joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4162e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov byte [0x505370], bl
cmp dword [esi + 4], ebx
je 0x416336
cmp dword [esi], ebx
je 0x416336
push dword [esi]
push dword [esi + 4]
call fcn.004a194c
pop ecx
pop ecx
test eax, eax
jne 0x416336
push 0x800
push 0x505370
push 0x140
call fcn.00441922
add esp, 0xc
mov dword [esi + 0x2c], eax
xor eax, eax
jmp 0x41650b
and dword [ebp - 0x10], ebx
xor eax, eax
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov word [ebp - 0x840], ax
cmp dword [esi], eax
je 0x416369
lea eax, [ebp - 0x840]
push eax
push dword [esi]
mov ecx, eax
call fcn.0041559c
mov ecx, dword [0x531c00]
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00418dd1
or ecx, 0xffffffff
mov edi, eax
cmp dword [ebp - 8], ebx
cmovne ecx, dword [ebp - 8]
mov dword [esi + 0x34], ecx
test edi, edi
jne 0x416401
mov eax, dword [ebp - 4]
dec eax
sub eax, 1
je 0x4163ed
sub eax, 1
je 0x4163d9
dec eax
sub eax, 1
je 0x4163c5
dec eax
sub eax, 1
je 0x4164e7
push 0x800
push 0x505370
push 0x146
jmp 0x4164dc
push 0x800
push 0x505370
push 0x145
jmp 0x4164dc
push 0x800
push 0x505370
push 0x144
jmp 0x4164dc
push 0x800
push 0x505370
push 0x143
jmp 0x4164dc
lea ecx, [esi + 8]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
cmp dword [ecx], 0x204d4350
je 0x41647a
cmp dword [esi + 0x20], 0x20494e49
mov eax, ebx
mov dword [ebp + 8], ebx
jne 0x416435
mov eax, dword [esi + 0x24]
push eax
push ebx
push ebx
lea eax, [ebp + 8]
push eax
push 1
push ecx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00415b8e
add esp, 0x24
test eax, eax
jne 0x416471
mov ecx, dword [0x531c00]
push edi
call fcn.00418abf
push 0x800
push 0x505370
push 0x147
jmp 0x4164dc
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x1c]
push ebx
push 0x80
push 2
push ebx
push 1
mov dword [esi + 0x54], eax
mov eax, dword [ebp - 0x18]
push 0x40000000
push dword [esi + 4]
mov dword [esi + 0x58], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], edi
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x4164eb
mov ecx, dword [0x531c00]
push edi
call fcn.00418abf
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x4164ca
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x800
push 0x505370
mov dword [esi + 0x4c], ebx
push 0x148
call fcn.00441922
add esp, 0xc
mov dword [esi + 0x2c], eax
xor eax, eax
jmp 0x41650a
lea ecx, [ebp - 0x20]
mov dword [esi + 0x48], eax
push ecx
push ebx
push esi
push 0x4156bb
push ebx
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41650f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x1000
xor ebx, ebx
mov edi, 0x505b70
push ebx
push edi
call fcn.0049a3b0
mov esi, dword [ebp + 8]
add esp, 0xc
cmp dword [esi + 4], ebx
je 0x416567
cmp dword [esi], ebx
je 0x416567
push dword [esi]
push dword [esi + 4]
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
jne 0x416567
push 0x800
push edi
push 0x140
call fcn.00441947
add esp, 0xc
mov dword [esi + 0x2c], eax
xor eax, eax
jmp 0x416716
mov ecx, dword [0x531c00]
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], ebx
or dword [ebp - 0xc], 0xffffffff
push eax
push dword [esi]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.00418dd1
or ecx, 0xffffffff
mov edi, eax
cmp dword [ebp - 0xc], ebx
cmovne ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], ecx
test edi, edi
jne 0x416608
mov eax, dword [ebp - 8]
dec eax
sub eax, 1
je 0x4165f4
sub eax, 1
je 0x4165e0
dec eax
sub eax, 1
je 0x4165cc
dec eax
sub eax, 1
je 0x416560
push 0x800
push 0x505b70
push 0x146
jmp 0x416555
push 0x800
push 0x505b70
push 0x145
jmp 0x416555
push 0x800
push 0x505b70
push 0x144
jmp 0x416555
push 0x800
push 0x505b70
push 0x143
jmp 0x416555
lea ecx, [esi + 8]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
cmp dword [ecx], 0x204d4350
je 0x416684
cmp dword [esi + 0x20], 0x20494e49
mov eax, ebx
mov dword [ebp + 8], ebx
jne 0x41663c
mov eax, dword [esi + 0x24]
push eax
push ebx
push ebx
lea eax, [ebp + 8]
push eax
push 1
push ecx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.00415b8e
add esp, 0x24
test eax, eax
jne 0x41667b
mov ecx, dword [0x531c00]
push edi
call fcn.00418abf
push 0x800
push 0x505b70
push 0x147
jmp 0x416555
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x20]
push ebx
push 0x80
push 2
push ebx
push 1
mov dword [esi + 0x54], eax
mov eax, dword [ebp - 0x1c]
push 0x40000000
push dword [esi + 4]
mov dword [esi + 0x58], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], edi
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4166f7
mov ecx, dword [0x531c00]
push edi
call fcn.00418abf
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x4166d4
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push dword [esi + 0x50]
mov dword [esi + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x800
push 0x505b70
mov dword [esi + 0x50], ebx
push 0x148
jmp 0x416555
lea ecx, [ebp - 4]
mov dword [esi + 0x48], eax
push ecx
push ebx
push esi
push 0x4158fe
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416ca6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
call fcn.004a1b7a
mov esi, eax
pop ecx
test esi, esi
je 0x416db8
push 0x100
call fcn.004a1b7a
push 0x30
mov dword [esi], eax
call fcn.004a1b7a
cmp dword [esi], 0
pop ecx
pop ecx
mov dword [esi + 4], eax
je 0x416da0
test eax, eax
je 0x416d98
push ebx
push edi
xor edi, edi
mov word [esi + 8], 0x404
push 0x10
pop ecx
mov eax, edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov ebx, edi
mov dword [esi + 0x14], 0x42400000
mov dword [esi + 0x18], 0x42400000
mov dword [esi + 0x1c], ecx
mov dword [ebp - 4], eax
mov edx, edi
mov cl, al
mov eax, dword [esi]
add eax, ebx
xor cl, dl
push 0x10
mov byte [eax + edx], cl
inc edx
mov eax, dword [ebp - 4]
pop ecx
cmp edx, ecx
jl 0x416d14
inc eax
add ebx, ecx
mov dword [ebp - 4], eax
cmp ebx, 0x100
jl 0x416d12
mov edx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edx
mov ebx, edi
mov eax, dword [esi + 4]
mov ecx, ebx
shr ecx, 4
add ebx, 0x32
add cl, 0x2b
mov byte [edi + eax], cl
mov eax, edx
mov ecx, dword [esi + 4]
lea edi, [edi + 3]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add al, 0x19
mov byte [ecx + edi - 2], al
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 4]
add dword [ebp - 4], 0xe
cdq
and edx, 0xf
add eax, edx
mov edx, dword [ebp - 8]
sar eax, 4
add edx, 0x1b
add al, 9
mov dword [ebp - 8], edx
mov byte [ecx + edi - 1], al
cmp ebx, 0x320
jl 0x416d42
pop edi
pop ebx
jmp 0x416db8
push dword [esi]
call fcn.004a1b5f
pop ecx
cmp dword [esi + 4], 0
je 0x416daf
push dword [esi + 4]
call fcn.004a1b5f
pop ecx
push esi
call fcn.004a1b5f
pop ecx
xor esi, esi
mov eax, esi
pop esi
leave
ret
Function at 0x418ad4
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x4c6db3
call fcn.0049911c
sub esp, 0x24
and dword [ebp - 0x14], 0
xor al, al
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00489f65
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x418c09
mov ecx, dword [ebp - 0x14]
test ecx, ecx
js 0x418b12
inc ecx
mov dword [ebp - 0x14], ecx
push str.winampGetExtendedRead_open
push dword [esi + 0xc]
mov byte [ebp - 0xd], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_open_float
push dword [esi + 0xc]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_openW
push dword [esi + 0xc]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_openW_float
push dword [esi + 0xc]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_getData
push dword [esi + 0xc]
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_close
push dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.winampGetExtendedRead_setTime
push dword [esi + 0xc]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
jne 0x418b9a
test esi, esi
je 0x418bf9
cmp dword [ebp - 0x1c], 0
je 0x418bf9
cmp dword [ebp - 0x18], 0
je 0x418bf9
push 0x24
call fcn.0049909d
pop ecx
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
test eax, eax
je 0x418bd7
push dword [ebp - 0x24]
mov ecx, eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
push dword [ebp - 0x20]
call fcn.00427e08
mov esi, eax
jmp 0x418bd9
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push ebx
push dword [ebp + 8]
call fcn.00427eb8
test al, al
jne 0x418c05
test esi, esi
je 0x418bf9
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
cmp dword [ebp - 0x14], 0
jge 0x418aef
jmp 0x418c0f
mov eax, esi
jmp 0x418c70
cmp byte [ebp - 0xd], 0
je 0x418c67
cmp byte [ebp + 0x10], 0
je 0x418c67
push 0xc
call fcn.0049909d
pop ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x418c36
mov ecx, eax
call fcn.00455722
mov esi, eax
jmp 0x418c38
xor esi, esi
or dword [ebp - 4], 0xffffffff
push 0
push dword [ebp + 8]
call fcn.00489f65
pop ecx
pop ecx
push ebx
push dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00455877
test al, al
jne 0x418c05
test esi, esi
je 0x418c6e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
jmp 0x418c6e
mov dword [ebx + 0x18], 2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x41dc3f
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x4c6e59
call fcn.0049911c
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
push 0x12
mov edi, 0x50733c
push edi
call fcn.0040c4d6
push 0
push 0
push ebx
call fcn.00404fb9
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
push 0x26e
push esi
push 0x400
push dword [0x531f70]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x531c1c]
push 0x13
push edi
call fcn.00428fa5
cmp dword [0x507338], 0
je 0x41dd8f
xor eax, eax
lea edi, [ebp - 0x40]
push 9
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4f7c84]
add eax, 0xffffff71
mov dword [ebp - 0x14], eax
mov eax, dword [0x4f7c88]
add eax, 0xffffffe4
cmp dword [0x531f3c], 0
mov dword [ebp - 0x10], eax
jne 0x41dd8f
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
cmp eax, 0x12
jge 0x41dd16
push ebx
push 0x13
lea eax, [ebp - 0x40]
push eax
call fcn.0040c4d6
push ebx
call edi
cmp eax, 0x12
jge 0x41dd20
push 0x12
pop ecx
sub ecx, eax
lea edi, [ebp - 0x40]
lea edi, [edi + eax*2]
shr ecx, 1
mov eax, 0x200020
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x41dd20
push 9
pop ecx
mov esi, ebx
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
call fcn.00419cef
push dword [0x506cf8]
call fcn.00419c9f
mov ebx, dword [ebp - 0x14]
xor edi, edi
mov esi, dword [ebp - 0x10]
pop ecx
pop ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x14]
push eax
movzx eax, word [ebp + edi*2 - 0x40]
push eax
call fcn.0041ab0a
add esp, 0xc
push 0xcc0020
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [0x506d00]
push 6
push 5
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add ebx, 5
inc edi
cmp edi, 0x12
jl 0x41dd3d
push 0
call fcn.00419c9f
mov esi, dword [ebp - 0x18]
pop ecx
push esi
call fcn.004a1b5f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41f90c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x507338], 0
je 0x41fb13
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [0x4f7c88]
lea ecx, [ebp - 0x10]
push dword [ebp + 0xc]
add edi, 0xffffffc6
mov dword [ebp - 4], edi
call fcn.00485a1f
lea ecx, [ebp - 0x10]
call fcn.004081ec
push eax
call fcn.00419cef
push dword [0x507330]
call fcn.00419c9f
mov eax, dword [0x4f7c88]
add eax, 0xffffffc4
cdq
idiv dword [0x4f7df8]
pop ecx
pop ecx
mov esi, eax
call fcn.00492412
mov ebx, eax
sub ebx, esi
cmp ebx, 1
jge 0x41f97c
xor ebx, ebx
xor edi, edi
jmp 0x41f9d9
mov ecx, dword [ebp + 0x14]
lea eax, [edi - 0x12]
cmp ecx, ebx
cmovg ecx, ebx
imul eax, ecx
cdq
idiv ebx
mov ebx, eax
test ebx, ebx
js 0x41f976
lea esi, [ebx - 0x1c]
xor edi, edi
test esi, esi
jle 0x41f9d9
push 0x1d
mov dword [ebp - 8], ebx
pop ebx
push 0xcc0020
push 0x2a
push 0x24
push dword [0x506d00]
lea eax, [edi + 0x14]
push ebx
push 8
push eax
mov eax, dword [0x4f7c84]
lea ecx, [ebp - 0x10]
add eax, 0xfffffff1
push eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
add edi, ebx
cmp edi, esi
jl 0x41f9a2
mov ebx, dword [ebp - 8]
push 0x3a
pop esi
lea eax, [edi + 0x1d]
lea ecx, [ebx + 0x12]
cmp ecx, eax
push 0x1d
pop eax
cmovle esi, eax
add esi, edi
cmp edi, ebx
jge 0x41fa22
push 0xcc0020
push 0x2a
push 0x24
push dword [0x506d00]
mov eax, ebx
lea ecx, [ebp - 0x10]
sub eax, edi
push eax
push 8
lea eax, [edi + 0x14]
push eax
mov eax, dword [0x4f7c84]
add eax, 0xfffffff1
push eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp + 0x10], 0
push 0xcc0020
push 0x35
push 0x34
pop eax
push 0x3d
pop ecx
cmovne eax, ecx
lea ecx, [ebp - 0x10]
push eax
push dword [0x506d00]
lea eax, [ebx + 0x14]
push 0x12
push 8
push eax
mov eax, dword [0x4f7c84]
add eax, 0xfffffff1
push eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea edi, [ebx + 0x12]
mov ebx, dword [ebp - 4]
cmp edi, esi
jge 0x41faaf
cmp edi, ebx
jge 0x41faaf
push 0xcc0020
mov eax, edi
lea ecx, [ebx - 0x1d]
sub eax, esi
mov edx, esi
add eax, 0x47
sub edx, edi
push eax
push 0x24
push dword [0x506d00]
mov eax, ebx
sub eax, edi
cmp edi, ecx
lea ecx, [ebp - 0x10]
cmovl eax, edx
push eax
push 8
lea eax, [edi + 0x14]
push eax
mov eax, dword [0x4f7c84]
add eax, 0xfffffff1
push eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp esi, ebx
jge 0x41fb00
mov edi, ebx
lea ecx, [ebx - 0x1d]
sub edi, esi
push 0xcc0020
push 0x2a
push 0x24
push dword [0x506d00]
cmp esi, ecx
mov eax, edi
push 0x1d
pop ecx
cmovl eax, ecx
lea ecx, [ebp - 0x10]
push eax
push 8
lea eax, [esi + 0x14]
push eax
mov eax, dword [0x4f7c84]
add eax, 0xfffffff1
push eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x1d
pop eax
add esi, eax
lea ecx, [ebx - 0x1d]
sub edi, eax
cmp esi, ebx
jl 0x41faba
push 0
call fcn.00419c9f
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00485a66
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420b12
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x531f7c], 0
je 0x420d14
cmp dword [0x507710], 0
je 0x420d14
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00419cef
pop ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp byte [0x4f7c4f], cl
sete cl
xor edx, edx
inc edx
cmp eax, dword [0x531f7c]
cmove ecx, edx
push ecx
call fcn.00421017
cmp dword [0x531f3c], 0
pop ecx
jne 0x420d13
push ebx
push esi
push dword [0x507714]
call fcn.00419c9f
pop ecx
mov ecx, dword [0x4f7cb0]
push 0x14
pop esi
push 0x1d
lea eax, [ecx - 0x3a]
pop ebx
cdq
idiv ebx
mov ebx, eax
test ebx, ebx
jle 0x420be5
push 0xcc0020
push 0x2a
push 0x7f
push dword [0x506d00]
dec ebx
push 0x1d
push 0xb
push esi
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x4f7cac]
push 0xcc0020
push 0x2a
push 0x8b
push dword [0x506d00]
add eax, 0xfffffff8
push 0x1d
push 8
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 0x1d
test ebx, ebx
jg 0x420b93
mov ecx, dword [0x4f7cb0]
lea eax, [ecx - 0x3a]
push 0x1d
cdq
pop ecx
idiv ecx
mov ebx, edx
test ebx, ebx
je 0x420c41
push 0xcc0020
push ecx
push 0xb
push 0x2a
push 0x7f
push dword [0x506d00]
push ebx
push 0xb
push esi
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0xcc0020
push 0x1d
pop eax
push eax
mov eax, dword [0x4f7cac]
push 8
push 0x2a
push 0x8b
push dword [0x506d00]
add eax, 0xfffffff8
push ebx
push 8
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
add esi, ebx
push 0xcc0020
push 0x2a
push 0
push dword [0x506d00]
push 0x26
push 0x7d
push esi
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [0x4f7cac]
mov dword [ebp - 4], 0x19
push 0x7d
pop ebx
lea eax, [ecx - 0xfa]
cdq
idiv dword [ebp - 4]
test eax, eax
jle 0x420cad
push 0xcc0020
push 0x51
push 0x7f
push dword [0x506d00]
dec eax
push 0x26
push dword [ebp - 4]
mov dword [ebp - 8], eax
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
add ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x420c7c
mov ecx, dword [0x4f7cac]
lea eax, [ecx - 0xfa]
mov ecx, dword [ebp - 4]
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
je 0x420ce3
push 0xcc0020
push 0x26
push ecx
push 0x51
push 0x7f
push dword [0x506d00]
push 0x26
push eax
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
add ebx, dword [ebp - 8]
push 0xcc0020
push 0x51
push 0
push dword [0x506d00]
push 0x26
push 0x7d
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
xor ebx, ebx
push ebx
push ebx
call fcn.00420d16
push ebx
call fcn.00419c9f
add esp, 0xc
pop esi
pop ebx
pop edi
leave
ret
Function at 0x420d16
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x531f3c], 0
jne 0x420f1d
mov eax, dword [0x531f7c]
test eax, eax
je 0x420f1d
cmp dword [0x507710], 0
je 0x420f1d
push ebx
push esi
push edi
push eax
lea ecx, [ebp - 0xc]
call fcn.00485a48
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x420d60
mov ebx, 0x507718
mov dword [ebp + 8], ebx
jmp 0x420d71
push 0x400
push ebx
push 0x507718
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0xc], 0
je 0x420e84
mov esi, dword [0x4f7cb0]
lea ecx, [ebp - 0xc]
add esi, 0xffffffda
mov dword [ebp - 4], esi
call fcn.004081ec
push eax
call fcn.00419cef
push dword [0x507714]
call fcn.00419c9f
pop ecx
pop ecx
push 0xcc0020
push 0x2a
push 0
push dword [0x506d00]
lea ecx, [ebp - 0xc]
push 0x26
push 0x7d
push esi
push 0
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [0x4f7cac]
push 0x7d
pop esi
push 0x19
lea eax, [ecx - 0xfa]
pop edi
cdq
idiv edi
mov edi, eax
test edi, edi
jle 0x420e1a
mov ebx, dword [ebp - 4]
push 0xcc0020
push 0x51
push 0x7f
push dword [0x506d00]
lea ecx, [ebp - 0xc]
dec edi
push 0x26
push 0x19
push ebx
push esi
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 0x19
test edi, edi
jg 0x420de5
mov ecx, dword [0x4f7cac]
mov ebx, dword [ebp + 8]
lea eax, [ecx - 0xfa]
push 0x19
cdq
pop ecx
idiv ecx
mov edi, edx
test edi, edi
je 0x420e56
push 0xcc0020
push 0x26
push ecx
push 0x51
push 0x7f
push dword [0x506d00]
lea ecx, [ebp - 0xc]
push 0x26
push edi
push dword [ebp - 4]
push esi
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
add esi, edi
push 0xcc0020
push 0x51
push 0
push dword [0x506d00]
lea ecx, [ebp - 0xc]
push 0x26
push 0x7d
push dword [ebp - 4]
push esi
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
call fcn.00419c9f
pop ecx
mov ecx, dword [0x4f7cb0]
push dword [0x506ce0]
mov dword [ebp - 0x1c], 0x5c
lea eax, [ecx - 0x1b]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4f7cac]
add eax, 0xffffffe7
mov dword [ebp - 0x14], eax
lea eax, [ecx - 0xd]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
call fcn.004081ec
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
call edi
push dword [0x4fa030]
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x4fa034]
lea ecx, [ebp - 0xc]
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x820
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0xc]
call fcn.004081ec
push eax
call dword [sym.imp.USER32.dll_DrawTextW]
push esi
lea ecx, [ebp - 0xc]
call fcn.004081ec
push eax
call edi
lea ecx, [ebp - 0xc]
call fcn.00485a66
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420f64
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x531f3c], 0
jne 0x421015
mov eax, dword [0x531f7c]
test eax, eax
je 0x421015
cmp dword [0x507710], 0
je 0x421015
push esi
push edi
push eax
lea ecx, [ebp - 8]
call fcn.00485a48
lea ecx, [ebp - 8]
call fcn.004081ec
push eax
call fcn.00419cef
push dword [0x507714]
call fcn.00419c9f
pop ecx
pop ecx
push 9
xor edi, edi
pop esi
cmp edi, dword [ebp + 8]
push 0xcc0020
push 0x2a
pop eax
push 0x33
pop ecx
cmovne eax, ecx
lea ecx, [ebp - 8]
push eax
lea eax, [esi + 0x95]
cmovne eax, esi
push eax
push dword [0x506d00]
mov eax, dword [0x4f7cb0]
push 0x12
push 0xf
add eax, 0xffffffe3
push eax
push esi
call fcn.004081ec
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 0xf
inc edi
cmp esi, 0x54
jl 0x420fbb
push 0
call fcn.00419c9f
pop ecx
lea ecx, [ebp - 8]
call fcn.00485a66
pop edi
pop esi
leave
ret

Function at 0x4214b6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
inc ebx
cmp byte [0x507b36], 0
jne 0x4215c4
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x4cf2b8
push 0x502730
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42151b
push eax
mov dword [0x507b30], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
push 0x4cf2dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmRegisterThumbnail
push eax
mov dword [0x507b38], eax
call esi
push str.DwmUpdateThumbnailProperties
push dword [0x507b38]
mov dword [0x507b3c], eax
call esi
push str.DwmUnregisterThumbnail
push dword [0x507b38]
mov dword [0x507b40], eax
call esi
push str.DwmSetWindowAttribute
push dword [0x507b38]
mov dword [0x507b44], eax
call esi
push str.DwmEnableMMCSS
push dword [0x507b38]
mov dword [0x507b48], eax
call esi
push str.DwmSetIconicThumbnail
push dword [0x507b38]
mov dword [0x507b4c], eax
call esi
push str.DwmInvalidateIconicBitmaps
push dword [0x507b38]
mov dword [0x507b50], eax
call esi
push str.DwmSetIconicLivePreviewBitmap
push dword [0x507b38]
mov dword [0x507b54], eax
call esi
mov dword [0x507b58], eax
mov byte [0x507b36], bl
pop esi
cmp dword [0x507b38], 0
je 0x4215fa
cmp dword [0x507b3c], 0
je 0x4215fa
cmp dword [0x507b40], 0
je 0x4215fa
cmp dword [0x507b44], 0
je 0x4215fa
cmp dword [0x507b48], 0
je 0x4215fa
cmp dword [0x507b4c], 0
jne 0x4215fc
xor bl, bl
mov al, bl
pop ebx
leave
ret