joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4edc48
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40abd2
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x24]
call fcn.00401760
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
add esi, 0xc
push edx
mov dword [esp + 0x4c], 0
call fcn.0040af40
cmp dword [esp + 0x34], 8
jb 0x40ac1e
mov eax, dword [esp + 0x20]
push eax
call fcn.004c8f17
add esp, 4
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0x18]
mov esi, dword [esi]
test edi, edi
je 0x40ac2f
cmp edi, esi
je 0x40ac34
call fcn.004c96d9
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x40ac6b
test edi, edi
jne 0x40ac67
call fcn.004c96d9
cmp esi, dword [edi + 0x18]
jne 0x40ac4f
call fcn.004c96d9
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4
mov edi, dword [edi]
jmp 0x40ac45
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4

Function at 0x40bb10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f1f38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1c], eax
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00409840
mov dword [esp + 0x30], 0
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x40bb5f
lea eax, [esp + 0xc]
push eax
push 0x532ba8
call fcn.00405c70
test al, al
jne 0x40bb83
cmp dword [esp + 0x20], 8
jb 0x40bc0b
mov eax, dword [esp + 0xc]
push eax
jmp 0x40bc03
call fcn.00406900
cmp dword [eax + 0x20], 0
je 0x40bba4
call fcn.00406900
mov eax, dword [eax + 0x20]
test eax, eax
je 0x40bba4
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
push 0x532ba8
mov edx, str.border.png
call fcn.00405f10
mov edi, eax
call fcn.00406900
mov dword [eax + 0x20], edi
call fcn.00406900
cmp dword [eax + 0x24], 0
je 0x40bbde
call fcn.00406900
mov eax, dword [eax + 0x24]
test eax, eax
je 0x40bbde
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
push 0x532ba8
mov edx, str.border2.png
call fcn.00405f10
mov edi, eax
call fcn.00406900
mov dword [eax + 0x24], edi
cmp dword [esp + 0x20], 8
jb 0x40bc0b
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x2c
ret
Function at 0x40bc70
Capabilities:
Check if file exists

Disassembly:
push ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bc7e
pop ecx
ret
push esi
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x40bca7
lea eax, [esi + 4]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [esi + 8], eax
jmp 0x40bca9
xor esi, esi
mov ecx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x40bcc6
mov dword [esi + 8], eax
cmp dword [esp + 4], 0
je 0x40bcf6
mov eax, dword [esi + 4]
lea edx, [esp + 4]
push edx
push eax
mov dword [esp + 0xc], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x40bcea
mov dword [esi + 8], eax
cmp dword [esp + 4], 0
je 0x40bcf6
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
xor eax, eax
pop esi
pop ecx
ret
Function at 0x40fdf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ec218
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x58]
mov eax, dword [ebx]
mov edx, dword [eax + 0x20]
mov ecx, ebx
call edx
xor edi, edi
cmp eax, edi
jne 0x40fe40
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
mov ecx, dword [eax + 4]
cmp ecx, edi
je 0x40fe29
mov dword [esp + 0x10], vtable.NewSkinView::CNewSkinEvent.0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov edx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x6c]
push eax
lea esi, [esp + 0x1c]
mov dword [esp + 0x5c], edi
call fcn.00412010
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
mov ecx, esi
push ecx
mov ecx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edi
call edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10

Function at 0x411830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f0efc
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov dword [esi + 0xc], eax
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.NewSkinView::CNewSkinWidget.0
mov byte [esi + 0x10], 1
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov byte [esi + 0x2d], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
lea ecx, [esi + 0x84]
mov byte [esp + 0x14], 2
push ecx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
call fcn.00403c40
mov byte [esp + 0x14], 3
cmp byte [0x534be8], bl
jne 0x4118eb
mov ecx, 0x50223c
mov byte [0x534be8], 1
call fcn.00411aa0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x41a260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f378b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [esp + 0xac]
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x24], eax
call fcn.004025b0
xor ebx, ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x5c], ebx
mov edx, dword [esi + 8]
mov edi, dword [esi + 0xc]
push edx
push ebp
lea eax, [esp + 0x2c]
call fcn.00401dc0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], ebx
call sub.gdiplus.dll_GdipCreateFromHDC
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov byte [esp + 0xa0], 2
push ebx
lea edx, [esp + 0x1c]
mov dword [esp + 0x64], edx
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x28]
push edx
mov dword [esp + 0x6c], ecx
mov ecx, dword [esi + 8]
push ecx
push ebx
push ebx
push eax
call sub.gdiplus.dll_GdipSetClipRectI
cmp eax, ebx
je 0x41a334
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
push 3
push edx
call sub.gdiplus.dll_GdipSetTextRenderingHint
cmp eax, ebx
je 0x41a348
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 4]
lea eax, [esp + 0x60]
push eax
mov eax, dword [edx + 0x24]
push eax
call fcn.00413080
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
add esp, 8
mov byte [esp + 0x17], 1
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0xff
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
push eax
push ecx
push ebx
push ebx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push eax
push ecx
push ebp
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov edx, dword [esp + 0x18]
push edx
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x41a3b1
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x41a3c0
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x90], 8
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
jb 0x41a3df
mov eax, dword [esp + 0x7c]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004c8f08
add esp, 0x94
ret 8
Function at 0x41b080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
lea edi, [ebx + 8]
cmp byte [ebp + 0xc], bl
jne 0x41b0c2
lea esi, [esp + 0x14]
call fcn.0047fd80
lea ebx, [edi - 7]
cmp dword [eax + 0x18], edi
jb 0x41b0b0
mov eax, dword [eax + 4]
jmp 0x41b0b3
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [esp + 0xf], bl
test eax, eax
je 0x41b0c7
mov byte [esp + 0xf], 0
test bl, 1
je 0x41b0df
cmp dword [esp + 0x2c], edi
jb 0x41b0df
mov eax, dword [esp + 0x18]
push eax
call fcn.004c8f17
add esp, 4
cmp byte [esp + 0xf], 0
je 0x41b125
push 0x502654
push 0x47c
push edi
call fcn.004845b0
mov ecx, eax
mov eax, str..MainWndUIDTLWallPaperMainWnd.cpp
call fcn.00484890
add esp, 0xc
cmp byte [ebp + 0x10], 0
je 0x41b26d
mov eax, dword [ebp + 8]
mov edi, 2
call fcn.0041a6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 0xc], 0
je 0x41b134
mov byte [0x533050], 0
jmp 0x41b141
cmp byte [0x533050], 0
jne 0x41b25b
push 0
push 0
push 1
call fcn.00418840
add esp, 0xc
call fcn.00495110
mov esi, eax
mov eax, dword [esi + 0x44]
test eax, eax
je 0x41b16c
lea ecx, [esi + 0x3c]
push ecx
lea edi, [eax + 0x12c]
call fcn.00483580
mov eax, dword [esi + 0x48]
test eax, eax
je 0x41b17b
push 0
push eax
call fcn.00410a60
mov dword [esi + 0x44], 0
call fcn.0048d140
mov esi, eax
mov eax, dword [esi + 0x64]
test eax, eax
je 0x41b19f
lea ecx, [esi + 0x3c]
push ecx
lea edi, [eax + 0x12c]
call fcn.00483580
mov eax, dword [esi + 0x68]
test eax, eax
je 0x41b1ae
push 0
push eax
call fcn.00410a60
mov dword [esi + 0x64], 0
call fcn.0045d0c0
call fcn.004721b0
push 1
call fcn.00472240
add esp, 4
call fcn.00471f50
mov byte [0x533050], 1
call fcn.00471e50
call fcn.004752b0
call fcn.00472000
call fcn.00474a70
call fcn.00475df0
push 0
push 0
push 2
call fcn.00418840
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x40]
add esp, 0xc
test eax, eax
je 0x41b21e
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x41b21e
cmp byte [eax + 0xde], 0
mov byte [esp + 0x10], 1
jne 0x41b223
mov byte [esp + 0x10], 0
mov esi, dword [ebx + 0x44]
test esi, esi
je 0x41b242
push 0xf4241
call fcn.00427d80
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 0x44]
push ecx
push edx
call fcn.00410a60
mov eax, dword [ebx + 4]
test eax, eax
je 0x41b25e
push 0x3e8
push 0x2712
push ebx
call fcn.004131f0
jmp 0x41b25e
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x41b26d
xor edi, edi
mov eax, ebx
call fcn.0041a6f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b510
Capabilities:
Lock the desktop
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x101c
call fcn.004dccb0
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadCursorW]
push esi
push edi
push 0x7f02
push 0
mov esi, ecx
mov edi, edx
mov byte [esp + 0x17], 0
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push esi
call fcn.0041b770
mov al, byte [esi + 0x120]
test al, al
jne 0x41b575
push 0x7f00
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x41b6d8
push 0x100c
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004d1df0
add esp, 0xc
push edi
lea edx, [esp + 0x20]
push 0x800
push edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 2
call fcn.004ca220
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b5b1
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub eax, edx
sar eax, 1
mov dword [esp + 0x18], eax
cmp byte [esi + 0x110], cl
je 0x41b613
mov eax, dword [esi + 0x114]
push 0
push 0
push 0
push 6
push eax
call ebx
mov edi, eax
test edi, edi
je 0x41b613
push 0x100c
push 0
push edi
call fcn.004d1df0
add esp, 0xc
push 0x100c
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.004d0a80
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esi + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 0x11c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41b661
push 0x7f00
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x41b6d8
cmp byte [esi + 0x110], 0
je 0x41b6af
mov ecx, dword [esi + 0x114]
push 0
push 0
push 0
push 6
push ecx
call ebx
mov edi, eax
test edi, edi
je 0x41b6af
push 0x100c
lea edx, [esp + 0x14]
push 0
push edx
call fcn.004d1df0
add esp, 0xc
push 0x100c
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004d0a80
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [esp + 0x14], 1
jne 0x41b6d8
mov eax, dword [esp + 0x10]
sub eax, 1
jne 0x41b6d8
mov byte [esp + 0xf], 1
cmp dword [0x532b2c], 0
je 0x41b6f2
call fcn.004a51b0
mov eax, dword [eax + 4]
test eax, eax
je 0x41b6fe
mov eax, dword [eax + 4]
jmp 0x41b700
mov esi, dword [esi + 4]
test esi, esi
je 0x41b6fe
mov eax, dword [esi + 4]
jmp 0x41b700
xor eax, eax
cmp byte [esp + 0xf], 0
je 0x41b73c
push 1
push 0x502698
push 0x5026a0
push eax
call fcn.00409ca0
add esp, 0x10
cmp eax, 1
jne 0x41b751
call dword [sym.imp.USER32.dll_LockWorkStation]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret
push 0
push 0x502698
push 0x5026c4
push eax
call fcn.00409ca0
add esp, 0x10
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret
Function at 0x41ba20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ee866
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x64c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x664]
mov dword fs:[0], eax
mov eax, dword [esp + 0x674]
push pe_nt_image_headers32
lea ecx, [esp + 0x264]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x6c]
push edx
push pe_nt_image_headers32
lea ecx, [esp + 0x474]
push ecx
push 3
lea edx, [esp + 0x74]
push edx
push eax
call fcn.004ca473
xor ebx, ebx
add esp, 0x24
xor eax, eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x60]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41bab2
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x64]
push ecx
lea esi, [esp + 0x28]
call fcn.00401760
lea eax, [esp + 0x260]
mov dword [esp + 0x66c], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41bae1
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x264]
push edx
lea eax, [esp + 0x28]
call fcn.004088a0
push 1
push 0x502770
lea eax, [esp + 0x28]
call fcn.004088a0
call fcn.00469880
lea esi, [esp + 0x3c]
call fcn.00418970
push 0xd
push 0x502774
mov eax, esi
mov byte [esp + 0x674], 1
call fcn.004088a0
mov edx, dword [esp + 0x24]
mov ebp, 8
cmp dword [esp + 0x38], ebp
jae 0x41bb49
lea edx, [esp + 0x24]
mov eax, edx
mov dword [esp + 0x14], vtable.DtlHelp::DBaseString_wchar_t__char__class_DtlHelp::DAString_.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41bb60
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x24]
call fcn.004189a0
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41bb8d
lea eax, [esp + 0x40]
push 0x502790
push eax
call fcn.004c97af
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x41bbb8
mov eax, dword [esp + 0x1c]
push esi
push eax
push 1
push edi
call fcn.004ca3f1
push esi
call fcn.004c9c66
add esp, 0x14
cmp edi, ebx
je 0x41bbc5
push edi
call fcn.004ca215
add esp, 4
cmp dword [esp + 0x54], ebp
jb 0x41bbd8
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004c8f17
add esp, 4
xor edx, edx
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], dx
cmp dword [esp + 0x38], ebp
jb 0x41bbfe
mov eax, dword [esp + 0x24]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x65c
ret 4
Function at 0x41c1e0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0x2f
jne 0x41c1f1
call fcn.0048d140
call fcn.0048d950
test esi, esi
je 0x41c225
push 0x14
push str.ConvertibleSlateMode
push esi
call fcn.004c94d5
add esp, 0xc
test eax, eax
jne 0x41c225
push 0x2003
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
sete al
movzx ecx, al
mov dword [esp + 4], ecx
jmp fcn.0041a5f0
ret 4
Function at 0x41e3f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ee828
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
xor eax, eax
push edi
mov word [esp + 0x1c], ax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
call fcn.00401850
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
jmp 0x41e450
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41e450
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x18]
call fcn.004088a0
push 0xffffffffffffffff
push edi
xor edx, edx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], dx
call fcn.00401850
cmp dword [esp + 0x28], 8
jb 0x41e499
mov eax, dword [esp + 0x14]
push eax
call fcn.004c8f17
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret

Function at 0x41e740
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp + 4]
push esi
push edi
test eax, eax
je 0x41e757
mov esi, dword [eax + 4]
jmp 0x41e759
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov edi, eax
call ebx
mov ecx, dword [esp + 0x10]
add ecx, 0x17c
cmp ecx, edi
jle 0x41e78c
add edi, 0xfffffe84
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x14]
add edx, 0xfa
cmp edx, eax
jle 0x41e7a3
add eax, 0xffffff06
mov dword [esp + 0x14], eax
test esi, esi
je 0x41e7e5
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e7e5
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 5
push 0
push 0
push eax
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 9
push esi
call edi
push 5
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push 0xfa
push 0x17c
push edx
push eax
push 0x90c00000
push str.HideDesktopIcon
push 0x80088
push ebp
mov ecx, str.HideDesktopIconWnd
call fcn.00488ef0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4243b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ee7ec
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov edi, 8
cmp dword [esi + 0xac], edi
jb 0x424404
mov eax, dword [esi + 0x98]
jmp 0x42440a
lea eax, [esi + 0x98]
push eax
lea eax, [esp + 0x78]
push 0x104
push eax
call fcn.004ca220
add esp, 0xc
push 0x50403c
xor ecx, ecx
push 0x504050
mov word [esp + 0x82], cx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
cmp eax, ebx
je 0x4244c3
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x80]
push ecx
call eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
je 0x424596
xor edx, edx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], dx
mov dword [esp + 0x290], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00424220
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x64]
mov byte [esp + 0x29c], 1
call fcn.00401850
mov byte [esp + 0x290], bl
cmp dword [esp + 0x40], 8
jmp 0x424548
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp eax, ebx
je 0x424596
xor eax, eax
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], ax
mov dword [esp + 0x290], 2
mov ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x18]
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00424220
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x64]
mov byte [esp + 0x29c], 3
call fcn.00401850
mov byte [esp + 0x290], 2
cmp dword [esp + 0x40], edi
jb 0x424557
mov edx, dword [esp + 0x2c]
push edx
call fcn.004c8f17
add esp, 4
mov edi, dword [esi + 0xb4]
cmp edi, ebx
je 0x424582
cmp dword [esp + 0x70], 8
mov edx, dword [esp + 0x5c]
jae 0x424570
lea edx, [esp + 0x5c]
call fcn.00402580
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
cmp dword [esp + 0x70], 8
jb 0x424596
mov eax, dword [esp + 0x5c]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret