joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424100
Capabilities:
Check http status code
Create http request
Get http content length

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, 4
mov edi, eax
mov byte [esp + 0x16], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], esi
call fcn.004238e0
test al, al
jne 0x424130
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [edi + 0x250]
push 0
shr eax, 1
push 0
and al, 1
push 0
mov byte [esp + 0x23], al
mov eax, dword [edi + 0x254]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
je 0x4242fe
mov eax, dword [edi + 0x248]
test eax, eax
jle 0x4241ae
mov ebp, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push esi
lea ecx, [esp + 0x1c]
push ecx
push 2
push ebx
mov dword [esp + 0x28], eax
call ebp
push esi
lea edx, [esp + 0x1c]
push edx
push 5
push ebx
call ebp
push esi
lea eax, [esp + 0x1c]
push eax
push 6
push ebx
call ebp
push esi
lea ecx, [esp + 0x1c]
push ecx
push 7
push ebx
call ebp
push esi
lea edx, [esp + 0x1c]
push edx
push 8
push ebx
call ebp
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x4241bd
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x24c]
push 0
push ecx
push 0
push 0
add eax, 4
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebp, eax
test ebp, ebp
je 0x4242f0
mov ecx, dword [edi + 0x24c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], esi
test ecx, 0x200000
je 0x42421f
push ecx
push ebp
lea eax, [edi + 0x260]
push ebx
lea esi, [esp + 0x28]
mov ecx, edi
call fcn.00425190
add esp, 0xc
test al, al
je 0x4242e9
mov esi, 4
jmp 0x42423f
push 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x24]
push eax
push 0x20000013
push ebp
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4242e9
mov eax, dword [esp + 0x1c]
cmp eax, 0xc8
je 0x424267
cmp eax, 0x130
je 0x42426e
cmp eax, 0x194
jne 0x4242e9
mov dword [edi + 0x260], esi
jmp 0x4242e9
cmp eax, 0x130
jne 0x424282
mov dword [edi + 0x260], 1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x20000005
push ebp
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4242a4
mov dword [esp + 0x20], eax
jmp 0x4242a8
mov eax, dword [esp + 0x20]
mov byte [esp + 0x18], 0
test eax, eax
jle 0x4242b8
mov byte [esp + 0x18], 1
jmp 0x4242bd
mov eax, 0x4000
cmp byte [esp + 0x17], 0
jne 0x4242d4
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00423940
add esp, 8
jmp 0x4242e5
mov edx, dword [esp + 0x18]
push edx
push eax
push edi
mov edx, ebp
call fcn.00423e40
add esp, 0xc
mov byte [esp + 0x16], al
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [esp + 0x16], 0
jne 0x424308
mov dword [edi + 0x25c], 0
mov al, byte [esp + 0x16]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x424320
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4f62bb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov eax, dword [esp + 0x150]
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
xor bl, bl
call fcn.00410d40
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x15c], 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x424421
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [esp + 0x14]
push eax
push 2
push esi
mov dword [esp + 0x20], 0xbb8
call edi
push 4
lea ecx, [esp + 0x14]
push ecx
push 5
push esi
call edi
push 4
lea edx, [esp + 0x14]
push edx
push 6
push esi
call edi
push 4
lea eax, [esp + 0x14]
push eax
push 8
push esi
call edi
cmp byte [esp + 0x154], bl
je 0x4243e7
lea ecx, [esp + 0x14]
push ecx
call fcn.00423420
add esp, 4
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x4243f9
mov eax, dword [esp + 0x1c]
push 0
push 0x84200000
push 0
push 0
add eax, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x42441e
push eax
mov bl, 1
call edi
push esi
call edi
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x424448
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x424448
push eax
call fcn.004d1d15
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004d158d
add esp, 0x13c
ret
Function at 0x424f50
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x4f2deb
mov eax, dword fs:[0]
push eax
mov eax, 0x1134
call fcn.004ea6d0
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x1130], eax
push ebp
push esi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x1140]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1158]
mov ebp, dword [esp + 0x1150]
mov esi, ecx
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x146]
push edx
mov dword [esp + 0x1c], eax
mov dword [ebx], 0
mov word [esp + 0x148], cx
call fcn.004d6770
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x144]
push ecx
push 0x21
push esi
