joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ba20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c2b3
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
call fcn.0049bc30
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
call dword [0x554ac0]
push 1
push ebx
push 1
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call dword [0x554f94]
mov dword [ebp - 4], ebx
xor dl, dl
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 0x21], dl
mov esi, dword [eax]
cmp esi, eax
je 0x49bb48
nop
mov ecx, dword [esi + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x49bab0
push 0x422e80
lea eax, [ebp - 0x14]
push eax
call dword [0x554854]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49bc10
call dword [0x554a54]
test al, al
je 0x49baf1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49bbfd
lea eax, [ebp - 0x2c]
push eax
call dword [0x554a64]
mov byte [ebp - 4], 4
or ebx, 1
mov dword [ebp - 0x28], ebx
cmp dword [eax], 0
mov byte [ebp - 0x1d], 1
jne 0x49baf5
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 1
test bl, 1
je 0x49bb1b
and ebx, 0xfffffffe
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x49bb1b
lea ecx, [eax + 4]
lea eax, [ebp - 0x2c]
push eax
call dword [0x554858]
cmp byte [ebp - 0x1d], 0
jne 0x49bba6
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49bb3a
lea eax, [ebp - 0x14]
push eax
call dword [0x554858]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x49ba90
mov dl, byte [ebp - 0x21]
xor dl, 1
mov ecx, edi
movzx eax, dl
push eax
push 0x2710
call dword [0x555988]
push dword [ebp - 0x21]
mov ecx, edi
push 0x2711
call dword [0x555988]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0xffff8000
test si, ax
je 0x49bbc2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x49bbc2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x49bbc2
call dword [0x554f98]
test al, al
je 0x49bbc2
mov al, 1
jmp 0x49bbc4
mov dl, 1
mov byte [ebp - 0x21], dl
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x49bb48
lea eax, [ebp - 0x14]
push eax
call dword [0x554858]
jmp 0x49bb45
xor al, al
push eax
push 0x2712
mov ecx, edi
call dword [0x555988]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00496fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x7c]
call dword [0x55529c]
mov byte [ebp - 4], 3
push eax
call fcn.00405bf0
lea ecx, [ebp - 0xcc]
call dword [0x55529c]
mov byte [ebp - 4], 2
push eax
call fcn.00405bf0
int3
Function at 0x49e160
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53caf0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x49e1b7
lea ecx, [edi + 0x70]
mov dword [edi + 0x28], 0x56bd98
call dword [0x55484c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 5
lea ecx, [edi + 0x24]
push 0
call dword [0x556004]
mov byte [ebp - 4], 6
mov dword [edi], vtable.ThumbnailWindow.0
mov dword [edi + 0x24], vtable.ThumbnailWindow.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 7
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 8
mov dword [edi + 0x38], 0
mov byte [ebp - 4], 9
mov dword [edi + 0x3c], 0
mov byte [ebp - 4], 0xa
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 0xb
mov dword [edi + 0x44], 0
mov byte [ebp - 4], 0xc
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 0xd
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x64]
call dword [0x5548b8]
mov byte [ebp - 4], 0xf
mov byte [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a2d50
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx + 0x444]
lea ecx, [ebp + 0xc]
push edi
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
mov ecx, eax
call dword [0x5559dc]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
push 0x41a
movups xmmword [ebp - 0x14], xmm0
push dword [esi + 0x3ec]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push 2
push eax
push 0
mov dword [ebp - 8], ecx
push dword [esi + 0x3ec]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
push eax
push 0
push 0x419
movups xmmword [ebp - 0x28], xmm0
push dword [esi + 0x3ec]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x1c]
mov ecx, 0x258
sub edi, dword [ebp - 0x24]
mov esi, dword [ebp - 8]
mov eax, edi
sub esi, dword [ebp - 0x10]
cdq
sub esi, edi
sub eax, edx
sar eax, 1
sub eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
imul eax, eax, 0x258
pop edi
cdq
idiv esi
pop esi
add eax, 0x258
cmp eax, ecx
cmovge eax, ecx
xor ecx, ecx
test eax, eax
cmovs eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret 8
Function at 0x4a96c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
push 0x404
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.00515fd2
add esp, 0xc
mov dword [ebp - 0x420], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x428], esi
test esi, esi
jne 0x4a9782
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x428], eax
test esi, esi
jne 0x4a9782
call fcn.004133f0
mov edi, eax
jmp 0x4a9873
push dword [ebp - 0x424]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4a97a0
call fcn.004133f0
jmp 0x4a9866
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x4a97be
call fcn.004133f0
jmp 0x4a9866
