joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004616
Capabilities:
Get file size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
push ebx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x54], ecx
add ecx, ecx
mov dword [ebp - 0x58], ecx
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x5c], ecx
mov esi, dword [ebp + 8]
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x1000d911
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x10004787
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x30]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 0x30]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
je 0x1000477d
mov dword [ebp - 0x34], eax
push 0x1000d6a7
call sym.dup2patcher.dll_AddMsg
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
push dword [ebp - 0x5c]
pop dword [ebp - 0x4c]
mov dword [ebp - 8], 0
push dword [ebp - 0x4c]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 2
push dword [ebp - 0x34]
call sub.kernel32.dll_MapViewOfFile
or eax, eax
je 0x10004737
mov dword [ebp - 0x38], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
cmp edx, 0xffffffff
je 0x100046e9
sub edx, dword [ebp - 8]
push edx
cmp dword [ebp - 0x4c], 0
je 0x100046fa
mov edx, dword [ebp - 0x58]
add edx, ecx
sub edx, 1
jmp 0x10004700
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x44]
push edx
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [ebp - 0x38]
call sym.dup2patcher.dll_SearchAndReplace
add dword [ebp - 8], eax
or dword [ebp - 4], eax
push dword [ebp - 0x38]
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0x4c], 0
jne 0x10004739
jmp 0x10004766
jmp 0x10004775
mov eax, dword [ebp - 0x58]
mov edx, 0
add dword [ebp - 0x44], eax
adc dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x48], ecx
jne 0x10004761
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x3c]
jb 0x10004761
mov dword [ebp - 0x4c], 0
jmp 0x100046c2
mov ecx, dword [esi]
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x100046a1
push dword [ebp - 0x34]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x30]
call sub.kernel32.dll_CloseHandle
jmp 0x10004787
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x10024d40
Capabilities:
Query or enumerate registry value

Disassembly:
cmp ecx, dword [0x1000e000]
jne 0x10024d4a
repz ret
jmp fcn.100257a1

Function at 0x1002da59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push 0x40000000
push 0x1000c944
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [0x1000ee90], eax
ret
Function at 0x401559
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp], 0
mov dword [esp + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
sub esp, 0x10
mov ebx, eax
jmp 0x4015a9
mov eax, ecx
mov edi, 4
cdq
idiv edi
mov edi, dword [ebp + 0x10]
mov al, byte [edi + edx]
mov edi, dword [ebp + 8]
xor al, byte [edi + ecx]
mov byte [ebx + ecx], al
inc ecx
cmp ecx, esi
jl 0x40158f
lea eax, [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x401550
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401608
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0x4053f0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ebx, eax
sub esp, 0x20
lea eax, [eax - 1]
cmp eax, 0xfffffffd
ja 0x4016cb
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
push edx
push edx
lea edx, [ebp - 0x1c]
jne 0x4016bd
jmp 0x4016cb
mov dword [esp + 0xc], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x4016c1
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
test esi, esi
jg 0x40168c
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4016f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x4053f0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [ebp - 0x1c]
mov esi, eax
sub esp, 0x1c
xor eax, eax
cmp esi, 0xffffffff
jne 0x401787
jmp 0x40179a
mov dword [esp + 0xc], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
je 0x40178b
mov eax, dword [ebp - 0x1c]
add edi, eax
sub ebx, eax
test ebx, ebx
jg 0x401756
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
push ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
div ecx
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], str._c_c_c_c_c_c_c_c_cMSSE__d_server
mov dword [esp], 0x4053f0
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4016d3
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], 0
sub esp, 0x18
leave
jmp fcn.004017a2

Function at 0x401e10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401e70
Function at 0x402360
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x402370
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x40236d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x402930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053dc]
sub esp, 4
test ebx, ebx
je 0x402985
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40297e
test esi, esi
je 0x40297e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402960
mov dword [esp], 0x4053c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebp
mov al, 0x45
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov byte [esp + 0xd], al
mov byte [esp + 0x10], al
mov al, 0x6c
push str.HeapFree
push str.kernel32.dll
mov byte [esp + 0x14], 0x4b
mov byte [esp + 0x16], 0x52
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x19], 0x4c
mov byte [esp + 0x1a], 0x33
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x2e
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
mov al, 0x65
mov cl, 0x73
mov byte [esp + 0x1d], al
mov byte [esp + 0x23], al
mov byte [esp + 0x27], al
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], cl
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x24], 0x47
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], 0x72
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2e], 0x48
mov byte [esp + 0x30], 0x61
mov byte [esp + 0x31], 0x70
mov byte [esp + 0x32], 0
call esi
push eax
call edi
mov edx, dword [esp + 0x30]
push edx
push 0
call eax
push eax
call ebp
pop edi
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x401c50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov edx, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push edi
mov dword [ebp - 0x24], ecx
mov si, word [eax + 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
lea esi, [esi + eax + 0x18]
mov dword [ebp - 0x18], esi
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 6]
mov eax, dword [ebp - 0x14]
cmp eax, edx
jge 0x401d65
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x401ce5
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x401d4d
mov edx, dword [esi + 0xc]
push 4
push 0x1000
add edx, ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x401d4d
push 4
push 0x1000
push eax
mov eax, dword [esi + 0xc]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [ebp - 0x20]
push 0x45ca98
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x55
call fcn.00435613
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov edx, ecx
add esi, eax
mov eax, 0x401d3d
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
ret
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
inc ecx
add esi, 0x28
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], esi
jmp 0x401c90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d80
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x401e39
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401dd7
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x401e1f
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x4640e0]
je 0x401df1
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401e0c
test al, 0x40
je 0x401e03
mov ecx, dword [ebx + 0x20]
jmp 0x401e0a
test al, 0x80
je 0x401e1f
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x401e1f
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x401da4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402140
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x4e2
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x59
test esi, esi
jbe 0x402171
mov eax, dword [esp + 8]
mov cl, byte [eax]
add cl, dl
xor cl, dl
add cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x402161
pop esi
ret

Function at 0x402180
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x7cf
push 0x14e74
push 0x464100
call fcn.00402140
push 0x464100
call fcn.00401b40
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4021c5
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.00401a00
add esp, 8
test eax, eax
jne 0x4021c9
push ebx
call fcn.00401950
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x34c
mov ecx, 0xd3
mov esi, 0x478f88
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.00401950
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x452550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x47a520]
push esi
mov esi, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x334]
lea ecx, [esp + 0x20]
push eax
push 0x479b90
push ecx
mov byte [esp + 0x38], 7
call fcn.004458fc
mov edx, dword [esi + 0x338]
lea eax, [esp + 0x28]
push edx
push 0x479b90
push eax
call fcn.004458fc
mov ecx, dword [esi + 0x33c]
lea edx, [esp + 0x30]
push ecx
push 0x479b90
push edx
call fcn.004458fc
mov eax, dword [esi + 0x340]
lea ecx, [esp + 0x38]
push eax
push 0x479b90
push ecx
call fcn.004458fc
mov edx, dword [esi + 0x344]
lea eax, [esp + 0x40]
push edx
push 0x479b90
push eax
call fcn.004458fc
mov ecx, dword [esi + 0x348]
lea edx, [esp + 0x48]
push ecx
push 0x479b90
push edx
call fcn.004458fc
mov eax, dword [esi + 0x34c]
add esp, 0x48
lea ecx, [esp + 8]
push eax
push 0x479b90
push ecx
call fcn.004458fc
mov edx, dword [esi + 0x350]
lea eax, [esp + 0x10]
push edx
push 0x479b90
push eax
call fcn.004458fc
mov ecx, dword [esp + 0x38]
add esp, 0x18
push ecx
lea ecx, [esi + 0x5b0]
call fcn.00449264
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 0x574]
push edx
call fcn.00449264
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esi + 0x538]
call fcn.00449264
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esi + 0x4fc]
call fcn.00449264
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x4c0]
push edx
call fcn.00449264
mov eax, dword [esp + 0xc]
lea ecx, [esi + 0x484]
push eax
call fcn.00449264
mov ecx, dword [esp + 8]
push ecx
lea ecx, [esi + 0x448]
call fcn.00449264
mov edx, dword [esp + 4]
lea ecx, [esi + 0x40c]
push edx
call fcn.00449264
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 6
call fcn.00449c55
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 5
call fcn.00449c55
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.00449c55
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
call fcn.00449c55
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.00449c55
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.00449c55
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 0
call fcn.00449c55
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00449c55
mov ecx, dword [esp + 0x24]
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x40a8f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4529f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x20]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x64], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
lea ecx, [esp + 0x44]
call fcn.0044ce2a
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 1
call fcn.0044c602
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 0x455ecc
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x40]
neg eax
sbb eax, eax
mov byte [esp + 0x5c], 3
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x34]
call fcn.0044c6b9
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub eax, edi
sub ecx, edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.0044d01e
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
and eax, ebp
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.0044c7fa
push 1
push ecx
lea edx, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov edi, eax
call fcn.004499ca
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x28]
mov dword [eax + 0xc], edx
lea eax, [esp + 0x48]
push eax
push ecx
mov ecx, esi
call fcn.0040ae30
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
test edi, edi
je 0x40aa01
mov edi, dword [edi + 4]
mov edx, dword [esp + 0x34]
push edi
push edx
call fcn.0044c7fa
lea ecx, [esp + 0x30]
call fcn.0044c721
lea ecx, [esp + 0x18]
call fcn.0044d075
mov esi, dword [esp + 0x64]
mov dword [esp + 0x18], vtable.CGdiObject.0
mov dword [esi], ebp
mov dword [esi + 4], ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x5c], 4
call fcn.0044d075
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 1
call fcn.0044c737
lea ecx, [esp + 0x40]
mov byte [esp + 0x5c], 0
call fcn.0044ce9c
lea ecx, [esp + 0x68]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00449c55
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x50
ret 8
Function at 0x40cc00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x452bf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
push eax
push 1
push 0
lea ecx, [esp + 0x18]
call fcn.0044d08b
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
push ecx
mov ecx, esi
call fcn.0044c84d
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov edi, eax
push ebx
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.0044cbab
mov ecx, dword [esp + 0x34]
push ebx
push ecx
mov ecx, esi
call fcn.0044cbf7
push edi
mov ecx, esi
call fcn.0044c84d
lea ecx, [esp + 0xc]
call fcn.0044d075
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.0044d075
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10