joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x423070
xor eax, eax
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x423089
mov edx, esi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x423080
sub edx, ecx
mov eax, dword [ebp + 8]
not eax
cmp edx, 8
jb 0x423147
push edi
mov edi, edx
shr edi, 3
nop dword [eax]
movzx ecx, byte [esi]
sub edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
movzx ecx, byte [esi + 7]
add esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
sub edi, 1
jne 0x4230a0
pop edi
test edx, edx
je 0x42316a
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4a0910]
sub edx, 1
jne 0x423150
not eax
pop esi
pop ebp
ret

Function at 0x4241d0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
lea edi, [edx + eax]
mov dword [ebp - 4], edi
cmp eax, 0x10
jb 0x424276
mov esi, dword [ebp + 0x10]
lea eax, [edi - 0x10]
push ebx
mov dword [ebp + 8], eax
lea ebx, [esi + 0x24234428]
lea edi, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
nop word [eax + eax]
imul ecx, dword [edx], 0x7a143589
sub ebx, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub edi, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp + 8]
jbe 0x424210
ror eax, 0xe
rol esi, 0xc
rol edi, 7
add eax, esi
add eax, edi
rol ebx, 1
mov edi, dword [ebp - 4]
add eax, ebx
pop ebx
jmp 0x42427e
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea esi, [edx + 4]
cmp esi, edi
ja 0x4242aa
nop dword [eax + eax]
imul ecx, dword [edx], 0x3d4d51c3
mov edx, esi
lea esi, [edx + 4]
sub eax, ecx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x424290
cmp edx, edi
jae 0x4242c9
nop
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x4242b0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x431270
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x68], esi
push edi
mov edi, dword [ebp + 8]
cmp ebx, 0xf
jne 0x4312ae
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
movups xmm0, xmmword [ebp - 0x4c]
mov esi, eax
mov dword [ebp - 0x68], esi
movups xmmword [ebp - 0x64], xmm0
jmp 0x4312f1
cmp ebx, 0x85
jne 0x4312d5
push 0x81
push esi
push edi
call dword [sym.imp.USER32.dll_GetDCEx]
mov esi, eax
lea eax, [ebp - 0x64]
push eax
push edi
mov dword [ebp - 0x68], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4312f1
cmp ebx, 0x14
je 0x4312e6
push edi
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x64]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push esi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
movups xmm0, xmmword [ebp - 0x64]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14]
push 2
push eax
push edi
movups xmmword [ebp - 0x14], xmm0
call esi
push eax
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x14]
push eax
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov esi, dword [ebp - 0x6c]
push 0
push esi
push 0x14
push edi
call fcn.00475dd0
cmp ebx, 0x85
jne 0x431367
mov eax, 2
jmp 0x431376
xor eax, eax
cmp ebx, 0x14
sete al
lea eax, [eax*4 + 4]
push eax
push esi
push 0x318
push edi
call fcn.00475dd0
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x60]
push 0xcc0020
push 0
push 0
push esi
mov esi, dword [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x64]
push ecx
push 0
push 0
push esi
mov dword [ebp - 0x70], eax
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x74]
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp ebx, 0xf
jne 0x4313ec
lea eax, [ebp - 0x54]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
cmp ebx, 0x14
je 0x4313f9
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x70]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x435280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x435332
mov edx, dword [esi + 0x60]
test edx, edx
je 0x435332
test byte [esi + 0x8c], 1
je 0x4352ea
mov ecx, dword [0x4edef8]
test ecx, ecx
je 0x4352d0
mov eax, dword [ecx + 4]
and eax, 0x900000
cmp eax, 0x900000
jne 0x4352d0
push 0
push dword [ecx + 0x1e00]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4352da
push esi
push edi
call fcn.004345b0
add esp, 8
push 0
push dword [esi + 0x78]
call fcn.0043f520
mov edx, dword [esi + 0x60]
add esp, 8
mov ecx, dword [esi + 4]
xorps xmm0, xmm0
mov eax, dword [esi + 0x5c]
mov edx, dword [ecx + edx*4]
mov eax, dword [ecx + eax*4]
movq qword [eax + 0x78], xmm0
movq qword [edx + 0x78], xmm0
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 4]
mov eax, dword [eax + ecx*4]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 2
push dword [esi + 0x78]
call fcn.0043f520
add esp, 8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi + 0x64], 0
pop edi
pop esi
pop ebp
ret
Function at 0x435c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], edi
test ebx, ebx
je 0x435cb4
mov esi, dword [0x4edef8]
mov dword [ebp - 0x70], esi
test esi, esi
je 0x435cb4
cmp ebx, 0x10000
jge 0x435cc7
mov edi, dword [ebp + 0x10]
mov eax, ebx
shl eax, 6
xor edx, edx
xor eax, edi
mov dword [ebp - 0x6c], 0x3f1
shl eax, 3
xor eax, ecx
xor eax, dword [ebp + 0x14]
div dword [ebp - 0x6c]
mov esi, dword [esi + edx*4 + 0xe1c]
test esi, esi
je 0x435cb4
cmp dword [esi], ecx
jne 0x435cad
cmp dword [esi + 8], edi
jne 0x435cad
cmp dword [esi + 4], ebx
jne 0x435cad
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x10], eax
je 0x435da6
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x435c93
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push str._08X_s_d
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push ebx
push ecx
push 0x25d
push str.D:MyProjectsProPilotLibLibMain.c
push str._08X_s_d
push 0x64
push eax
call fcn.004236c0
lea esi, [ebp - 0x68]
add esp, 0x24
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x435cf4
sub esi, ecx
mov eax, esi
and eax, 3
je 0x435d21
push eax
mov eax, esi
lea ecx, [ebp - 0x68]
and eax, 0xfc
add eax, ecx
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00480c20
mov edi, dword [ebp - 0x6c]
add esp, 0xc
sar esi, 2
test esi, esi
je 0x435d31
xor edi, dword [ebp + esi*4 - 0x6c]
dec esi
test esi, esi
jne 0x435d28
mov esi, dword [ebp - 0x70]
mov eax, 0x3ce4585
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3f1
sub edi, eax
mov esi, dword [esi + edi*4 + 0xe1c]
test esi, esi
je 0x435cb4
mov edi, dword [ebp - 0x74]
cmp dword [esi], edi
jne 0x435d8c
mov eax, dword [ebp + 0x10]
cmp dword [esi + 8], eax
jne 0x435d8c
mov eax, dword [ebp + 0x14]
cmp dword [esi + 0x10], eax
jne 0x435d8c
mov eax, dword [esi + 4]
cmp eax, 0x10000
jl 0x435d8c
push ebx
push eax
call fcn.00486acf
add esp, 8
test eax, eax
je 0x435da6
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x435d60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x435dc0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push ecx
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x14]
test ebx, ebx
push 0
cmove ebx, eax
mov dword [ebp - 0x40], eax
test esi, esi
mov dword [ebp - 0x24], ebx
cmove esi, ebx
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov ebx, eax
mov eax, dword [0x4edef8]
test eax, eax
je 0x435e3d
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x435e3d
push 0
push eax
push ebx
call edi
push ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call esi
push ebx
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
mov eax, dword [0x4edef8]
mov dword [ebp - 0x2c], esi
test eax, eax
je 0x435e74
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x435e74
push 0
push eax
push esi
call edi
push ebx
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call edi
push dword [ebp - 0x38]
push esi
call edi
mov esi, eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp + 0xc]
push 0xcc0020
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x2c]
push esi
call edi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x435ed8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
test eax, eax
je 0x435eeb
push 0
push eax
push esi
call edi
test esi, esi
je 0x435ef6
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x435f03
push 0
push eax
push ebx
call edi
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x4364d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
test esi, esi
jne 0x436506
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4edef8]
test ecx, ecx
jne 0x436528
push eax
push esi
call dword [sym.imp.USER32.dll_GetPropA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push edi
push 0x537
push str.D:MyProjectsProPilotLibLibMain.c
lea eax, [ecx + 0xd84]
push 0
push eax
call fcn.0041fd60
mov edi, dword [0x4edefc]
add esp, 0x10
test edi, edi
je 0x43657d
mov eax, 0x3ce4585
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3f1
sub ecx, eax
mov edi, dword [edi + ecx*4 + 8]
test edi, edi
je 0x43657d
cmp dword [edi], esi
je 0x4365a3
mov edi, dword [edi + 0x34]
test edi, edi
jne 0x436572
mov eax, dword [0x4edef8]
add eax, 0xd84
push eax
call fcn.00421a10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4365b0
sub esi, edx
mov eax, esi
and eax, 3
je 0x4365dd
push eax
mov eax, esi
and eax, 0xfc
add eax, ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00480c20
mov ebx, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
sar esi, 2
test esi, esi
je 0x4365ed
xor ebx, dword [ecx + esi*4 - 4]
dec esi
test esi, esi
jne 0x4365e4
mov eax, 0xba2e8ba3
mul ebx
shr edx, 3
imul eax, edx, 0xb
sub ebx, eax
mov esi, dword [edi + ebx*4 + 8]
test esi, esi
je 0x43657d
mov eax, ecx
mov ecx, dword [esi]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x436630
test dl, dl
je 0x43662c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x436630
add ecx, 2
add eax, 2
test dl, dl
jne 0x436610
xor eax, eax
jmp 0x436635
sbb eax, eax
or eax, 1
test eax, eax
je 0x436648
mov esi, dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x436608
jmp 0x43657d
mov ecx, dword [0x4edef8]
mov esi, dword [esi + 4]
add ecx, 0xd84
push ecx
call fcn.00421a10
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x4366f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
test edi, edi
je 0x436798
mov al, byte [edi]
test al, al
je 0x436798
cmp al, 0x23
je 0x436798
mov esi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x436725
sub esi, edx
mov eax, esi
and eax, 3
je 0x43674f
push eax
mov eax, esi
and eax, 0xfc
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00480c20
mov ecx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x43675f
xor ecx, dword [edi + esi*4 - 4]
dec esi
test esi, esi
jg 0x436756
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov esi, dword [ecx*4 + 0x5548a4]
test esi, esi
je 0x436798
push dword [esi + 4]
push edi
call fcn.0048df36
add esp, 8
test eax, eax
je 0x4367ab
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x436781
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi + 8]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
movups xmmword [ebx], xmm0
xor ecx, ebp
movq xmm0, qword [esi + 0x18]
pop esi
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x437160
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ADVAPI32.DLL
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x43718f
push str.ADVAPI32.DLL
call ebx
test eax, eax
je 0x43719c
push str.SystemFunction036
push eax
call esi
mov dword [0x4dc5f4], eax
push str.Msimg32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x4371b8
push str.Msimg32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x4371d4
push str.AlphaBlend
push eax
call esi
push str.GradientFill
push dword [ebp - 4]
mov dword [0x4edf0c], eax
call esi
mov dword [0x4edf08], eax
push 0x4a1728
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x4371f0
push 0x4a1728
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x43720c
push 0x4a1734
push eax
call esi
push str.UpdateLayeredWindow
push dword [ebp - 4]
mov dword [0x4edf10], eax
call esi
mov dword [0x4edf14], eax
push str.UxTheme.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437228
push str.UxTheme.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x437244
push str.SetThemeAppProperties
push eax
call esi
push str.SetWindowTheme
push dword [ebp - 4]
mov dword [0x4edf18], eax
call esi
mov dword [0x4edf1c], eax
push str.Wtsapi32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437260
push str.Wtsapi32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x43727c
push str.WTSQuerySessionInformationA
push eax
call esi
push str.WTSFreeMemory
push dword [ebp - 4]
mov dword [0x4edf20], eax
call esi
mov dword [0x4edf24], eax
push str.Kernel32.dll
call edi
mov edi, eax
test edi, edi
jne 0x437296
push str.Kernel32.dll
call ebx
mov edi, eax
test edi, edi
je 0x4372b0
push str.WTSGetActiveConsoleSessionId
push edi
call esi
push str.ProcessIdToSessionId
push edi
mov dword [0x4edf28], eax
call esi
mov dword [0x4edf2c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439020
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0xc
test edx, edx
je 0x4391ce
mov eax, dword [0x4edef8]
push esi
test eax, eax
je 0x43907d
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x43907d
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x439059
mov dword [0x4edefc], edx
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
test ecx, 0x40000000
je 0x43907d
mov eax, dword [eax + 0x1f2c]
test eax, eax
je 0x43907d
push 0x4a1824
push edx
call eax
mov esi, eax
mov dword [ebp - 8], esi
jmp 0x43908d
push 0x4a1824
push edx
call fcn.004364d0
mov esi, eax
mov dword [ebp - 8], eax
add esp, 8
test esi, esi
je 0x4391cd
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4391cd
mov dword [ebp - 0xc], 0
jle 0x4391ab
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0xf4]
test edi, edi
js 0x4390da
cmp dword [ecx + eax + 0x3c], edi
jne 0x439190
lea edi, [ecx + eax]
test edi, edi
je 0x43914e
xor esi, esi
mov ecx, dword [edi + 8]
mov eax, dword [esi + ecx]
test eax, eax
je 0x439153
test edx, edx
js 0x4390ff
push 0
push edx
push 0x111
push eax
call ebx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x40]
mov eax, dword [esi + eax]
test eax, eax
je 0x43912d
cmp eax, dword [ebp + 8]
je 0x43912d
push 0
push dword [esi + ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x40]
push dword [eax + esi]
mov eax, dword [edi + 8]
push dword [eax + esi]
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x439138
push 0
push 0
push 0x10
push dword [esi + ecx]
call ebx
mov eax, dword [edi + 0xc]
push dword [eax + esi]
call fcn.0048690c
mov edx, dword [ebp + 0x10]
add esp, 4
add esi, 4
jmp 0x4390e3
mov ecx, dword [edi + 8]
jmp 0x439156
mov esi, dword [ebp - 8]
push ecx
call fcn.0048690c
push dword [edi + 0xc]
call fcn.0048690c
push dword [edi + 0x40]
call fcn.0048690c
add esp, 0xc
push 0
push 0
push 0x1302
push dword [edi]
call ebx
test eax, eax
je 0x439187
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 0x48
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp eax, dword [esi + 0xf0]
jl 0x4390c6
pop edi
pop ebx
push dword [esi + 0xf4]
call fcn.0048690c
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf0], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e3f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x43e4fb
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
mov dword [ebp - 0x134], eax
cmp eax, 0xf
jle 0x43e4a7
push 0xa
lea eax, [ebp - 0x130]
push str.pcanywhere
push eax
call fcn.00486932
add esp, 0xc
test eax, eax
jne 0x43e4a1
lea eax, [ebp - 0x130]
push 0x4a1d18
push eax
call fcn.0048e3d0
add esp, 8
test eax, eax
je 0x43e4ec
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x134]
cmp eax, 6
jne 0x43e4ec
lea eax, [ebp - 0x130]
push str.WinVNC
push eax
call fcn.0048e032
add esp, 8
test eax, eax
jne 0x43e4ec
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x130]
push str.WinVNC_desktop_sink
push eax
call fcn.0048e032
add esp, 8
test eax, eax
je 0x43e524
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x43e442
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4edf2c]
test ecx, ecx
je 0x43e55e
lea edx, [ebp - 0x138]
push edx
push eax
call ecx
test eax, eax
je 0x43e55e
mov eax, dword [0x4edf28]
test eax, eax
jne 0x43e53a
jmp 0x43e53c
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
call eax
cmp dword [ebp - 0x138], eax
je 0x43e5dd
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4edf20]
test eax, eax
je 0x43e5c6
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x13c]
push ecx
push 4
push 0xffffffffffffffff
push 0
call eax
test eax, eax
je 0x43e5c6
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x43e5dd
mov ecx, dword [0x4edf28]
test ecx, ecx
je 0x43e59f
call ecx
mov ecx, eax
mov eax, dword [ebp - 0x13c]
cmp dword [eax], ecx
jne 0x43e5cc
mov ecx, dword [0x4edf24]
test ecx, ecx
je 0x43e5b0
push eax
call ecx
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x43e5dd
mov ecx, dword [0x4edf24]
test ecx, ecx
je 0x43e5dd
push eax
call ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret