joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4267cb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [ebp + 0xc]
and dword [edi], 0
mov esi, ecx
call fcn.004264ec
mov dword [ebp - 4], eax
test eax, eax
jne 0x42689a
push eax
call sub.MSVCR90.dll__time64
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x21c]
mov dword [ebp - 8], edx
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
pop ecx
fild qword [ebp - 0xc]
faddp st(1)
fstp qword [ebp - 0xc]
test eax, eax
jg 0x426818
fldz
fstp qword [ebp - 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
push ebx
push dword [eax + 0x110]
call dword [sym.imp.ScCore.dll_public:_char_const____thiscall_ScCore::String::encode_class_ScCore::Encoder_const__const]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ScCore.dll_public:_static_int___cdecl_ScCore::String::getEncodedLength_void_]
mov ebx, eax
mov eax, dword [esi + 4]
push 0
push ebx
push dword [ebp + 0xc]
push dword [eax + 0x114]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x426882
add dword [edi], eax
add dword [ebp + 0xc], eax
sub ebx, eax
test ebx, ebx
jle 0x426884
fldz
fcomp qword [ebp - 0xc]
fnstsw ax
test ah, 0x44
jnp 0x426882
push 0
call sub.MSVCR90.dll__time64
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
fild qword [ebp - 0x14]
pop ecx
fcomp qword [ebp - 0xc]
fnstsw ax
test ah, 5
jnp 0x426836
test ebx, ebx
pop ebx
je 0x42689a
fldz
fcomp qword [ebp - 0xc]
fnstsw ax
test ah, 0x44
jnp 0x42689a
mov dword [ebp - 4], 0x3a
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x4268a3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push edi
mov edi, ecx
mov edx, dword [edi + 4]
mov eax, dword [edx + 8]
cmp dword [eax], 0
je 0x4268b9
xor al, al
jmp 0x426957
call fcn.004264ec
test eax, eax
je 0x4268c9
mov al, 1
jmp 0x426957
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push ebp
push 2
xor ebp, ebp
inc ebp
push ebp
lea eax, [esp + 0x17]
push eax
push dword [edx + 0x114]
call ebx
cmp eax, 0xffffffff
jne 0x42693e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42694b
mov eax, dword [edi + 4]
push esi
mov esi, dword [eax + 0x21c]
test esi, esi
jg 0x426907
push 5
pop esi
imul esi, esi, 0x3e8
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, ebp
cmp ebp, 0x1f4
jge 0x426920
add ebp, ebp
push 2
push 1
lea eax, [esp + 0x1b]
push eax
mov eax, dword [edi + 4]
push dword [eax + 0x114]
call ebx
test esi, esi
jle 0x42693d
cmp eax, 0xffffffff
je 0x42690d
pop esi
test eax, eax
je 0x42694b
cmp eax, 0xffffffff
je 0x42694b
xor al, al
jmp 0x426955
mov ecx, dword [edi + 4]
call fcn.004260f8
mov al, 1
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4269ca
Capabilities:
Resolve dns

Disassembly:
push 0x28
mov eax, 0x4ebbcf
call fcn.00495410
mov edi, ecx
call fcn.004264c9
mov ecx, dword [edi + 4]
add ecx, 8
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::erase_void_]
mov eax, dword [edi + 4]
mov si, word [ebp + 8]
mov word [eax + 0x220], si
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add eax, 0xc
push eax
call dword [sym.imp.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::get_unsigned_short_int_const__]
pop ecx
mov ecx, dword [edi + 4]
mov dword [ecx + 0x110], eax
mov eax, dword [edi + 4]
xor ebx, ebx
cmp dword [eax + 0x110], ebx
jne 0x426a2c
call dword [sym.imp.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getAscii_void_]
mov ecx, dword [edi + 4]
mov dword [ecx + 0x110], eax
push 0x20
lea eax, [ebp - 0x34]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
inc eax
add esp, 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
movzx eax, si
push eax
lea eax, [ebp - 0x10]
push 0x507330
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ScCore.dll_public:_void___cdecl_ScCore::String::print_char_const__]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_char_const____thiscall_ScCore::String::encode_class_ScCore::Encoder_const__const]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x426b2a
mov esi, dword [ebp - 0x14]
jmp 0x426b22
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
cmp eax, 2
je 0x426aa3
cmp eax, 0x17
jne 0x426b1f
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
je 0x426b0c
push dword [esi + 0x10]
push dword [esi + 0x18]
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
je 0x426b0c
push 5
push ebx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
je 0x426b0c
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x218]
mov dword [eax + ecx*4 + 0x118], ebx
mov eax, dword [edi + 4]
inc dword [eax + 0x218]
jmp 0x426b17
test ebx, ebx
je 0x426b17
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp byte [ebp + 0xb], 0
je 0x426b35
xor ebx, ebx
mov esi, dword [esi + 0x1c]
cmp esi, ebx
jne 0x426a93
mov eax, dword [edi + 4]
cmp dword [eax + 0x218], ebx
jne 0x426b3f
push 0x34
pop ebx
mov ecx, edi
call fcn.004264c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, ebx
call fcn.004954af
ret 8
Function at 0x426dd1
Capabilities:
Connect socket

Disassembly:
cmp byte [0x564b94], 0
push esi
mov esi, ecx
jne 0x426de5
push 0x38
pop eax
jmp 0x426e9e
push ebx
call fcn.004264c9
mov ecx, dword [esi + 4]
add ecx, 8
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::erase_void_]
push dword [esp + 0xc]
mov ecx, dword [esi + 4]
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_class_ScCore::String_const__]
mov ecx, dword [esi + 4]
call fcn.0042622c
mov ebx, eax
test ebx, ebx
je 0x426e96
push edi
mov edi, ebx
push 0
push 1
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esi + 4]
mov dword [ecx + 0x114], eax
mov eax, dword [esi + 4]
cmp dword [eax + 0x114], 0xffffffff
jne 0x426e42
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x426e19
mov eax, dword [eax + 0x114]
cmp eax, 0xffffffff
je 0x426e82
push dword [edi + 0x10]
push dword [edi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x426e7a
mov eax, dword [esi + 4]
push dword [eax + 0x114]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 4]
or dword [eax + 0x114], 0xffffffff
jmp 0x426e82
mov ecx, dword [esi + 4]
call fcn.004260b9
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [esi + 4]
cmp dword [eax + 0x114], 0xffffffff
pop edi
jne 0x426e9b
push 0x38
pop eax
jmp 0x426e9d
xor eax, eax
pop ebx
pop esi
ret 4
Function at 0x4283e2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x564bc8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x428426
call ebx
test eax, eax
jns 0x42841c
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x564bc4], eax
mov dword [0x564bc8], 1
mov eax, dword [0x564bc4]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428442
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x428472
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x428468
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x42845d
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x428462
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x428471
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x4284e4
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x564bbc], ebx
jne 0x428530
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push ebx
push 1
push ebx
push ebx
mov edi, 0x564bbc
push edi
call esi
test eax, eax
jne 0x42852e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x80090016
jne 0x42852d
push 8
push 1
push ebx
push ebx
push edi
call esi
test eax, eax
jne 0x42852d
call ebp
mov dword [0x564bbc], ebx
pop ebp
pop edi
pop esi
mov eax, dword [0x564bbc]
pop ebx
ret

Function at 0x428637
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x4ec074
call fcn.00495479
xor esi, esi
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
call fcn.00414a56
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], 1
call fcn.004284e4
cmp eax, esi
jne 0x428678
push 0xffffffffffffffff
push 0x503732
mov ecx, edi
call fcn.00414ac7
jmp 0x4286be
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0xffffffffffffffff
mov ecx, edi
push 0x503732
test eax, eax
je 0x428671
call fcn.00414ac7
movzx eax, byte [ebp + esi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x509238
push eax
call sub.MSVCR90.dll_sprintf
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00414c49
add esp, 0x14
inc esi
cmp esi, 0x10
jb 0x428697
mov eax, edi
call fcn.004954c3
ret
Function at 0x428f96
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x5c
mov eax, 0x4ec18f
call fcn.00495479
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], ebx
call fcn.004284e4
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ebx
call fcn.00414a56
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00414a56
push dword [ebp - 0x3c]
mov eax, 0x50938c
push eax
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], esi
push eax
push dword [ebp - 0x3c]
push edi
call fcn.00414c1c
pop ecx
pop ecx
push eax
call fcn.00414c49
pop ecx
pop ecx
push eax
call fcn.00414c1c
pop ecx
pop ecx
push eax
call fcn.00414c49
pop ecx
pop ecx
push eax
call fcn.00414c1c
pop ecx
pop ecx
cmp dword [ebp - 0x48], ebx
jne 0x42902c
push 0xffffffffffffffff
push 0x503732
mov ecx, edi
call fcn.00414ac7
jmp 0x4290fe
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x429019
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
push ebx
push ecx
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x429019
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], eax
call esi
test eax, eax
je 0x429019
push dword [ebp - 0x44]
call fcn.00414e79
pop ecx
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jne 0x42909c
push 0xffffffffffffffff
push 0x503732
mov ecx, edi
call fcn.00414ac7
jmp 0x4290f0
push ebx
lea ecx, [ebp - 0x44]
push ecx
push eax
push 2
push dword [ebp - 0x40]
call esi
push 0xffffffffffffffff
mov ecx, edi
push 0x503732
test eax, eax
je 0x429095
call fcn.00414ac7
xor esi, esi
cmp dword [ebp - 0x44], ebx
jbe 0x4290f0
cmp esi, 0x28
jae 0x4290f0
mov eax, dword [ebp - 0x3c]
movzx eax, byte [esi + eax]
push eax
lea eax, [ebp - 0x38]
push 0x509238
push eax
call sub.MSVCR90.dll_sprintf
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.00414c49
add esp, 0x14
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x4290c2
cmp dword [ebp - 0x3c], ebx
je 0x4290fe
push dword [ebp - 0x3c]
call fcn.00414e92
pop ecx
cmp dword [ebp - 0x40], ebx
je 0x42910c
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], bl
call fcn.00414a92
mov eax, edi
call fcn.004954c3
ret
Function at 0x429578
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
lea eax, [eax + eax + 2]
push edi
push eax
call fcn.00414e79
pop ecx
push dword [esi + 8]
mov ebx, eax
push ebx
mov ecx, esi
mov dword [ebp - 0xc], ebx
call fcn.00414a42
mov eax, dword [esi + 8]
xor edi, edi
push edi
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
cmp ebx, edi
je 0x4296d9
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push edi
push ebx
call esi
mov dword [0x564ba4], edi
mov dword [0x564ba8], 1
cmp dword [ebp + 8], edi
jne 0x4295e5
mov dword [0x564ba4], ebx
jmp 0x4295f2
push edi
push 0x428805
push eax
call dword [sym.imp.USER32.dll_EnumThreadWindows]
mov eax, dword [0x564ba4]
cmp eax, edi
je 0x4296d9
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffc
push dword [0x564ba4]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, eax
je 0x42969e
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jne 0x42969e
cmp ebx, dword [ebp - 4]
je 0x42969e
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push dword [ebp - 4]
push ebx
call esi
test eax, eax
je 0x42969e
push dword [0x564ba4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42966c
push 1
jmp 0x42966e
push 5
push dword [0x564ba4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x564ba4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push edi
push dword [0x564ba4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
push dword [ebp - 4]
push ebx
call esi
jmp 0x4296d9
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2000
call esi
push 2
lea eax, [ebp - 0x10]
push eax
push edi
mov ebx, 0x2001
push ebx
mov dword [ebp - 0x10], edi
call esi
push dword [0x564ba4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 4]
push eax
push edi
push ebx
call esi
push dword [ebp - 0xc]
call fcn.00414e92
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42fc72
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x42fc84
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x42fdf9
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4ed471
call fcn.00495410
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.0041a4f1
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi], vtable.ScObjects::Thread.0
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call fcn.00414e79
pop ecx
cmp eax, ebx
je 0x42fe3d
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x42fe3f
xor eax, eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x42fbd3
push ebx
push ebx
call sub.MSVCR90.dll__beginthreadex
add esp, 0x18
cmp eax, 0xffffffff
jne 0x42fe6f
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x42fe7b
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 8]
mov dword [ecx + 4], eax
mov eax, esi
call fcn.004954af
ret

Function at 0x435b27
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x4ee507
call fcn.00495410
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x56047c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043005f
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.WinInterAppStream.0
call fcn.00414a56
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.00414c1c
pop ecx
pop ecx
push eax
call fcn.00414c1c
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.MSVCR90.dll_memset
add esp, 0x14
mov eax, edi
xor ecx, ecx
call fcn.00435b16
test al, al
je 0x435b9c
cmp dword [esi + 0x5a], ebx
je 0x435b9c
mov ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
mov byte [ebp - 4], bl
call fcn.00414a92
mov eax, esi
call fcn.004954af
ret 8

Function at 0x435c15
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x4ee532
call fcn.00495410
mov esi, ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00419fe6
lea eax, [esi + 0x30]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00414e04
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00414e97
mov eax, dword [esi + 0x5a]
push ebx
push 0x80
add esi, 0x56
neg eax
push 3
sbb eax, eax
and eax, esi
push eax
push 1
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x10], ebx
cmp edi, 0xffffffff
je 0x435cad
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push ebx
lea edx, [ebp - 0x10]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], ebx
je 0x435cad
mov esi, dword [esi + 8]
mov byte [ebp + 0xb], 1
cmp dword [ebp - 0x10], esi
je 0x435cb0
mov byte [ebp + 0xb], bl
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00414a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041a019
mov al, byte [ebp + 0xb]
call fcn.004954af
ret 8
Function at 0x435e32
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
cmp byte [ebp + 0xc], al
push ebx
setne al
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, ecx
dec eax
and eax, 0x8001
push eax
call edi
mov ecx, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String___thiscall_ScCore::FileSpec::getPath_void_]
mov eax, dword [eax]
add eax, 0xc
push eax
call fcn.004297d2
mov ecx, dword [esi + 8]
mov dword [ecx], eax
lea ecx, [ebp + 0xc]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push ebx
call edi
mov eax, dword [esi + 8]
cmp dword [eax], 0
jne 0x435e92
mov dword [ebp - 4], 0x34
jmp 0x435eef
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ESInitialize
push dword [eax]
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
push str.ESTerminate
push dword [eax]
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
push str.ESFreeMem
push dword [eax]
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
push str.ESGetVersion
push dword [eax]
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
push str.ESClientInterface
push dword [eax]
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 8]
push str.ESMallocMem
push dword [eax]
call edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x439523
Capabilities:
Get graphical window text

Disassembly:
push 0
mov eax, 0x4f808e
call fcn.00495410
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x439599
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x439599
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
push esi
mov edi, eax
push edi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp + 8]
push edi
push eax
call fcn.00440bf1
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_class_ScCore::String_const__]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.004954af
ret 8

Function at 0x4395f3
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 8], 0
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, dword [esi + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x43962e
push 5
push dword [esi + 4]
call edi
test ebx, ebx
je 0x439623
push 5
push ebx
call edi
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x43964a
mov esi, dword [esi + 8]
test esi, esi
je 0x43964a
push 5
jmp 0x439647
push 0
push dword [esi + 4]
call edi
test ebx, ebx
je 0x43963e
push 0
push ebx
jmp 0x439648
mov esi, dword [esi + 8]
test esi, esi
je 0x43964a
push 0
push esi
call edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x4397ec
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x439800
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4

Function at 0x43ce58
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x4ef1f9
call fcn.00495410
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
push dword [esi + 0x54]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
jle 0x43cee6
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494f5c
pop ecx
push edi
push eax
push dword [esi + 0x54]
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.00440bf1
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ScCore.dll_public:_class_ScCore::String____thiscall_ScCore::String::operator_class_ScCore::String_const__]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
push dword [ebp - 0x10]
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, dword [ebp + 8]
call fcn.004954af
ret 4

Function at 0x43e4cf
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
je 0x43e562
lea esi, [edi + 0x48]
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x5c]
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x64]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c0]
test al, al
je 0x43e53c
mov edi, dword [edi + 0x54]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
cmp ebp, edi
je 0x43e576
push ebp
call dword [sym.imp.USER32.dll_SetActiveWindow]
test ebx, ebx
je 0x43e576
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x43e576
push 5
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [edi + 0x54]
mov byte [edi + 0x90], 0
call fcn.0043c896
pop ecx
jmp 0x43e576
push dword [edi + 0x54]
call fcn.0043e100
pop ecx
push 0
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 4