joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b902a
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x808
mov dword [ebp - 4], 0
call fcn.00468d62
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00429d30
mov byte [ebp - 4], 2
lea ecx, [edi + 0x798]
mov dword [edi], vtable.CBlockConfirmWnd.5.0
mov dword [edi + 0x24], vtable.CBlockConfirmWnd.4.0
mov dword [edi + 0x28], vtable.CBlockConfirmWnd.3.0
mov dword [edi + 0x2c], vtable.CBlockConfirmWnd.2.0
mov dword [edi + 0x30], vtable.CBlockConfirmWnd.1.0
mov dword [edi + 0x794], 0x746ce4
call fcn.00451a60
lea eax, [ebp + 8]
mov byte [ebp - 4], 0
push eax
lea ecx, [ebp - 0x80]
call fcn.00451af0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x798]
call fcn.00427280
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x34]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44795b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x38]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447975
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.0042e7a0
lea ecx, [ebp + 8]
call fcn.00450ea0
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 8]
sar eax, 2
test eax, eax
je 0x447999
mov ebx, dword [ecx - 4]
jmp 0x44799b
xor ebx, ebx
push dword [ebp + 0x74]
lea eax, [edi + 0x20]
push eax
push 0x773248
call fcn.00428980
add esp, 8
movzx eax, ax
mov ecx, edi
push eax
push 0
push 0x80
push 0x80880000
push 0
push 0
push ebx
call fcn.00428810
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 0x54]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4479ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x50]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x447a04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp + 8]
call fcn.0042e7a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x70
Function at 0x449560
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x568]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
cmp byte [ebp + 8], 0
je 0x4495c7
test eax, eax
jne 0x44959e
mov ecx, dword [esi + 0x54]
push eax
push eax
push eax
push str.nativectrl_init
push esi
call fcn.00482610
push dword [esi + 0x568]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4495d9
push 0xa
push dword [esi + 0x568]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x568]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x190]
pop esi
pop ebp
ret 4
test eax, eax
je 0x4495d9
push 0
push dword [esi + 0x568]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
Function at 0x44d420
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b9720
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x48]
call fcn.00516fd1
mov dword [ebp - 4], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x48]
call fcn.005175ae
lea ecx, [ebp - 0x48]
call fcn.00406270
cmp eax, 1
je 0x44d58d
push str._1382463573
lea ecx, [ebp - 0x48]
call fcn.00517881
test al, al
je 0x44d58d
push str._1382463573
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x48]
call fcn.00517012
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x44d4c3
mov eax, dword [eax]
push str.LRwFgZVsu9cpOTUW
push str.JnZZ0m1TQ3htIpCQ
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00514f60
add esp, 0x10
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x44d4e6
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.00517653
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44d52d
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d523
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d5b5
push edx
push ecx
call fcn.00468d54
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x44d57b
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d571
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d5ba
push edx
push ecx
call fcn.00468d54
add esp, 8
push 0x747544
lea ecx, [ebp - 0x48]
call fcn.00517881
movzx esi, al
jmp 0x44d58f
xor esi, esi
lea ecx, [ebp - 0x48]
call fcn.00516fff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 4
call fcn.00533dd1
call fcn.00533dd1
int3
Function at 0x44f840
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x76a02c]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0044f790
mov esi, eax
test esi, esi
jne 0x44f937
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x44f909
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0044f840
mov esi, eax
test esi, esi
jne 0x44f937
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x44f8d0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44f920
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.0044f980
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44f946
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 4
Function at 0x4505f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b99d6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x45069c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x45069c
call fcn.00450cb0
mov edi, eax
jmp 0x4507bb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4506bf
call fcn.00450cb0
jmp 0x4507ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4506dd
call fcn.00450cb0
jmp 0x4507ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4506fe
mov edi, 0x8007000e
jmp 0x4507b0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4507f4
jb 0x45071c
cmp eax, 0xffffffff
ja 0x4507f4
cmp eax, 0x400
jbe 0x450731
push eax
lea ecx, [ebp - 0x418]
call fcn.0044ed00
jmp 0x450757
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x450757
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x45076e
mov edi, 0x8007000e
jmp 0x4507b0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x45078e
call fcn.00450cb0
jmp 0x4507ae
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00450490
mov edi, eax
test esi, esi
je 0x4507bb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4507d4
lea ecx, [ebp - 0x418]
call fcn.0044ece0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004222a0
int3
Function at 0x450ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b9a1e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x451045
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x45104f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], 0
cmp dword [esi + 8], eax
je 0x450fcc
mov dword [eax], 0
add dword [esi + 4], 4
jmp 0x450fd8
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00402150
mov ecx, esi
call fcn.00450ea0
push 0
push 0
lea ecx, [esi + 0xc]
call fcn.00429270
push 0
push 0
lea ecx, [esi + 0x10]
call fcn.00429270
xorps xmm0, xmm0
mov dword [esi + 0x24], 0
movups xmmword [esi + 0x14], xmm0
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
int3
Function at 0x455980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b6980
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CReportDlg.5.0
or edi, 0xffffffff
mov dword [esi + 0x24], vtable.CReportDlg.4.0
mov eax, edi
mov dword [esi + 0x28], vtable.CReportDlg.3.0
mov dword [esi + 0x2c], vtable.CReportDlg.2.0
mov dword [esi + 0x30], vtable.CReportDlg.1.0
mov dword [esi + 0x794], 0x74a218
mov edx, dword [esi + 0x81c]
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4559f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x818]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x455a0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x7d0]
call fcn.0042e7a0
mov dword [esi + 0x794], 0x746b4c
mov eax, dword [esi + 0x7a4]
test eax, eax
je 0x455a40
push eax
call fcn.00534415
add esp, 4
mov dword [esi + 0x7a4], 0
mov dword [esi + 0x7a8], 0
mov dword [esi + 0x7ac], 0
mov eax, dword [esi + 0x798]
test eax, eax
je 0x455a71
push eax
call fcn.00534415
add esp, 4
mov dword [esi + 0x798], 0
mov ecx, esi
mov dword [esi + 0x79c], 0
mov dword [esi + 0x7a0], 0
call fcn.004270c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459500
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ba0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x4596a7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push str._s_d
push eax
call fcn.0041f510
mov eax, dword [ebp - 0x14]
add esp, 0x10
xor ebx, ebx
mov edi, eax
mov ecx, dword [eax - 0xc]
lea esi, [ecx + ecx]
mov edx, esi
xor edx, 0x19870714
mov dword [ebp - 0x10], edx
cmp esi, 8
jl 0x4595df
mov eax, esi
shr eax, 3
mov dword [ebp - 0x18], eax
neg eax
lea esi, [esi + eax*8]
mov eax, edx
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp - 0x18]
imul edx, dword [edi], 0x5bd1e995
imul eax, eax, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul ecx, ecx, 0x5bd1e995
xor eax, ecx
mov ecx, dword [edi + 4]
imul edx, ecx, 0x5bd1e995
add edi, 8
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul ecx, ecx, 0x5bd1e995
xor ebx, ecx
sub esi, 1
jne 0x459592
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp esi, 4
jl 0x459608
mov ecx, dword [edi]
add edi, 4
imul edx, ecx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x18
xor ecx, edx
imul edx, dword [ebp - 0x10], 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor edx, ecx
sub esi, 4
sub esi, 1
je 0x459629
sub esi, 1
je 0x459620
sub esi, 1
jne 0x459634
movzx ecx, byte [edi + 2]
shl ecx, 0x10
xor ebx, ecx
movzx ecx, byte [edi + 1]
shl ecx, 8
xor ebx, ecx
movzx ecx, byte [edi]
xor ecx, ebx
imul ebx, ecx, 0x5bd1e995
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
shr ecx, 0x12
lea edi, [eax - 0x10]
xor ecx, edx
or eax, 0xffffffff
imul edx, ecx, 0x5bd1e995
mov ecx, edx
shr ecx, 0x16
xor ecx, ebx
imul esi, ecx, 0x5bd1e995
mov ecx, esi
shr ecx, 0x11
xor ecx, edx
xor edx, edx
imul ebx, ecx, 0x5bd1e995
mov ecx, ebx
shr ecx, 0x13
xor ecx, esi
imul ecx, ecx, 0x5bd1e995
or edx, ecx
mov dword [ebp - 0x1c], edx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x459691
mov ecx, dword [edi]
push edi
mov esi, dword [ecx]
call dword [esi + 4]
mov edx, dword [ebp - 0x1c]
mov eax, edx
mov edx, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004222a0
int3
Function at 0x45c630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b4d60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0xf74]
mov dword [edi], vtable.CSettingDlg.5.0
mov dword [edi + 0x24], vtable.CSettingDlg.4.0
mov dword [edi + 0x28], vtable.CSettingDlg.3.0
mov dword [edi + 0x2c], vtable.CSettingDlg.2.0
mov dword [edi + 0x30], vtable.CSettingDlg.1.0
mov dword [edi + 0x794], 0x74a900
call fcn.0046fdc0
lea ecx, [edi + 0x7e0]
call fcn.004270c0
mov edx, dword [edi + 0x7cc]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45c6b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 0x794], vtable.WTL::CMessageLoop.0
mov eax, dword [edi + 0x7a4]
test eax, eax
je 0x45c6dd
push eax
call fcn.00534415
add esp, 4
mov dword [edi + 0x7a4], 0
mov dword [edi + 0x7a8], 0
mov dword [edi + 0x7ac], 0
mov eax, dword [edi + 0x798]
test eax, eax
je 0x45c70e
push eax
call fcn.00534415
add esp, 4
mov dword [edi + 0x798], 0
mov ecx, edi
mov dword [edi + 0x79c], 0
mov dword [edi + 0x7a0], 0
call fcn.004270c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45f510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b6980
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x76a02c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CShotDlg.5.0
or edi, 0xffffffff
mov dword [esi + 0x24], vtable.CShotDlg.4.0
mov eax, edi
mov dword [esi + 0x28], vtable.CShotDlg.3.0
mov dword [esi + 0x2c], vtable.CShotDlg.2.0
mov dword [esi + 0x30], vtable.CShotDlg.1.0
mov dword [esi + 0x794], 0x74aa60
mov edx, dword [esi + 0x82c]
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45f583
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x828]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x45f59e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x7e0]
call fcn.0042e7a0
mov ecx, dword [esi + 0x7d4]
test ecx, ecx
je 0x45f619
mov edx, dword [esi + 0x7d8]
push ecx
call fcn.00460d10
mov ecx, dword [esi + 0x7dc]
add esp, 4
mov eax, dword [esi + 0x7d4]
sub ecx, eax
and ecx, 0xffffff80
cmp ecx, 0x1000
jb 0x45f5f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f69e
mov eax, edx
push ecx
push eax
call fcn.00468d54
mov dword [esi + 0x7d4], 0
add esp, 8
mov dword [esi + 0x7d8], 0
mov dword [esi + 0x7dc], 0
mov dword [esi + 0x794], vtable.WTL::CMessageLoop.0
mov eax, dword [esi + 0x7a4]
test eax, eax
je 0x45f640
push eax
call fcn.00534415
add esp, 4
mov dword [esi + 0x7a4], 0
mov dword [esi + 0x7a8], 0
mov dword [esi + 0x7ac], 0
mov eax, dword [esi + 0x798]
test eax, eax
je 0x45f671
push eax
call fcn.00534415
add esp, 4
mov dword [esi + 0x798], 0
mov ecx, esi
mov dword [esi + 0x79c], 0
mov dword [esi + 0x7a0], 0
call fcn.004270c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00533dd1
int3
Function at 0x45fd20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x776998
mov edi, ecx
xorps xmm0, xmm0
push 0x7759cc
push 0
push str.tab_cover
lea ecx, [edi + 0x34]
movups xmmword [ebp - 0x24], xmm0
call fcn.00479ce0
push eax
call fcn.005325ba
add esp, 0x14
mov dword [edi + 0x850], eax
test eax, eax
je 0x45ff47
push 0
push 0x7784a4
push 0x7759cc
push 0
push str.lay_bk
lea ecx, [edi + 0x34]
call fcn.00479ce0
push eax
call fcn.005325ba
add esp, 0x14
mov dword [edi + 0x854], eax
test eax, eax
je 0x45ff47
push edi
push 0x45f780
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x24]
mov ecx, 0x77cfec
push eax
call fcn.004020c0
movups xmm0, xmmword [ebp - 0x24]
sub esp, 0x10
xor ecx, ecx
mov eax, esp
movups xmmword [eax], xmm0
call fcn.00463830
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45ff47
mov ebx, dword [edi + 0x854]
mov ecx, dword [ebx + 0x6d8]
cmp ecx, esi
je 0x45fdfb
test ecx, ecx
je 0x45fdf5
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0x6d8], esi
xorps xmm0, xmm0
mov ecx, 0x77cfec
movups xmmword [ebp - 0x14], xmm0
call fcn.00401f50
mov ecx, eax
call fcn.00401df0
lea eax, [ebp - 0x14]
movss dword [ebp - 0x28], xmm0
push eax
mov ecx, 0x77cfec
call fcn.004020c0
movd xmm0, dword [ebp - 0xc]
movss xmm2, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
push 1
movd xmm1, dword [ebp - 0x14]
divss xmm0, xmm2
cvtdq2ps xmm1, xmm1
cvttss2si edx, xmm0
movd xmm0, dword [ebp - 0x10]
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0xc], edx
divss xmm1, xmm2
divss xmm0, xmm2
cvttss2si esi, xmm1
cvttss2si ecx, xmm0
sub edx, esi
mov dword [ebp - 0x14], esi
movd xmm0, dword [ebp - 8]
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x10], ecx
divss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
sub eax, ecx
push eax
push edx
push ecx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 0x32
push 0x200
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [edi + 0x79c]
lea eax, [edi + 0x30]
mov esi, dword [edi + 0x7a0]
mov ebx, edi
neg ebx
sbb ebx, ebx
and ebx, eax
cmp ecx, esi
jne 0x45ff14
mov edx, dword [edi + 0x798]
lea eax, [ebp - 0x2c]
cmp eax, edx
jb 0x45fed8
lea eax, [edx + esi*4]
lea esi, [ebp - 0x2c]
cmp esi, eax
mov esi, dword [edi + 0x7a0]
jb 0x45ff5d
test esi, esi
jne 0x45fee3
mov esi, 1
jmp 0x45fef2
lea esi, [ecx + ecx]
test esi, esi
js 0x45ff32
cmp esi, 0x1fffffff
ja 0x45ff32
push 4
push esi
push edx
call fcn.0054136d
add esp, 0xc
test eax, eax
je 0x45ff32
mov ecx, dword [edi + 0x79c]
mov dword [edi + 0x7a0], esi
mov dword [edi + 0x798], eax
mov eax, dword [edi + 0x798]
lea eax, [eax + ecx*4]
test eax, eax
je 0x45ff29
mov dword [eax], ebx
mov ecx, dword [edi + 0x79c]
lea eax, [ecx + 1]
mov dword [edi + 0x79c], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468d3e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004222a0
int3