe], 1
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], 1
mov byte [esi + 0x15], 1
mov byte [esi + 0x2e], 1
mov byte [esi + 0x2f], bl
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
mov byte [esi + 0x39], bl
mov byte [esi + 0x3a], bl
mov byte [esi + 0x3b], bl
mov byte [esi + 0x3c], 1
mov dword [esi + 0x40], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
mov byte [esi + 0x46], bl
mov dword [esi + 0x48], 3
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], 0x1e
push eax
mov dword [esi + 0x54], vtable.PortMappingContainer.0
call fcn.00477d50
lea eax, [esi + 0x70]
push eax
mov byte [esp + 0x18], 1
call fcn.00403ea0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x14], 2
push ecx
mov byte [esi + 0x88], bl
call fcn.00477d50
mov byte [esp + 0x14], 3
lea ecx, [esi + 0xac]
mov dword [esi + 0xa4], 0xbb8
mov byte [esi + 0xa8], 1
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], 1
call fcn.00404990
lea edx, [esi + 0xd0]
mov byte [esi + 0xc8], bl
mov byte [esi + 0xc9], bl
mov byte [esi + 0xca], bl
push edx
mov dword [esi + 0xcc], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
mov dword [esi + 0x16], eax
mov dword [esi + 0x1a], eax
mov dword [esi + 0x1e], eax
mov dword [esi + 0x22], eax
mov dword [esi + 0x26], ebx
mov dword [esi + 0x2a], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4