mov dword [esp + 0x20], 0x1000
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x424ff6
mov dword [ebx], 5
jmp 0x425136
mov edx, dword [esp + 0xc]
shr edx, 1
xor eax, eax
push esi
mov word [esp + edx*2 + 0x140], ax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x18]
call fcn.00410c10
mov dword [esp + 0x1148], 0
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x425030
mov eax, dword [edi + 8]
add eax, 4
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x144]
call fcn.00424b90
add esp, 8
test al, al
jne 0x425085
mov dword [ebx], 7
mov dword [esp + 0x18], vtable.t_str.0
cmp byte [esp + 0x134], al
jne 0x425136
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
cmp eax, edx
je 0x425136
push eax
call fcn.004d1d15
add esp, 4
jmp 0x425136
cmp byte [esp + 0x134], 0
lea eax, [esp + 0x24]
jne 0x425097
mov eax, dword [esp + 0x20]
add eax, 4
mov edx, edi
call fcn.00410e40
cmp byte [esp + 0x134], 0
lea ecx, [esp + 0x24]
jne 0x4250b3
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1154]
push 0
or eax, 0x200000
push eax
push 0
push 0
add ecx, 4
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x425103
mov dword [ebx], 8
mov dword [esp + 0x18], vtable.t_str.0
cmp byte [esp + 0x134], al
jne 0x425136
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
cmp eax, ecx
je 0x425136
push eax
call fcn.004d1d15
add esp, 4
jmp 0x425136
mov esi, dword [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push 0x20000013
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x42515e
mov dword [ebx], 6
lea ecx, [esp + 0x18]
call fcn.004161d0
xor al, al
mov ecx, dword [esp + 0x1140]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x1130]
xor ecx, esp
call fcn.004d158d
add esp, 0x1140
ret
mov eax, dword [esi]
cmp eax, 0xc8
je 0x42512d
cmp eax, 0x12c
jb 0x42512d
cmp eax, 0x190
jae 0x42512d
lea ecx, [esp + 0x18]
call fcn.004161d0
mov al, 1
jmp 0x425138
Function at 0x425190
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20000013
push ebp
mov edi, ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4251c7
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
cmp dword [esi], 0xc8
jne 0x4251d8
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
mov dword [ebx], 0
mov eax, dword [esi]
cmp eax, 0x12c
jb 0x42521d
cmp eax, 0x190
jae 0x42521d
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push esi
push ecx
push edx
mov ecx, ebp
call fcn.00424f50
add esp, 0xc
test al, al
je 0x42521d
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 5
mov dword [esp + 0xc], eax
jl 0x4251f6
xor eax, eax
cmp dword [ebx], eax
pop edi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x426330
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x54d2fc]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004d158d
add esp, 0x808
ret

Function at 0x4263a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x468
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x464], eax
push esi
push edi
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x66]
push ecx
mov word [esp + 0x68], ax
call fcn.004d6770
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push 0x527250
lea edx, [esp + 0x60]
push edx
call esi
push 0x54d918
lea eax, [esp + 0x60]
push eax
call esi
push str.crashrpt.exe
lea ecx, [esp + 0x60]
push ecx
call esi
push 0x52d408
lea edx, [esp + 0x60]
push edx
call esi
push 0x54d710
lea eax, [esp + 0x60]
push eax
call esi
push 0x52d408
lea ecx, [esp + 0x60]
push ecx
call esi
push str.sogoupy
lea edx, [esp + 0x60]
push edx
call esi
push 0x52d408
lea eax, [esp + 0x60]
push eax
call esi
cmp byte [0x546c4e], 0
mov eax, 0x51a914
jne 0x426449
mov eax, 0x52a0f8
push eax
lea ecx, [esp + 0x60]
push ecx
call esi
push 0x527250
lea edx, [esp + 0x60]
push edx
call esi
push 0x5c
push 0x54d508
call fcn.004d3998
mov edi, eax
add esp, 8
test edi, edi
je 0x426495
push 0x52d410
lea eax, [esp + 0x60]
push eax
call esi
add edi, 2
push edi
lea ecx, [esp + 0x60]
push ecx
call esi
push 0x527250
lea edx, [esp + 0x60]
push edx
call esi
push 0x5c
push 0x54d300
call fcn.004d3998
mov edi, eax
add esp, 8
test edi, edi
je 0x4264cd
push 0x52d410
lea eax, [esp + 0x60]
push eax
call esi
add edi, 2
push edi
lea ecx, [esp + 0x60]
push ecx
call esi
push 0x527250
lea edx, [esp + 0x60]
push edx
call esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004d6770
add esp, 0xc
cmp byte [0x546c4e], 0
pop edi
mov dword [esp + 0x14], 0x44
pop esi
je 0x426503
mov ecx, 5
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], cx
xor eax, eax
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x74]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.004d158d
add esp, 0x468
ret
Function at 0x426ef0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f1161
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
lea esi, [ebp + 4]
mov dword [ebp], vtable.t_bbWnd2_Client.0
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], fcn.004d1df2
mov dword [esi + 0x1c], fcn.004d2a0a
mov dword [esi + 0x20], fcn.004d1d15
push 4
mov dword [esp + 0x2c], ebx
call fcn.004d1512
push 0xc
mov edi, eax
call fcn.004d2d51
add esp, 8
mov dword [esp + 0x18], eax
mov byte [esp + 0x28], 1
cmp eax, ebx
je 0x426f82
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.00427800
jmp 0x426f84
xor eax, eax
mov byte [esp + 0x28], bl
push 8
mov dword [edi], eax
call fcn.004d2d51
add esp, 4
cmp eax, ebx
je 0x426fa5
mov dword [eax], edi
mov dword [eax + 4], 1
mov edi, eax
jmp 0x426fa7
xor edi, edi
push 0xc
call fcn.004d2d51
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x28], 2
cmp eax, ebx
je 0x426fcc
push edi
push eax
mov edi, str.Initialize
call fcn.00426790
jmp 0x426fce
xor eax, eax
mov byte [esp + 0x28], bl
lea edx, [esp + 0x34]
mov dword [esp + 0x34], eax
push edx
lea ebx, [esp + 0x1c]
mov eax, esi
call fcn.00426b50
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8

Function at 0x429ef0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f1646
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.t_wndBase.0
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], fcn.004d1df2
mov dword [esi + 0x18], fcn.004d2a0a
mov dword [esi + 0x1c], fcn.004d1d15
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.00410c10
lea eax, [esi + 0x160]
push eax
mov byte [esp + 0x18], 1
call fcn.00439680
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
or eax, 0xffffffff
mov dword [esi + 0x1cc], eax
mov dword [esi + 0x1d0], eax
mov dword [esi + 0x1d4], eax
mov dword [esi + 0x1d8], eax
mov byte [esi + 0x38], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1b8], 3
mov byte [esi + 0x1b4], 1
mov byte [esi + 0x1bc], bl
mov byte [esi + 0x1be], bl
mov byte [esi + 0x1bf], bl
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov byte [esi + 0x1c8], bl
mov byte [esi + 0x1c9], bl
mov byte [esi + 0x1bd], bl
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov byte [esi + 0x1e4], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x42b290
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f0f61
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], fcn.004d1df2
mov dword [esi + 0x30], fcn.004d2a0a
mov dword [esi + 0x34], fcn.004d1d15
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
lea ebx, [esi + 0x40]
mov dword [esp + 0x1c], edi
push ebx
mov dword [esi], vtable.t_layoutGrid.0
call fcn.0042b3e0
lea ebp, [esi + 0x94]
push ebp
mov byte [esp + 0x20], 1
call fcn.0042b3e0
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], 0xa
mov dword [esi + 0xfc], fcn.004d1df2
mov dword [esi + 0x100], fcn.004d2a0a
mov dword [esi + 0x104], fcn.004d1d15
mov dword [esi + 0x108], edi
lea eax, [edi + 1]
mov byte [esp + 0x1c], 3
call fcn.0043bce0
lea eax, [edi + 1]
mov ebx, ebp
call fcn.0043bce0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x42b3e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f08e3
mov eax, dword fs:[0]
push eax
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov edx, fcn.004d1d15
mov dword [eax + 0x10], fcn.004d1df2
mov dword [eax + 0x14], fcn.004d2a0a
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], fcn.004d1df2
mov dword [eax + 0x30], fcn.004d2a0a
mov dword [eax + 0x34], edx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], fcn.004d1df2
mov dword [eax + 0x4c], fcn.004d2a0a
mov dword [eax + 0x50], edx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x42c960
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
xor ecx, ecx
push edi
test edx, edx
je 0x42c972
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push 2
push ecx
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esp + 0x40], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x42c9b5
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esi], edx
mov edx, dword [esp + 0x58]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebx
add esp, 0x5c
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
xor edx, edx
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], edx
push edx
mov dword [esi + 8], ebx
push str.Shell_TrayWnd
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x42ca26
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebx
add esp, 0x5c
ret
Function at 0x42cc10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x42cd61
cmp byte [esi + 0x22c], 0
mov byte [esi + 0x20a], 1
je 0x42cc8f
mov eax, esi
call fcn.0042bce0
cmp byte [0x54db2a], 0
je 0x42cc6a
mov eax, dword [esi + 0x1e8]
push 0x5b
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x1e8]
push 0x25f
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x10]
mov edx, esi
call fcn.0042aa30
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
sub edi, dword [esp + 0x10]
sub ebx, dword [esp + 0x14]
cmp byte [esi + 0x224], 0
jne 0x42ccbb
mov eax, dword [esi + 0x1e8]
jmp 0x42ccc1
mov eax, dword [esi + 0x1ec]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42cceb
cmp byte [esi + 0x224], al
jne 0x42ccdc
mov eax, dword [esi + 0x1e8]
jmp 0x42cce2
mov eax, dword [esi + 0x1ec]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x224], 0
jne 0x42ccfc
mov eax, dword [esi + 0x1e8]
jmp 0x42cd02
mov eax, dword [esi + 0x1ec]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0x2714
push ebx
push edi
push edx
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x1e8]
push 1
push 0
mov dword [esi + 0x254], eax
add edi, eax
mov dword [esi + 0x258], ecx
push 0
add ebx, ecx
mov dword [esi + 0x25c], edi
push edx
mov dword [esi + 0x260], ebx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
push 0
mov byte [esi + 0x20a], 0
mov byte [esi + 0x38], 0
mov byte [esi + 0x208], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
push 1
mov ecx, esi
call edx
mov ecx, esi
call fcn.0042b070
mov esi, dword [esi + 0x1e8]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4307a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push ebx
mov ebx, dword [esp + 0x6c]
mov ecx, dword [ebx + 8]
push ebp
xor ebp, ebp
push esi
push edi
cmp ecx, ebp
je 0x4307d5
mov eax, dword [ebx + 4]
imul eax, dword [ebx]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
lea eax, [eax*4 + 4]
push eax
push ebp
push ecx
call fcn.004d6770
add esp, 0xc
mov esi, dword [esp + 0x74]
or edi, 0xffffffff
cmp dword [esi + 0x18], edi
jne 0x430803
cmp dword [esi + 0x1c], edi
jne 0x430803
cmp byte [esi + 0x2d], 0
jne 0x430803
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push ecx
push edx
call fcn.0043c7a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
push 0x50
lea eax, [esp + 0x24]
push ebp
push eax
mov dword [esp + 0x28], ebp
call fcn.004d6770
mov eax, dword [esi + 0x28]
add esp, 0xc
cmp eax, ebp
jne 0x430822
mov eax, dword [esi]
jmp 0x430837
cmp eax, 1
jne 0x430835
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x430835
call fcn.00406750
jmp 0x430837
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push 0x54
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi + 0x18]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x18], edx
cmp eax, edi
jne 0x43085a
mov dword [esp + 0x10], ebp
jmp 0x43088c
mov ecx, eax
shr ecx, 0x10
movzx edx, al
shl edx, 0x10
and ecx, 0xff
or ecx, edx
mov edx, eax
and edx, 0xff00
or ecx, edx
and eax, 0xff000000
je 0x430882
or ecx, eax
jmp 0x430888
or ecx, 0xff000000
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x1c]
cmp eax, edi
jne 0x430899
mov dword [esp + 0x14], ebp
jmp 0x4308cb
mov ecx, eax
shr ecx, 0x10
movzx edx, al
shl edx, 0x10
and ecx, 0xff
or ecx, edx
mov edx, eax
and edx, 0xff00
or ecx, edx
and eax, 0xff000000
je 0x4308c1
or ecx, eax
jmp 0x4308c7
or ecx, 0xff000000
mov dword [esp + 0x14], ecx
mov ebp, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
add eax, ebp
cmp ebp, eax
jge 0x43094f
mov ecx, dword [esp + 0x38]
jmp 0x4308e0
test ebp, ebp
jl 0x430944
mov ebx, dword [esp + 0x3c]
sub ebx, ebp
sub ebx, 1
js 0x43094f
mov edi, dword [esi + 8]
mov edx, dword [esi + 0x10]
add edx, edi
cmp edi, edx
jge 0x430944
jmp 0x430900
cmp ebp, dword [esp + 0x3c]
jge 0x430939
cmp edi, ecx
jge 0x430939
mov edx, dword [esp + 0x18]
mov eax, ecx
imul eax, ebx
add eax, edi
mov eax, dword [edx + eax*4]
cmp eax, dword [esp + 0x10]
je 0x430939
cmp eax, dword [esp + 0x14]
je 0x430939
mov esi, dword [esp + 0x78]
mov edx, ebp
mov ecx, edi
call fcn.0043c700
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x74]
mov eax, dword [esi + 8]
add eax, dword [esi + 0x10]
inc edi
cmp edi, eax
jl 0x430900
mov edx, dword [esi + 0xc]
add edx, dword [esi + 0x14]
inc ebp
cmp ebp, edx
jl 0x4308e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
Function at 0x43a5b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
push 0
mov ecx, esi
mov byte [esi + 0x20a], 0
mov byte [esi + 0x38], 0
mov byte [esi + 0x208], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
push 1
mov ecx, esi
call edx
mov ecx, esi
call fcn.0042b070
mov eax, dword [esi + 0x1e8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret