joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445b80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x47c170]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
mov ebx, dword [ebp]
push esi
mov esi, dword [ebp + 0x3d0]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
lea edi, [esi + 0x15c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x445c0f
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.00415e20
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x445c4a
push str.Received_too_short_packet
push ebx
call fcn.0043b920
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004157fe
add esp, 0x88
ret
mov eax, edi
call fcn.00444a60
movzx eax, ax
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x445c63
jmp dword [eax*4 + 0x445d50]
cmp edx, 4
jle case.0x445c63.4
mov eax, edi
call fcn.00444a70
movzx ecx, word [esi + 0x40]
add ecx, 1
cmp cx, ax
jne case.0x445c63.4
add edx, 0xfffffffc
push edx
mov edx, dword [edi]
add edx, 4
push edx
push 1
push ebp
call fcn.0043bc00
mov edi, eax
add esp, 0x10
test edi, edi
je 0x445cb8
mov ecx, 5
mov eax, esi
call fcn.00445b00
mov eax, edi
jmp 0x445c31
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0x38], eax
mov ecx, dword [ebx + 0x38]
adc dword [ebx + 0x3c], edx
mov eax, dword [ebx + 0x3c]
push eax
push ecx
push ebx
call fcn.00452730
jmp 0x445d24
mov eax, edi
call fcn.00444a70
movzx edx, ax
mov eax, dword [edi]
add eax, 4
push eax
push 0x46e078
push ebx
mov dword [esi + 8], edx
call fcn.0043b890
jmp 0x445d24
mov ecx, dword [edi]
add edx, 0xfffffffe
push edx
add ecx, 2
push ecx
push esi
call fcn.00444b10
add esp, 0xc
test eax, eax
je case.0x445c63.4
jmp 0x445c31
push str.Internal_error:_Unexpected_packet
push 0x46a71c
push ebx
call fcn.0043b920
add esp, 0xc
push ebp
call fcn.004527f0
add esp, 4
test eax, eax
je 0x445c2f
mov ecx, 5
mov eax, esi
call fcn.00445b00
mov eax, 0x2a
jmp 0x445c31

Function at 0x447ac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x447b04
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0043b920
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.004479b0
add esp, 4
pop esi
pop ecx
ret
Function at 0x449150
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x47c170]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
push edi
mov edi, dword [esi]
push 1
push 0
push edi
or ebp, 0xffffffff
mov dword [esp + 0x18], 0x10
call fcn.0043bd60
add esp, 0xc
test eax, eax
jl 0x4491b9
mov ecx, 0x3e8
cmp eax, ecx
jge 0x449190
mov ecx, eax
push ecx
push 0xffffffffffffffff
push ebx
call fcn.004511b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x449254
test eax, eax
jne 0x4491de
push 1
push eax
push edi
call fcn.0043bd60
add esp, 0xc
test eax, eax
jge 0x449185
push str.Timeout_while_waiting_for_server_connect
push edi
call fcn.0043b920
add esp, 8
pop edi
pop ebp
mov eax, 0x1c
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004157fe
add esp, 0x18
ret
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x44920e
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov ebp, eax
push ebx
push esi
call fcn.0043c570
add esp, 8
cmp ebp, 0xffffffff
jne 0x449224
push str.Error_accept__ing_server_connect
jmp 0x449259
push str.Connection_accepted_from_server_n
push edi
call fcn.0043b890
push 1
push ebp
mov dword [esi + 0x134], ebp
call fcn.00454e30
add esp, 0x10
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004157fe
add esp, 0x18
ret
push str.Error_while_waiting_for_server_connect
push edi
call fcn.0043b920
mov ecx, dword [esp + 0x28]
add esp, 8
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x1e
call fcn.004157fe
add esp, 0x18
ret
Function at 0x4511b0
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
sub esp, 0x31c
push ebx
mov ebx, dword [esp + 0x324]
push ebp
mov ebp, dword [esp + 0x32c]
push esi
xor esi, esi
cmp ebx, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
jne 0x4511f4
cmp ebp, ebx
jne 0x4511f4
mov eax, dword [esp + 0x334]
push eax
call fcn.00451180
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
push edi
mov edi, dword [esp + 0x338]
cmp edi, esi
jle 0x45120f
mov esi, edi
call fcn.004405b0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x124], eax
je 0x451243
mov ecx, 1
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ecx
mov edx, ebx
cmp ebp, 0xffffffff
mov dword [esp + 0x228], eax
je 0x45128a
test ecx, ecx
mov dword [esp + 0x22c], ebp
mov dword [esp + 0x228], 1
jbe 0x451272
cmp dword [esp + eax*4 + 0x24], ebp
je 0x451272
add eax, 1
cmp eax, ecx
jb 0x451265
cmp eax, ecx
jne 0x451284
cmp ecx, 0x40
jae 0x451284
mov dword [esp + eax*4 + 0x24], ebp
add dword [esp + 0x20], 1
cmp ebp, edx
jbe 0x45128a
mov edx, ebp
xor ebx, ebx
test edi, edi
setl bl
lea ecx, [esp + 0x18]
lea ebp, [edx + 1]
sub ebx, 1
and ebx, ecx
lea ecx, [ecx]
xor eax, eax
cmp edi, eax
jle 0x4512d1
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
imul eax, eax, 0x3e8
mov edx, esi
sub edx, eax
imul edx, edx, 0x3e8
mov dword [esp + 0x1c], edx
jmp 0x4512db
jne 0x4512db
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x130]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x451345
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x45130e
cmp eax, 0x2714
jne 0x451349
test edi, edi
jle 0x4512a0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004405b0
push edx
push eax
call fcn.004405e0
mov esi, edi
sub esi, eax
add esp, 0x10
test esi, esi
jg 0x4512a0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
test eax, eax
jge 0x451357
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x31c
ret
jne 0x451366
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x31c
ret
mov edi, dword [esp + 0x330]
xor esi, esi
cmp edi, 0xffffffff
je 0x45139d
lea edx, [esp + 0x124]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x45138b
mov esi, 1
lea eax, [esp + 0x20]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x45139d
or esi, 4
mov edi, dword [esp + 0x334]
cmp edi, 0xffffffff
je 0x4513d0
lea ecx, [esp + 0x228]
push ecx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4513be
or esi, 2
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4513d0
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x452f20
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x452f2f
jmp dword [ecx*4 + 0x452f84]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x453110
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x47c170]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0042d836
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x453175
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x453175
lea edx, [esp]
push edx
call dword [0x47d52c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004157fe
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004157fe
add esp, 0x108
ret
jmp 0x453110

Function at 0x453190
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x47c170]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0042d836
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x453175
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp byte [esp], 0
je 0x453175
lea edx, [esp]
push edx
call dword [0x47d52c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004157fe
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.004157fe
add esp, 0x108
ret
jmp 0x453110

Function at 0x455cc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x45c100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [0x47ec04], 0
jne 0x45c117
jmp 0x45c2ad
push 0x473c44
mov ecx, dword [ebp - 0x28]
add ecx, 8
call fcn.00401200
push eax
mov eax, dword [0x47d628]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x45c142
jmp 0x45c2ad
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [0x47d628]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [0x47d628]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00415e20
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0040f0b0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45c1dd
jmp 0x45c2ad
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
lea edx, [ebp + 8]
push edx
mov ecx, 0x47ecc8
call fcn.0040f180
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
push 0
mov edx, dword [0x47d628]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0
push bind
push 0x80c80000
push 0
mov ecx, dword [str.PerryShadowWnd]
push ecx
push 0x80020
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x24], eax
push 0xfffffffffffffff0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x10000000
jne 0x45c255
mov edx, dword [ebp - 0x28]
mov byte [edx + 0x2c], 1
jmp 0x45c28a
mov eax, dword [ebp - 0xc]
and eax, 0x21000000
je 0x45c268
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 0x2c], 5
jmp 0x45c28a
mov edx, dword [ebp - 0x28]
mov byte [edx + 0x2c], 7
push 8
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x28]
call fcn.0045bb60
push 0xfffffffffffffffc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x28], eax
push 0x45be50
push 0xfffffffffffffffc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esp, ebp
pop ebp
ret 4
Function at 0x45c340
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x45c3b0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x473ccc
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret

Function at 0x45c420
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x473cb0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret
Function at 0x45c570
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
mov eax, dword [0x47c170]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0xa10], 0
push 0x206
push 0
lea eax, [ebp - 0xa0e]
push eax
call fcn.00415da0
add esp, 0xc
push 0x473d04
lea ecx, [ebp - 0xa10]
push ecx
call fcn.0041620d
add esp, 8
mov dword [ebp - 0xc24], 0x1f4
mov word [ebp - 0x5f8], 0
push 0x3e6
push 0
lea edx, [ebp - 0x5f6]
push edx
call fcn.00415da0
add esp, 0xc
lea eax, [ebp - 0xa10]
push eax
push 0x473d14
lea ecx, [ebp - 0xc18]
push ecx
call fcn.00416420
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00415da0
add esp, 0xc
mov word [ebp - 0x808], 0
push 0x206
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.00415da0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x808]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x808]
push edx
call fcn.00401000
add esp, 8
mov word [eax], 0
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c678
jmp 0x45c800
lea ecx, [ebp - 0x808]
push ecx
call fcn.004155ac
add esp, 4
lea edx, [ebp + eax*2 - 0x806]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0041620d
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xa10]
push edx
push 0x473d2c
lea eax, [ebp - 0xc18]
push eax
call fcn.00416420
add esp, 0x10
lea ecx, [ebp + 0xc]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0xc1c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc24]
sub ecx, 1
push ecx
lea edx, [ebp - 0x5f8]
push edx
call fcn.0041afe5
add esp, 0x10
mov eax, dword [ebp - 0xc24]
mov word [ebp + eax*2 - 0x5fa], 0
mov dword [ebp - 0xc20], 0
lea ecx, [ebp - 0xc18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c722
mov dword [ebp - 0xc20], 1
push 0x473d40
lea edx, [ebp - 0xc18]
push edx
call fcn.0041b0c6
add esp, 8
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
je 0x45c800
cmp dword [ebp - 0xc20], 0
jne 0x45c775
mov word [ebp - 0xc30], 0xfeff
mov eax, dword [ebp - 0x5fc]
push eax
push 2
push 1
lea ecx, [ebp - 0xc30]
push ecx
call fcn.00415c2e
add esp, 0x10
lea edx, [ebp - 0x5f8]
push edx
call fcn.004155ac
add esp, 4
mov dword [ebp - 0xc28], eax
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0xc28]
shl ecx, 1
push ecx
push 1
lea edx, [ebp - 0x5f8]
push edx
call fcn.00415c2e
add esp, 0x10
mov word [ebp - 0xc2c], 0xd
mov eax, dword [ebp - 0x5fc]
push eax
push 2
push 1
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00415c2e
add esp, 0x10
mov word [ebp - 0xc2c], 0xa
mov edx, dword [ebp - 0x5fc]
push edx
push 2
push 1
lea eax, [ebp - 0xc2c]
push eax
call fcn.00415c2e
add esp, 0x10
mov ecx, dword [ebp - 0x5fc]
push ecx
call fcn.00415d22
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004157fe
mov esp, ebp
pop ebp
ret
Function at 0x45c8a0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [0x47ebd8], 0
push 0
push 0x45c490
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x473c5c
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x3c], edx
cmp dword [0x47ebd8], 1
jle 0x45c96d
mov dword [ebp - 0x40], 0
jmp 0x45c940
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [0x47ebd8]
jge 0x45c96d
mov edx, dword [ebp - 0x40]
shl edx, 4
mov eax, dword [edx + 0x47e8e0]
cmp eax, dword [ebp - 0x3c]
jle 0x45c96b
mov ecx, dword [ebp - 0x40]
shl ecx, 4
mov edx, dword [ecx + 0x47e8e0]
mov dword [ebp - 0x3c], edx
jmp 0x45c937
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret
Function at 0x45cc80
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x47c170]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x440], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
push 9
push 0
push 0x473f88
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45ccdd
xor eax, eax
jmp 0x45ce0c
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.00415da0
add esp, 0xc
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x224], 0
jmp 0x45cd1e
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x45cdff
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45cdfa
mov dword [ebp - 0x230], 0x104
mov word [ebp - 0x438], 0
push 0x206
push 0
lea ecx, [ebp - 0x436]
push ecx
call fcn.00415da0
add esp, 0xc
mov dword [ebp - 0x228], 1
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0x473ff4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
jne 0x45cdf0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x438]
push ecx
call fcn.00402210
add esp, 8
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x45cdf0
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45cd0f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004157fe
mov esp, ebp
pop ebp
ret 4
Function at 0x45d2b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4688ce
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x47c170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x220], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00415da0
add esp, 0xc
push 0
push 0x19
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45d3b3
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x23c]
call fcn.00402250
mov dword [ebp - 4], 0
push 0x474094
lea ecx, [ebp - 0x23c]
call fcn.004011e0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00401200
push eax
mov ecx, dword [ebp - 0x264]
call fcn.0045ce20
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x45d3a1
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.00401180
mov eax, dword [ebp - 0x25c]
jmp 0x45d45b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.00401180
push 0
push 0x10
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45d459
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x258]
call fcn.00402250
mov dword [ebp - 4], 1
push 0x474134
lea ecx, [ebp - 0x258]
call fcn.004011e0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x258]
call fcn.00401200
push eax
mov ecx, dword [ebp - 0x264]
call fcn.0045ce20
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x45d447
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00401180
mov eax, dword [ebp - 0x260]
jmp 0x45d45b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00401180
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004157fe
mov esp, ebp
pop ebp
ret 4

Function at 0x45dc20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4