joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447880
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x477e48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00470532
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00447220
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00470460
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0046cd26
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0046cd26
push 1
push 0
push 0
mov ecx, esi
call fcn.0046ccce
push 1
push 0
push 1
mov ecx, esi
call fcn.0046ccce
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004705a4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x447a00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x477e68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00470532
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00447220
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00470460
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x447ac4
cmp dword [esp + 0x40], 1
jne 0x447ac2
cmp ecx, eax
jge 0x447ac4
mov eax, ecx
cmp eax, 0xc8
jge 0x447ad0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00447880
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004705a4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x448240
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x477ed3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b141
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004707da
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00471d39
test eax, eax
je 0x44835c
mov ecx, dword [esp + 0x3c]
call fcn.00470807
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x448320
push edi
mov ecx, esi
call fcn.0046de6d
mov ecx, esi
call fcn.004484c0
cmp dword [esp + 0x38], 1
jne 0x448355
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046dfa8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44ad80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44adb3
push esi
call fcn.0044de70
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44adac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44ae39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44ae22
mov eax, dword [esi + 8]
test eax, eax
je 0x44add7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44ae1e
cmp eax, 2
je 0x44ae22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44adca
cmp eax, 3
je 0x44adfd
cmp eax, 1
jne 0x44adca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44adca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44adca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044ae60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44ae48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044ae60
add esp, 4
pop esi
ret

Function at 0x4569c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x456a63
test eax, eax
jbe 0x456a63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x456a63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x456a0e
xor esi, esi
jmp 0x456a14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x456a3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040b160
add esi, eax
push esi
mov ebx, esi
call fcn.0040b160
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x456a20
pop ebp
test edi, edi
pop edi
jne 0x456a63
test ebx, ebx
je 0x456a63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045ad80
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x456ba5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x456cbd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456cbd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046b593
mov esi, eax
test esi, esi
je 0x456cbd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x456cbd
mov ecx, esi
call fcn.00456b10
cmp edi, eax
jge 0x456cbd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x456c43
mov dword [esp + 0x34], 1
jmp 0x456c9e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x456cbd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004560c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46bf37
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46bf6f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00469fc4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00469f9c
jmp 0x46bf7b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46d62a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46d66c
call fcn.00473129
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46d66c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46d663
xor eax, eax
jmp 0x46d674
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046d67a
pop edi
pop esi
pop ebx
ret 4
Function at 0x473659
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x473687
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4736a5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004735bf
jmp 0x4736a5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4736a5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004735bf
test edi, edi
mov eax, edi
jne 0x47368f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405480
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
push ebx
push ebp
push esi
push edi
push 0x4a1470
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
xor edi, edi
add esp, 8
cmp esi, edi
je 0x405608
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push edi
push 0x3c
push esi
mov dword [esp + 0x1c], edi
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call ebp
mov edx, dword [esp + 0x2c]
add esp, 0x1c
cmp edx, edi
je 0x4055fe
xor eax, eax
mov dword [esp + 0x18], edi
mov ecx, 0x3d
lea edi, [esp + 0x1c]
push eax
push edx
rep stosd dword es:[edi], eax
push esi
call ebx
push esi
push 1
lea edx, [esp + 0x2c]
push 0xf8
push edx
call ebp
mov eax, dword [esp + 0x34]
add esp, 0x1c
cmp eax, 0x4550
jne 0x4055fe
mov ebx, dword [esp + 0x1e]
test bx, bx
je 0x4055fe
cmp bx, 0x14
ja 0x4055fe
and ebx, 0xffff
mov dword [esp + 0x14], ebx
jle 0x405551
cmp ebx, 0xc8
jg 0x405551
lea ebx, [ebx + ebx*4]
shl ebx, 3
push ebx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40556d
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push 1
push ebx
push ebp
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edi, dword [esp + 0x28]
add esp, 0x14
xor eax, eax
test edi, edi
jle 0x4055c1
mov esi, dword [esp + 0x118]
lea ecx, [ebp + 0x14]
mov edx, dword [ecx]
cmp esi, edx
jl 0x4055b9
mov ebx, dword [ecx - 4]
add ebx, edx
cmp esi, ebx
jl 0x4055d0
inc eax
add ecx, 0x28
cmp eax, edi
jl 0x4055aa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 0xc
lea eax, [eax + eax*4]
pop edi
mov ecx, dword [ebp + eax*8 + 0xc]
mov edx, dword [ebp + eax*8 + 0x14]
lea ebp, [ebp + eax*8]
sub ecx, edx
mov edx, dword [esp + 0x118]
add ecx, esi
pop esi
pop ebp
mov dword [edx], ecx
mov eax, 1
pop ebx
add esp, 0x100
ret 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x100
ret 0xc
Function at 0x407130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
test ebp, ebp
mov esi, ecx
je 0x4071a9
lea edi, [esi + 0x94]
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [esp + 0x14]
push 0
push ebp
mov ecx, edi
lea eax, [eax + eax*4]
shl eax, 1
push eax
call sub.MFC42.DLL_CFont::CreatePointFont
test esi, esi
jne 0x407166
xor eax, eax
jmp 0x407169
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
test edi, edi
mov ebp, eax
je 0x407179
mov edi, dword [edi + 4]
push edi
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esi + 0x9c]
push ecx
push 1
push 0x4a14c4
push ebp
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
test esi, esi
jne 0x40719e
xor eax, eax
jmp 0x4071a1
mov eax, dword [esi + 0x20]
push ebp
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov dword [esi + 0x11c], eax
call edi
mov dword [esi + 0x120], eax
lea edi, [esi + 0x128]
cdq
idiv dword [esi + 0xa0]
mov ecx, edi
add eax, 4
mov dword [0x4ba588], eax
mov eax, dword [esi + 0x11c]
cdq
idiv dword [esi + 0x9c]
add eax, 0x60
mov dword [0x4ba584], eax
call fcn.00410770
mov edx, dword [0x4ba588]
mov ecx, edi
shl edx, 4
push edx
call fcn.00410720
test eax, eax
jne 0x40721e
push 0xffffffffffffffff
push eax
push 0xf00a
call sub.MFC42.DLL_AfxMessageBox_1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x40723b
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0xa4], 0
mov eax, dword [0x4ba584]
imul eax, dword [0x4ba588]
shl eax, 4
push eax
call sub.MFC42.DLL_operatornew
mov edi, eax
xor eax, eax
mov dword [esi + 0xa4], edi
mov ecx, dword [0x4ba584]
imul ecx, dword [0x4ba588]
shl ecx, 4
mov edx, ecx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x144]
test eax, eax
je 0x407298
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0x144], 0
mov eax, dword [0x4ba584]
lea eax, [eax + eax*2]
push eax
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
mov dword [esi + 0x144], edi
mov eax, dword [0x4ba584]
lea ecx, [eax + eax*2]
mov eax, 0x20202020
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x4ba584]
mov ecx, dword [esi + 0x144]
pop edi
pop esi
lea eax, [eax + eax*2]
pop ebp
mov byte [eax + ecx - 1], 0
ret 8
Function at 0x410900
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
push esi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [esp + 4]
add eax, 0x85c
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call fcn.00428e50
