joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424e80
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push edi
mov esi, ecx
lea edi, [eax + 0x49c]
add eax, 0xffffff96
cmp eax, 9
ja case.0x424ea4.107
movzx eax, byte [eax + 0x425040]
jmp dword [eax*4 + 0x425030]
mov ecx, dword [esi + 4]
push ecx
movzx eax, di
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [esi + 0xc8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x178], 0
test eax, eax
je 0x424ee8
push 0
push dword [eax + 4]
call edi
cmp byte [esi + 0x9d], 0
je 0x425025
mov word [esi + 0x9c], 0
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push dword [esi + 0xd0]
mov dword [esi + 0xac], 0
call edi
mov eax, dword [esi + 0xc4]
test eax, eax
je 0x424f29
push 0
push dword [eax + 4]
call edi
mov eax, dword [esi + 0xb4]
xor edi, edi
sub eax, dword [esi + 0xb0]
sar eax, 2
test eax, eax
je 0x424f67
nop
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x424f53
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xb4]
inc edi
sub eax, dword [esi + 0xb0]
sar eax, 2
cmp edi, eax
jb 0x424f40
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xb4], eax
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x424f83
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0xc8]
mov dword [esi + 0xbc], 0
test ecx, ecx
je 0x424f9f
add ecx, 0x28
call fcn.0042d500
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [esi + 0x50]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x6b
push dword [0x5bf3a4]
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
push 0xfffffffffffffff4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetClassLongW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [esi + 0xc8]
test eax, eax
je 0x425025
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x425025
mov eax, dword [esi + 0xc8]
push 0
push edi
push 0x225a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x428110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.005111c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42817d
mov eax, dword [ebp - 0x114]
cmp eax, 5
jae 0x42816d
cmp eax, 4
jne 0x42817d
cmp dword [ebp - 0x110], 0x5a
jb 0x42817d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
Function at 0x42eb70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5ba4bc]
cmp eax, 0xffffffff
jne 0x42ed89
push 0x110
lea eax, [ebp - 0x114]
mov dword [0x5ba4bc], 0xfffffc18
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.005111c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ed84
cmp dword [ebp - 0x108], 2
jne 0x42ed84
mov ecx, dword [ebp - 0x114]
cmp ecx, 5
jne 0x42eccf
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x42ec0e
mov eax, 1
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x42ecae
push 0x7f
lea eax, [ebp - 0x104]
push eax
push 0x5847fc
call fcn.00538f9f
add esp, 0xc
test eax, eax
jne 0x42ec49
mov eax, 3
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.00538f9f
add esp, 0xc
test eax, eax
jne 0x42ec7b
mov eax, 4
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_3
call fcn.00538f9f
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x42ed84
mov eax, 6
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
cmp ecx, 6
jne 0x42ed61
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x42ed44
push 0x7f
lea eax, [ebp - 0x104]
push eax
push 0x5847fc
call fcn.00538f9f
add esp, 0xc
test eax, eax
jne 0x42ed14
mov eax, 8
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.00538f9f
add esp, 0xc
neg eax
sbb eax, eax
add eax, 8
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x42ed84
mov eax, 9
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5ba4bc]
cmp ecx, 7
mov edx, 9
cmove eax, edx
mov dword [0x5ba4bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5ba4bc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
Function at 0x4310a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x4310db
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
mov ecx, edi
push ebx
push esi
xor ebx, ebx
mov esi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4310e6
sub ecx, edx
xor eax, eax
sar ecx, 1
cmp ecx, 0x104
ja 0x4311a6
cmp ax, word [edi]
je 0x4311a4
nop dword [eax]
push 0x580eec
push esi
call fcn.0050d153
mov edi, eax
add esp, 8
test edi, edi
jne 0x431138
push 0x5848ac
push esi
call fcn.0050d153
mov edi, eax
add esp, 8
test edi, edi
je 0x4311a4
mov esi, edi
sub esi, dword [ebp - 0x214]
sar esi, 1
test esi, esi
jle 0x431196
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.005111c0
push esi
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
call fcn.0053c38f
add esp, 0x18
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x431196
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x431196
mov ebx, 1
lea esi, [edi + 2]
xor eax, eax
cmp ax, word [esi]
jne 0x431110
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0050a055
mov esp, ebp
pop ebp
ret
Function at 0x431400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x5a7074]
xor eax, esp
mov dword [esp + 0x280], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0x5bf3a4]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
push 0x5843a4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x1c]
push 0x104
push eax
mov dword [esp + 0x20], ecx
call fcn.00429140
xor eax, eax
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov word [esp + 0x27e], ax
mov dword [esp + 0x20], 0x58
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
test ebx, ebx
je 0x431495
mov eax, dword [ebx]
mov dword [esp + 0x38], eax
jmp 0x43149d
mov dword [esp + 0x38], 1
lea eax, [esp + 0x78]
mov dword [esp + 0x40], 0x208
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], eax
xor eax, eax
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0x431380
mov dword [esp + 0x58], 0x80802
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x431544
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x431510
test ebx, ebx
je 0x43152a
mov eax, dword [esp + 0x38]
mov dword [ebx], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x280]
xor ecx, esp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x28c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0050a055
mov esp, ebp
pop ebp
ret

Function at 0x4452b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4452e1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4452d0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x449f00
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x44a0d6
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x44a0d5
cmp eax, 0x29
jne 0x449f38
cmp dword [esi + 0x10], 0
jne 0x44a0d5
test dword [esi + 0x50], 0x10000000
je 0x44a0e1
cmp eax, 0x2e
jne 0x449f95
push 5
lea ecx, [esi + 0x24]
call fcn.0044a2f0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x449f89
cmp word [eax], 0x5c
jne 0x449f86
add eax, 2
cmp eax, ecx
je 0x449f86
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x449f72
movzx edx, word [eax]
cmp edx, 0x28
je 0x449f84
cmp edx, 0x29
je 0x449f84
test cl, 0x10
jne 0x449f86
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x449f84
cmp ecx, 0x7d
jne 0x449f86
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.00447a00
jmp 0x44a0c2
cmp eax, 0x5c
jne 0x449ffc
mov ecx, esi
call fcn.00449eb0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x449fc8
cmp word [esi + 0x48], 0x62
jne 0x449fc8
push 4
lea ecx, [esi + 0x24]
call fcn.0044a2f0
mov ecx, esi
call fcn.00449eb0
jmp 0x44a0c9
test eax, eax
je 0x449ff0
cmp word [esi + 0x48], 0x42
jne 0x449ff0
push 4
lea ecx, [esi + 0x24]
call fcn.0044a2f0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00449eb0
jmp 0x44a0c9
mov ecx, esi
call fcn.0044b570
jmp 0x44a0c2
cmp eax, 0x5b
jne 0x44a01e
mov ecx, esi
call fcn.00449eb0
mov ecx, esi
call fcn.0044b520
cmp dword [esi + 0x4c], 0x5d
je 0x44a0bb
jmp 0x44a0da
cmp eax, 0x28
jne 0x44a04e
mov ecx, esi
call fcn.00449eb0
mov ecx, esi
call fcn.0044b640
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x44a0e1
mov ecx, esi
call fcn.00449eb0
test bl, bl
je 0x44a0c9
jmp 0x44a0c2
cmp eax, 0x5e
jne 0x44a066
push 2
lea ecx, [esi + 0x24]
call fcn.0044a2f0
mov ecx, esi
call fcn.00449eb0
jmp 0x44a0c9
cmp eax, 0x24
jne 0x44a07e
push 3
lea ecx, [esi + 0x24]
call fcn.0044a2f0
mov ecx, esi
call fcn.00449eb0
jmp 0x44a0c9
cmp eax, 0x2a
je 0x44a0ef
cmp eax, 0x2b
je 0x44a0ef
cmp eax, 0x3f
je 0x44a0ef
cmp eax, 0x7b
je 0x44a0ef
cmp eax, 0x7d
jne 0x44a0a0
test dword [esi + 0x50], 0x10000000
je 0x44a0e8
cmp eax, 0x5d
jne 0x44a0ae
test dword [esi + 0x50], 0x10000000
je 0x44a0da
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0044b890
mov ecx, esi
call fcn.00449eb0
mov ecx, esi
call fcn.0044b700
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x449f10
pop ebx
mov al, cl
pop esi
ret
push 4
call fcn.004f00d5
push 5
call fcn.004f00d5
push 6
call fcn.004f00d5
push 0xa
call fcn.004f00d5
int3
Function at 0x4566d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566056
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5a7074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0050a09e
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f0577
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45c060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x45c078
mov eax, dword [ecx]
push dword [ebp + 0xc]
call dword [eax + 0x110]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [esi + 0xe4], 0
je 0x45c0ca
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x45c0ca
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45c0ca
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0xe0]
je 0x45c0bf
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 0x10
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x45c0e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x45c103
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp dword [esi + 0xe4], 0
je 0x45c1a1
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x45c1a1
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45c1a1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x45c190
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x45c190
mov eax, dword [esi + 0xe0]
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 0x38]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0xe0]
lea eax, [ebp - 0x14]
sub dword [ebp - 0x14], 5
add ecx, 0x38
sub dword [ebp - 0x10], 3
add dword [ebp - 0xc], 5
add dword [ebp - 8], 7
push 1
push eax
call fcn.0041e610
jmp 0x45c1a1
mov eax, dword [esi + 0xe0]
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
cmp eax, method.CXWindow.virtual_88
jne 0x45c1c3
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
call fcn.0050a055
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call eax
jmp 0x45c1ad
Function at 0x4678e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5677a7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5a7074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.0040e640
mov ecx, eax
test ecx, ecx
jne 0x467927
push 0x80004005
call fcn.0040e1d0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x46793c
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x46793e
call edx
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.0040e640
mov ecx, eax
test ecx, ecx
jne 0x467960
push 0x80004005
call fcn.0040e1d0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x467975
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x467977
call edx
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00469df0
mov dword [esi], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
xorps xmm0, xmm0
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov byte [ebp - 4], 4
mov eax, dword [0x5bf8ac]
test eax, eax
jne 0x4679eb
push 0xc
call fcn.0050a09e
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [0x5bf8ac], eax
mov dword [eax], 0x64
mov byte [eax + 8], 0
mov dword [edi + 0x30], eax
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x468230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46fdc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi]
mov edx, dword [eax + 0xd8]
cmp eax, vtable.CXStatic.0
jne 0x46ff57
mov eax, dword [eax + 0xa4]
cmp eax, method.CXStatic.virtual_164
jne 0x46fe26
cmp dword [esi + 0x44], 0
jne 0x46fe21
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x46fe21
mov eax, dword [ecx]
call dword [eax + 0xa4]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x44]
jmp 0x46fe2a
mov ecx, esi
call eax
test eax, eax
je 0x46fe36
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x38]
jmp 0x46fe38
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x10]
xor ebx, ebx
sub eax, dword [esi + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
sub eax, dword [esi + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 0x2aaaaaab
mov ecx, dword [esi + 0x14c]
sub ecx, dword [esi + 0x148]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x46ff3f
xor edi, edi
nop word [eax + eax]
push dword [esp + 0x14]
mov eax, dword [esi + 0x148]
push dword [esp + 0x14]
add eax, 8
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x46fec2
mov eax, dword [esi + 0x148]
cmp dword [eax + edi + 0x20], 0
jne 0x46ff0f
cmp dword [eax + edi + 0x24], 0xffffffff
jne 0x46fee9
mov ecx, dword [esi + 0x14c]
mov eax, 0x2aaaaaab
sub ecx, dword [esi + 0x148]
inc ebx
imul ecx
add edi, 0x30
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x46fe90
jmp 0x46ff37
mov eax, dword [ebp + 0x14]
lea ecx, [ebx + ebx*2]
add ecx, ecx
mov dword [eax], 1
mov eax, dword [esi + 0x148]
mov edx, dword [esi]
push dword [eax + ecx*8 + 0x24]
mov ecx, esi
push 0x389
call dword [edx + 0x2c]
jmp 0x46ff37
mov eax, dword [ebp + 0x14]
lea ecx, [ebx + ebx*2]
push 1
push 0
add ecx, ecx
mov dword [eax], 1
mov eax, dword [esi + 0x148]
push 0
push dword [eax + ecx*8 + 0x28]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x46ff4c
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x2c]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call edx
jmp 0x46fe38
Function at 0x4891e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5a7074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5d0510]
test eax, eax
jne 0x489292
push esi
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [ebp - 0x60]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [0x5bf8ac]
mov esi, 0xc
test eax, eax
jne 0x48923c
push esi
call fcn.0050a09e
add esp, 4
mov dword [ebp - 0x64], eax
mov dword [0x5bf8ac], eax
mov dword [eax], 0x64
mov byte [eax + 8], 0
cmp byte [eax + 8], 0
je 0x489256
mov eax, dword [eax]
cmp eax, 0x64
je 0x489256
push 0x64
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
neg esi
mov dword [ebp - 0x50], 0x190
mov dword [ebp - 0x60], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
pop esi
push ecx
cmp al, 6
jb 0x489275
push 0x581774
jmp 0x48927a
push 0x583df0
push ecx
lea ecx, [ebp - 0x44]
call fcn.0048a7f0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x5d0510], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a055
mov esp, ebp
pop ebp
ret
Function at 0x490720
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xb8], 0
je 0x49089b
mov eax, dword [ebx + 0xc0]
test eax, eax
je 0x490798
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push ecx
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push eax
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x34]
je 0x49087c
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x30]
je 0x49087c
push dword [ebx + 0xc0]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0xc0], 0
push dword [ebx + 0xbc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x49089b
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebx + 0xbc]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.gdiplus.dll_GdipGetImagePixelFormat]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 4]
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
push edx
push 0
push dword [ebp - 8]
mov dword [ebp - 0x20], vtable.Gdiplus::Bitmap.0
push 0
push ecx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov esi, dword [ebp + 0x14]
sub edi, dword [ebp + 8]
sub esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov eax, dword [ebp - 4]
push 7
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.gdiplus.dll_GdipSetInterpolationMode]
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 0x10]
push 0
push 0
push edi
push esi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push ecx
mov edx, 1
lea ecx, [ebp - 0x20]
call fcn.0048b0c0
add esp, 4
mov dword [ebx + 0xc0], eax
push esi
test eax, eax
je 0x490887
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10