joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433db7
Capabilities:
Switch active desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 4], edi
je 0x433e97
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x40]
push 0x1bf
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_OpenDesktopW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x433e31
mov eax, dword [esi]
push 1
pop ecx
lea edx, [ebp - 0x10]
push edx
push 0x10000000
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_CreateDesktopW]
push edi
mov ecx, esi
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], eax
call fcn.00401b75
push eax
push str.userinit.exe
mov ecx, ebx
call fcn.00434d7c
cmp dword [ebp - 4], edi
je 0x433e97
mov eax, dword [0x4a16f0]
mov ecx, 0x81
mov dword [ebp - 0x21c], eax
xor eax, eax
lea edi, [ebp - 0x218]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x21c]
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
mov ecx, esi
call fcn.00401b75
push eax
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.00434d7c
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SwitchDesktop]
test eax, eax
jne 0x433ea5
push edi
push str.Error
push dword [esi]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x433ea5
push edi
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433eac
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x433eac
Capabilities:
Change the wallpaper
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, str.c:_bild_WQREWTETLE.jpg
xor ebx, ebx
push ebp
lea esi, [edi + 0x44]
mov dword [edi + 0x464], eax
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x433ef9
test al, 0x10
jne 0x433ef9
push 3
mov ebx, 0x100
push esi
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push ebx
push 0x73
call esi
push 3
push ebp
push ebx
push 0x14
call esi
xor ebx, ebx
mov eax, dword [edi + 0x458]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
cmp eax, ebx
je 0x433f0d
push ebx
push eax
call esi
mov ecx, edi
call fcn.004347ad
cmp dword [edi + 0x458], ebx
jne 0x433f24
push ebx
mov ecx, edi
call fcn.0043421b
push 5
push dword [edi + 0x458]
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
call esi
push 0x4d
mov ebp, eax
call esi
add ebp, eax
push ebp
push 0x4e
call esi
push 0x4c
mov ebp, eax
call esi
add ebp, eax
push ebp
push 0x4d
call esi
push eax
push 0x4c
call esi
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
push 0x12
push ecx
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
push ecx
push eax
push dword [esp + 0x20]
push ebx
push dword [edi + 0x458]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [edi + 0x458]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4345a5
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4345c1
xor eax, eax
jmp 0x4346d5
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, eax
jne 0x4345dd
push eax
push eax
push eax
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov dword [ebp + 8], eax
jmp 0x4345e0
mov dword [ebp + 8], ecx
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push 8
push dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x10], eax
call esi
push 0xa
push dword [ebp + 8]
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
call esi
push 0x4d
mov ebx, eax
call esi
add ebx, eax
push ebx
push 0x4e
call esi
push 0x4c
mov ebx, eax
call esi
add ebx, eax
push ebx
push 0x4d
call esi
push eax
push 0x4c
call esi
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 8], eax
jge 0x434655
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 4], eax
jge 0x434660
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jle 0x43466b
mov eax, dword [ebp - 0x18]
cmp edi, dword [ebp - 0x14]
jle 0x434673
mov edi, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
sub edi, dword [ebp - 4]
mov ebx, eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0xc]
call esi
push 0xcc0020
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push edi
xor edi, edi
push ebx
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call esi
cmp dword [ebp + 0xc], edi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, eax
jne 0x4346cc
push dword [ebp + 8]
call esi
push dword [ebp - 0xc]
call esi
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x434714
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x444], ebx
je 0x4347a7
lea eax, [ebp - 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_GetCursorPos]
push eax
call edi
push 0xcc0020
push ebx
push ebx
push dword [esi + 0x444]
push dword [esi + 0x454]
push dword [esi + 0x450]
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [esi + 0x38], ebx
je 0x434792
lea eax, [ebp - 8]
push eax
call edi
push dword [ebp - 4]
mov ecx, esi
push dword [esi + 0x450]
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.00434cf7
push dword [esi + 0x454]
mov ecx, esi
push dword [ebp - 8]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00434cf7
cmp dword [esi + 0x30], ebx
pop edi
je 0x4347a7
lea eax, [esi + 0x20]
mov ecx, esi
push eax
push ebx
push dword [ebp + 8]
call fcn.00434343
pop esi
pop ebx
leave
ret 4

Function at 0x4347ad
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x444]
cmp eax, ebx
je 0x4347f7
push dword [esi + 0x448]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push dword [esi + 0x444]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esi + 0x44c]
lea edi, [esi + 0x44c]
mov dword [esi + 0x444], ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi], ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push eax
mov dword [ebp - 4], eax
call edi
push 0xa
mov dword [esi + 0x450], eax
push dword [ebp - 4]
call edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4f
mov dword [esi + 0x454], eax
call edi
push eax
push 0x4e
call edi
push eax
push 0x4d
call edi
push eax
push 0x4c
call edi
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
sub edi, dword [ebp - 0x14]
sub ebx, dword [ebp - 0x10]
push dword [ebp - 4]
mov dword [esi + 0x450], edi
mov dword [esi + 0x454], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov dword [esi + 0x444], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push ebx
push edi
push dword [ebp - 4]
mov dword [esi + 0x448], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [esi + 0x44c], eax
push dword [esi + 0x444]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 4]
push ebx
push edi
xor edi, edi
push edi
push edi
push dword [esi + 0x444]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 4]
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esi + 0x44c]
mov ecx, esi
call fcn.00434b15
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434bf9
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x434c34
push 0x10
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x434cf2
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov ebx, 0x2002
push esi
push ebx
call edi
mov dword [ebp - 4], eax
lea eax, [esi + esi*2]
push eax
push ebx
call edi
cmp dword [ebp - 4], 0
mov ebx, eax
je 0x434ce7
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call edi
push ebx
mov dword [ebp + 8], eax
call edi
mov edi, eax
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [ebp - 0xc], eax
je 0x434ce7
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ebp - 0x28]
call fcn.00401dd5
push esi
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call fcn.00401f34
and byte [edi], 0
lea ecx, [ebp - 0x28]
call fcn.00401e33
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.screenshot__d__d_data:image_png_base64__s
push edi
call fcn.00442fbb
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
add esp, 0x14
push ebx
call esi
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 4]
call esi
lea ecx, [ebp - 0x28]
call fcn.00401e08
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
leave
ret 0xc

Function at 0x434d7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov ebx, ecx
push 0x31
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x11a]
mov word [ebp - 0x11c], si
rep stosd dword es:[edi], eax
push 0x64
push dword [ebp + 8]
stosw word es:[edi], ax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call fcn.00442580
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 3
call fcn.00442580
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
leave
ret 8
Function at 0x434f47
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x4a16f0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
mov dword [ebp - 0x858], eax
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x854]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x858]
push str.mspaint
push eax
call esi
lea eax, [ebp - 0x858]
push 0x49cf00
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x858]
push eax
call esi
lea eax, [ebp - 0x858]
push 0x49cefc
push eax
call esi
push 0x44
xor esi, esi
pop edi
lea eax, [ebp - 0x54]
push edi
push esi
push eax
call fcn.00442580
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 3
call fcn.00442580
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x858]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 4

Function at 0x4352b5
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x3a8
push edi
lea edi, [esi + 0x28]
push ebx
push 0
push edi
call fcn.00442580
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [edi], ebx
mov dword [esi + 0x2c], eax
push 0
push 1
push 0x7f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov ebx, 0x4ce470
push 0xa0
push ebx
mov dword [esi + 0x3c], eax
push dword [esi + 4]
mov dword [esi + 0x30], 0x1400
mov dword [esi + 0x34], 7
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebp, [esi + 0x40]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
call ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x435330
push dword [esi + 0x20]
push ebp
call ebx
push edi
push 0
mov dword [esi + 0x38], 0x8064
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4361dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436209
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x436205
call esi
cmp eax, 3
je 0x436205
or esi, 0xffffffff
jmp 0x436214
xor esi, esi
jmp 0x436214
test al, 0x10
je 0x436211
push 2
jmp 0x436213
push 1
pop esi
lea ecx, [esp + 8]
call fcn.00401802
mov eax, esi
pop esi
ret
Function at 0x43677a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push str.runas
lea ecx, [ebp - 4]
call fcn.0040182e
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push esi
call fcn.004070c2
push dword [ebp - 4]
mov eax, dword [eax]
push eax
call fcn.00442dbe
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 8]
inc bl
call fcn.00401802
lea ecx, [ebp - 4]
call fcn.00401802
test bl, bl
jne 0x4367f8
call fcn.00436ae9
test eax, eax
je 0x4367f8
lea ecx, [ebp - 0x20]
call fcn.00436812
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x20]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
call fcn.004368fe
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00436b00
mov eax, esi
jmp 0x43680e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebx
leave
ret

Function at 0x436c8a
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x1c]
mov dword [esi], 0x453e9c
push 2
push dword [esi + 0x24]
call fcn.00436cfd
mov eax, dword [esi + 8]
test eax, eax
je 0x436cb7
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esi + 0x10]
call fcn.00401802
pop esi
ret
Function at 0x436d77
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x436db4
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x436db4
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x436e78
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x436e1a
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x436dfe
dec eax
je 0x436ddf
dec eax
je 0x436dfe
dec eax
jne 0x436e78
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x436e78
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x436df9
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x436e57
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x436e45
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x436e78
add eax, 0xffffffe2
jmp 0x436e75
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x436eab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.00436e7d
test eax, eax
je 0x436ee4
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00436d77
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x436f5d
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
lea eax, [ebp + 0x10]
push eax
lea ecx, [esi + 0x10]
call fcn.0040711b
mov ecx, esi
call fcn.00436f16
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x436f8c
mov dword [esi + 0x20], eax
cmp dword [ebp + 0x18], 0
je 0x436fbe
mov eax, dword [esi + 8]
test eax, eax
je 0x436fa5
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x436fce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
lea ecx, [ebp + 0x10]
call fcn.00401802
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x437055
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x208]
lea edi, [esi + 0x208]
test eax, eax
mov dword [esi], 0x453ea4
je 0x437084
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x437084
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00437327
mov esi, dword [esi + 0x210]
test esi, esi
je 0x4370a1
push 0xeafe
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
ret

Function at 0x4371ee
Capabilities:
Create thread
Get graphical window text
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x20c], eax
mov eax, dword [ebp + 8]
push eax
mov dword [esi + 0x208], eax
call fcn.00420c4f
mov edi, dword [sym.imp.USER32.dll_CopyIcon]
pop ecx
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
call edi
cmp dword [ebp + 0x10], 0
mov dword [esi + 4], eax
je 0x437231
push dword [ebp + 0x10]
call edi
mov dword [esi + 4], eax
mov dword [ebp + 8], eax
mov ebx, 0x3a8
lea eax, [esi + 0x220]
push ebx
push 0
push eax
call fcn.00442580
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], eax
push dword [ebp + 8]
call edi
mov edi, 0x4ce530
mov dword [esi + 0x234], eax
mov eax, dword [esi + 0x214]
push 0xa0
push edi
add eax, 0x1388
push dword [esi + 0x208]
mov dword [esi + 0x228], eax
mov dword [esi + 0x22c], 7
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [esi + 0x238]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call edi
cmp dword [ebp + 0x14], 0
je 0x4372b9
push dword [ebp + 0x14]
push ebx
call edi
push dword [ebp + 0x14]
lea eax, [esi + 8]
push eax
call edi
cmp dword [ebp + 0x18], 0
je 0x4372c9
mov dword [esi + 0x21c], 0x8064
mov eax, dword [esi + 0x21c]
mov dword [esi + 0x230], eax
lea eax, [esi + 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x43731e
mov eax, dword [esi + 0x210]
cmp eax, edi
je 0x437302
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 0x218]
push eax
push edi
push esi
push 0x4370a4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x210], eax
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x437327
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x220]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [esi + 0x208], 0
mov eax, dword [esi + 0x210]
add esi, 0x210
test eax, eax
je 0x43735f
push 0xeafe
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi], 0
pop esi
ret

Function at 0x437487
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
xor edx, edx
cmp dword [0x4ce6b4], edx
jne 0x43750d
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push edi
mov ecx, 0xac
xor eax, eax
cmp dword [0x4ce6ac], edx
lea edi, [ebp - 0x2b0]
mov dword [ebp - 0x2b4], edx
mov ebx, 0x2b4
rep stosd dword es:[edi], eax
mov edi, 0x49d17c
jne 0x4374e2
push 0x4001
lea eax, [ebp - 0x2b4]
push ebx
push eax
push edx
push edi
call esi
mov dword [0x4ce6ac], eax
xor edx, edx
cmp dword [0x4ce6b0], edx
jne 0x437500
push 0x4000
lea eax, [ebp - 0x2b4]
push ebx
push eax
push edx
push edi
call esi
mov dword [0x4ce6b0], eax
pop edi
pop esi
mov dword [0x4ce6b4], 1
pop ebx
leave
ret

Function at 0x43750f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push esi
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.00442580
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x437551
neg eax
sbb eax, eax
and eax, 2
or ax, 0x4011
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0x10
jmp 0x43756a
neg eax
sbb eax, eax
and eax, 2
or ax, 0x4011
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0x80
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop esi
leave
ret