joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x79fd0e8f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x41cf38a3
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0xfe5730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x990000]
push edi
jmp 0xfe574a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfe5751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe5740
mov eax, 1
add ebx, ebx
jne 0xfe5763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfe5774
jne 0xfe5793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe5793
dec eax
add ebx, ebx
jne 0xfe5780
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xfe5758
add ebx, ebx
jne 0xfe578f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xfe57e5
xor ecx, ecx
sub eax, 3
jb 0xfe57ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfe581a
sar eax, 1
mov ebp, eax
jmp 0xfe57b6
add ebx, ebx
jne 0xfe57b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe5784
inc ecx
add ebx, ebx
jne 0xfe57c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe5784
add ebx, ebx
jne 0xfe57d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfe57c6
jne 0xfe57e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfe57c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfe5804
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfe57f6
jmp 0xfe5746
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfe5804
add edi, ecx
jmp 0xfe5746
pop esi
mov edi, esi
mov ecx, 0x3f8c2e
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xfe583f
cmp byte [edi], 0x65
jne 0xfe5824
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xfe5822
lea edi, [esi + 0xbe1000]
mov eax, dword [edi]
or eax, eax
je 0xfe5890
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbe6f80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbe7110]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfe5845
mov ecx, edi
jns 0xfe5874
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbe7114]
or eax, eax
je 0xfe588a
mov dword [ebx], eax
add ebx, 4
jmp 0xfe5862
call dword [esi + 0xbe7124]
mov ebp, dword [esi + 0xbe7118]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfe58c4
sub esp, 0xffffff80
jmp 0x4025a8
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x602272da
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xdec09c2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402330
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cce9b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fe0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x402432
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x40243c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x1c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049ca7e
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x513944]
cmp eax, dword [ecx + 4]
jg 0x402446
mov dword [edi + 0x30], 0x4feebc
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404bb0
push 0x80004005
call fcn.00404bb0
push 0x513944
call fcn.0049cd97
add esp, 4
cmp dword [0x513944], 0xffffffff
jne 0x40240a
push 0x4d7c00
mov dword [0x4feebc], 0x64
mov byte [0x4feec0], 0
call fcn.0049cd06
push 0x513944
call fcn.0049cd46
add esp, 8
jmp 0x40240a

Function at 0x404630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40468b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40468b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40467a
cmp esi, edx
jae 0x40468b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404668
cmp esi, edx
jae 0x40468b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40d610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xec], 0
je 0x40d664
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d664
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d664
mov eax, dword [esi + 0xe8]
push edi
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
test eax, eax
je 0x40d663
push dword [esi + 0x38]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d67e
mov dword [esi + 0xe8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40d69b
mov dword [esi + 0x64], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x40d6af
mov dword [esi + 0x68], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x40d6c3
mov dword [esi + 0x6c], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x40d6e6
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40d6e6
mov dword [esi + 0x60], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x412bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub edx, dword [esi + 0x58]
sub ebx, dword [esi + 0x5c]
mov dword [eax], 0
mov eax, dword [esi + 0x138]
mov ecx, dword [esi + 0x134]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
test eax, eax
je 0x412ceb
xor edi, edi
push ebx
lea eax, [ecx + 8]
push edx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x412cb5
mov eax, dword [esi + 0x134]
cmp dword [eax + edi + 0x20], 0
je 0x412cb5
push 1
mov dword [ebx], 1
mov eax, dword [esi + 0x134]
push 0
push 0
push dword [eax + edi + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x138]
add edi, 0x2c
mov ecx, dword [esi + 0x134]
sub eax, ecx
mov edx, dword [esp + 0xc]
sar eax, 2
inc edx
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0xc], edx
cmp edx, eax
jae 0x412ce6
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jmp 0x412c73
cmp dword [ebx], 0
jne 0x412cf8
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421b30
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4fe0c0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x5f7
je 0x421c30
cmp eax, 0x5f8
je 0x421c30
cmp eax, 0x201
jne 0x421b74
mov ecx, dword [esi + 0x138]
push 2
jmp 0x421cba
cmp eax, 0x202
jne 0x421cc2
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
mov dword [esp + 0xc], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 4]
add eax, ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
add eax, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x138]
test eax, eax
mov eax, dword [ecx]
je 0x421c29
push 1
call dword [eax + 0x158]
push ecx
mov ecx, esi
call fcn.00420520
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 0x14
push 0
jmp 0x421cbc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov edx, dword [esp + 0x10]
push dword [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
push dword [esp + 8]
add eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x138]
test eax, eax
je 0x421cb8
push 1
jmp 0x421cba
push 0
mov eax, dword [ecx]
call dword [eax + 0x158]
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 0x14
Function at 0x422aa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce795
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4fe0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x15c], 0
je 0x422b1d
call fcn.00404dd0
test eax, eax
je 0x422bf3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x4e3458
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00404730
test al, al
jne 0x422bd3
push 0
push 0x4e3458
mov ecx, esi
call fcn.004049e0
jmp 0x422bd3
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x422bf3
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push dword [edi + 0x134]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
test ebx, ebx
js 0x422be9
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x422b72
push ebx
lea ecx, [ebp - 0x10]
call fcn.00404940
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [edi + 0x134]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x422b91
push dword [esi - 8]
push esi
call fcn.004ab044
add esp, 8
test eax, eax
js 0x422be9
cmp eax, dword [esi - 8]
jg 0x422be9
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edi, [esi - 0x10]
mov word [esi + eax*2], cx
push edi
call fcn.004044e0
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x422bd3
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00404bb0
push 0x80004005
call fcn.00404bb0
int3
Function at 0x42a200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x84], eax
je 0x42a269
mov dword [edi + 0x84], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42a252
mov ecx, dword [esi]
test ecx, ecx
je 0x42a24a
cmp dword [edi + 0x84], 0
je 0x42a23f
cmp dword [edi + 0x88], 0
je 0x42a23f
mov edx, 1
jmp 0x42a241
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42a220
mov ecx, dword [edi + 0x40]
pop esi
test ecx, ecx
je 0x42a25f
call fcn.004065a0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42a291
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42a2b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x88], eax
je 0x42a30d
mov dword [edi + 0x88], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42a302
mov ecx, dword [esi]
test ecx, ecx
je 0x42a2fa
cmp dword [edi + 0x84], 0
je 0x42a2ef
cmp dword [edi + 0x88], 0
je 0x42a2ef
mov edx, 1
jmp 0x42a2f1
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42a2d0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
pop esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42a335
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42ac00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x88]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042bf50
mov edx, eax
test edx, edx
jne 0x42ac24
mov eax, 0x80004005
pop esi
ret
mov ecx, esi
lea eax, [esi + 0x104]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, edx
call fcn.0042be90
test eax, eax
je 0x42ac49
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x10c], 0
xor eax, eax
pop esi
ret
Function at 0x42ac60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x4fe0c0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42acad
push eax
push ecx
mov eax, esp
push 0
push SysReAllocString
push 0
push ecx
mov dword [eax], 0
mov ecx, esi
mov eax, esp
push edi
mov dword [eax], 0
call fcn.0040c270
cmp byte [ebp + 0x1c], 0
je 0x42acbf
mov ecx, dword [esi + 0x30]
lea eax, [ebp + 0xc]
push eax
call fcn.00423d90
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x8c]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x42ace7
mov eax, dword [ebp + 0xc]
sub ecx, eax
push 1
push dword [esp + 0x18]
push ecx
push dword [ebp + 0x10]
push eax
jmp 0x42ad3c
push 0
push edi
mov dword [esp + 0x20], 0x68
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x34]
lea eax, [ebx + ecx]
cmp eax, edx
jle 0x42ad1d
mov ecx, edx
sub ecx, ebx
mov dword [ebp + 0xc], ecx
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [edi + edx]
cmp eax, dword [esp + 0x38]
jle 0x42ad36
mov edx, dword [esp + 0x38]
sub edx, edi
mov dword [ebp + 0x10], edx
push 1
push edi
push ebx
push edx
push ecx
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x84]
cmp dword [esi + 0x108], 0
jne 0x42ada6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042bf50
mov edi, eax
test edi, edi
je 0x42adc0
cmp dword [esi + 0x10c], 0
je 0x42ad8c
lea ecx, [esi + 0x104]
push ecx
mov ecx, edi
call fcn.0042be90
lea eax, [esi + 0x104]
mov ecx, edi
push eax
call fcn.0042be00
mov dword [esi + 0x10c], 1
jmp 0x42adc0
mov ecx, dword [esi + 0x124]
mov edx, 0x6a4
mov dword [esi + 0x108], 0
call fcn.00430720
mov ecx, dword [esp + 0x84]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049cdfb
mov esp, ebp
pop ebp
ret 0x18
Function at 0x430440
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfdfd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x4fe0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x2c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x30
push 0
push eax
call fcn.0049e870
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004b4b96
add esp, 4
call fcn.004b4b75
mov esi, eax
call fcn.00404dd0
mov ecx, eax
test ecx, ecx
je 0x4305c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push str.x_timer_lu
push eax
call fcn.0041f160
mov eax, dword [ebp - 0x10]
mov edx, 0x502d70
mov edi, eax
add esp, 0xc
mov esi, 0x104
sub edi, edx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x430501
movzx ecx, word [edi + edx]
test cx, cx
je 0x430501
mov word [edx], cx
add edx, 2
sub esi, 1
jne 0x4304e3
lea ecx, [edx - 2]
mov dword [ebp - 4], 0xffffffff
test esi, esi
cmovne ecx, edx
xor edx, edx
mov word [ecx], dx
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43052d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
mov dword [ebp - 0x18], 0x502d70
mov dword [ebp - 0x38], 0x430170
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [ebp - 0x2c]
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push 0x4e531c
push dword [ebp - 0x18]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x502b5c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x513420]
mov dword [0x4fec34], 0
sub eax, dword [0x51341c]
je 0x4305b4
push 0
push 0x32
push 1
push dword [0x502b5c]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4fec34], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404bb0
int3
Function at 0x432f70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x120], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x124], 0
mov dword [esi + 0x140], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], 1
call fcn.00433100
lea ebx, [esi + 0x11c]
mov dword [ebp + 0xc], ebx
call fcn.0044c2d0
mov edi, eax
test ebx, ebx
je 0x433041
lea eax, [edi + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push dword [edi + 0xfc]
lea esi, [edi + 0xf8]
push dword [esi]
call fcn.0049bd60
cmp eax, dword [edi + 0xfc]
jne 0x43300a
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x432ffe
mov dword [eax], ebx
add dword [esi + 4], 4
jmp 0x43300a
lea ecx, [ebp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00403f20
lea eax, [edi + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
cmp dword [edi + 0x104], 0
jne 0x433041
push 0
push 0
push edi
push 0x44c100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x104], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8