test eax, eax
je 0x41098f
push edi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x410981
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x410981
mov edx, dword [esi + 4]
mov ecx, dword [eax]
cmp edx, ecx
ja 0x41095e
mov edi, dword [esi + 0x14]
add edi, edx
cmp edi, ecx
jbe 0x41095e
sub ecx, edx
mov edx, dword [esi + 8]
add ecx, edx
cmp byte [ecx], 0xcc
jne 0x41095e
mov dl, byte [eax + 4]
mov byte [ecx], dl
mov edx, dword [esi + 0xc]
mov ecx, dword [eax]
cmp edx, ecx
ja 0x410981
mov edi, dword [esi + 0x14]
add edi, edx
cmp edi, ecx
jbe 0x410981
sub ecx, edx
mov edx, dword [esi + 0x10]
add ecx, edx
cmp byte [ecx], 0xcc
jne 0x410981
mov al, byte [eax + 4]
mov byte [ecx], al
lea ecx, [esp + 8]
call fcn.00428e80
test eax, eax
jne 0x41092d
pop edi
pop esi
add esp, 8
ret
Function at 0x411490
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x390
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3a8]
mov dword [esp + 0x10], ecx
lea eax, [edi*8]
push eax
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
xor ebx, ebx
xor eax, eax
test edi, edi
jle 0x4114fa
mov esi, dword [esp + 0x3a4]
mov edx, ebp
lea ecx, [eax + eax*2]
cmp dword [esi + ecx*8 + 8], 0
lea ecx, [esi + ecx*8]
je 0x4114f5
mov edi, dword [ecx]
mov dword [edx], edi
mov edi, dword [ecx + 0xc]
add eax, edi
mov edi, dword [esp + 0x3a8]
inc ebx
add edx, 8
lea ecx, [eax + eax*2]
mov ecx, dword [esi + ecx*8 - 0x18]
mov dword [edx - 4], ecx
jmp 0x4114f6
inc eax
cmp eax, edi
jl 0x4114c8
xor esi, esi
test ebx, ebx
jle 0x41155f
lea eax, [esi + 1]
mov edi, 1
cmp eax, ebx
jge 0x41152a
lea ecx, [ebp + eax*8]
mov edx, dword [ebp + esi*8]
cmp edx, dword [ecx]
jne 0x41152a
mov edx, dword [ebp + esi*8 + 4]
cmp edx, dword [ecx + 4]
jne 0x41152a
inc edi
inc eax
add ecx, 8
cmp eax, ebx
jl 0x411510
mov eax, dword [ebp + esi*8 + 4]
mov ecx, dword [ebp + esi*8]
push eax
push ecx
lea edx, [esp + 0x1c]
push str.__p__p_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0x14]
add ecx, 0xc
push eax
push edi
call fcn.00410d00
add esi, edi
cmp esi, ebx
jl 0x411500
push ebp
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x14]
add esp, 4
lea ebx, [edx + 0xc]
mov ecx, ebx
call fcn.00410cc0
mov ecx, ebx
call fcn.00410f90
lea eax, [esp + 0x198]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea ecx, [esp + 0x98]
push str.vdbg_test_m__d.txt
push ecx
call ebp
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4a1820
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1a8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x14
mov esi, eax
mov ecx, ebx
push 0
push esi
call fcn.00411070
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x198]
lea edx, [esp + 0x94]
push ecx
push str.notepad.exe__s
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x94]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x390
ret 8
Function at 0x412610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4800e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x489988
mov dword [esi + 4], ebx
lea edi, [esi + 8]
mov dword [esp + 0x18], ebx
mov ecx, edi
call sub.MFC42.DLL_CPtrArray::CPtrArray
mov dword [edi], 0x489d7c
lea edi, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, edi
call sub.MFC42.DLL_CPtrArray::CPtrArray
or eax, 0xffffffff
push 0x4ba5f0
mov dword [edi], 0x489d68
push ebx
mov dword [esi], 0x489d40
mov dword [esi + 0x50], ebx
mov dword [esi + 0x40], 0x10
mov dword [esi + 0x44], 0xf
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x48], 0xc0c0c0
mov dword [esi + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x418b50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x20]
push eax
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push eax
lea ecx, [esp + 0x30]
call fcn.0047de62
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x20]
push edx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call sub.MFC42.DLL_CWnd::ScreenToClient
mov eax, dword [esi + 0x90]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x418c86
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x8c]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, edi
push eax
push ecx
push edx
lea edi, [esi + 0x9c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
test edi, edi
je 0x418c32
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x90]
push edi
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0xa4], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x90]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0x8c]
sub ecx, edi
test edx, edx
je 0x418ca7
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4