joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4197d4
Capabilities:
Continue service
Modify service
Persist via windows service
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0xc], edi
call fcn.00419ea0
push 1
push edi
push edi
mov byte [ebp - 0x10], al
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
call esi
push eax
push dword [ebp - 8]
push str.ForceExitService::OpenSCManager_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 8], edi
je 0x4198f3
push 0x30130
push str.ZhuDongFangYu
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp - 4]
push str.ForceExitService::OpenService_ZhuDongFangYu__Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 4], edi
je 0x4198ea
mov ecx, ebx
call fcn.004198fb
push 1
mov ecx, ebx
call fcn.00419993
mov ecx, ebx
call fcn.0041993f
push edi
mov ecx, ebx
call fcn.00419969
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesZhuDongFangYu
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 3
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x2c]
push eax
push 0x8e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0xc], eax
call esi
push eax
push dword [ebp - 0xc]
push str.ForceExitService::ControlService___Ret:_d_Error:_d
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 0xc], edi
jne 0x4198e1
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4198fb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push str.SystemCurrentControlSetServicesZhuDongFangYu
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41993a
push str.DeleteFlag
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4199c2
Capabilities:
Modify service
Pause service
Persist via windows service
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 8], edi
call fcn.00419ea0
push 1
push edi
push edi
mov byte [ebp - 0x10], al
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
call esi
push eax
push dword [ebp - 0xc]
push str.Start360KrnlService::OpenSCManager_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 0xc], edi
je 0x419ae4
push 1
mov ecx, ebx
call fcn.00419969
push 0x30130
push str.ZhuDongFangYu
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp - 4]
push str.Start360KrnlService::OpenService_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 4], edi
je 0x419adb
push 1
mov ecx, ebx
call fcn.00419993
lea eax, [ebp - 8]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesZhuDongFangYu
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 2
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 8], eax
call esi
push eax
push dword [ebp - 8]
push str.Start360KrnlService::StartService___Ret:_d_Error:_d
push dword [ebp - 0x10]
push ebx
call fcn.00419ceb
add esp, 0x14
cmp dword [ebp - 8], edi
je 0x419ad2
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea eax, [ebp - 0x2c]
push eax
push 0x8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419aec
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
call fcn.00419ea0
mov ecx, esi
mov byte [ebp - 4], al
call fcn.00419071
mov edi, eax
xor eax, eax
test edi, edi
setge al
push eax
push str.RepairService:Service_Status:_d_r_n
push dword [ebp - 4]
push esi
call fcn.00419ceb
add esp, 0x10
test edi, edi
jl 0x419b2d
push 1
pop eax
jmp 0x419c18
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x419c16
push ebx
mov ecx, esi
call fcn.00419c1f
test eax, eax
je 0x419c16
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
push str.RepairService:Reinstall_Service__r_n
push dword [ebp - 4]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x30], ebx
push esi
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x34], str.open
mov dword [ebp - 0x2c], str.__install
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0x40
mov ebx, 0x80004005
call fcn.00419ceb
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x419c0d
push 0x2710
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 8], edi
je 0x419bbd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004199c2
test eax, eax
jne 0x419bed
push edi
push str.RepairService:Start360Service_Fails_and_Retry___d_r_n
push dword [ebp - 4]
push esi
call fcn.00419ceb
add esp, 0x10
inc edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, dword [ebp + 0xc]
jae 0x419c02
jmp 0x419bbd
push str.RepairService:Start360Service_Succeed__r_n
xor ebx, ebx
push dword [ebp - 4]
push esi
call fcn.00419ceb
add esp, 0xc
jmp 0x419c0d
push str.Repair_Service_Fails__Cannot_Execute_Repair_Command_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
test ebx, ebx
sete al
jmp 0x419c18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x419ceb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x419da1
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x80e]
mov word [ebp - 0x810], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x810]
push dword [ebp + 0x10]
push 0x200
push eax
call fcn.0040ebc3
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x410]
push 0x1a
push eax
push ebx
mov word [ebp - 0x412], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x419da1
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x410]
push str.360Safe
push eax
call esi
lea eax, [ebp - 0x410]
push str.Zhudongfangyu.log
push eax
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00419da4
pop esi
pop ebx
leave
ret
Function at 0x419da4
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp + 8], esi
je 0x419e99
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x419df3
push esi
jmp 0x419e93
cmp dword [ebp - 0x10], ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], ebx
jl 0x419e20
jg 0x419e0c
cmp dword [ebp - 0x14], 0x100000
jbe 0x419e20
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp - 4]
push 2
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
cmp eax, 0xffffffff
je 0x419e90
push ebx
push ebx
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x419e90
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
cmp edi, ebx
je 0x419e90
push ebx
push ebx
push dword [ebp - 8]
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
mov byte [eax + edi], bl
lea eax, [ebp - 0xc]
push ebx
push eax
push edi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.0044b020
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x419f96
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 0x2bc]
push 1
push esi
push 0x45f
add ecx, 0x54
call fcn.0041a376
and dword [ebp - 4], 0
cmp dword [esi], 0
pop esi
je 0x419fc2
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0x4812bc
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0x64
call fcn.004077e7
pop ecx
xor eax, eax
pop ecx
leave
ret 0x10
Function at 0x41ac3c
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
call fcn.0041ad6a
pop ecx
push 1
pop ebx
cmp eax, ebx
jne 0x41ac6a
xor eax, eax
cmp dword [ebp - 8], esi
setne al
jmp 0x41ad66
push esi
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x41acb2
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push 0x1388
push ebx
push esi
push 0x8c
push 0x416
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x41acb2
cmp dword [ebp - 4], ebx
jne 0x41aca9
mov eax, ebx
jmp 0x41ad66
cmp dword [ebp - 4], esi
je 0x41ad3d
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
mov word [ebp - 0x218], si
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x472e44
push 0x472dc4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x41ad63
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
push 0x472eb8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41ad41
xor eax, eax
jmp 0x41ad66
lea eax, [ebp - 0x218]
push eax
push esi
push str.ProtectSelf
push str.param
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x41ad63
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x41d938
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 0
push eax
call ebx
and dword [esi + 0x64], 0
mov ecx, esi
call fcn.0041d905
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x41d989
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 5
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 0
push eax
call ebx
mov ecx, esi
mov dword [esi + 0x64], 1
call fcn.0041d905
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x41d9dd
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 5
push eax
call ebx
mov ecx, esi
mov dword [esi + 0x64], 2
call fcn.0041d905
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x41db52
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push 0x24
lea eax, [ebp - 0x2c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.GetNativeSystemInfo
push 0x480ad0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41db8e
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x41db98
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 9
push esi
push edi
je 0x41dc5a
cmp word [ebp - 0x2c], 6
je 0x41dc5a
mov esi, 0x11c
xor edi, edi
push esi
lea eax, [ebp - 0x148]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x41dbf8
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x114
push eax
call esi
test eax, eax
je 0x41dc18
cmp dword [ebp - 0x138], 2
jne 0x41dc5a
mov eax, dword [ebp - 0x144]
mov edx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x34]
jmp 0x41dc49
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push str.kernel32.dll
call fcn.0041dcb4
add esp, 0xc
test eax, eax
je 0x41dcaf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
movzx edx, word [ebp - 4]
shr eax, 0x10
shr ecx, 0x10
cmp eax, 5
jb 0x41dc5a
jne 0x41dc67
test edx, edx
jne 0x41dc60
cmp di, 4
jae 0x41dcaf
xor eax, eax
pop edi
pop esi
leave
ret
cmp edx, 2
jne 0x41dcaf
jmp 0x41dc5a
cmp eax, 6
jne 0x41dcaf
test edx, edx
jne 0x41dc8a
cmp ecx, 0x1770
je 0x41dcaf
cmp ecx, 0x1771
je 0x41dcaf
cmp ecx, 0x1772
je 0x41dcaf
jmp 0x41dc5a
cmp edx, 1
jne 0x41dcaf
cmp ecx, 0x1b58
je 0x41dcaf
cmp ecx, 0x1bbc
je 0x41dcaf
cmp ecx, 0x1db0
je 0x41dcaf
cmp ecx, 0x1db1
jne 0x41dc5a
push 1
pop eax
jmp 0x41dc5c

Function at 0x41dcb4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x41dcde
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x41dce2
xor eax, eax
jmp 0x41dd23
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41dd19
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x480434
push esi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41fe85
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
push 3
mov esi, dword [ebp + 0x10]
cdq
pop ecx
mov edi, dword [ebp + 0xc]
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x18]
add eax, esi
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
mov dword [ebp + 0x1c], eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xcc0020
mov eax, dword [ebp + 0x28]
push dword [ebp + 0x24]
sub eax, ebx
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x14]
lea eax, [ebx + ebx]
sub esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
lea edi, [esi + ebx]
sub ecx, ebx
add edi, eax
add ecx, edx
cmp edi, ecx
mov dword [ebp + 0xc], ecx
jge 0x41ff47
add eax, ebx
mov dword [ebp + 0x14], eax
push 0xcc0020
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x2c]
push esi
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add edi, esi
add esi, esi
cmp edi, dword [ebp + 0xc]
jl 0x41ff1f
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp - 4]
push 0xcc0020
sub eax, ebx
push dword [ebp + 0x24]
add eax, dword [ebp + 0x28]
push eax
push esi
push dword [ebp + 0x2c]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp + 0x1c], edi
je 0x41ff89
push dword [ebp + 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 8]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, edi
je 0x41ffb1
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
test eax, eax
je 0x41ffa7
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x41ffb1
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4201b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x28]
mov eax, esi
push edi
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
lea ecx, [eax + eax]
sub esi, ecx
jne 0x4201d3
dec eax
push 2
mov dword [ebp - 4], eax
pop esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add ecx, eax
push ecx
push edi
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
mov dword [ebp + 0x18], eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov ebx, 0xcc0020
mov eax, dword [ebp + 0x28]
push ebx
sub eax, dword [ebp - 4]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 8]
push dword [ebp + 0x2c]
push eax
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0x1c], esi
add esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
add esi, eax
sub ecx, dword [ebp - 4]
add ecx, edx
cmp esi, ecx
mov dword [ebp + 0xc], ecx
jge 0x42028a
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp + 0x14], ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 0x1c]
add esi, eax
add eax, eax
cmp esi, dword [ebp + 0xc]
mov dword [ebp + 0x1c], eax
jl 0x420262
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp - 8]
sub eax, dword [ebp - 4]
push ebx
push dword [ebp + 0x24]
add eax, dword [ebp + 0x28]
push eax
push esi
push dword [ebp + 0x2c]
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp + 0x18], edi
pop ebx
je 0x4202c8
push dword [ebp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0xc]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp esi, edi
je 0x4202f0
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
test eax, eax
je 0x4202e6
mov dword [ebp - 8], edi
cmp dword [ebp - 8], edi
je 0x4202f0
push dword [ebp - 8]
call esi
pop edi
pop esi
leave
ret
Function at 0x4204e6
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, ecx
mov esi, dword [ebp + 0x10]
sub eax, dword [ebp + 0x2c]
mov ebx, dword [ebp + 0xc]
cdq
sub eax, edx
mov edi, eax
lea eax, [esi + ecx]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
push esi
sar edi, 1
push ebx
inc edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xcc0020
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push 1
push dword [ebp + 0x28]
push esi
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
call ebx
lea ecx, [esi + 1]
lea eax, [edi + esi]
cmp ecx, eax
mov dword [ebp + 0x1c], 1
mov dword [ebp + 0x10], ecx
jge 0x4205a4
push 0xcc0020
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x28]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0x1c]
add dword [ebp + 0x10], eax
add eax, eax
mov dword [ebp + 0x1c], eax
lea eax, [edi + esi]
cmp dword [ebp + 0x10], eax
jl 0x420574
push 0xcc0020
lea eax, [edi + esi]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
sub esi, edi
mov dword [ebp + 0x1c], 1
add esi, dword [ebp + 0x18]
lea edi, [esi + 1]
cmp edi, dword [ebp - 8]
jge 0x4205ff
push 0xcc0020
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x28]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0x1c]
add edi, eax
add eax, eax
mov dword [ebp + 0x1c], eax
jmp 0x4205d3
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
cmp dword [ebp + 0x14], edi
je 0x420619
push dword [ebp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [ebp - 4], edi
je 0x420646
push dword [ebp - 4]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
test eax, eax
je 0x42063c
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x420646
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret