joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ddf61
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x12e4484], 0x40
jae 0x12de04e
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x12de04b
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x12de026
cmp dword [esp + 0x20], 0x10000
jne 0x12de018
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x12de01c
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x12de01c
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x12de02a
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x12ddfc9
test ebx, ebx
je 0x12de04b
xor eax, eax
cmp dword [eax*4 + 0x12e4488], 0
je 0x12de03e
inc eax
cmp eax, 0x40
jb 0x12de02c
jmp 0x12de04b
inc dword [0x12e4484]
mov dword [eax*4 + 0x12e4488], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x12dfae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
lea ebx, [eax + ebp]
cmp eax, 8
jbe 0x12dfc97
mov edi, dword [esp + 0x120]
lea esi, [ebp + 8]
push 0x800
lea eax, [edi + 0x5410]
push eax
mov eax, ebx
sub eax, esi
push eax
lea eax, [edi + 0x140c]
push esi
push eax
call fcn.012e3110
add esp, 0x14
cmp eax, 0xffffff88
ja 0x12dfc97
add esi, eax
mov dword [esp + 0x14], 0x1c
mov eax, ebx
sub eax, esi
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.012dfce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x12dfc97
mov eax, dword [esp + 0x1c]
cmp eax, 8
ja 0x12dfc97
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push eax
lea eax, [edi + 0x804]
push eax
call fcn.012e0110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x12dfc97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x18], 0x34
push eax
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.012dfce0
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x12dfc97
mov eax, dword [esp + 0x20]
cmp eax, 9
ja 0x12dfc97
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0xb8]
push eax
lea eax, [edi + 0xc08]
push eax
call fcn.012e0110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x12dfc97
add esi, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.012dfce0
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0x12dfc97
mov eax, dword [esp + 0x24]
cmp eax, 9
ja 0x12dfc97
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.012e0110
add esp, 0x10
cmp eax, 0xffffff88
ja 0x12dfc97
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, ebx
ja 0x12dfc97
sub ebx, esi
xor edx, edx
sub ebx, 0xc
add edi, 0x5c10
nop
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0x12dfc97
cmp ecx, ebx
jae 0x12dfc97
mov dword [edi], ecx
inc edx
add edi, 4
cmp edx, 3
jl 0x12dfc70
sub esi, ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffe2
pop ebx
add esp, 0x10c
ret
Function at 0x12e2d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
shr eax, 8
test al, al
je 0x12e2d56
mov dword [esp + 0x14], ecx
jmp fcn.012e1f60
mov dword [esp + 0x14], ecx
jmp fcn.012e1320
Function at 0x401610
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ae76
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5a6124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x401657
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x40166c
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x40166e
call edx
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x401690
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4016a5
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4016a7
call edx
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004042b0
mov dword [esi], eax
xorps xmm0, xmm0
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x5ac14c]
cmp eax, dword [ecx + 4]
jle 0x401745
push 0x5ac14c
call fcn.00502aef
add esp, 4
cmp dword [0x5ac14c], 0xffffffff
jne 0x401745
push 0x56c5f0
mov dword [0x5a6d20], 0x64
mov byte [0x5a6d24], 0
call fcn.00502944
push 0x5ac14c
call fcn.00502ab0
add esp, 8
mov dword [edi + 0x30], 0x5a6d20
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x401e60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4071a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4071b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4071f6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4071f2
nop word [eax + eax]
cmp esi, edx
jae 0x4071f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4071e0
cmp esi, edx
jb 0x4071fb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x413bd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xe4], 0
je 0x413c3a
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x413c3a
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x413c3a
mov eax, dword [esi + 0xe0]
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xe4], 0
je 0x413c1f
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x413c1f
push dword [eax + 0x38]
jmp 0x413c22
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x413c3a
mov ecx, esi
call fcn.00415b40
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [esi + 0xe0], 0
je 0x413c80
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x413c80
mov dword [esi + 0xe0], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
cmp ecx, vtable.CLayerdWindow.1.0
jne 0x413cef
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x413c80
add ecx, 0xffffffff
mov dword [eax + 8], ecx
jne 0x413c80
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0xc]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x413c9d
mov dword [esi + 0x5c], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x413cb1
