joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422c92
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402510
mov dword [ebp - 4], 0
push 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.0046af6b
mov byte [ebp - 4], 1
push 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0046af6b
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], fcn.0041d5b0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00470581
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00422ed5
test eax, eax
je 0x422d58
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0042301a
test eax, eax
je 0x422d58
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004232d2
test eax, eax
je 0x422d58
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004233b5
test eax, eax
je 0x422d58
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
je 0x422d6f
push 0
push 3
mov ecx, 0x4a0cd8
call fcn.0042e56a
cmp dword [ebp + 0x10], 0
je 0x422da0
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 8], 0
je 0x422d8d
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
call dword [eax]
mov dword [ebp + 0x10], eax
jmp 0x422d9e
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
call dword [eax + 4]
jmp 0x422da0
jmp 0x422d6f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422dba
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [eax], fcn.0041d5b0
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 8], 0
je 0x422e1c
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x422e15
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.004251a0
mov dword [ebp - 0x30], eax
jmp 0x422e1c
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.004251d0
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
call fcn.00402510
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0
je 0x422e80
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.0046b1d5
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x422e77
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
call dword [edx + 4]
mov dword [ebp - 0x34], eax
jmp 0x422e7e
mov dword [ebp - 0x34], 0
jmp 0x422e36
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.0046aff3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.00470444
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.0046b045
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.0046b045
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.00470444
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x422ed5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
mov dword [ebp - 0x420], ecx
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push 0x47e884
push str.Type
mov ecx, dword [ebp - 0x420]
add ecx, 0xc
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x414]
push edx
call fcn.00446520
add esp, 4
test eax, eax
jne 0x422f50
push 1
push 7
mov ecx, 0x4a0cd8
call fcn.0042e56a
xor eax, eax
jmp 0x42300a
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x10]
call fcn.004704b2
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x420]
mov dword [ecx + 4], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x24
movsx eax, byte [edx + str.BARCODE_D]
test eax, eax
je 0x422feb
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x24
add ecx, str.BARCODE_D
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00406f20
and eax, 0xff
test eax, eax
je 0x422fe0
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x24
mov ecx, dword [ebp - 0x420]
mov edx, dword [eax + 0x48f470]
mov dword [ecx + 4], edx
mov dword [ebp - 0x418], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00470444
mov eax, dword [ebp - 0x418]
jmp 0x42300a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x422f7a
mov dword [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00470444
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x42301a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479b99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x414]
push ecx
push 0x47e884
push str.Atoms
mov ecx, dword [ebp - 0x43c]
add ecx, 0xc
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x414]
push edx
call fcn.00446520
add esp, 4
test eax, eax
je 0x42313c
mov dword [ebp - 0x10], 1
push 0x47e8a0
lea eax, [ebp - 0x414]
push eax
call fcn.0044811b
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x42313c
push 0x1c
call fcn.004024f0
mov dword [ebp - 0x430], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x430], 0
je 0x4230e9
mov ecx, dword [ebp - 0x430]
call fcn.00425270
mov dword [ebp - 0x440], eax
jmp 0x4230f3
mov dword [ebp - 0x440], 0
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x424]
push eax
mov ecx, dword [ebp - 0x43c]
add ecx, 0x14
call fcn.00421060
push 0x47e8a0
push 0
call fcn.0044811b
add esp, 8
mov dword [ebp - 0x424], eax
jmp 0x4230ac
push str.Atoms
lea ecx, [ebp - 0x420]
push ecx
call fcn.00446430
add esp, 8
push 0x48f5a4
lea edx, [ebp - 0x420]
push edx
call fcn.00446440
add esp, 8
mov dword [ebp - 0x14], 1
push 0xa
lea eax, [ebp - 0x41a]
push eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
push edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
call fcn.00448641
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x400
lea edx, [ebp - 0x414]
push edx
push 0x47e884
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x43c]
add ecx, 0xc
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x414]
push ecx
call fcn.00446520
add esp, 4
test eax, eax
je 0x42328e
mov dword [ebp - 0x10], 1
push 0x47e8a0
lea edx, [ebp - 0x414]
push edx
call fcn.0044811b
add esp, 8
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x42328e
push 0x1c
call fcn.004024f0
mov dword [ebp - 0x438], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x438], 0
je 0x42323b
mov ecx, dword [ebp - 0x438]
call fcn.00425270
mov dword [ebp - 0x448], eax
jmp 0x423245
mov dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x434], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x428]
push edx
mov ecx, dword [ebp - 0x43c]
add ecx, 0x14
call fcn.00421060
push 0x47e8a0
push 0
call fcn.0044811b
add esp, 8
mov dword [ebp - 0x428], eax
jmp 0x4231fe
lea eax, [ebp - 0x414]
push eax
call fcn.00446520
add esp, 4
test eax, eax
jne 0x42316b
cmp dword [ebp - 0x10], 0
jne 0x4232bd
push 1
push 1
mov ecx, 0x4a0cd8
call fcn.0042e56a
xor eax, eax
jmp 0x4232c2
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4232d2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov dword [ebp - 0x40c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x408]
push ecx
push 0x47e884
push str.IdentifiedBy
mov ecx, dword [ebp - 0x40c]
add ecx, 0xc
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x408]
push edx
call fcn.00446520
add esp, 4
test eax, eax
jne 0x423335
push 1
push 1
mov ecx, 0x4a0cd8
call fcn.0042e56a
xor eax, eax
jmp 0x4233af
push 0x47e8a0
lea eax, [ebp - 0x408]
push eax
call fcn.0044811b
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4233aa
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x40c]
add ecx, 0x14
call fcn.0046b0ed
test eax, eax
je 0x423384
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x40c]
add ecx, 0x30
call fcn.00421060
jmp 0x423396
push 1
push 2
mov ecx, 0x4a0cd8
call fcn.0042e56a
xor eax, eax
jmp 0x4233af
push 0x47e8a0
push 0
call fcn.0044811b
add esp, 8
mov dword [ebp - 4], eax
jmp 0x42334c
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4233b5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479bac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
mov dword [ebp - 0x42c], ecx
lea ecx, [ebp - 0x10]
call fcn.00402510
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x42c]
add ecx, 0x14
call fcn.004251d0
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x4234f3
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x41c]
push edx
mov ecx, dword [ebp - 0x42c]
add ecx, 0x14
call fcn.0046b1d5
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x418]
push ecx
push 0x47e884
lea ecx, [ebp - 0x10]
call fcn.00402550
push eax
mov ecx, dword [ebp - 0x42c]
add ecx, 0xc
call fcn.00402550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x418]
push edx
call fcn.00446520
add esp, 4
test eax, eax
jne 0x42349b
push 1
push 2
mov ecx, 0x4a0cd8
call fcn.0042e56a
mov dword [ebp - 0x420], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00470444
mov eax, dword [ebp - 0x420]
jmp 0x423512
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402550
push eax
mov ecx, dword [ebp - 0x42c]
add ecx, 0x30
call fcn.0046b0ed
push eax
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0xc]
test eax, eax
jne 0x4234ee
mov dword [ebp - 0x424], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00470444
mov eax, dword [ebp - 0x424]
jmp 0x423512
jmp 0x4233fc
mov dword [ebp - 0x428], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00470444
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x42b97a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
mov eax, dword [0x48d4fc]
push eax
push 0xff
lea ecx, [ebp - 0x504]
push ecx
push 0x49009c
push str.EDITOR
push 0x4900a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x504]
push edx
push 0x4900b0
call fcn.00446e20
add esp, 8
test eax, eax
jne 0x42b9cd
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x42b9d6
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [0x48d4fc]
push edx
push 0xff
lea eax, [ebp - 0x504]
push eax
push str.LIST
push str.SCRIPTSELECT
push 0x4900cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x504]
push ecx
push str.DIALOG
call fcn.00446e20
add esp, 8
test eax, eax
jne 0x42ba22
mov edx, dword [ebp + 8]
mov dword [edx + 4], 1
jmp 0x42ba2c
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [0x48d4fc]
push ecx
push 0xff
lea edx, [ebp - 0x504]
push edx
mov eax, dword [str.inpascr.ini]
push eax
push str.DEFINI
push str.SCRIPT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.00446430
add esp, 8
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x508]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0044659b
add esp, 0x14
push 0x4a0cac
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x508]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call fcn.00446395
add esp, 0x14
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x430660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4a15e8], 0
je 0x43068e
cmp dword [0x4a15e0], 0
je 0x430683
push 0x4a13c4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4a0dcc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x4902b8], 0
je 0x4307bc
push 0x4a0dcc
call fcn.00446520
add esp, 4
mov dword [ebp - 8], eax
push 0x4a13c4
call fcn.00446520
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [0x4a15e0]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x80
jle 0x4306e0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
jmp 0x4306e7
mov dword [ebp - 0x10], 0x80
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4902b4]
sub ecx, dword [0x4a15dc]
cmp ecx, dword [ebp - 0xc]
jge 0x43072f
mov ecx, 0x4a0fcc
call fcn.00402550
push eax
call fcn.004488d4
add esp, 4
mov ecx, 0x4a0fcc
call fcn.00402550
push eax
mov ecx, 0x4a13bc
call fcn.00402550
push eax
call fcn.0044887c
add esp, 8
push 0x180
push 0x10a
mov ecx, 0x4a13bc
call fcn.00402550
push eax
call fcn.004488f0
add esp, 0xc
mov dword [0x4a15c8], eax
cmp dword [0x4a15c8], 0xffffffff
je 0x4307bc
cmp dword [0x4a15e0], 0
je 0x430788
mov edx, dword [ebp - 4]
push edx
push 0x4a13c4
mov eax, dword [0x4a15c8]
push eax
call fcn.0044e791
add esp, 0xc
mov ecx, dword [0x4a15dc]
add ecx, eax
mov dword [0x4a15dc], ecx
mov edx, dword [ebp - 8]
push edx
push 0x4a0dcc
mov eax, dword [0x4a15c8]
push eax
call fcn.0044e791
add esp, 0xc
mov ecx, dword [0x4a15dc]
add ecx, eax
mov dword [0x4a15dc], ecx
mov edx, dword [0x4a15c8]
push edx
call fcn.00448d7b
add esp, 4
mov dword [0x4a15e0], 0
mov esp, ebp
pop ebp
ret
Function at 0x438be6
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x438c01
xor eax, eax
jmp 0x438d20
push 0
push 0
push 0
push 0x491108
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x30], eax
push 8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x20], eax
push 0xa
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
jge 0x438c70
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x1c], 0
jge 0x438c7d
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
jle 0x438c8b
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 4]
jle 0x438c99
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
push 0xcc0020
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x438e0b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 8], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x2c], eax
push 0xa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x28], eax
cmp dword [0x4a161c], 0
je 0x438e65
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
mov ecx, dword [0x49fda4]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x438e96
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x438e65
lea edx, [ebp - 0x34]
push edx
call fcn.00438b78
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x4a161c], 0
je 0x438eba
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43c694
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b23a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
push 0x4a188c
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.004704b2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], 0
push 0x4a1890
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.004704b2
mov byte [ebp - 4], 1
push 0x4a1894
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.004704b2
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00469faa
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.00469faa
mov byte [ebp - 4], 4
cmp dword [ebp + 8], 0
je 0x43c73f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00429310
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
push 5
mov ecx, 0x4a0cd8
call fcn.004214f0
push 1
mov ecx, 0x4a0cc8
call fcn.0043a398
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c76e
jmp 0x43c84d
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0043d430
push 0
mov ecx, 0x4a0cc8
call fcn.0043a398
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c794
jmp 0x43c84d
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0043c9b4
test eax, eax
jne 0x43c7a9
jmp 0x43c84d
push 0
mov ecx, 0x4a0cc8
call fcn.0043a398
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c7c3
jmp 0x43c84d
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0043ca4c
push 0
mov ecx, 0x4a0cc8
call fcn.0043a398
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43c7e6
jmp 0x43c84d
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0043ca8f
mov ecx, dword [ebp - 0x14]
call fcn.0043cad2
test eax, eax
jne 0x43c800
jmp 0x43c84d
push 0
mov ecx, 0x4a0cc8
call fcn.0043a398
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43c84b
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0043cbcd
cmp eax, 2
jne 0x43c82f
jmp 0x43c84d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0043ccf5
cmp eax, 2
jne 0x43c849
jmp 0x43c84d
jmp 0x43c800
jmp 0x43c85b
push 1
push 3
mov ecx, 0x4a0cd8
call fcn.0042e56a
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c875
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b274
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00469fdd
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00469fdd
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00470444
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00470444
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00470444
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret