joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fcdb
mov eax, dword fs:[0]
push eax
sub esp, 0xaac
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xaa8], 0
push 0x8000
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, ebx
mov dword [ebp - 0xab4], eax
call fcn.00417dc0
push 0x400
lea ecx, [ebp - 0xaa8]
call fcn.00425490
push dword [ebp - 0xaa8]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, dword [ebp - 0xaa8]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417ea0
sub ecx, edx
sar ecx, 1
je 0x417ffb
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
call edi
test eax, eax
je 0x417fb3
cmp eax, 1
je 0x417fb3
mov eax, dword [0x4a63a8]
mov dword [ebp - 0x18], eax
movzx eax, word [0x4a63ac]
mov word [ebp - 0x14], ax
movzx eax, word [esi]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0xa20]
push 0x400
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x417f40
push 0xe
lea eax, [ebp - 0xa20]
push str.DeviceFloppy
push eax
call fcn.004774d7
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
je 0x417f40
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417f30
jmp 0x417fcb
push 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xab8]
push eax
push 0
push 0
push 0
push 0
push esi
call ebx
test eax, eax
je 0x417fa1
push 0x40
call fcn.0046c52d
add esp, 4
mov dword [ebp - 0xaac], eax
mov ecx, eax
call fcn.00410b30
mov edx, eax
mov dword [ebp - 0xaac], eax
mov ecx, esi
mov dword [eax + 0x1c], 2
call fcn.00418660
mov ecx, dword [ebp - 0xab0]
lea eax, [ebp - 0xaac]
push eax
call fcn.0041c580
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417fa6
jmp 0x417fcb
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417fc0
sub ecx, edx
add esi, 2
sar ecx, 1
add ecx, ecx
add esi, ecx
mov eax, esi
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417fe0
sub eax, edx
sar eax, 1
jne 0x417ec1
mov ebx, dword [ebp - 0xab0]
push dword [ebp - 0xab4]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebx + 4]
lea eax, [ebp - 0xaa4]
sub esi, dword [ebx]
sar esi, 2
cmp dword [ebp - 0xaa8], eax
je 0x418028
lea ecx, [ebp - 0xaa8]
call fcn.004254c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x418440
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fd8b
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x264]
call fcn.00403eb0
push 0x5c
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], 0
call fcn.00425880
push 2
push 0x4a63d0
lea ecx, [ebp - 0x264]
call fcn.00403730
lea eax, [ebp - 0x260]
xor esi, esi
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x418575
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test esi, esi
jne 0x418504
mov ecx, 0x4a63d8
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4184fb
test dx, dx
je 0x4184f7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4184fb
add eax, 4
add ecx, 4
test dx, dx
jne 0x4184d5
xor eax, eax
jmp 0x418500
sbb eax, eax
or eax, 1
test eax, eax
je 0x41853f
mov eax, 0x4a63dc
lea ecx, [ebp - 0x234]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x418536
test dx, dx
je 0x418532
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x418536
add ecx, 4
add eax, 4
test dx, dx
jne 0x418510
xor eax, eax
jmp 0x41853b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x418542
inc esi
jmp 0x41854c
inc esi
test byte [ebp - 0x260], 0x10
jne 0x418569
lea eax, [ebp - 0x260]
push eax
push edi
call ebx
test eax, eax
jne 0x4184c6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
jmp 0x418575
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41859a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret

Function at 0x4185c0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4d6740]
test eax, eax
jg 0x418647
push 0
push 0x24
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x418642
push 0x2b4
lea eax, [ebp - 0x4c0]
push 0
push eax
call fcn.0046ea70
add esp, 0xc
lea eax, [ebp - 0x4c0]
push 0x4000
push 0x2b4
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4bc]
mov dword [0x4d6740], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4d6740]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x418d80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fe89
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.004091c0
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 4]
mov ecx, dword [edi + 4]
sub ecx, 0x10
mov dword [ebp + 8], esi
call fcn.004091c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 8]
mov ecx, dword [edi + 8]
sub ecx, 0x10
mov dword [ebp + 8], esi
call fcn.004091c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0xc]
mov ecx, dword [edi + 0xc]
sub ecx, 0x10
mov dword [ebp + 8], esi
call fcn.004091c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x10]
mov ecx, dword [edi + 0x10]
sub ecx, 0x10
mov dword [ebp + 8], esi
call fcn.004091c0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
movups xmm0, xmmword [edi + 0x20]
movups xmmword [ebx + 0x20], xmm0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41be90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4902e7
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x22c], edi
call fcn.0046ea70
add esp, 0xc
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
call fcn.0040b800
mov dword [ebp - 0x220], eax
push 0
push 0
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
xor esi, esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x41c03d
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [eax]
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov eax, dword [0x4d138c]
test eax, eax
jne 0x41bf69
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov dword [0x4d138c], eax
test eax, eax
je 0x41bf78
lea ecx, [ebp - 0x234]
push ecx
call eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41bfeb
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
call fcn.00403eb0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x228]
push dword [ebp - 0x224]
push eax
push ecx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x220]
call fcn.0041f580
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41bfeb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x238], 0
je 0x41c02c
mov eax, dword [0x4d1388]
mov edi, dword [ebp - 0x234]
test eax, eax
jne 0x41c023
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov dword [0x4d1388], eax
test eax, eax
je 0x41c026
push edi
call eax
mov edi, dword [ebp - 0x22c]
inc esi
mov byte [ebp - 4], 0
cmp esi, dword [ebp - 0x230]
jb 0x41bf30
push edi
call dword [sym.imp.SHELL32.dll_DragFinish]
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax + 0xf18]
test ecx, ecx
je 0x41c06d
cmp dword [ebp - 0x21c], 0
jbe 0x41c06d
mov eax, dword [ebp - 0x220]
mov edx, dword [ecx]
mov eax, dword [eax]
push dword [eax + 0x10]
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x220]
push eax
push dword [eax]
lea eax, [ebp - 0x224]
push eax
call fcn.0040b260
push dword [ebp - 0x220]
call fcn.0046be2a
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c870
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x41c89e
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.0041d550
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x41c8b9
mov eax, 1
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x41c8bf
mov dword [ecx], 1
push 0
call fcn.0041e1f0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 3
jne 0x41c8da
push 1
call fcn.0041e1f0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 5
jne 0x41c8e6
cmp dword [ecx], 0
je 0x41c8b0
jmp 0x41c8a9
cmp eax, 0x18
jne 0x41c90b
cmp dword [ebp + 0x10], 1
je 0x41c8b0
push 0
push dword [ecx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 0x86
jne 0x41c8b9
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 1
push eax
push ecx
push dword [ebp + 0x10]
push ecx
call fcn.0041d4c0
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x41c8b9
mov eax, 1
pop ebp
ret 0x18

Function at 0x41c940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x41c972
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.0041d5e0
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x41c9ed
mov eax, 1
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x41c993
push 0
mov dword [ecx], 1
call fcn.0041e300
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 3
jne 0x41c9ae
push 1
call fcn.0041e300
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 5
jne 0x41c9ce
cmp dword [ecx], 0
je 0x41c9e4
push 0
call fcn.0041e300
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x41c9ed
cmp dword [ebp + 0x10], 1
je 0x41c9e4
push 0
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
Function at 0x41e1f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, ecx
mov esi, ebx
neg esi
push edi
lea eax, [ebx - 0x748]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e2e5
push dword [ebx + 0x14]
lea edi, [ebx + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e2e5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x41e2db
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x41e2db
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41e2db
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0041ea70
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push 0xffffffffffffffeb
movups xmm0, xmmword [eax]
push dword [edi]
movups xmmword [ebp - 0x18], xmm0
call ebx
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x18]
mov ecx, edi
je 0x41e2b5
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x10
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x41e300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, ecx
mov esi, ebx
neg esi
push edi
lea eax, [ebx - 0x3c0]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e3f5
push dword [ebx + 8]
lea edi, [ebx + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e3f5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x41e3eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x41e3eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41e3eb
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0041eb10
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push 0xffffffffffffffeb
movups xmm0, xmmword [eax]
push dword [edi]
movups xmmword [ebp - 0x18], xmm0
call ebx
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x18]
mov ecx, edi
je 0x41e3c5
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x50
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4

Function at 0x41ebb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41ebe1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41ebd0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41f860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490693
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
lea esi, [edi + 0x14]
mov dword [edi], eax
mov ecx, esi
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0x10], esi
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push eax
push 0
mov dword [ebp + 0xc], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00420230
mov dword [esi + 0xc], 0
push 0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0041ffc0
push 0x24
mov dword [ebp - 4], 1
call fcn.0046c52d
mov edx, dword [ebp + 0x14]
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [eax + 4], 0x14
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax], vtable.std::_Root_node.0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov eax, edx
shr eax, 3
not eax
mov dword [edi + 0x2c], edx
and eax, 0x100
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], eax
mov eax, edx
shr eax, 9
not eax
and eax, 4
mov dword [edi + 0x38], eax
mov dword [edi + 0x40], edx
and edx, 0x3f
mov dword [edi + 0x3c], ecx
cmp edx, 1
je 0x41f9b5
test edx, edx
je 0x41f9b5
cmp edx, 2
jne 0x41f982
mov eax, 0x6e000300
jmp 0x41f9ba
cmp edx, 4
jne 0x41f98e
mov eax, 0x7080001b
jmp 0x41f9ba
cmp edx, 8
jne 0x41f99a
mov eax, 0x7181a01b
jmp 0x41f9ba
cmp edx, 0x10
jne 0x41f9a6
mov eax, 0x6e080304
jmp 0x41f9ba
xor eax, eax
mov ecx, 0x7088001f
cmp edx, 0x20
cmove eax, ecx
jmp 0x41f9ba
mov eax, 0x8775dfb
mov dword [edi + 0x50], eax
test eax, 0x40000000
je 0x41f9cb
mov eax, dword [edi + 0x24]
or dword [eax + 8], 8
mov ecx, edi
call fcn.00420370
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x3b8]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426047
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426047
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42603c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x42603c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42603c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00425ea0
push 1
push 0xffffffffffffffeb
push dword [edi + 8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 8]
je 0x426011
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x50
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4

Function at 0x426060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x426092
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.00425e10
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x42610d
mov eax, 1
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x4260b3
push 0
mov dword [ecx], 1
call fcn.00425f40
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 3
jne 0x4260ce
push 1
call fcn.00425f40
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 5
jne 0x4260ee
cmp dword [ecx], 0
je 0x426104
push 0
call fcn.00425f40
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x42610d
cmp dword [ebp + 0x10], 1
je 0x426104
push 0
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
Function at 0x426250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x740]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426357
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426357
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42634c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x42634c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42634c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004261b0
push 1
push 0xffffffffffffffeb
push dword [edi + 0x14]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 0x14]
je 0x426321
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x10
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4

Function at 0x426400
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x42642e
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
sub esp, 0xc
call fcn.00426120
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x426449
mov eax, 1
pop ebp
ret 0x18
cmp eax, 0xf
jne 0x42644f
mov dword [ecx], 1
push 0
call fcn.00426250
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 3
jne 0x42646a
push 1
call fcn.00426250
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 5
jne 0x426476
cmp dword [ecx], 0
je 0x426440
jmp 0x426439
cmp eax, 0x18
jne 0x42649b
cmp dword [ebp + 0x10], 1
je 0x426440
push 0
push dword [ecx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
xor eax, eax
pop ebp
ret 0x18
cmp eax, 0x86
jne 0x426449
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 1
push eax
push ecx
push dword [ebp + 0x10]
push ecx
call fcn.00426370
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x426449
mov eax, 1
pop ebp
ret 0x18