joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433a40
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.00433ab0
push 0
push 0
push esi
push 0x4327b0
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
mov ecx, dword [esi + 0x54]
add esp, 0x18
mov edi, eax
test ecx, ecx
je 0x433a71
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x54], edi
test edi, edi
jne 0x433aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CHttpManager::Start_return_error:_u
push edi
push str.HttpManager.cpp
call fcn.00416d30
add esp, 0x10
mov ecx, esi
call fcn.00433ab0
mov eax, 0x80004005
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x437cd0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b68f8
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x83c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 0x840], 0
push SysReAllocString
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x83c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x437d60
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x4c4634
mov byte [edi], 0
call fcn.00403381
jmp 0x437f17
xorps xmm0, xmm0
sub esp, 0x18
movdqu xmmword [ebp - 0x838], xmm0
mov eax, esp
movdqu xmmword [ebp - 0x828], xmm0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x83c]
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_96dfe1787354200c493a3f9af176861c____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x838]
mov dword [eax + 0x10], eax
mov byte [ebp - 4], 0
call fcn.00435120
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x818], 0
push eax
lea eax, [ebp - 0x818]
mov dword [ebp - 0x814], 0x7fe
push eax
push 0
push str.ProxyEnable
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x437edf
cmp dword [ebp - 0x814], 4
jne 0x437edf
cmp dword [ebp - 0x818], 4
jne 0x437edf
cmp dword [ebp - 0x810], eax
jne 0x437e20
push 0x4c4634
mov ecx, edi
call fcn.00402cfd
jmp 0x437efe
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x7fe
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.ProxyServer
push dword [ebp - 0x83c]
call esi
test eax, eax
jne 0x437e0f
mov eax, dword [ebp - 0x814]
cmp eax, 0x800
jae 0x437eda
cmp dword [ebp + 0xc], 0
mov byte [ebp + eax - 0x810], 0
lea eax, [ebp - 0x810]
je 0x437e8a
push str.https
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x437eca
add esi, 5
jmp 0x437e9f
push str.http
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov esi, eax
test esi, esi
je 0x437eca
add esi, 4
test esi, esi
je 0x437eca
mov al, byte [esi]
cmp al, 0x20
je 0x437ead
cmp al, 0x3d
jne 0x437eb0
inc esi
jmp 0x437ea3
push 0x3b
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrA]
test eax, eax
je 0x437ec0
mov byte [eax], 0
push esi
mov ecx, edi
call fcn.00402cfd
jmp 0x437efe
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
call fcn.00402cfd
jmp 0x437efe
call fcn.004a5e52
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x4c4634
mov byte [edi], 0
call fcn.00403381
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x840], 1
mov byte [ebp - 4], 0
call fcn.00435080
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret 8
Function at 0x43b110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6c04
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x78], 8
lea esi, [ebx + 0x64]
jb 0x43b14a
mov eax, dword [esi]
jmp 0x43b14c
mov eax, esi
push eax
push str.ReadReportFile_report_file__s
push 0
push str.Report.cpp
call fcn.00416f00
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x43b16b
mov eax, dword [esi]
jmp 0x43b16d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43b194
push str.ReadReportFile_report_file_not_exsted
push 0
push str.Report.cpp
call fcn.00416f00
add esp, 0xc
xor eax, eax
jmp 0x43b2e7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x44], 0
jb 0x43b1a3
mov esi, dword [esi]
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.00431e70
mov ecx, dword [ebp - 0x44]
mov edx, eax
test ecx, ecx
je 0x43b2e2
cmp byte [ecx], 0
je 0x43b2e2
test edx, edx
jle 0x43b2e2
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00483660
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0xc
test eax, eax
je 0x43b2d4
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.004204d0
add esp, 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
push str.ReadReportFile_report_file_strDataW:_s
push 0
push str.Report.cpp
call fcn.00416f00
add esp, 0x10
lea ecx, [ebp - 0x50]
call fcn.004184d0
mov dword [ebp - 0x50], vtable.CReportData.0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.0041f750
test al, al
je 0x43b303
lea ecx, [ebp - 0x50]
call fcn.00419a00
mov edi, eax
xor esi, esi
test edi, edi
jle 0x43b2b8
lea eax, [ebx + 0x84]
mov ebx, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [ebp - 0x54], eax
nop
push 0xc
call ebx
add esp, 4
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x43b29e
push esi
push eax
lea ecx, [ebp - 0x50]
call fcn.00419880
jmp 0x43b2a0
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
call fcn.0043c4d0
inc esi
cmp esi, edi
jl 0x43b280
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea ecx, [ebp - 0x50]
call fcn.004185a0
cmp dword [ebp - 0x2c], 8
jb 0x43b2d4
push dword [ebp - 0x40]
call esi
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x43b2e2
push dword [ebp - 0x28]
call esi
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
push str.ReadReportFile_parse_json_failed
push 0
push str.Report.cpp
call fcn.00416f00
add esp, 0xc
jmp 0x43b2be
Function at 0x43cdd0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6eed
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x238], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43cf24
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x218], ax
jne 0x43ce88
xor ecx, ecx
jmp 0x43cea0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ce91
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00402ddd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004035de
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x43cee8
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 1
push 0x4c6108
mov ecx, esi
call fcn.00404056
push 0xd
push str.LightRegulate
mov ecx, esi
call fcn.00404056
push 7
push 0x4c8eac
mov ecx, esi
call fcn.00404056
mov ecx, esi
call fcn.0043c7b0
test al, al
jne 0x43cf24
mov ecx, esi
call fcn.0043c8d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
Function at 0x43cf40
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6eed
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x238], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d094
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x218], ax
jne 0x43cff8
xor ecx, ecx
jmp 0x43d010
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43d001
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00402ddd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004035de
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x43d058
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 1
push 0x4c6108
mov ecx, esi
call fcn.00404056
push 0xd
push str.LightRegulate
mov ecx, esi
call fcn.00404056
push 5
push str.Temp
mov ecx, esi
call fcn.00404056
mov ecx, esi
call fcn.0043c7b0
test al, al
jne 0x43d094
mov ecx, esi
call fcn.0043c8d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
Function at 0x43d0b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6eed
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x238], esi
mov word [esi], ax
push 0x208
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d204
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [ebp - 0x218], ax
jne 0x43d168
xor ecx, ecx
jmp 0x43d180
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43d171
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00402ddd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004035de
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x43d1c8
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 1
push 0x4c6108
mov ecx, esi
call fcn.00404056
push 0xd
push str.LightRegulate
mov ecx, esi
call fcn.00404056
push 0xa
push str._bugreport
mov ecx, esi
call fcn.00404056
mov ecx, esi
call fcn.0043c7b0
test al, al
jne 0x43d204
mov ecx, esi
call fcn.0043c8d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret

Function at 0x43d220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6f30
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [ebp - 0x40]
call fcn.0041d330
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041d0a0
push 5
push str.debug
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00404056
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43d29a
test al, 0x10
je 0x43d29a
mov esi, 1
jmp 0x43d29c
xor esi, esi
cmp dword [ebp - 0x14], 8
jb 0x43d2ae
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x43d2d4
push dword [ebp - 0x40]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
Function at 0x43d900
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7080
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.0043cdd0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.0043a9f0
push 1
push 0x4c6108
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00404056
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004035de
push 5
push 0x4c9114
lea ecx, [ebp - 0x28]
call fcn.00404056
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.IsCheckProxyByFile_path:__s
push 0
push str.Light_pub.cpp
call fcn.00416f00
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
push ebx
push str.IsFileExist_path:__d
push 0
push str.Light_pub.cpp
call fcn.00416f00
xor eax, eax
add esp, 0x10
test ebx, ebx
sete al
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x44], eax
jb 0x43d9e0
push dword [ebp - 0x40]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [ebp - 0x44]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2c], 7
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
jb 0x43da09
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [ebp - 0x44]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
Function at 0x444790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [esi + 0x138], eax
jne 0x4447c6
mov dword [esi + 0x138], 0
mov eax, dword [esi + 0x138]
test eax, eax
je 0x4447df
push 2
push eax
call dword [sym.imp.USER32.dll_GetAncestor]
mov dword [esi + 0x138], eax
sub esp, 0xc
push dword [esi + 0x138]
push 0xb4
push 0x12c
push 0
push 0
push 0x86080000
push 0x4c5f3c
push ecx
push 0
mov ecx, esi
call fcn.00440580
push 0
push 0
push 0x110
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 4]
call fcn.00453a10
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x1c]
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x44488d
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44488d
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
jne 0x444860
cmp dword [ebp - 0x18], 0x12
jne 0x44489c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esi + 0x13c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x444b80
Capabilities:
Hide graphical window
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x444bd9
cmp dword [ebp + 0x10], 0
jle 0x444c59
cmp dword [ebp + 0x14], 0
jle 0x444c59
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
push 0x50
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
mov ecx, esi
call fcn.00441d70
pop esi
pop ecx
pop ebp
ret 0x10
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x4ed294], 0
jne 0x444c59
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x444c0e
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x444c0e
push 0x50
push eax
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x444c18
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
mov ecx, esi
call fcn.00441d70
cmp dword [esi + 0x130], 0
mov dword [0x4ed294], esi
jne 0x444c59
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x444a90
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x130], eax
pop esi
pop ecx
pop ebp
ret 0x10
Function at 0x446c60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b79c0
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4e50cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x130], 0x4edad0
mov dword [0x4edad0], 0x4c9874
mov dword [0x4edb00], 7
mov dword [0x4edafc], 0
mov word [0x4edaec], ax
mov dword [ebp - 4], eax
mov dword [0x4edb08], eax
mov dword [0x4edb0c], eax
call fcn.00448c80
mov dword [0x4edb08], eax
mov byte [ebp - 4], 1
mov dword [0x4edb14], 0
mov dword [0x4edb18], 0
call fcn.00448c80
mov dword [0x4edb14], eax
mov byte [ebp - 4], 2
mov dword [0x4edb1c], 0
mov dword [0x4edb20], 0
call fcn.00448c80
mov dword [0x4edb1c], eax
mov byte [ebp - 4], 3
mov dword [0x4edb24], 0
mov dword [0x4edb28], 0
call fcn.00448c80
mov dword [0x4edb24], eax
mov byte [ebp - 4], 4
mov dword [0x4edb2c], 0
mov dword [0x4edb30], 0
call fcn.00448c80
mov dword [0x4edb2c], eax
mov byte [ebp - 4], 5
mov dword [0x4edb34], 0
mov dword [0x4edb38], 0
call fcn.00448c80
mov dword [0x4edb34], eax
mov byte [ebp - 4], 6
mov dword [0x4edb3c], 0
mov dword [0x4edb40], 0
call fcn.00448c80
mov dword [0x4edb3c], eax
mov byte [ebp - 4], 7
mov dword [0x4edb44], 0
mov dword [0x4edb48], 0
call fcn.0044dec0
push 0x11c
mov dword [0x4edb44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x12c]
mov dword [0x4edae8], 0
push 0
push eax
movdqu xmmword [0x4edad4], xmm0
mov dword [0x4edae4], 0
mov dword [0x4edb04], 0
mov dword [0x4edb10], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x446e3f
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x446e48
cmp dword [ebp - 0x128], 6
jae 0x446e52
mov dword [0x4ed338], 1
mov eax, 0x4edad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a5ae0
mov esp, ebp
pop ebp
ret
Function at 0x44c0a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e50cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x34], 7
xor eax, eax
mov dword [esi + 0x30], 0
xorps xmm0, xmm0
mov word [esi + 0x20], ax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x83
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x44], eax
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x58], eax
movdqa xmm0, xmmword [0x4d1810]
movdqu xmmword [esi + 0x48], xmm0
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [ebp - 4], eax
push eax
mov dword [esi], vtable.miniskin::CVContainer.0
mov dword [esi + 0x68], eax
push eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
call fcn.0044d4e0
mov dword [esi + 0x6c], eax
mov eax, esi
mov dword [esi + 0x14], 0x64
mov dword [esi + 0x1c], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44f840
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x80]
mov ecx, esi
call fcn.0044e990
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 8]
push 0
push 0xa
push 0x3e9
push dword [edi + 4]
mov dword [edi + 0x190], eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x50
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [edi + 0x130], 0
mov dword [0x4ed33c], edi
jne 0x44f8b9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x44f7b0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x130], eax
pop edi
pop esi
pop ebp
ret 8