joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187c1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x4ccbf8]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push 0x14
mov esi, edx
mov dword [esp + 0x1c], eax
mov edi, ecx
call fcn.00486927
push 0x14
mov dword [esp + 0x1c], eax
call fcn.00486927
mov ebx, eax
mov dword [esp + 0x18], ebx
pop ecx
pop ecx
cmp esi, 0x40
jbe 0x418985
push 0x14
call fcn.00486927
and dword [esp + 0x28], 0
mov ebx, eax
push ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], edi
push eax
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], esi
push 1
push eax
call fcn.00418318
add esp, 0x18
lea edx, [esp + 0x5a]
mov esi, ebx
mov eax, edx
sub esi, eax
push 5
pop edi
mov ecx, dword [esi + edx]
mov eax, ecx
shr eax, 0x18
mov byte [edx - 2], al
mov eax, ecx
shr eax, 0x10
mov byte [edx - 1], al
mov eax, ecx
shr eax, 8
mov byte [edx], al
lea edx, [edx + 4]
mov byte [edx - 3], cl
sub edi, 1
jne 0x418846
push 0x14
pop eax
push 0x40
pop edi
cmp eax, edi
jae 0x4189ae
mov byte [esp + eax + 0x58], 0
inc eax
cmp eax, edi
jl 0x418873
push ebx
call fcn.0048690c
mov ebx, dword [esp + 0x14]
pop ecx
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x58]
xor al, 0x36
mov byte [esp + ecx + 0x98], al
inc ecx
cmp ecx, edi
jl 0x418892
lea eax, [esp + 0x98]
mov dword [esp + 0x38], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x38]
push edi
push eax
push edx
lea eax, [esp + 0x34]
mov dword [esp + 0x48], edx
push 2
push eax
mov dword [esp + 0x54], 8
mov dword [esp + 0x58], edx
call fcn.00418318
add esp, 0x14
lea edx, [ebx + 2]
xor esi, esi
mov ecx, dword [edi + esi*4]
mov eax, ecx
shr eax, 0x18
mov byte [edx - 2], al
mov eax, ecx
shr eax, 0x10
mov byte [edx - 1], al
mov eax, ecx
shr eax, 8
inc esi
mov byte [edx], al
lea edx, [edx + 4]
mov byte [edx - 3], cl
cmp esi, 5
jl 0x4188e9
xor edx, edx
push 0x40
mov ecx, edx
pop esi
mov al, byte [esp + ecx + 0x58]
xor al, 0x5c
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, esi
jl 0x418916
push dword [esp + 0x18]
lea eax, [esp + 0xdc]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x4c]
push eax
push edx
lea eax, [esp + 0x3c]
mov dword [esp + 0x54], esi
push 2
push eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], 0x14
mov dword [esp + 0x68], edx
call fcn.00418318
push edi
call fcn.0048690c
push ebx
call fcn.0048690c
mov ecx, dword [esp + 0x138]
add esp, 0x1c
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x418998
push esi
lea eax, [esp + 0x5c]
push edi
push eax
call fcn.00480c20
add esp, 0xc
push 0x40
pop edi
jmp 0x4189a5
jae 0x4189ae
mov byte [esp + esi + 0x58], 0
inc esi
cmp esi, edi
jl 0x41899d
jmp 0x41888e
call fcn.0047f54c
int3
Function at 0x41bfd0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp edi, 3
jne 0x41c010
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push 0
xor edx, edx
mov eax, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
test ecx, ecx
push edi
cmovne eax, edx
push eax
push 0x4a11e4
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x41c05e
cmp dword [ebp - 0x14], esi
mov ecx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 8
push edi
mov eax, str.Microsoft_Base_Cryptographic_Provider_v1.0
cmove eax, ecx
push eax
push 0x4a11e4
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x41c114
test ebx, ebx
je 0x41c114
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x41c114
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41c0f1
push 0
push edi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41c0e3
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x41c0e3
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x18]
push 0
push 1
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
mov ecx, 1
mov eax, dword [ebp - 0x10]
cmovne esi, ecx
test eax, eax
je 0x41c0e3
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41c0f1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41c101
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x41c130
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], edi
jg 0x41c164
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c158
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov esi, dword [ebp + 0x18]
cmp esi, 3
jne 0x41c17f
pop edi
lea eax, [esi - 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 8]
push 0
push esi
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0x4a11e4
push eax
call ebx
test eax, eax
jne 0x41c1b8
push 8
push esi
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0x4a11e4
lea eax, [ebp - 8]
push eax
call ebx
test eax, eax
je 0x41c274
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41c274
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x41c274
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41c251
push 0
push esi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41c243
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x41c243
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x18]
push 0
push 1
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
mov ecx, 1
mov eax, dword [ebp - 0x10]
cmovne edi, ecx
test eax, eax
je 0x41c243
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x41c251
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x41c261
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x41c290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4dc5d8], 0
jne 0x41c2b9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push esi
push 0x548
push str.D:MyProjectsProPilotLibMisc.c
push 0
push 0x4dc5dc
call fcn.0041fd60
push 0x20
call fcn.00486927
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41c2ea
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
mov eax, dword [0x4dc5d0]
xor ecx, ecx
inc eax
mov edx, 4
mov dword [0x4dc5d0], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [0x4dc5d4]
call fcn.00483b6d
mov ecx, dword [0x4dc5d0]
add esp, 8
mov dword [0x4dc5d4], eax
push 0x4dc5dc
mov dword [eax + ecx*4 - 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x41c368
mov eax, dword [ebp + 0x18]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x41c380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x41ccd0
Capabilities:
Delete file
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x10000
jb 0x41ce35
cmp esi, 0xffffffff
je 0x41ce35
test dword [esi + 0x1c], 0x2000
push ebx
mov ebx, dword [ebp + 0xc]
push edi
je 0x41cdc6
mov ecx, dword [esi + 0x28]
mov ebx, dword [esi + 0x18]
add ecx, 0xfffffffc
push dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add ebx, ecx
call edi
push 4
push 0
push 0
push 0xf001f
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x14], eax
test eax, eax
je 0x41cd43
mov dword [eax], ebx
push dword [esi + 0x14]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
xor ebx, ebx
test byte [ebp + 0xc], 8
mov dword [esi + 8], 0
mov dword [esi + 0x30], 2
jne 0x41cda8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41cd80
test dword [esi + 0x1c], 0x3000
jne 0x41cd80
push eax
call fcn.0048690c
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x41cd8f
push eax
call fcn.0048690c
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x41cd9f
push eax
call fcn.0048690c
add esp, 4
push esi
call fcn.0048690c
add esp, 4
or edi, ebx
pop edi
pop ebx
je 0x41ce35
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
test bl, 1
je 0x41cdea
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41cdea
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [esi + 0x14]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41cd43
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x41cd43
cmp dword [ebp - 8], eax
jne 0x41cd43
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test bl, 4
jne 0x41cd4c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
jmp 0x41cd53
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x41e5e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x51e
push str.D:MyProjectsProPilotLibMisc.c
push 0
push 0x4dc5dc
call fcn.0041fd60
mov edi, dword [ebp + 8]
add esp, 0x10
xor esi, esi
test edi, edi
jne 0x41e69a
cmp dword [0x4dc5d0], esi
jle 0x41e665
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
nop word [eax + eax]
mov eax, dword [0x4dc5d4]
push 0
mov edi, dword [eax + esi*4]
push dword [edi + 0x10]
call ebx
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
test eax, eax
je 0x41e652
push dword [eax + 4]
call fcn.0048690c
push dword [edi + 8]
call fcn.0048690c
add esp, 8
push edi
call fcn.0048690c
inc esi
add esp, 4
cmp esi, dword [0x4dc5d0]
jl 0x41e620
pop ebx
mov eax, dword [0x4dc5d4]
test eax, eax
je 0x41e677
push eax
call fcn.0048690c
add esp, 4
push 0x4dc5dc
mov dword [0x4dc5d4], 0
mov dword [0x4dc5d0], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
ret
mov eax, dword [0x4dc5d0]
test eax, eax
jle 0x41e734
mov ecx, dword [0x4dc5d4]
nop dword [eax]
cmp edi, dword [ecx + esi*4]
je 0x41e6c9
inc esi
cmp esi, eax
jl 0x41e6b0
push 0x4dc5dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
ret
cmp esi, eax
jge 0x41e734
mov eax, dword [edi + 8]
test eax, eax
je 0x41e6e7
push dword [eax + 4]
call fcn.0048690c
push dword [edi + 8]
call fcn.0048690c
add esp, 8
push edi
call fcn.0048690c
mov eax, dword [0x4dc5d0]
add esp, 4
dec eax
mov dword [0x4dc5d0], eax
cmp esi, eax
jge 0x41e710
mov ecx, dword [0x4dc5d4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + esi*4], eax
mov eax, dword [0x4dc5d0]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push dword [0x4dc5d4]
call fcn.00483b6d
add esp, 8
mov dword [0x4dc5d4], eax
push 0x4dc5dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
ret
Function at 0x41ea70
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x388]
push 0
push esi
push eax
call fcn.00422060
lea edx, [ebp - 0x130]
add esp, 0xc
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41eaa1
lea eax, [ebp - 0x4c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x4c8], 0x10
jne 0x41eb05
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x25c]
push 0x4b2860
push eax
call fcn.00401045
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
call ebx
lea eax, [ebp - 0x4c8]
push eax
push esi
call edi
test eax, eax
jne 0x41ead1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x41f0f0
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 3
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 0x14]
push SysReAllocString
push edi
mov dword [ebp - 0x454], eax
call fcn.0041dce0
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x41f15d
push 0x10
push str.Error_opening_file
push str.File_does_not_exist
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push edi
push dword [ebp - 0x454]
lea eax, [ebp - 0x3ec]
push dword [ebp - 0x458]
push str._s__s___s_
push 0x3e7
push eax
call fcn.00422fe0
add esp, 0x18
mov dword [ebp - 0x428], 0
xor eax, eax
mov dword [ebp - 0x450], 0x44
mov word [ebp - 0x40e], ax
xorps xmm0, xmm0
mov dword [ebp - 0x444], eax
mov ax, word [ebp + 0x18]
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x450]
movlpd qword [ebp - 0x44c], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3ec]
movlpd qword [ebp - 0x440], xmm0
push eax
push 0
movlpd qword [ebp - 0x438], xmm0
movlpd qword [ebp - 0x430], xmm0
movlpd qword [ebp - 0x41e], xmm0
movlpd qword [ebp - 0x416], xmm0
movups xmmword [ebp - 0x3fc], xmm0
mov dword [ebp - 0x424], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41f23f
push 0x1388
push dword [ebp - 0x3fc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x41f2ba
call fcn.00435f20
test eax, eax
je 0x41f2ba
call fcn.00435f20
cmp dword [eax], 0
je 0x41f2ba
mov eax, dword [0x4edee0]
test eax, eax
je 0x41f263
mov esi, dword [eax + 0x190]
jmp 0x41f269
mov esi, dword [0x4edee4]
call fcn.00435f20
test eax, eax
je 0x41f27b
call fcn.00435f20
mov edi, dword [eax]
jmp 0x41f27d
xor edi, edi
push str.Error_starting_process__s:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00420470
add esp, 8
push eax
lea eax, [ebp - 0x3ec]
push eax
push str.Error_starting_process__s:__s
push dword [0x4edee0]
push esi
push 0
push 0x7cb
push str.D:MyProjectsProPilotLibMisc.c
push 2
call edi
add esp, 0x28
push 0
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x3fc]
call ebx
push dword [ebp - 0x3f8]
call ebx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x404], eax
lea eax, [ebp - 0x40c]
push eax
push 0x41fee0
mov dword [ebp - 0x400], 0
mov dword [ebp - 0x40c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
Function at 0x420c40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x420d68
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x420d68
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
test eax, eax
je 0x420d4c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x420d4b
test edi, edi
je 0x420cb7
cmp byte [edi], 0
je 0x420cb7
push edi
push esi
call fcn.00480870
mov esi, eax
add esp, 8
test esi, esi
je 0x420d42
mov dword [ebp - 4], 1
cmp ebx, 0xffffffff
jne 0x420d2d
test esi, esi
je 0x420cf4
cmp byte [esi], 0
je 0x420cdc
mov edi, esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x420cd1
sub edi, ecx
jmp 0x420cde
xor edi, edi
lea eax, [esi - 1]
add eax, edi
cmp eax, esi
jbe 0x420cf6
cmp byte [eax], 0
jne 0x420cf6
dec eax
dec edi
cmp eax, esi
ja 0x420ce7
jmp 0x420cf6
xor edi, edi
push 0x1cbe
push str.D:MyProjectsProPilotLibMisc.c
lea eax, [edi + 1]
push eax
push 0
call fcn.00483b6d
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x420d29
test edi, edi
je 0x420d23
push edi
push esi
push ebx
call fcn.00480c20
add esp, 0xc
mov byte [ebx + edi], 0
jmp 0x420d42
xor ebx, ebx
jmp 0x420d42
test ebx, ebx
je 0x420d42
mov ecx, ebx
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x420d35
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 4], 0
je 0x420d68
test ebx, ebx
mov eax, 1
pop edi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422930
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
xor eax, eax
push esi
mov word [ebp - 0x26], ax
mov dword [ebp - 0x5c], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
movlpd qword [ebp - 0x64], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], 0
movlpd qword [ebp - 0x36], xmm0
movlpd qword [ebp - 0x2e], xmm0
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4229c7
push 0x1388
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x422a3e
call fcn.00435f20
test eax, eax
je 0x422a3e
call fcn.00435f20
cmp dword [eax], 0
je 0x422a3e
mov eax, dword [0x4edee0]
test eax, eax
je 0x4229eb
mov esi, dword [eax + 0x190]
jmp 0x4229f1
mov esi, dword [0x4edee4]
push edi
call fcn.00435f20
test eax, eax
je 0x422a04
call fcn.00435f20
mov edi, dword [eax]
jmp 0x422a06
xor edi, edi
push str.Error_starting_process__s:__s
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00420470
add esp, 8
push eax
push ebx
push str.Error_starting_process__s:__s
push dword [0x4edee0]
push esi
push 0
push 0x7cb
push str.D:MyProjectsProPilotLibMisc.c
push 2
call edi
add esp, 0x28
pop edi
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push 0x41fee0
mov dword [ebp - 0x24], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop esi
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret

Function at 0x422f10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push edi
test esi, esi
je 0x422f33
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call ebx
inc eax
cmp esi, eax
jl 0x422f3c
push edi
call ebx
jmp 0x422f39
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea esi, [eax + 1]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
push esi
mov ecx, dword [ebx]
push ecx
test eax, eax
je 0x422f5f
call eax
add esp, 8
mov dword [ebx], eax
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00483b6d
add esp, 8
mov dword [ebx], eax
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
pop ebx
pop ebp
ret