mov dword [esi + 0x60], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x64]
test eax, eax
je 0x413cc5
mov dword [esi + 0x64], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x413ce8
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [esi + 0x58]
test eax, eax
je 0x413ce8
mov dword [esi + 0x58], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
pop ebp
ret 0x10
push eax
call edx
jmp 0x413c80
Function at 0x415590
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x4155a8
mov eax, dword [ecx]
push dword [ebp + 0xc]
call dword [eax + 0xfc]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [esi + 0xe4], 0
je 0x41561a
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x41561a
cmp dword [ebp + 0xc], 0
je 0x4155dc
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 0x10
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xe4], 0
je 0x4155ff
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x4155ff
push dword [eax + 0x38]
jmp 0x415602
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x41561a
mov ecx, esi
call fcn.00415b40
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x415630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x415653
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp dword [esi + 0xe4], 0
je 0x415719
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x415719
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415719
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x415708
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x415708
mov eax, dword [esi + 0xe0]
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 0x38]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x30]
push 5
call fcn.004353f0
mov ecx, dword [esi + 0x30]
sub dword [ebp - 0x14], eax
push 3
call fcn.004353f0
mov ecx, dword [esi + 0x30]
sub dword [ebp - 0x10], eax
push 5
call fcn.004353f0
mov ecx, dword [esi + 0x30]
add dword [ebp - 0xc], eax
push 7
call fcn.004353f0
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
mov ecx, dword [esi + 0xe0]
push 1
push eax
add ecx, 0x38
call fcn.00419b60
jmp 0x415719
mov eax, dword [esi + 0xe0]
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov eax, dword [eax + 0x50]
cmp eax, method.CInstallHintMsg.virtual_80
jne 0x41573b
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
call fcn.00502bf3
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call eax
jmp 0x415725
Function at 0x41d660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi]
mov edx, dword [eax + 0xc8]
cmp eax, vtable.CXStatic.0
jne 0x41d7c8
mov eax, dword [eax + 0x98]
cmp eax, method.CPageInstalling.virtual_152
jne 0x41d6c6
cmp dword [esi + 0x44], 0
jne 0x41d6c1
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x41d6c1
mov eax, dword [ecx]
call dword [eax + 0x98]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x44]
jmp 0x41d6ca
mov ecx, esi
call eax
test eax, eax
je 0x41d6d6
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x38]
jmp 0x41d6d8
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x14]
xor ecx, ecx
sub eax, dword [esi + 0x5c]
mov ebx, dword [esp + 0x10]
sub ebx, dword [esi + 0x58]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [eax], 0
mov eax, 0x2e8ba2e9
mov ecx, dword [esi + 0x134]
sub ecx, dword [esi + 0x130]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x41d7b0
xor edi, edi
nop
mov eax, dword [esi + 0x130]
push dword [esp + 0x14]
add eax, 8
push ebx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x41d77b
mov eax, dword [esi + 0x130]
cmp dword [eax + edi + 0x20], 0
je 0x41d77b
push 1
mov dword [ebx], 1
mov eax, dword [esi + 0x130]
push 0
push 0
push dword [eax + edi + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x134]
mov eax, 0x2e8ba2e9
sub ecx, dword [esi + 0x130]
add edi, 0x2c
inc dword [esp + 0xc]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0xc], eax
jae 0x41d7ab
mov ebx, dword [esp + 0x10]
jmp 0x41d730
cmp dword [ebx], 0
jne 0x41d7bd
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call edx
jmp 0x41d6d8
Function at 0x42ea90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xb4], 0
je 0x42ec0b
mov eax, dword [ebx + 0xbc]
test eax, eax
je 0x42eb08
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push ecx
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push eax
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x34]
je 0x42ebec
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x30]
je 0x42ebec
push dword [ebx + 0xbc]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0xbc], 0
push dword [ebx + 0xb8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x42ec0b
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebx + 0xb8]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.gdiplus.dll_GdipGetImagePixelFormat]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 4]
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
push edx
push 0
push dword [ebp - 8]
mov dword [ebp - 0x20], vtable.Gdiplus::Bitmap.0
push 0
push ecx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov esi, dword [ebp + 0x14]
sub edi, dword [ebp + 8]
sub esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov eax, dword [ebp - 4]
push 7
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.gdiplus.dll_GdipSetInterpolationMode]
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 0x10]
push 0
push 0
push edi
push esi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push ecx
mov edx, 1
lea ecx, [ebp - 0x20]
