joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c5ddc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c5e39
cmp byte [ebx + 0xeb], 0
jne 0x5c5e39
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409888
mov eax, dword [esi]
test eax, eax
je 0x5c5e26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c5e46
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
jmp 0x5c5e46
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c76f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c7769
mov eax, esi
call fcn.0051e4a4
test al, al
je 0x5c7769
mov eax, dword [ebx + 0x98]
call fcn.0051e0d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c7769
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5c775a
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051e0d4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00514d18
jmp 0x5c7769
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005c7530
pop esi
pop ebx
ret
Function at 0x5cc060
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5cc0da
mov eax, dword [ebx + 8]
call fcn.0051e0d4
mov ecx, eax
mov dl, 1
mov eax, dword [0x52c504]
call fcn.005183d4
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00533f6c
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5cb930
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051e0d4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051e0d4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5cc150
mov eax, dword [ebx + 8]
call fcn.0051e0d4
mov ecx, eax
mov dl, 1
mov eax, dword [0x52c504]
call fcn.005183d4
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00533f6c
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x5cb97c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051e0d4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051e0d4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5cc1bc
mov eax, dword [ebx + 8]
call fcn.0051e0d4
mov ecx, eax
mov dl, 1
mov eax, dword [0x52cf84]
call fcn.005183d4
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051e0d4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051e0d4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 8]
push esi
push edi
push eax
push 0x40
push ebp
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x18]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001024
sub esi, edx
xor ebx, ebx
sub ebp, esi
mov dword [esp + 0x24], ebp
je 0x1000108d
mov ebp, dword [esp + 0x1c]
mov edi, ecx
mov eax, dword [esp + 0x20]
sub edi, eax
sub ebp, ecx
mov dword [esp + 0x1c], ebp
nop dword [eax]
xor edx, edx
add eax, ebx
test esi, esi
je 0x1000108f
mov dword [esp + 0x10], eax
add ebp, edi
nop
cmp byte [eax + ebp], 0x3f
je 0x1000106d
mov cl, byte [edi + eax]
cmp cl, byte [eax]
jne 0x1000107d
inc edx
inc eax
cmp edx, esi
jb 0x10001060
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x20]
inc ebx
mov ebp, dword [esp + 0x1c]
dec edi
cmp ebx, dword [esp + 0x24]
jb 0x10001050
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Get common file path

Disassembly:
sub esp, 0x11c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x118], eax
push 0x104
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.dinput8.dll
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100010fa
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100011a5
add esp, 0x11c
ret 0xc
push ebx
push 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
push ecx
xorps xmm0, xmm0
push eax
movq qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x10001182
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.xx_x_xxxx____xx_xx_xxx____xx_
push 0x1000e18c
call section..text
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001182
push 0x7f
add ebx, 3
push ebx
push str.x__xx____xxx____x_x
push 0x1000e1c0
call section..text
add esp, 0x10
mov dword [esp + 4], eax
test eax, eax
je 0x10001182
lea eax, [esp + 0x14]
push eax
push 0x40
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 4]
sub al, bl
mov byte [ebx], 0xeb
add al, 0xc
mov byte [ebx + 1], al
mov ecx, dword [esp + 0x11c]
mov eax, 1
pop ebx
xor ecx, esp
call fcn.100011a5
add esp, 0x11c
ret 0xc

Function at 0x10004647
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004686
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004686
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004686
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004686
cmp dword [ecx + 0x74], 0xe
jbe 0x10004686
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000730f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100073ac
push ebx
push esi
call fcn.100072d8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000726c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10007359
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100073ab
push edi
push eax
call fcn.100082ca
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10007379
call fcn.10005db4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100073aa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000726c
add esp, 0x20
test eax, eax
jne 0x10007398
push edi
call fcn.10005db4
jmp 0x100073a0
push ebx
call fcn.10005db4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007619
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f570
push 0x1000f568
push str.FlsAlloc
push 0x1f
call fcn.10007535
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000764d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e120]
call esi
jmp 0x10007653
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007697
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f580
push 0x1000f578
push str.FlsGetValue
push 0x21
call fcn.10007535
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100076ce
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100076d6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f588
push 0x1000f580
push str.FlsSetValue
push 0x22
call fcn.10007535
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007710
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000e120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x409769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d190
cmp edx, dword [eax]
je 0x40978b
add eax, 8
inc ecx
cmp eax, 0x40d220
jl 0x40977c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d190]
jne 0x4098b9
mov eax, dword [0x40dbb0]
cmp eax, 1
je 0x409893
test eax, eax
jne 0x4097bc
cmp dword [0x40d0e4], 1
je 0x409893
cmp edx, 0xfc
je 0x4098b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4097f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040a670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040a490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x409836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040a490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c45c
push edi
call fcn.0040af00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040a670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a680
lea eax, [ebp - 0xa0]
push 0x40c43c
push eax
call fcn.0040a680
push dword [esi + 0x40d194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040ae75
add esp, 0x2c
pop edi
jmp 0x4098b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40d194]
push 0
push eax
push dword [esi]
call fcn.0040a490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x41655c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x416651
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x416622
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4165d5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4165d3
push 0x35f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x416620
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x416603
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x416620
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00433c91
mov dword [eax], 0x902820a3
jmp 0x4165f8
jmp 0x41664f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push 0x7527
push 0
push 0
push 0x2907
push dword [ebp - 0x3c]
push 0x6d09
push dword [ebp - 0x40]
call fcn.00408dd9
add esp, 0x1c
jmp 0x416679
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
push 0x3683
push dword [ebp - 0x44]
push 0
push 0x1749
push 1
push dword [ebp - 0x48]
call fcn.00422734
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4167b1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4168a2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x416813
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x6942
push dword [ebp - 0x10]
push 0x5336
push 1
call fcn.004168ae
add esp, 0x10
jmp 0x4168a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x416882
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x416863
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x416880
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00433c91
mov dword [eax], 0x571177e8
jmp 0x416858
jmp 0x4168a0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x4168a0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x4168aa
push 0
call fcn.004117f1
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x417516
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x417636
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4175a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x417577
push 0x3d4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x41759b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41759b
push 0
push 0xd87
call fcn.0042a5e3
pop ecx
pop ecx
jmp 0x417634
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4175e8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4175e6
push 1
push 1
push 1
push 0x5f2d
push 0x62b8
push 0x5af4
push 0x13d0
push 0
call fcn.0041541d
add esp, 0x20
jmp 0x417634
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x417634
push 0x3562
push 1
push 0x63c3
push 0x2a70
push 0x5a1a
push 0x77e0
push 0
push 0
push 0x29cf
push 0x6784
push 0x5b4f
call fcn.0042dc2d
add esp, 0x2c
jmp 0x417644
push 1
push 0x317a
call fcn.00414c0f
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a170
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41a1c0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0x60a1
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x14de
push 1
push dword [ebp - 0xc]
push 0x613a
push 0x7568
call fcn.0041a25a
add esp, 0x20
jmp 0x41a256
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41a232
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41a21a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41a218
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x41a230
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x41a256
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x4bc9
push 0
push dword [ebp - 0x30]
push 0x38b3
push 0x164
push 0
call fcn.0041ea24
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x423792
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42385b
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x423812
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4237f4
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x423810
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x423810
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x423859
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
push 0x1cd1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x53e
push 0x5e8
push 0
push 0
push 0x30f7
push 0x6707
push 1
push 0x3302
call fcn.0040887e
add esp, 0x30
jmp 0x423878
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
push 0x5860
push dword [ebp - 0x38]
push 0x1452
push 0
call fcn.00420859
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4262aa
Capabilities:
Enumerate gui resources
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x426372
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42632c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x426316
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x426314
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x42632a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42632a
push 0x7b
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x426370
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x4ca2
push 0x5c29
push 1
push 0x3253
push 0x13d5
push 0x6798
push 0x635c
push 1
push 0x4a6f
push dword [ebp - 0x28]
push 0x37de
push 1
push 0x77d6
call fcn.0041f216
add esp, 0x34
jmp 0x42639a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
push 0x4b96
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
push 0x1790
call fcn.0041db53
add esp, 0x18
mov esp, ebp
pop ebp
ret