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x430], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4a97df
mov edi, 0x8007000e
jmp 0x4a9868
mov byte [ebp - 4], 2
lfence
push eax
lea ecx, [ebp - 0x420]
call fcn.004a8660
mov dword [ebp - 4], 1
jmp 0x4a981a
mov eax, dword [ebp - 0x420]
test eax, eax
jne 0x4a982b
mov edi, 0x8007000e
jmp 0x4a9868
lfence
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4a9849
call fcn.004133f0
jmp 0x4a9866
xor edx, edx
mov eax, dword [ebp - 0x420]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x420]
lea ecx, [ebp - 0x1c]
call fcn.004a9510
mov edi, eax
test esi, esi
je 0x4a9873
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x4a9890
lea ecx, [ebp - 0x420]
call fcn.004a8ba0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4add10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fcb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4addfc
lea ecx, [esi + 0x44]
mov dword [esi + 0x20], 0x56df04
mov dword [esi + 0x4c], 0x56df1c
mov dword [esi + 0x88], 0x56df24
mov dword [esi + 0x9c], 0x56df30
mov dword [esi + 0xa4], 0x56df40
call dword [0x55484c]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x48]
push 0
mov dword [ebp - 0x10], 1
call dword [0x554a6c]
mov dword [ebp - 4], 1
lea ecx, [esi + 0x84]
push 0
mov dword [ebp - 0x10], 3
call dword [0x554a74]
mov dword [ebp - 4], 2
lea ecx, [esi + 0x98]
push 0
mov dword [ebp - 0x10], 7
call dword [0x555fe0]
mov dword [ebp - 4], 3
lea ecx, [esi + 0xa0]
push 0
mov dword [ebp - 0x10], 0xf
call dword [0x556004]
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0x1f
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x20]
mov dword [esi], vtable.wui::DialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__.0
mov eax, dword [eax + 8]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__.1.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__.2.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x10]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__.3.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x14]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUICollectSupportData__class_ATL::CWindow__.4.0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x64]
mov dword [ecx + esi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
lea eax, [ecx - 0x78]
mov dword [ecx + esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x40]
call dword [0x55484c]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4aea80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53fd0e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 4], 0
test byte [esi + 0x3c], 1
je 0x4aeb08
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4aead3
mov eax, dword [esi + 0x30]
mov edx, dword [eax]
add edx, ecx
jmp 0x4aeadd
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x1c]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
sub edx, eax
cmp edx, 0x1000
jb 0x4aeafe
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4aeb68
mov eax, ecx
push edx
push eax
call fcn.00514c00
add esp, 8
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
and dword [esi + 0x3c], 0xfffffffe
mov dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [0x55427c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call dword [0x5546a8]
int3
Function at 0x4c4a20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp byte [ebp + 0xc], 0
mov ecx, dword [ebp + 8]
je 0x4c4a48
call dword [0x555c60]
mov edi, eax
mov ecx, esi
call fcn.004b9a60
test byte [esi + 0x145c], 2
mov ebx, eax
je 0x4c4ac9
mov ecx, dword [0x5dd1d0]
call fcn.0043dfb0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4c4a8a
mov ecx, eax
call dword [0x554c14]
test al, al
jne 0x4c4ac9
push dword [ebp - 0x18]
mov ecx, dword [0x5dd1d0]
call fcn.0043e1a0
test al, al
jne 0x4c4ac9
test ebx, ebx
jne 0x4c4ac9
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
lea ecx, [esi + 0x714]
movups xmmword [ebp - 0x14], xmm0
call fcn.00507280
mov eax, dword [esi + 0x14a4]
mov ecx, eax
sub ecx, edi
cmp byte [ebp + 0xc], bl
cmove ecx, eax
mov eax, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
sub eax, dword [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.004b9080
cmp byte [ebp + 0x10], 0
mov eax, dword [esi + 4]
je 0x4c4af2
push 0
push 0xf
push 3
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret 0xc
push 3
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [ebp + 0xc], 0
jne 0x4c4b22
push 0
push dword [esi + 0x14a0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x14a0], 0
xor edi, edi
mov byte [esi + 0x14aa], 0
push ebx
push 0
push ebx
mov ecx, esi
mov dword [esi + 0x14a4], edi
call fcn.004b6ff0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005150f0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c5e80
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5d3b14]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5dd410], 0
je 0x4c5eb5
xor eax, eax
cmp dword [0x5dd404], eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005150f0
mov esp, ebp
pop ebp
ret
push esi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.00515fd2
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
push str.USER32
sete al
mov dword [0x5dd414], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4c5fbb
push 0x56ebe0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd3f4], eax
test eax, eax
je 0x4c5fbb
push 0x56ebf4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd3f8], eax
test eax, eax
je 0x4c5fbb
push str.MonitorFromRect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd3fc], eax
test eax, eax
je 0x4c5fbb
push 0x56ec18
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd400], eax
test eax, eax
je 0x4c5fbb
push str.EnumDisplayMonitors
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd408], eax
test eax, eax
je 0x4c5fbb
push str.EnumDisplayDevicesW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd40c], eax
test eax, eax
je 0x4c5fbb
cmp dword [0x5dd414], 0
je 0x4c5f9f
push 0x56ec54
jmp 0x4c5fa4
push str.GetMonitorInfoA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5dd404], eax
test eax, eax
je 0x4c5fbb
mov eax, 1
jmp 0x4c6003
mov dword [0x5dd3f4], 0
xor eax, eax
mov dword [0x5dd3f8], 0
mov dword [0x5dd3fc], 0
mov dword [0x5dd400], 0
mov dword [0x5dd404], 0
mov dword [0x5dd408], 0
mov dword [0x5dd40c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x5dd410], 1
pop esi
call fcn.005150f0
mov esp, ebp
pop ebp
ret
Function at 0x4caaa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5442e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
lea eax, [edx + 8]
mov dword [edx + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edx + 0x20], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov dword [edx + 0x48], 0
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0xfc], 0
mov word [edx + 0x5c], ax
mov dword [ebp - 4], 5
mov dword [edx], vtable.CVMUIPane.0
mov dword [edx + 0x100], eax
mov dword [edx + 0x104], eax
mov byte [ebp - 4], 6
mov eax, dword [0x56f8c8]
mov ecx, dword [0x56f8cc]
push 0x21
mov dword [edx + 0x108], eax
mov dword [edx + 0x10c], ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
mov edi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x10]
push 0x28
mov dword [ebp - 0x2c], 0x4cbb10
mov dword [ebp - 0x28], 0
mov dword [ecx + 0x110], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x11c], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 0x114], esi
mov dword [ecx + 0x118], edi
mov dword [ecx + 0x120], eax
mov dword [ecx + 0x124], 0
mov byte [ecx + 0x128], 0
mov dword [ebp - 0x24], ecx
call dword [0x554868]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x4cac5f
push 0x4c7170
push 0x4340f0
push 0
mov ecx, esi
call dword [0x554860]
mov byte [ebp - 4], 8
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [esi + 0x18], xmm0
mov byte [ebp - 4], 7
jmp 0x4cac61
xor esi, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
push esi
call dword [0x554880]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0x4cc9c0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
mov ecx, dword [0x5556b0]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0x5548b4]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call dword [0x55488c]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ccf70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fcb4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5d3b14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x4cd05c
lea ecx, [esi + 0x44]
mov dword [esi + 0x20], 0x56facc
mov dword [esi + 0x4c], 0x56fae4
mov dword [esi + 0x88], 0x56faec
mov dword [esi + 0x9c], 0x56faf8
mov dword [esi + 0xa4], 0x56fb08
call dword [0x55484c]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x48]
push 0
mov dword [ebp - 0x10], 1
call dword [0x554a6c]
mov dword [ebp - 4], 1
lea ecx, [esi + 0x84]
push 0
mov dword [ebp - 0x10], 3
call dword [0x554a74]
mov dword [ebp - 4], 2
lea ecx, [esi + 0x98]
push 0
mov dword [ebp - 0x10], 7
call dword [0x555fe0]
mov dword [ebp - 4], 3
lea ecx, [esi + 0xa0]
push 0
mov dword [ebp - 0x10], 0xf
call dword [0x556004]
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0x1f
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x18], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 6
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 9
mov eax, dword [esi + 0x20]
mov dword [esi], vtable.wui::DialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__.0
mov eax, dword [eax + 8]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__.1.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0xc]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__.2.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x10]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__.3.0
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x14]
mov dword [eax + esi + 0x20], vtable.wui::DialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__class_ATL::CDialogImpl_class_CVMUISnapshotDetails__class_ATL::CWindow__.4.0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xc]
lea eax, [ecx - 0x64]
mov dword [ecx + esi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
lea eax, [ecx - 0x78]
mov dword [ecx + esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x40]
call dword [0x55484c]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4