call fcn.00429d60
add esp, 4
mov dword [ebx + 0xbc], eax
push esi
test eax, eax
je 0x42ebf7
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x432a50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0x104
push eax
push dword [esi + 0x130]
mov dword [esi + 0x150], 1
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x15c]
lea ecx, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x432abe
test dx, dx
je 0x432aba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x432abe
add eax, 4
add ecx, 4
test dx, dx
jne 0x432a98
xor eax, eax
jmp 0x432ac3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x432ade
push 0x57f940
push dword [esi + 0x130]
mov dword [esi + 0x158], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
call fcn.00502bf3
mov esp, ebp
pop ebp
ret 0x10

Function at 0x434770
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x4347ec
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4347a5
push edi
mov ecx, esi
call fcn.004076b0
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x4347cd
mov ecx, dword [esi]
test ecx, ecx
je 0x4347d1
push dword [ecx - 8]
push ecx
call fcn.0052340e
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x4347ec
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4347ec
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00407c80
int3
Function at 0x4360f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d518
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x5a6124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5ab028]
test eax, eax
je 0x436141
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436141
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00533c03
add esp, 4
call fcn.00533be2
mov esi, eax
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x43616c
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x436181
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x436183
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push str.x_GeneralNotify_lu
push eax
call fcn.0042ff80
mov esi, dword [ebp - 0x10]
mov ecx, 0x5ab030
mov edi, esi
add esp, 0xc
mov edx, 0x104
sub edi, ecx
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4361d1
movzx eax, word [edi + ecx]
test ax, ax
je 0x4361d1
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4361b3
lea eax, [ecx - 2]
mov dword [ebp - 0x40], 0x30
test edx, edx
push 0x2c
cmovne eax, ecx
xor ecx, ecx
push ecx
mov word [eax], cx
lea eax, [ebp - 0x3c]
push eax
call fcn.00506b00
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x5ab030
mov dword [ebp - 0x38], 0x4360d0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [ebp - 0x2c]
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push str.CGeneralObserverMgrWnd
push dword [ebp - 0x18]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x5ab028], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4362a8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4362a6
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4362a6
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43fda0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0
jne 0x43fe31
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x43fdd1
cmp dword [esi + 0x3c], edi
mov eax, 5
cmovg edi, eax
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [ebp - 0x60]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi + 0x3c]
sub eax, edi
cmp dword [esi + 0x40], 0
mov dword [ebp - 0x60], eax
pop edi
je 0x43fdfd
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x50], eax
jmp 0x43fe04
mov dword [ebp - 0x50], 0x190
movzx eax, byte [esi + 0x44]
mov edx, 0x20
push ecx
push dword [esi + 0x38]
mov byte [ebp - 0x4b], al
movzx eax, byte [esi + 0x48]
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x4c], al
call fcn.0043cea0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x34], eax
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x34]
xor ecx, ebp
pop esi
call fcn.00502bf3
mov esp, ebp
pop ebp
ret
Function at 0x442530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00409850
mov eax, dword [esi]
mov eax, dword [eax + 0xd0]
cmp eax, method.CPageInstalling.virtual_208
jne 0x4425c9
cmp dword [esi + 0x84], 0
je 0x44255f
cmp dword [esi + 0x88], 0
jne 0x442584
mov eax, dword [esi]
mov eax, dword [eax + 0x130]
cmp eax, method.CXChildWnd.virtual_304
jne 0x4425d9
mov eax, dword [esi + 0x128]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov eax, dword [eax + 0x130]
cmp eax, method.CXChildWnd.virtual_304
jne 0x4425d3
mov eax, dword [esi + 0x128]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
mov ecx, esi
call eax
test eax, eax
je 0x44255f
jmp 0x442584
mov ecx, esi
call eax
jmp 0x4425a9
mov ecx, esi
call eax
jmp 0x4425b9

Function at 0x4425e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00409920
mov eax, dword [esi]
mov eax, dword [eax + 0xd0]
cmp eax, method.CPageInstalling.virtual_208
jne 0x442679
cmp dword [esi + 0x84], 0
je 0x44260f
cmp dword [esi + 0x88], 0
jne 0x442634
mov eax, dword [esi]
mov eax, dword [eax + 0x130]
cmp eax, method.CXChildWnd.virtual_304
jne 0x442689
mov eax, dword [esi + 0x128]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov eax, dword [eax + 0x130]
cmp eax, method.CXChildWnd.virtual_304
jne 0x442683
mov eax, dword [esi + 0x128]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
mov ecx, esi
call eax
test eax, eax
je 0x44260f
jmp 0x442634
mov ecx, esi
call eax
jmp 0x442659
mov ecx, esi
call eax
jmp 0x442669