joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dbc0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push esi
mov esi, ecx
cmp eax, 0x10
je 0x44dcbc
cmp eax, 0x20
je 0x44dbec
mov eax, dword [ebp + 0x14]
pop esi
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi + 0xa8]
test ecx, 4
je 0x44dca8
test ecx, 0x10
je 0x44dc46
push 0x20
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.00443c00
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x200000
jne 0x44dd77
mov eax, ecx
and eax, 0xf000000
cmp eax, 0x2000000
jne 0x44dd77
shr ecx, 8
and ecx, 0x3f
sub dword [esi + 0xa4], ecx
mov ecx, esi
call fcn.0042c5a0
mov ecx, esi
call fcn.0042cfc0
mov ecx, esi
call fcn.0042d070
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
test dword [esi + 0xa8], 0xc000
jne 0x44dd77
push 0x20
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi + 0xa8]
test ecx, 2
je 0x44dd6c
test ecx, 0x10
je 0x44dd16
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.00443c00
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x300000
jne 0x44dd77
mov eax, ecx
and eax, 0xf000000
cmp eax, 0x3000000
jne 0x44dd77
shr ecx, 8
and ecx, 0x3f
add dword [esi + 0xa4], ecx
mov ecx, esi
call fcn.0042c5a0
mov ecx, esi
call fcn.0042cfc0
mov ecx, esi
call fcn.0042d070
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
test dword [esi + 0xa8], 0xc000
jne 0x44dd77
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x452880
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [esi + 0x48]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x452aac
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
test ebx, 1
je 0x452a0a
mov eax, dword [esi + 4]
xorps xmm0, xmm0
push 0x90
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xc4]
push 0
push eax
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc8], 0x94
call fcn.00530cf0
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
call edi
test eax, eax
je 0x452920
cmp dword [ebp - 0xc4], 6
mov eax, 0x30
jae 0x452925
mov eax, 0x2c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x5c89a0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x405
push dword [esi + 0x48]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0xfffffff1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 4]
xorps xmm0, xmm0
push 0x90
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xc4]
push 0
push eax
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc8], 0x94
call fcn.00530cf0
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
call edi
test eax, eax
je 0x4529c1
cmp dword [ebp - 0xc4], 6
mov eax, 0x30
jae 0x4529c6
mov eax, 0x2c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x5c89a0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x405
push dword [esi + 0x48]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0xfffffff2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_SendMessageA]
test ebx, 8
je 0x452aab
mov ebx, dword [esi + 4]
lea eax, [ebp - 0xc4]
push 0x90
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
push eax
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc8], 0x94
call fcn.00530cf0
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
call edi
test eax, eax
je 0x452a68
cmp dword [ebp - 0xc4], 6
mov eax, 0x30
jae 0x452a6d
mov eax, 0x2c
mov dword [ebp - 0x34], eax
mov eax, dword [0x5c89a0]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x405
push dword [esi + 0x48]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xfffffff0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
push 0
mov ecx, esi
call fcn.00444130
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x452acf
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x452ad6
mov dword [esi + 0x48], 0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005189ad
mov esp, ebp
pop ebp
ret
Function at 0x4653a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5604b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x15868]
mov dword [ebx], vtable.EventDispatcher.0
mov dword [ebx + 4], vtable.EventDispatcher.1.0
call fcn.00466710
mov ecx, 0x3e8
lea edi, [ebx + 0xfe8]
mov dword [ebp - 0x10], ecx
nop
mov eax, dword [edi]
test eax, eax
je 0x465430
xor esi, esi
cmp dword [edi - 0xfa0], esi
jle 0x465421
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x465418
cmp dword [ecx + 0x10], 0
je 0x465418
mov eax, dword [ecx]
push 0
call dword [eax + 4]
mov eax, dword [edi]
inc esi
cmp esi, dword [edi - 0xfa0]
jl 0x465400
push eax
mov eax, dword [ebx + 0x158c4]
call eax
mov ecx, dword [ebp - 0x10]
add esp, 4
add edi, 4
sub ecx, 1
mov dword [ebp - 0x10], ecx
jne 0x4653f0
lea esi, [ebx + 0xbbc8]
mov edi, 0x2710
mov eax, dword [esi]
test eax, eax
je 0x465458
push eax
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
mov dword [esi], 0
add esi, 4
sub edi, 1
jne 0x465446
cmp dword [ebx + 0x15814], edi
jle 0x46547f
push dword [ebx + 0x15810]
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
mov eax, dword [ebx + 0x15808]
test eax, eax
je 0x465495
push eax
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
push 1
push dword [ebx + 0xc]
mov dword [ebx + 0x14], 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4654c4
push dword [ebx + 0xc]
mov dword [ebx + 8], 2
call esi
mov dword [ebx + 0xc], 0
push dword [ebx + 0x15818]
call esi
push 0x5c86b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5c86d4]
test eax, eax
je 0x465504
sub eax, 1
mov dword [0x5c86d4], eax
jne 0x465504
mov ecx, dword [0x5c86d0]
test ecx, ecx
je 0x465504
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x5c86d0], 0
push 0x5c86b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebx + 0x15868]
mov dword [0x5c8858], 0
call fcn.00465570
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [ebx + 0x1584c]
push eax
call esi
lea eax, [ebx + 0x15834]
push eax
call esi
lea eax, [ebx + 0x1581c]
push eax
call esi
lea ecx, [ebx + 0x1c]
call fcn.004651c0
mov dword [ebx + 4], vtable.Utilities::SimpleThread.0
mov dword [ebx], vtable.Utilities::Singleton_class_EventDispatcher__class_Utilities::SingletonCreateUsingNew_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469e50
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563e48
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.Utilities::Singleton_class_Coordinators::IssuerCoordinator__class_Utilities::SingletonCreateInteractionObject_.0
lea esi, [edi + 4]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00467690
mov dword [esi], vtable.InteractionObjectImpl.0
lea eax, [edi + 0x3c]
mov dword [esi + 4], 0x8c
mov dword [esi + 0xc], 0
mov dword [esi], vtable.Coordinators::IssuerCoordinator.0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi], vtable.Coordinators::IssuerCoordinator.1.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push eax
mov dword [edi + 0x2c], vtable.Coordinators::safevector_class_DataTransferObjects::IssuerDTO__.0
call esi
lea eax, [edi + 0x64]
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
push eax
mov dword [edi + 0x54], vtable.Coordinators::safevector_class_DataTransferObjects::AccountDTO__.0
call esi
lea eax, [edi + 0x8c]
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
push eax
mov dword [edi + 0x7c], vtable.Coordinators::safevector_class_DataTransferObjects::DiscriminationDTO__.0
call esi
lea eax, [edi + 0xb4]
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
push eax
mov dword [edi + 0xa4], vtable.Coordinators::safevector_class_DataTransferObjects::CardCategoryDTO__.0
call esi
lea eax, [edi + 0xdc]
mov dword [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
push eax
mov dword [edi + 0xcc], vtable.Coordinators::safevector_class_DataTransferObjects::OrganizationDTO__.0
call esi
lea eax, [edi + 0x104]
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 0
mov dword [edi + 0x100], 0
push eax
mov dword [edi + 0xf4], vtable.Coordinators::safevector_class_DataTransferObjects::PersonDTO__.0
call esi
lea eax, [edi + 0x12c]
mov dword [edi + 0x120], 0
mov dword [edi + 0x124], 0
mov dword [edi + 0x128], 0
push eax
mov dword [edi + method.Coordinators::safevector_class_DataTransferObjects::PaymentDTO__.virtual_0], vtable.Coordinators::safevector_class_DataTransferObjects::PaymentDTO__.0
call esi
mov dword [edi + 0x144], 0
mov eax, edi
mov dword [edi + 0x148], 1
mov dword [edi + 0x14c], 1
mov dword [edi + 0x150], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48a660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56694e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
mov dword [esi], vtable.DataTransferObjects::PosTerminalDTO.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov dword [ebp - 4], 0
mov byte [ecx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
push 0
push 0x5707b4
mov byte [ebp - 4], 2
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
call fcn.0040a4a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48ace0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566ab9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x18]
mov dword [edi], vtable.DataTransferObjects::SensorDTO.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov dword [ebp - 4], 0
mov byte [ecx], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xf
mov byte [edi + 0x30], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
push 0
push 0x5707b4
mov byte [ebp - 4], 3
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.0040a4a0
push 0
push 0x5707b4
lea ecx, [edi + 0x30]
call fcn.0040a4a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4942d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4942e6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_SetParent]
pop esi
ret
Function at 0x4bf9f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0
mov eax, dword [ebp + 0x18]
push edi
mov edi, ecx
mov dword [ebp - 0x3f0], eax
jne 0x4bfb0e
mov eax, dword [ebp + 0xc]
cmp eax, 8
jne 0x4bfad5
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [edi + 0x24], 0
jne 0x4bfab3
push 0x3e8
lea eax, [ebp - 0x3ec]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x3ec]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bfa58
push ebx
push esi
sub ecx, edx
lea eax, [ebp - 0x3ec]
push ecx
push eax
lea ecx, [edi + 0x28]
call fcn.0040a4a0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp dword [edi + 0x3c], 0x10
mov esi, eax
lea eax, [edi + 0x28]
jb 0x4bfa8a
mov eax, dword [edi + 0x28]
push 0
push 0x5707b4
push dword [edi + 0x38]
push eax
call fcn.0040f850
add esp, 0x10
test al, al
jne 0x4bfab1
push edi
push dword [edi + 0x40]
push 0x401
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ecx], 0
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005189ad
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x102
jne 0x4bfb0e
lea eax, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 1
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x102
call fcn.004aae70
cmp dword [ebp - 0x3f4], 0
mov ecx, dword [ebp - 0x3f0]
mov dword [ecx], eax
jne 0x4bfabf
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.005189ad
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4cad60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xd0], 0
je 0x4cadb3
mov ecx, dword [edi + 0xcc]
xor edx, edx
mov esi, dword [edi + 0xd4]
mov eax, dword [ecx]
cmp eax, ecx
je 0x4cada0
cmp edx, esi
je 0x4cae70
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x4cad91
xor eax, eax
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4cadb3
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xd4]
mov esi, dword [ebp + 8]
cmp esi, eax
je 0x4cadde
test dword [edi + 0xac], 0x100
je 0x4cadde
cmp dword [edi + 0x9c], 0
jl 0x4cadde
push esi
push eax
mov ecx, edi
call fcn.004919b0
mov dword [edi + 0xd4], esi
mov dword [edi + 0xb8], 0
mov dword [edi + 0xa0], 0xffffffff
cmp dword [edi + 0xd0], 0
je 0x4caea6
mov ecx, dword [edi + 0xcc]
xor edx, edx
mov eax, dword [ecx]
cmp eax, ecx
je 0x4cae1e
cmp edx, esi
je 0x4cae78
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x4cae13
xor eax, eax
mov esi, dword [eax + 0x1c]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4caea6
push ebx
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [edi + 0xd0]
test ebx, ebx
je 0x4cae7d
mov edx, dword [edi + 0xd4]
sub ebx, edx
mov eax, dword [ebp - 0x10]
dec ebx
imul ebx, dword [edi + 0x50]
dec eax
lea ecx, [edx + 1]
imul ecx, dword [edi + 0x50]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
sub eax, ebx
mov dword [ebp - 8], eax
jmp 0x4cae80
mov eax, dword [eax + 8]
jmp 0x4cada2
mov eax, dword [eax + 8]
jmp 0x4cae20
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
push dword [edi + 0xd4]
push 5
push 0x401
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005189ad
mov esp, ebp
pop ebp
ret 4
Function at 0x4cb690
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x90
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], 0x94
push 0
push eax
call fcn.00530cf0
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4cb74c
cmp dword [ebp - 0xa8], 6
jb 0x4cb74c
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0x14
push str.comctl32.dll
xor ebx, ebx
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4cb74c
push str.DllGetVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4cb71e
mov esi, 0x80004001
jmp 0x4cb726
lea ecx, [ebp - 0x18]
push ecx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js 0x4cb736
mov ebx, dword [ebp - 0x14]
jmp 0x4cb73e
cmp esi, 0x80004001
je 0x4cb74c
test esi, esi
js 0x4cb74c
mov eax, 0x64
cmp ebx, 6
jae 0x4cb751
mov eax, 0x50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005189ad
mov esp, ebp
pop ebp
ret
Function at 0x4d1e40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561558
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
push str.Sensor
mov eax, dword [edi]
call dword [eax + 0xb8]
mov edx, dword [edi]
lea eax, [esi + 4]
push eax
push str.SensorKey
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
lea eax, [esi + 8]
push eax
push str.SencorCode
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
lea eax, [esi + 0xc]
push eax
push str.SensorType
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
lea eax, [esi + 0x10]
push eax
push str.Mode
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
lea eax, [esi + 0x14]
push eax
push str.LastStateCode
mov ecx, edi
call dword [edx + 4]
mov edx, dword [edi]
lea eax, [esi + 0x18]
push eax
push str.Name
mov ecx, edi
call dword [edx + 0x1c]
mov edx, dword [edi]
lea eax, [esi + 0x30]
push eax
push str.DeviceName
mov ecx, edi
call dword [edx + 0x1c]
lea eax, [esi + 0x48]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00477ee0
add esp, 8
mov edx, dword [edi]
mov ecx, edi
push eax
push str.States
mov dword [ebp - 4], 0
call dword [edx + 0x58]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4d1f42
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4d1f38
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1f55
push ecx
push edx
call fcn.005189ee
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00545078
int3
Function at 0x4de520
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bf38
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5b7de4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004d98f0
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
push str.Object
mov dword [ebp - 4], 0
call dword [eax + 0x90]
push 1
push esi
push 0x64
push 0x6a
mov ecx, edi
call fcn.00474420
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov eax, dword [esi]
push ecx
push str.Result
mov ecx, esi
call dword [eax + 0x30]
mov edx, dword [esi]
mov ecx, esi
mov edi, dword [ebp - 0x10]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4e5a20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
push 0x43a
movups xmmword [ebp - 0x14], xmm0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call esi
test eax, eax
je 0x4e5a7b
lea eax, [ebp - 0xc]
push eax
push dword [edi + 4]
call esi
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x7c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005189ad
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e6050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cc88
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5b7de4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
push 0x43a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
push 5
push esi
call edi
mov ecx, dword [ebp - 0x64]
push 0
push dword [ecx + 0x7c]
call edi
mov edi, dword [ebp - 0x64]
lea eax, [ebp - 0x48]
push 0x1f
push eax
push 0x72
push dword [edi + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0x5707b4
push 0x72
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0xa
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00544a5d
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
test eax, eax
je 0x4e61b8
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x68]
cmp ecx, edx
je 0x4e610f
nop dword [eax + eax]
cmp dword [ecx], eax
je 0x4e61b8
add ecx, 4
cmp ecx, edx
jne 0x4e6100
cmp dword [edi + 0x70], edx
je 0x4e611f
mov eax, dword [ebp - 0x6c]
mov dword [edx], eax
add dword [edi + 0x6c], 4
jmp 0x4e612c
lea eax, [ebp - 0x68]
push eax
push edx
lea ecx, [edi + 0x68]
call fcn.0040aeb0
push dword [ebp - 0x68]
lea eax, [ebp - 0x13]
push eax
call fcn.0040f8c0
lea edx, [ebp - 0x13]
mov dword [ebp - 0x50], 0
add esp, 8
mov byte [ebp - 0x60], 0
mov ecx, 0xf
mov dword [ebp - 0x4c], ecx
cmp eax, edx
je 0x4e6166
mov ecx, edx
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.0040a4a0
mov ecx, dword [ebp - 0x4c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x60]
cmp ecx, 0x10
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x60]
push eax
push 0
push 0x143
push esi
call edi
cmp dword [ebp - 0x4c], 0x10
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push eax
push 0xffffffffffffffff
push 0x14d
push esi
call edi
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
call fcn.004e6330
lea ecx, [ebp - 0x60]
call fcn.00408f00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005189ad
mov esp, ebp
pop ebp
ret 0x10